mirror of
https://github.com/hardkernel/linux.git
synced 2026-06-05 10:31:46 +09:00
ff55f3e7ea69a22fdba2e415532d7bce00d15561
1168798 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Jianan Huang
|
ff55f3e7ea |
ANDROID: mm: add vendor hook to trace shrink_node
This is to adjust parameters between different memcgs to achieve more accurate memory reclamation. Bug: 373540729 Change-Id: Ifb97a144c057555c5f9181f357fa146f9509be3e Signed-off-by: Jianan Huang <huangjianan@xiaomi.com> (cherry picked from commit 9d6f981a89e6e289f114270e2f1738b2b6fdd2ab) |
||
|
Jianan Huang
|
f2a18f1865 |
ANDROID: mm: add vendor hook to add folio to specific memcg
Add vendor hook when folio charges memcg. This is to manage some specific folios in separate memcg for more accurate memory reclamation. Bug: 373540729 Change-Id: I11b1fca279ea9e9e8be1f789bdf1f9d7c1bf001f Signed-off-by: Jianan Huang <huangjianan@xiaomi.com> (cherry picked from commit 6e2565c513127c425ddfb84e473dba8161154036) |
||
|
Sandeep Dhavale
|
e63d8c3188 |
ANDROID: f2fs: fix incorrect merge resolution in f2fs_trace_rw_file_path()
The merge included commit |
||
|
Dongdong zhang
|
efda22f348 |
ANDROID: GKI: update symbol list for xiaomi
INFO: 4 function symbol(s) added 'void bio_crypt_set_ctx(struct bio*, const struct blk_crypto_key*, const u64*, gfp_t)' 'void blk_crypto_evict_key(struct block_device*, const struct blk_crypto_key*)' 'int blk_crypto_init_key(struct blk_crypto_key*, const u8*, size_t, enum blk_crypto_key_type, enum blk_crypto_mode_num, unsigned int, unsigned int)' 'int blk_crypto_start_using_key(struct block_device*, const struct blk_crypto_key*)' Bug: 410012026 Change-Id: I74021d561087ea73c2c8896ff05a504a4eba87b7 Signed-off-by: Dongdong zhang <zhangdongdong5@xiaomi.com> |
||
|
Mahadevan
|
19a0fb1d35 |
ANDROID: abi_gki_aarch64_qcom: Update symbol list for display HFI driver
The symbol list has been updated to the QCOM ABI symbol list for the display
HFI driver to facilitate communication with the Display CoProcessor
(DCP Firmware).
1 function symbol added
virtqueue_get_vring
Bug: 409461670
Change-Id: I5ad34386609d3dc0a72a2600edc202fcecf0d999
Signed-off-by: Mahadevan <quic_mahap@quicinc.com>
|
||
|
Willem de Bruijn
|
37c227e873 |
UPSTREAM: bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
Classic BPF socket filters with SKB_NET_OFF and SKB_LL_OFF fail to
read when these offsets extend into frags.
This has been observed with iwlwifi and reproduced with tun with
IFF_NAPI_FRAGS. The below straightforward socket filter on UDP port,
applied to a RAW socket, will silently miss matching packets.
const int offset_proto = offsetof(struct ip6_hdr, ip6_nxt);
const int offset_dport = sizeof(struct ip6_hdr) + offsetof(struct udphdr, dest);
struct sock_filter filter_code[] = {
BPF_STMT(BPF_LD + BPF_B + BPF_ABS, SKF_AD_OFF + SKF_AD_PKTTYPE),
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, PACKET_HOST, 0, 4),
BPF_STMT(BPF_LD + BPF_B + BPF_ABS, SKF_NET_OFF + offset_proto),
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_UDP, 0, 2),
BPF_STMT(BPF_LD + BPF_H + BPF_ABS, SKF_NET_OFF + offset_dport),
This is unexpected behavior. Socket filter programs should be
consistent regardless of environment. Silent misses are
particularly concerning as hard to detect.
Use skb_copy_bits for offsets outside linear, same as done for
non-SKF_(LL|NET) offsets.
Offset is always positive after subtracting the reference threshold
SKB_(LL|NET)_OFF, so is always >= skb_(mac|network)_offset. The sum of
the two is an offset against skb->data, and may be negative, but it
cannot point before skb->head, as skb_(mac|network)_offset would too.
This appears to go back to when frag support was introduced to
sk_run_filter in linux-2.4.4, before the introduction of git.
The amount of code change and 8/16/32 bit duplication are unfortunate.
But any attempt I made to be smarter saved very few LoC while
complicating the code.
Fixes:
|
||
|
Seiya Wang
|
44009cb85e |
ANDROID: GKI: Update symbol list for mtk
2 function symbol(s) added 'struct sock* nf_sk_lookup_slow_v4(struct net*, const struct sk_buff*, const struct net_device*)' 'struct sock* nf_sk_lookup_slow_v6(struct net*, const struct sk_buff*, const struct net_device*)' Bug: 409358930 Change-Id: Id2cf12b854c696f824683157a39d3677638e4d19 Signed-off-by: Seiya Wang <seiya.wang@mediatek.com> |
||
|
Douglas Anderson
|
777d831361 |
UPSTREAM: regset: use kvzalloc() for regset_get_alloc()
While browsing through ChromeOS crash reports, I found one with an
allocation failure that looked like this:
chrome: page allocation failure: order:7,
mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO),
nodemask=(null),cpuset=urgent,mems_allowed=0
CPU: 7 PID: 3295 Comm: chrome Not tainted
5.15.133-20574-g8044615ac35c #1 (HASH:1162 1)
Hardware name: Google Lazor (rev3 - 8) with KB Backlight (DT)
Call trace:
...
warn_alloc+0x104/0x174
__alloc_pages+0x5f0/0x6e4
kmalloc_order+0x44/0x98
kmalloc_order_trace+0x34/0x124
__kmalloc+0x228/0x36c
__regset_get+0x68/0xcc
regset_get_alloc+0x1c/0x28
elf_core_dump+0x3d8/0xd8c
do_coredump+0xeb8/0x1378
get_signal+0x14c/0x804
...
An order 7 allocation is (1 << 7) contiguous pages, or 512K. It's not
a surprise that this allocation failed on a system that's been running
for a while.
More digging showed that it was fairly easy to see the order 7
allocation by just sending a SIGQUIT to chrome (or other processes) to
generate a core dump. The actual amount being allocated was 279,584
bytes and it was for "core_note_type" NT_ARM_SVE.
There was quite a bit of discussion [1] on the mailing lists in
response to my v1 patch attempting to switch to vmalloc. The overall
conclusion was that we could likely reduce the 279,584 byte allocation
by quite a bit and Mark Brown has sent a patch to that effect [2].
However even with the 279,584 byte allocation gone there are still
65,552 byte allocations. These are just barely more than the 65,536
bytes and thus would require an order 5 allocation.
An order 5 allocation is still something to avoid unless necessary and
nothing needs the memory here to be contiguous. Change the allocation
to kvzalloc() which should still be efficient for small allocations
but doesn't force the memory subsystem to work hard (and maybe fail)
at getting a large contiguous chunk.
[1] https://lore.kernel.org/r/20240201171159.1.Id9ad163b60d21c9e56c2d686b0cc9083a8ba7924@changeid
[2] https://lore.kernel.org/r/20240203-arm64-sve-ptrace-regset-size-v1-1-2c3ba1386b9e@kernel.org
Link: https://lkml.kernel.org/r/20240205092626.v2.1.Id9ad163b60d21c9e56c2d686b0cc9083a8ba7924@changeid
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Dave Martin <Dave.Martin@arm.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 409708978
(cherry picked from commit 6b839b3b76cf17296ebd4a893841f32cae08229c)
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
(cherry picked from https://android-review.googlesource.com/q/commit:4f551093f53b449c590bbd44e97bc2cdf528e8d3)
Merged-In: I42c9bcb78bde782b0b52432086c6b3e9e95ab6d3
Change-Id: I42c9bcb78bde782b0b52432086c6b3e9e95ab6d3
|
||
|
John Stultz
|
6bd3b482a8 |
ANDROID: sched: Reapply reverted portions of "sched/core: Prevent race condition between cpuset and __sched_setscheduler()"
This reverts commit |
||
|
Badhri Jagan Sridharan
|
ca24c52e3c |
Revert "ANDROID: usb: Optimization the transfer rate of accessory mode in USB3.2 mode"
This reverts commit
|
||
|
Jamal Hadi Salim
|
3e6e324f5b |
UPSTREAM: net: sched: Disallow replacing of child qdisc from one parent to another
[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ] Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Bug: 393266309 Joint work with Lion Ackermann <nnamrec@gmail.com> Fixes: |
||
|
pengzhongcui
|
df2dac406f |
ANDROID: GKI: Update symbol list for xiaomi
3 variable symbol(s) added 'struct tracepoint __tracepoint_android_vh_tune_swappiness' 'struct tracepoint __tracepoint_android_vh_do_shrink_slab_ex' 'struct tracepoint __tracepoint_android_vh_shrink_slab_bypass' Bug: 407420219 Change-Id: I95326ce626fa279db21dcd4ba2b7b1441c5c7d23 Signed-off-by: pengzhongcui <pengzhongcui@xiaomi.corp-partner.google.com> |
||
|
pengzhongcui
|
4fc6483e90 |
ANDROID: vendor_hook: Add hook is to optimize the time consumption of shrink slab.
one Vendor hook add:
android_vh_do_shrink_slab_ex
Add vendor hook point in do_shrink_slab to optimize for user
experience related threads and time-consuming shrinkers.
Bug: 407420219
Change-Id: I5ee29988eebb53da503f729564946b12deb1d981
Signed-off-by: pengzhongcui <pengzhongcui@xiaomi.corp-partner.google.com>
|
||
|
Bosser Ye
|
c1fd50266b |
ANDROID: GKI: Update symbol list for mtk
1 function symbol(s) added
'struct device* device_find_any_child(struct device*)'
Bug: 406580420
Change-Id: I6a95c44e60b5299cac1f4a6acdc098941494a448
Signed-off-by: Bosser Ye <bo.ye@mediatek.com>
|
||
|
Roy Luo
|
e1ab072bcf |
UPSTREAM: usb: gadget: core: flush gadget workqueue after device removal
[ Upstream commit 399a45e5237ca14037120b1b895bd38a3b4492ea ]
device_del() can lead to new work being scheduled in gadget->work
workqueue. This is observed, for example, with the dwc3 driver with the
following call stack:
device_del()
gadget_unbind_driver()
usb_gadget_disconnect_locked()
dwc3_gadget_pullup()
dwc3_gadget_soft_disconnect()
usb_gadget_set_state()
schedule_work(&gadget->work)
Move flush_work() after device_del() to ensure the workqueue is cleaned
up.
Fixes:
|
||
|
Greg Kroah-Hartman
|
1c9aeb1ce3 |
Merge tag 'android14-6.1.129_r00' into android14-6.1
This merges the android14-6.1.129_r00 tag into the android14-6.1 branch, catching it up with the latest LTS releases. It contains the following commits: * |
||
|
Bian Jin chen
|
b18db21117 |
ANDROID: GKI: Update rockchip symbols for drm driver.
INFO: 1 function symbol(s) added 'unsigned int drm_format_info_bpp(const struct drm_format_info*, int)' Bug: 300024866 Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com> Change-Id: I54c9645f16633bb61f1b8b80523e83a07d9c4a4f |
||
|
Martin Liu
|
f628136006 |
ANDROID: ABI: Update pixel symbol list
Adding the following symbols:
- __traceiter_android_vh_calculate_totalreserve_pages
- __tracepoint_android_vh_calculate_totalreserve_pages
Bug: 396115949
Change-Id: I0e17cd9359b1bdc1b5de5c63d75681ee3be1366d
Signed-off-by: Martin Liu <liumartin@google.com>
|
||
|
Martin Liu
|
2fb96ec85c |
ANDROID: vendor_hook: add vendor hook on calculate_totalreserve_pages
This vendor hook enables or disables updating the LMKD zone watermark level. Bug: 396115949 Test: build Change-Id: I0089a0586821120e47c46e08bcfea11a1602d516 Signed-off-by: Martin Liu <liumartin@google.com> |
||
|
Marcus Ma
|
5145d15773 |
ANDROID: GKI: update symbol list file for xiaomi
add 1 function: android_vh_folio_referenced_check_bypass() Bug: 404067669 Change-Id: I91288be3a33ce839b8371e7f8f0e28b0b163920f Signed-off-by: Marcus Ma <maminghui5@xiaomi.corp-partner.google.com> |
||
|
Marcus Ma
|
2f4537ba6c |
ANDROID: vendor_hooks: Skip pages with high memory pressure in shrink_active_list
The android_vh_folio_referenced_check_bypass hook reverse-maps and skips pages with high memory pressure in shrink_active_list, preferring to recycle them. This helps reduce memory pressure and improve system performance under high load. Bug: 404067669 Change-Id: Ic10edcef9761df774d6cf18544e7c044bf78d3ed Signed-off-by: Marcus Ma <maminghui5@xiaomi.corp-partner.google.com> |
||
|
Martin Liu
|
da6a42c111 |
FROMGIT: mm/page_alloc: add trace event for totalreserve_pages calculation
This commit introduces a new trace event, `mm_calculate_totalreserve_pages`, which reports the new reserve value at the exact time when it takes effect. The `totalreserve_pages` value represents the total amount of memory reserved across all zones and nodes in the system. This reserved memory is crucial for ensuring that critical kernel operations have access to sufficient memory, even under memory pressure. By tracing the `totalreserve_pages` value, developers can gain insights that how the total reserved memory changes over time. Link: https://lkml.kernel.org/r/20250308034606.2036033-4-liumartin@google.com Signed-off-by: Martin Liu <liumartin@google.com> Acked-by: David Rientjes <rientjes@google.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 396115949 (cherry picked from commit 15766485e4a51bec2dcce304c089a95550720033 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Change-Id: Iced6ea39ad8a36a50bf4393814b6bca2f64ac3b0 Signed-off-by: Martin Liu <liumartin@google.com> |
||
|
Martin Liu
|
95baed1663 |
BACKPORT: FROMGIT: mm/page_alloc: add trace event for per-zone lowmem reserve setup
This commit introduces the `mm_setup_per_zone_lowmem_reserve` trace event,which provides detailed insights into the kernel's per-zone lowmem reserve configuration. The trace event provides precise timestamps, allowing developers to 1. Correlate lowmem reserve changes with specific kernel events and able to diagnose unexpected kswapd or direct reclaim behavior triggered by dynamic changes in lowmem reserve. 2. Know memory allocation failures that occur due to insufficient lowmem reserve, by precisely correlating allocation attempts with reserve adjustments. Link: https://lkml.kernel.org/r/20250308034606.2036033-3-liumartin@google.com Signed-off-by: Martin Liu <liumartin@google.com> Acked-by: David Rientjes <rientjes@google.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 396115949 (cherry picked from commit a293aba4a584709889f77a0ad0c45746aecf1b9f https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Change-Id: I271fc260ec60645230681bf0afbcd10d84453c88 Signed-off-by: Martin Liu <liumartin@google.com> |
||
|
Martin Liu
|
9d6305174c |
BACKPORT: FROMGIT: mm/page_alloc: add trace event for per-zone watermark setup
Patch series "Add tracepoints for lowmem reserves, watermarks and totalreserve_pages", v2. This patchset introduces tracepoints to track changes in the lowmem reserves, watermarks and totalreserve_pages. This helps to track the exact timing of such changes and understand their relation to reclaim activities. The tracepoints added are: mm_setup_per_zone_lowmem_reserve mm_setup_per_zone_wmarks mm_calculate_totalreserve_pagesi This patch (of 3): This commit introduces the `mm_setup_per_zone_wmarks` trace event, which provides detailed insights into the kernel's per-zone watermark configuration, offering precise timing and the ability to correlate watermark changes with specific kernel events. While `/proc/zoneinfo` provides some information about zone watermarks, this trace event offers: 1. The ability to link watermark changes to specific kernel events and logic. 2. The ability to capture rapid or short-lived changes in watermarks that may be missed by user-space polling 3. Diagnosing unexpected kswapd activity or excessive direct reclaim triggered by rapidly changing watermarks. Link: https://lkml.kernel.org/r/20250308034606.2036033-1-liumartin@google.com Link: https://lkml.kernel.org/r/20250308034606.2036033-2-liumartin@google.com Signed-off-by: Martin Liu <liumartin@google.com> Acked-by: David Rientjes <rientjes@google.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Martin Liu <liumartin@google.com> Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Bug: 396115949 (cherry picked from commit 8c02048d1c6126527f15752a5e0849dc49cefeeb https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable) Change-Id: I7e326e78542abb6fa5f3ccbe5d61a59f42d7cf2f Signed-off-by: Martin Liu <liumartin@google.com> |
||
|
Marcus Ma
|
7da329f7cf |
ANDROID: Update the ABI symbol list
Adding the following symbols: - folio_mapcount Bug: 404067677 Change-Id: Id8382f108729e23475a652855a75d99ee892c41c Signed-off-by: Marcus Ma <maminghui5@xiaomi.corp-partner.google.com> |
||
|
Marcus Ma
|
d3b0aaa092 |
ANDROID: Add EXPORT_SYMBOL_GPL for folio_mapcount
We need to get the number of folio mappings through folio_mapcount. Later, pages with mapcount higher than a certain threshold will be skipped for reverse mapping to reduce the high load caused by reverse mapping during the recycling process. Bug: 404067677 Change-Id: I21dd847a07fb4e7bb616a3bc01b7d1cdf46e9b0b Signed-off-by: Marcus Ma <maminghui5@xiaomi.corp-partner.google.com> |
||
|
Jianan Huang
|
6bd3e435f2 |
UPSTREAM: f2fs: fix inconsistent dirty state of atomic file
When testing the atomic write fix patches, the f2fs_bug_on was triggered as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:935! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 3 UID: 0 PID: 257 Comm: bash Not tainted 6.13.0-rc1-00033-gc283a70d3497 #5 RIP: 0010:f2fs_evict_inode+0x50f/0x520 Call Trace: <TASK> ? __die_body+0x65/0xb0 ? die+0x9f/0xc0 ? do_trap+0xa1/0x170 ? f2fs_evict_inode+0x50f/0x520 ? f2fs_evict_inode+0x50f/0x520 ? handle_invalid_op+0x65/0x80 ? f2fs_evict_inode+0x50f/0x520 ? exc_invalid_op+0x39/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? __pfx_f2fs_get_dquots+0x10/0x10 ? f2fs_evict_inode+0x50f/0x520 ? f2fs_evict_inode+0x2e5/0x520 evict+0x186/0x2f0 prune_icache_sb+0x75/0xb0 super_cache_scan+0x1a8/0x200 do_shrink_slab+0x163/0x320 shrink_slab+0x2fc/0x470 drop_slab+0x82/0xf0 drop_caches_sysctl_handler+0x4e/0xb0 proc_sys_call_handler+0x183/0x280 vfs_write+0x36d/0x450 ksys_write+0x68/0xd0 do_syscall_64+0xc8/0x1a0 ? arch_exit_to_user_mode_prepare+0x11/0x60 ? irqentry_exit_to_user_mode+0x7e/0xa0 The root cause is: f2fs uses FI_ATOMIC_DIRTIED to indicate dirty atomic files during commit. If the inode is dirtied during commit, such as by f2fs_i_pino_write, the vfs inode keeps clean and the f2fs inode is set to FI_DIRTY_INODE. The FI_DIRTY_INODE flag cann't be cleared by write_inode later due to the clean vfs inode. Finally, f2fs_bug_on is triggered due to this inconsistent state when evict. To reproduce this situation: - fd = open("/mnt/test.db", O_WRONLY) - ioctl(fd, F2FS_IOC_START_ATOMIC_WRITE) - mv /mnt/test.db /mnt/test1.db - ioctl(fd, F2FS_IOC_COMMIT_ATOMIC_WRITE) - echo 3 > /proc/sys/vm/drop_caches To fix this problem, clear FI_DIRTY_INODE after commit, then f2fs_mark_inode_dirty_sync will ensure a consistent dirty state. Bug: 402645924 Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit") Change-Id: I2c637b4bc544453b07ab124527efb694da9b757f Signed-off-by: Yunlei He <heyunlei@xiaomi.com> Signed-off-by: Jianan Huang <huangjianan@xiaomi.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit 03511e936916873bf880e6678c98d5fb59c19742) (cherry picked from commit 0e0c530475d05e8d91972957761d08ab0f0e931d) (cherry picked from commit 52d776ea9f68f0101bd6c1b42ac98e9b697bfe7b) |
||
|
Antoine Tenart
|
2afd0800a7 |
UPSTREAM: net: avoid race between device unregistration and ethnl ops
[ Upstream commit 12e070eb6964b341b41677fd260af5a305316a1f ] The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutex_lock+0xc8a/0x1120 Call Trace: <TASK> ethtool_check_max_channel+0x1ea/0x880 ethnl_set_channels+0x3c3/0xb10 ethnl_default_set_doit+0x306/0x650 genl_family_rcv_msg_doit+0x1e3/0x2c0 genl_rcv_msg+0x432/0x6f0 netlink_rcv_skb+0x13d/0x3b0 genl_rcv+0x28/0x40 netlink_unicast+0x42e/0x720 netlink_sendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because unregister_netdevice_many_notify might run before the rtnl lock section of ethnl operations, eg. set_channels in the above example. In this example the rss lock would be destroyed by the device unregistration path before being used again, but in general running ethnl operations while dismantle has started is not a good idea. Fix this by denying any operation on devices being unregistered. A check was already there in ethnl_ops_begin, but not wide enough. Note that the same issue cannot be seen on the ioctl version (__dev_ethtool) because the device reference is retrieved from within the rtnl lock section there. Once dismantle started, the net device is unlisted and no reference will be found. Bug: 392852041 Fixes: |
||
|
Quang Le
|
92ada4b4c2 |
UPSTREAM: pfifo_tail_enqueue: Drop new packet when sch->limit == 0
commit 647cef20e649c576dff271e018d5d15d998b629d upstream. Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return `NET_XMIT_CN` status code. Weird behaviour: In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by one and return `NET_XMIT_CN` status code. The problem is: Let's say we have two qdiscs: Qdisc_A and Qdisc_B. - Qdisc_A's type must have '->graft()' function to create parent/child relationship. Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`. - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`. - Qdisc_B is configured to have `sch->limit == 0`. - Qdisc_A is configured to route the enqueued's packet to Qdisc_B. Enqueue packet through Qdisc_A will lead to: - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) - Qdisc_B->q.qlen += 1 - pfifo_tail_enqueue() return `NET_XMIT_CN` - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A. The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen. Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable. Bug: 395539871 Fixes: |
||
|
Michal Luczaj
|
cd0ebcd175 |
UPSTREAM: vsock: Orphan socket after transport release
commit 78dafe1cf3afa02ed71084b350713b07e72a18fb upstream.
During socket release, sock_orphan() is called without considering that it
sets sk->sk_wq to NULL. Later, if SO_LINGER is enabled, this leads to a
null pointer dereferenced in virtio_transport_wait_close().
Orphan the socket only after transport release.
Partially reverts the 'Fixes:' commit.
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
lock_acquire+0x19e/0x500
_raw_spin_lock_irqsave+0x47/0x70
add_wait_queue+0x46/0x230
virtio_transport_release+0x4e7/0x7f0
__vsock_release+0xfd/0x490
vsock_release+0x90/0x120
__sock_release+0xa3/0x250
sock_close+0x14/0x20
__fput+0x35e/0xa90
__x64_sys_close+0x78/0xd0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Bug: 396331793
Reported-by: syzbot+9d55b199192a4be7d02c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9d55b199192a4be7d02c
Fixes: fcdd2242c023 ("vsock: Keep the binding until socket destruction")
Tested-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-1-ef6244d02b54@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit
|
||
|
Michal Luczaj
|
7f11cc02d9 |
UPSTREAM: vsock: Keep the binding until socket destruction
commit fcdd2242c0231032fc84e1404315c245ae56322a upstream.
Preserve sockets bindings; this includes both resulting from an explicit
bind() and those implicitly bound through autobind during connect().
Prevents socket unbinding during a transport reassignment, which fixes a
use-after-free:
1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)
2. transport->release() calls vsock_remove_bound() without checking if
sk was bound and moved to bound list (refcnt=1)
3. vsock_bind() assumes sk is in unbound list and before
__vsock_insert_bound(vsock_bound_sockets()) calls
__vsock_remove_bound() which does:
list_del_init(&vsk->bound_table); // nop
sock_put(&vsk->sk); // refcnt=0
BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730
Read of size 4 at addr ffff88816b46a74c by task a.out/2057
dump_stack_lvl+0x68/0x90
print_report+0x174/0x4f6
kasan_report+0xb9/0x190
__vsock_bind+0x62e/0x730
vsock_bind+0x97/0xe0
__sys_bind+0x154/0x1f0
__x64_sys_bind+0x6e/0xb0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Allocated by task 2057:
kasan_save_stack+0x1e/0x40
kasan_save_track+0x10/0x30
__kasan_slab_alloc+0x85/0x90
kmem_cache_alloc_noprof+0x131/0x450
sk_prot_alloc+0x5b/0x220
sk_alloc+0x2c/0x870
__vsock_create.constprop.0+0x2e/0xb60
vsock_create+0xe4/0x420
__sock_create+0x241/0x650
__sys_socket+0xf2/0x1a0
__x64_sys_socket+0x6e/0xb0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 2057:
kasan_save_stack+0x1e/0x40
kasan_save_track+0x10/0x30
kasan_save_free_info+0x37/0x60
__kasan_slab_free+0x4b/0x70
kmem_cache_free+0x1a1/0x590
__sk_destruct+0x388/0x5a0
__vsock_bind+0x5e1/0x730
vsock_bind+0x97/0xe0
__sys_bind+0x154/0x1f0
__x64_sys_bind+0x6e/0xb0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150
RIP: 0010:refcount_warn_saturate+0xce/0x150
__vsock_bind+0x66d/0x730
vsock_bind+0x97/0xe0
__sys_bind+0x154/0x1f0
__x64_sys_bind+0x6e/0xb0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
refcount_t: underflow; use-after-free.
WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150
RIP: 0010:refcount_warn_saturate+0xee/0x150
vsock_remove_bound+0x187/0x1e0
__vsock_release+0x383/0x4a0
vsock_release+0x90/0x120
__sock_release+0xa3/0x250
sock_close+0x14/0x20
__fput+0x359/0xa80
task_work_run+0x107/0x1d0
do_exit+0x847/0x2560
do_group_exit+0xb8/0x250
__x64_sys_exit_group+0x3a/0x50
x64_sys_call+0xfec/0x14f0
do_syscall_64+0x93/0x1b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Bug: 396331793
Fixes:
|
||
|
Michal Luczaj
|
e2647b0fb4 |
UPSTREAM: bpf, vsock: Invoke proto::close on close()
commit 135ffc7becc82cfb84936ae133da7969220b43b2 upstream. vsock defines a BPF callback to be invoked when close() is called. However, this callback is never actually executed. As a result, a closed vsock socket is not automatically removed from the sockmap/sockhash. Introduce a dummy vsock_close() and make vsock_release() call proto::close. Note: changes in __vsock_release() look messy, but it's only due to indent level reduction and variables xmas tree reorder. Bug: 396331793 Fixes: |
||
|
Yeongjin Gil
|
cfa792a776 |
FROMGIT: f2fs: fix to avoid atomicity corruption of atomic file
In the case of the following call stack for an atomic file,
FI_DIRTY_INODE is set, but FI_ATOMIC_DIRTIED is not subsequently set.
f2fs_file_write_iter
f2fs_map_blocks
f2fs_reserve_new_blocks
inc_valid_block_count
__mark_inode_dirty(dquot)
f2fs_dirty_inode
If FI_ATOMIC_DIRTIED is not set, atomic file can encounter corruption
due to a mismatch between old file size and new data.
To resolve this issue, I changed to set FI_ATOMIC_DIRTIED when
FI_DIRTY_INODE is set. This ensures that FI_DIRTY_INODE, which was
previously cleared by the Writeback thread during the commit atomic, is
set and i_size is updated.
Cc: <stable@vger.kernel.org>
Fixes: fccaa81de87e ("f2fs: prevent atomic file from being dirtied before commit")
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Reviewed-by: Sunmin Jeong <s_min.jeong@samsung.com>
Signed-off-by: Yeongjin Gil <youngjin.gil@samsung.com>
Reviewed-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Bug: 381519582
(cherry picked from commit f098aeba04c9328571567dca45159358a250240c
https: //git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Link: https://lore.kernel.org/linux-f2fs-devel/20250314120651.443184-1-youngjin.gil@samsung.com/
Change-Id: I7ce87dfbc2525ae185ae6c22671e98ecf021b988
|
||
|
Srinivasarao Pathipati
|
f3c4686f77 |
ANDROID: abi_gki_aarch64_qcom: Add xas_load
Add xas_load to qcom abi symbol list. Bug: 397560786 Change-Id: Ia4a7bab9c2f7670fd62b7aba6a8858a1c1890969 Signed-off-by: Ravi Kumar Bokka <quic_c_rbokka@quicinc.com> Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com> |
||
|
Dongbum Kim
|
33c9d4844a |
ANDROID: Update the ABI symbol list
Adding the following symbols: - __traceiter_android_vh_vprintk_store - __tracepoint_android_vh_vprintk_store Bug: 342523877 Change-Id: I8ddbe5f40960a9f04084da5b0fbdc06eadab0746 Signed-off-by: Dongbum Kim <dongbum.kim@lge.com> |
||
|
Dongbum Kim
|
0ad7fae66c |
ANDROID: printk: add vendor hook to logging during hibernation
If hibernation fail, user cannot check log during hibernation. During hibernation, we cannot get any log from copying hibernation image to shutdown the system, for example, write image to storage. A vendor hook copies every log with all loglevel to reserved memory address. We cannot get all loglevels with pstore, so we add vendor hook for copying every log. When the system is rebooted, user can check log from reserved memory address where vendor hook stored in. Bug: 342523877 Change-Id: I31f61378f555ea65ccecfa5b7a96a3ed3e4061a6 Signed-off-by: Dongbum Kim <dongbum.kim@lge.com> |
||
|
Chao Yu
|
4da91a8e56 |
BACKPORT: FROMGIT: f2fs: fix to avoid running out of free segments
If checkpoint is disabled, GC can not reclaim any segments, we need
to detect such condition and bail out from fallocate() of a pinfile,
rather than letting allocator running out of free segment, which may
cause f2fs to be shutdown.
reproducer:
mkfs.f2fs -f /dev/vda 16777216
mount -o checkpoint=disable:10% /dev/vda /mnt/f2fs
for ((i=0;i<4096;i++)) do { dd if=/dev/zero of=/mnt/f2fs/$i bs=1M count=1; } done
sync
for ((i=0;i<4096;i+=2)) do { rm /mnt/f2fs/$i; } done
sync
touch /mnt/f2fs/pinfile
f2fs_io pinfile set /mnt/f2fs/pinfile
f2fs_io fallocate 0 0 4201644032 /mnt/f2fs/pinfile
cat /sys/kernel/debug/f2fs/status
output:
- Free: 0 (0)
Fixes:
|
||
|
Chao Yu
|
64560e780e |
BACKPORT: FROMGIT: f2fs: fix to avoid panic once fallocation fails for pinfile
syzbot reports a f2fs bug as below:
------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:2746!
CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0
RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline]
RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876
Call Trace:
<TASK>
__allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210
f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline]
f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238
f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830
f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940
vfs_fallocate+0x569/0x6e0 fs/open.c:327
do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl+0x80/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Concurrent pinfile allocation may run out of free section, result in
panic in get_new_segment(), let's expand pin_sem lock coverage to
include f2fs_gc(), so that we can make sure to reclaim enough free
space for following allocation.
In addition, do below changes to enhance error path handling:
- call f2fs_bug_on() only in non-pinfile allocation path in
get_new_segment().
- call reset_curseg_fields() to reset all fields of curseg in
new_curseg()
Fixes:
|
||
|
Qi Han
|
27895588a2 |
BACKPORT: f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks
After release a file and subsequently reserve it, the FSCK flag is set
when the file is deleted, as shown in the following backtrace:
F2FS-fs (dm-48): Inconsistent i_blocks, ino:401231, iblocks:1448, sectors:1472
fs_rec_info_write_type+0x58/0x274
f2fs_rec_info_write+0x1c/0x2c
set_sbi_flag+0x74/0x98
dec_valid_block_count+0x150/0x190
f2fs_truncate_data_blocks_range+0x2d4/0x3cc
f2fs_do_truncate_blocks+0x2fc/0x5f0
f2fs_truncate_blocks+0x68/0x100
f2fs_truncate+0x80/0x128
f2fs_evict_inode+0x1a4/0x794
evict+0xd4/0x280
iput+0x238/0x284
do_unlinkat+0x1ac/0x298
__arm64_sys_unlinkat+0x48/0x68
invoke_syscall+0x58/0x11c
For clusters of the following type, i_blocks are decremented by 1 and
i_compr_blocks are incremented by 7 in release_compress_blocks, while
updates to i_blocks and i_compr_blocks are skipped in reserve_compress_blocks.
raw node:
D D D D D D D D
after compress:
C D D D D D D D
after reserve:
C D D D D D D D
Let's update i_blocks and i_compr_blocks properly in reserve_compress_blocks.
Bug: 403145794
Fixes: eb8fbaa53374 ("f2fs: compress: fix to check unreleased compressed cluster")
Change-Id: I596af62bbd54941bfc77f30e182db94e81cba59b
Signed-off-by: Qi Han <hanqi@vivo.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 26413ce18e85de3dda2cd3d72c3c3e8ab8f4f996)
(cherry picked from commit 90d495244f3b9d0f69f7a158d2fcbc0d91d2592e)
|
||
|
gy niu
|
70d032fba5 |
ANDROID: GKI: Add KMI symbol list for zebra
These symbols are required to third part ethernet driver pegasus.ko and smsc95xx.ko INFO: 2 function symbol(s) added 'void mii_ethtool_get_link_ksettings(struct mii_if_info*, struct ethtool_link_ksettings*)' 'int mii_ethtool_set_link_ksettings(struct mii_if_info*, const struct ethtool_link_ksettings*)' Bug: 403203480 Change-Id: Idfb8fad289516d5cbbe6235bca6c87bd24406ca0 Signed-off-by: gy niu <gyniu1024@gmail.com> |
||
|
Bian Jin chen
|
efd0bedd2c |
ANDROID: GKI: Update rockchip symbols for drm driver.
INFO: 4 function symbol(s) added 'bool drm_bridge_is_panel(const struct drm_bridge*)' 'int drm_panel_bridge_set_orientation(struct drm_connector*, struct drm_bridge*)' 'struct drm_bridge* drmm_of_get_bridge(struct drm_device*, struct device_node*, u32, u32)' 'struct drm_bridge* drmm_panel_bridge_add(struct drm_device*, struct drm_panel*)' Bug: 300024866 Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com> Change-Id: I256402894b3a19be401c27113c0fe52647d43531 |
||
|
Seiya Wang
|
69a6dfc9c3 |
ANDROID: GKI: Update symbol list for mtk
7 function symbol(s) added 'int nfnetlink_subsys_register(const struct nfnetlink_subsystem*)' 'int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem*)' 'int nfnetlink_unicast(struct sk_buff*, struct net*, u32)' 'void nfnl_lock(__u8)' 'void nfnl_unlock(__u8)' 'int xt_register_matches(struct xt_match*, unsigned int)' 'void xt_unregister_matches(struct xt_match*, unsigned int)' Bug: 402616138 Change-Id: Ic3eaedb9ea04389141704e72e46e15e0936c0a78 Signed-off-by: Seiya Wang <seiya.wang@mediatek.com> |
||
|
Greg Kroah-Hartman
|
1bc4f0dcdc |
Merge 6.1.129 into android14-6.1-lts
Changes in 6.1.129
powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
afs: Fix directory format encoding struct
fs: fix proc_handler for sysctl_nr_open
block: retry call probe after request_module in blk_request_module
nbd: don't allow reconnect after disconnect
pstore/blk: trivial typo fixes
nvme: Add error check for xa_store in nvme_get_effects_log
selftests/powerpc: Fix argument order to timer_sub()
partitions: ldm: remove the initial kernel-doc notation
select: Fix unbalanced user_access_end()
afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
sched/psi: Use task->psi_flags to clear in CPU migration
sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
drm/msm/dp: set safe_to_exit_level before printing it
drm/etnaviv: Fix page property being used for non writecombine buffers
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
drm/rockchip: vop2: Set YUV/RGB overlay mode
drm/rockchip: vop2: set bg dly and prescan dly at vop2_post_config
drm/rockchip: vop2: Fix the windows switch between different layers
drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
OPP: Rearrange entries in pm_opp.h
OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs
OPP: Introduce dev_pm_opp_get_freq_indexed() API
OPP: Add dev_pm_opp_find_freq_exact_indexed()
OPP: Reuse dev_pm_opp_get_freq_indexed()
OPP: add index check to assert to avoid buffer overflow in _read_freq()
OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
genirq: Make handle_enforce_irqctx() unconditionally available
ipmi: ipmb: Add check devm_kasprintf() returned value
wifi: ath11k: Fix unexpected return buffer manager error for WCN6750/WCN6855
wifi: rtlwifi: do not complete firmware loading needlessly
wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
wifi: rtlwifi: wait for firmware loading before releasing memory
wifi: rtlwifi: fix init_sw_vars leak when probe fails
wifi: rtlwifi: usb: fix workqueue leak when probe fails
wifi: wcn36xx: fix channel survey memory allocation size
net_sched: sch_sfq: annotate data-races around q->perturb_period
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: don't allow 1 packet limit
spi: zynq-qspi: Add check for clk_enable()
dt-bindings: mmc: controller: clarify the address-cells description
dt-bindings: leds: class-multicolor: Fix path to color definitions
wifi: rtlwifi: remove unused timer and related code
wifi: rtlwifi: remove unused dualmac control leftovers
wifi: rtlwifi: remove unused check_buddy_priv
wifi: rtlwifi: destroy workqueue at rtl_deinit_core
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
wifi: rtlwifi: pci: wait for firmware loading before releasing memory
HID: multitouch: fix support for Goodix PID 0x01e9
regulator: dt-bindings: mt6315: Drop regulator-compatible property
ACPI: fan: cleanup resources in the error path of .probe()
cpupower: fix TSC MHz calculation
dt-bindings: mfd: bd71815: Fix rsense and typos
leds: netxbig: Fix an OF node reference leak in netxbig_leds_get_of_pdata()
inetpeer: remove create argument of inet_getpeer_v[46]()
inetpeer: remove create argument of inet_getpeer()
inetpeer: update inetpeer timestamp in inet_getpeer()
inetpeer: do not get a refcount in inet_getpeer()
pwm: stm32-lp: Add check for clk_enable()
cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
clk: imx8mp: Fix clkout1/2 support
team: prevent adding a device which is already a team device lower
regulator: of: Implement the unwind path of of_regulator_match()
ax25: rcu protect dev->ax25_ptr
OPP: OF: Fix an OF node leak in _opp_add_static_v2()
clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
mfd: syscon: Remove extern from function prototypes
mfd: syscon: Add of_syscon_register_regmap() API
mfd: syscon: Use scoped variables with memory allocators to simplify error paths
mfd: syscon: Fix race in device_node_get_regmap()
samples/landlock: Fix possible NULL dereference in parse_path()
wifi: wlcore: fix unbalanced pm_runtime calls
wifi: mac80211: prohibit deactivating all links
wifi: mac80211: Fix common size calculation for ML element
net/smc: fix data error when recvmsg with MSG_PEEK flag
landlock: Handle weird files
wifi: mt76: mt76u_vendor_request: Do not print error messages when -EPROTO
wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.
wifi: mt76: mt7915: fix register mapping
cpufreq: ACPI: Fix max-frequency computation
selftests: timers: clocksource-switch: Adapt progress to kselftest framework
selftests: harness: fix printing of mismatch values in __EXPECT()
wifi: cfg80211: Handle specific BSSID in 6GHz scanning
wifi: cfg80211: adjust allocation of colocated AP data
clk: analogbits: Fix incorrect calculation of vco rate delta
pwm: stm32: Add check for clk_enable()
selftests/landlock: Fix error message
net: let net.core.dev_weight always be non-zero
net/mlxfw: Drop hard coded max FW flash image size
net: avoid race between device unregistration and ethnl ops
net: sched: Disallow replacing of child qdisc from one parent to another
netfilter: nft_flow_offload: update tcp state flags under lock
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
tcp_cubic: fix incorrect HyStart round start detection
net/rose: prevent integer overflows in rose_setsockopt()
libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is missing
tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
libbpf: Fix segfault due to libelf functions not setting errno
ASoC: sun4i-spdif: Add clock multiplier settings
ASoC: renesas: rz-ssi: Use only the proper amount of dividers
ktest.pl: Remove unused declarations in run_bisect_test function
crypto: hisilicon/sec2 - optimize the error return process
crypto: hisilicon/sec2 - fix for aead icv error
crypto: hisilicon/sec2 - fix for aead invalid authsize
crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
padata: fix sysfs store callback check
ASoC: Intel: avs: Fix theoretical infinite loop
pinctrl: stm32: set default gpio line names using pin names
pinctrl: stm32: Add check for devm_kcalloc
pinctrl: stm32: check devm_kasprintf() returned value
pinctrl: stm32: Add check for clk_enable()
bpf: Send signals asynchronously if !preemptible
bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire A115-31 laptop
padata: fix UAF in padata_reorder
padata: add pd get/put refcnt helper
padata: avoid UAF for reorder_work
smb: client: fix oops due to unset link speed
soc: atmel: fix device_node release in atmel_soc_device_init()
ARM: at91: pm: change BU Power Switch to automatic mode
arm64: dts: mt8183: set DMIC one-wire mode on Damu
arm64: dts: mediatek: mt8516: fix GICv2 range
arm64: dts: mediatek: mt8516: fix wdt irq type
arm64: dts: mediatek: mt8516: add i2c clock-div property
arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
RDMA/mlx4: Avoid false error about access to uninitialized gids array
rdma/cxgb4: Prevent potential integer overflow on 32bit
arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
RDMA/srp: Fix error handling in srp_add_port
memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage settings
arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
arm64: dts: qcom: msm8996: Fix up USB3 interrupts
arm64: dts: qcom: msm8994: Describe USB interrupts
arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
arm64: dts: qcom: msm8916: correct sleep clock frequency
arm64: dts: qcom: msm8994: correct sleep clock frequency
arm64: dts: qcom: sc7280: correct sleep clock frequency
arm64: dts: qcom: sm6125: correct sleep clock frequency
arm64: dts: qcom: sm8250: correct sleep clock frequency
arm64: dts: qcom: sm8350: correct sleep clock frequency
arm64: dts: qcom: sm8450: correct sleep clock frequency
arm64: dts: ti: k3-am62: Remove duplicate GICR reg
arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
arm64: dts: qcom: sc7180: Add compat qcom,sc7180-dsi-ctrl
arm64: dts: qcom: sc7180-idp: use just "port" in panel
arm64: dts: qcom: sc7180-trogdor-quackingstick: use just "port" in panel
arm64: dts: qcom: sc7180-trogdor-wormdingler: use just "port" in panel
arm64: dts: qcom: sc7180: Don't enable lpass clocks by default
arm64: dts: qcom: sc7180: Drop redundant disable in mdp
arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
arm64: dts: qcom: pm6150l: add temp sensor and thermal zone config
arm64: dts: qcom: sc7180-*: Remove thermal zone polling delays
arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280 properties
arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
ARM: dts: mediatek: mt7623: fix IR nodename
fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
RDMA/mlx5: Fix indirect mkey ODP page count
of: reserved-memory: Do not make kmemleak ignore freed address
efi: sysfb_efi: fix W=1 warnings when EFI is not set
RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
media: rc: iguanair: handle timeouts
media: lmedm04: Handle errors for lme2510_int_read
PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
media: marvell: Add check for clk_enable()
media: i2c: imx412: Add missing newline to prints
media: i2c: ov9282: Correct the exposure offset
media: mipi-csis: Add check for clk_enable()
media: camif-core: Add check for clk_enable()
media: uvcvideo: Propagate buf->error to userspace
mtd: hyperbus: hbmc-am654: Convert to platform remove callback returning void
mtd: hyperbus: hbmc-am654: fix an OF node reference leak
staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
PCI: epf-test: Simplify DMA support checks
PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
module: Extend the preempt disabled section in dereference_symbol_descriptor().
serial: 8250: Adjust the timeout for FIFO mode
NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
tools/bootconfig: Fix the wrong format specifier
xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
dmaengine: ti: edma: fix OF node reference leaks in edma_driver
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
ubifs: skip dumping tnc tree when zroot is null
regulator: core: Add missing newline character
net: hns3: fix oops when unload drivers paralleling
gpio: mxc: remove dead code after switch to DT-only
net: fec: implement TSO descriptor cleanup
ipmr: do not call mr_mfc_uses_dev() for unres entries
PM: hibernate: Add error handling for syscore_suspend()
iavf: allow changing VLAN state without calling PF
net: rose: fix timer races against user threads
net: netdevsim: try to close UDP port harness races
vxlan: Fix uninit-value in vxlan_vnifilter_dump()
net: davicom: fix UAF in dm9000_drv_remove
bgmac: reduce max frame size to support just MTU 1500
net: sh_eth: Fix missing rtnl lock in suspend/resume path
net: hsr: fix fill_frame_info() regression vs VLAN packets
genksyms: fix memory leak when the same symbol is added from source
genksyms: fix memory leak when the same symbol is read from *.symref file
ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
kconfig: add warn-unknown-symbols sanity check
kconfig: require a space after '#' for valid input
kconfig: remove unused code for S_DEF_AUTO in conf_read_simple()
kconfig: deduplicate code in conf_read_simple()
kconfig: WERROR unmet symbol dependency
kconfig: fix memory leak in sym_warn_unmet_dep()
hexagon: fix using plain integer as NULL pointer warning in cmpxchg
hexagon: Fix unbalanced spinlock in die()
f2fs: Introduce linear search for dentries
NFSD: Reset cb_seq_status after NFS4ERR_DELAY
kbuild: switch from lz4c to lz4 for compression
netfilter: nf_tables: reject mismatching sum of field_len with set key length
nvme: fix metadata handling in nvme-passthrough
drm/amd/display: fix double free issue during amdgpu module unload
ktest.pl: Check kernelrelease return in get_version
ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
net: usb: rtl8150: enable basic endpoint checking
usb: xhci: Fix NULL pointer dereference on certain command aborts
drivers/card_reader/rtsx_usb: Restore interrupt based detection
usb: gadget: f_tcm: Fix Get/SetInterface return value
usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
usb: dwc3: core: Defer the probe until USB power supply ready
usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR PPS
mptcp: consolidate suboption status
mptcp: handle fastopen disconnect correctly
remoteproc: core: Fix ida_free call while not allocated
media: uvcvideo: Fix double free in error path
usb: gadget: f_tcm: Don't free command immediately
staging: media: max96712: fix kernel oops when removing module
media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
btrfs: output the reason for open_ctree() failure
ptp: Properly handle compat ioctls
s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
pinctrl: stm32: fix array read out of bound
btrfs: fix use-after-free when attempting to join an aborted transaction
arm64/mm: Ensure adequate HUGE_MAX_HSTATE
exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents()
btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
sched: Don't try to catch up excess steal time.
lockdep: Fix upper limit for LOCKDEP_*_BITS configs
x86/amd_nb: Restrict init function to AMD-based systems
drm/virtio: New fence for every plane update
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
drm/bridge: it6505: fix HDCP Bstatus check
drm/bridge: it6505: fix HDCP encryption when R0 ready
drm/bridge: it6505: fix HDCP CTS compare V matching
safesetid: check size of policy writes
tun: fix group permission check
mmc: core: Respect quirk_max_rate for non-UHS SDIO card
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
tomoyo: don't emit warning in tomoyo_write_control()
mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
HID: Wacom: Add PCI Wacom device support
net/mlx5: use do_aux_work for PHC overflow checks
wifi: brcmfmac: Check the return value of of_property_read_string_index()
wifi: iwlwifi: avoid memory leak
i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
APEI: GHES: Have GHES honor the panic= setting
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
net: wwan: iosm: Fix hibernation by re-binding the driver around it
mmc: sdhci-msm: Correctly set the load for the regulator
tipc: re-order conditions in tipc_crypto_key_rcv()
selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
x86/kexec: Allocate PGD for x86_64 transition page tables separately
iommu/arm-smmu-v3: Clean up more on probe failure
platform/x86: int3472: Check for adev == NULL
ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
ASoC: amd: Add ACPI dependency to fix build error
Input: allocate keycode for phone linking
platform/x86: acer-wmi: Ignore AC events
KVM: PPC: e500: Mark "struct page" dirty in kvmppc_e500_shadow_map()
KVM: PPC: e500: Mark "struct page" pfn accessed before dropping mmu_lock
KVM: PPC: e500: Use __kvm_faultin_pfn() to handle page faults
KVM: e500: always restore irqs
usb: chipidea/ci_hdrc_imx: Convert to platform remove callback returning void
usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()
net/ncsi: Add NC-SI 1.2 Get MC MAC Address command
net/ncsi: fix locking in Get MAC Address handling
gpio: xilinx: Convert to immutable irq_chip
gpio: xilinx: Convert gpio_lock to raw spinlock
xfs: report realtime block quota limits on realtime directories
xfs: don't over-report free space or inodes in statvfs
nvme: handle connectivity loss in nvme_set_queue_count
firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
gpu: drm_dp_cec: fix broken CEC adapter properties check
tg3: Disable tg3 PCIe AER on system reboot
udp: gso: do not drop small packets when PMTU reduces
gpio: pca953x: Improve interrupt support
net: atlantic: fix warning during hot unplug
net: rose: lock the socket in rose_bind()
x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
x86/xen: add FRAME_END to xen_hypercall_hvm()
ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
tun: revert fix group permission check
net: sched: Fix truncation of offloaded action statistics
cpufreq: s3c64xx: Fix compilation warning
leds: lp8860: Write full EEPROM, not only half of it
ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
drm/modeset: Handle tiled displays in pan_display_atomic.
smb: client: change lease epoch type from unsigned int to __u16
s390/futex: Fix FUTEX_OP_ANDN implementation
m68k: vga: Fix I/O defines
fs/proc: do_task_stat: Fix ESP not readable during coredump
binfmt_flat: Fix integer overflow bug on 32 bit systems
drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
ksmbd: fix integer overflows on 32 bit systems
drm/amd/pm: Mark MM activity as unsupported
Revert "drm/amd/display: Use HW lock mgr for PSR1"
drm/i915/guc: Debug print LRC state entries only if the context is pinned
drm/komeda: Add check for komeda_get_layer_fourcc_list()
drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
clk: sunxi-ng: a100: enable MMC clock reparenting
clk: qcom: clk-alpha-pll: fix alpha mode configuration
clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
blk-cgroup: Fix class @block_class's subsystem refcount leakage
efi: libstub: Use '-std=gnu11' to fix build with GCC 15
scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
of: Correct child specifier used as input of the 2nd nexus node
of: Fix of_find_node_opts_by_path() handling of alias+path+options
of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
HID: hid-sensor-hub: don't use stale platform-data on remove
wifi: rtlwifi: rtl8821ae: Fix media status report
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
usb: gadget: f_tcm: Translate error to sense
usb: gadget: f_tcm: Decrement command ref count on cleanup
usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
usb: gadget: f_tcm: Don't prepare BOT write request twice
ASoC: acp: Support microphone from Lenovo Go S
soc: qcom: socinfo: Avoid out of bounds read of serial number
serial: sh-sci: Drop __initdata macro for port_cfg
serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
MIPS: Loongson64: remove ROM Size unit in boardinfo
powerpc/pseries/eeh: Fix get PE state translation
dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
dm-crypt: track tag_offset in convert_context
mips/math-emu: fix emulation of the prefx instruction
block: don't revert iter for -EIOCBQUEUED
Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
ALSA: hda/realtek: Enable headset mic on Positivo C6400
ALSA: hda: Fix headset detection failure due to unstable sort
arm64: tegra: Fix Tegra234 PCIe interrupt-map
PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
scsi: qla2xxx: Move FCE Trace buffer allocation to user control
scsi: storvsc: Set correct data length for sending SCSI command without payload
kbuild: Move -Wenum-enum-conversion to W=2
x86/boot: Use '-std=gnu11' to fix build with GCC 15
arm64: dts: qcom: sm6350: Fix ADSP memory length
arm64: dts: qcom: sm6350: Fix MPSS memory length
arm64: dts: qcom: sm8350: Fix MPSS memory length
arm64: dts: qcom: sm8450: Fix MPSS memory length
crypto: qce - fix priority to be less than ARMv8 CE
arm64: tegra: Disable Tegra234 sce-fabric node
xfs: Add error handling for xfs_reflink_cancel_cow_range
ACPI: PRM: Remove unnecessary strict handler address checks
rv: Reset per-task monitors also for idle tasks
kfence: skip __GFP_THISNODE allocations on NUMA systems
media: ccs: Clean up parsed CCS static data on parse failure
iio: light: as73211: fix channel handling in only-color triggered buffer
soc: qcom: smem_state: fix missing of_node_put in error path
media: mc: fix endpoint iteration
media: ov5640: fix get_light_freq on auto
media: ccs: Fix CCS static data parsing for large block sizes
media: ccs: Fix cleanup order in ccs_probe()
media: uvcvideo: Fix event flags in uvc_ctrl_send_events
media: uvcvideo: Remove redundant NULL assignment
mm: kmemleak: fix upper boundary check for physical address objects
ata: libata-sff: Ensure that we cannot write outside the allocated buffer
crypto: qce - fix goto jump in error path
crypto: qce - unregister previously registered algos in error path
nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
nvmem: core: improve range check for nvmem_cell_write()
io_uring/net: don't retry connect operation on EPOLLERR
vfio/platform: check the bounds of read/write syscalls
selftests: mptcp: connect: -f: no reconnect
pnfs/flexfiles: retry getting layout segment for reads
ocfs2: fix incorrect CPU endianness conversion causing mount failure
ocfs2: handle a symlink read error correctly
nilfs2: fix possible int overflows in nilfs_fiemap()
mailbox: tegra-hsp: Clear mailbox before using message
NFC: nci: Add bounds checking in nci_hci_create_pipe()
i3c: master: Fix missing 'ret' assignment in set_speed()
irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
mtd: onenand: Fix uninitialized retlen in do_otp_read()
misc: fastrpc: Deregister device nodes properly in error scenarios
misc: fastrpc: Fix registered buffer page address
misc: fastrpc: Fix copy buffer page size
net/ncsi: wait for the last response to Deselect Package before configuring channel
net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
rtla/osnoise: Distinguish missing workload option
rtla: Add trace_instance_stop
rtla/timerlat_hist: Stop timerlat tracer on signal
rtla/timerlat_top: Stop timerlat tracer on signal
pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
ptp: Ensure info->enable callback is always set
rtc: zynqmp: Fix optional clock name property
io_uring: fix multishots with selected buffers
io_uring: fix io_req_prep_async with provided buffers
io_uring/rw: commit provided buffer state on async
MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
gpio: xilinx: remove excess kernel doc
ocfs2: check dir i_size in ocfs2_find_entry
cachefiles: Fix NULL pointer dereference in object->file
mptcp: pm: only set fullmesh for subflow endp
mptcp: prevent excessive coalescing on receive
tty: xilinx_uartps: split sysrq handling
maple_tree: fix static analyser cppcheck issue
maple_tree: simplify split calculation
pps: Fix a use-after-free
Revert "btrfs: avoid monopolizing a core when activating a swap file"
btrfs: avoid monopolizing a core when activating a swap file
nfsd: clear acl_access/acl_default after releasing them
NFSD: fix hang in nfsd4_shutdown_callback
pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
HID: multitouch: Add NULL check in mt_input_configured
HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
vrf: use RCU protection in l3mdev_l3_out()
vxlan: check vxlan_vnigroup_init() return value
team: better TEAM_OPTION_TYPE_STRING validation
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
cgroup: Remove steal time from usage_usec
drm/i915/selftests: avoid using uninitialized context
gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
gpio: bcm-kona: Add missing newline to dev_err format string
xen/swiotlb: relax alignment requirements
xen: remove a confusing comment on auto-translated guest I/O
x86/xen: allow larger contiguous memory regions in PV guests
RDMA/efa: Reset device on probe failure
fbdev: omap: use threaded IRQ for LCD DMA
media: cxd2841er: fix 64-bit division on gcc-9
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
PCI: switchtec: Add Microchip PCI100X device IDs
scsi: ufs: bsg: Set bsg_queue to NULL after removal
rtla/timerlat_hist: Abort event processing on second signal
rtla/timerlat_top: Abort event processing on second signal
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
Grab mm lock before grabbing pt lock
selftests: gpio: gpio-sim: Fix missing chip disablements
x86/mm/tlb: Only trim the mm_cpumask once a second
orangefs: fix a oob in orangefs_debug_write
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
batman-adv: fix panic during interface removal
batman-adv: Ignore neighbor throughput metrics in error case
batman-adv: Drop unmanaged ELP metric worker
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
KVM: nSVM: Enter guest mode before initializing nested NPT MMU
perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
usb: dwc3: Fix timeout issue during controller enter/exit from halt state
usb: roles: set switch registered flag early on
usb: gadget: udc: renesas_usb3: Fix compiler warning
usb: dwc2: gadget: remove of_node reference upon udc_stop
USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
usb: core: fix pipe creation for get_bMaxPacketSize0
USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
USB: hub: Ignore non-compliant devices with too many configs or interfaces
USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
usb: cdc-acm: Check control transfer buffer size before access
usb: cdc-acm: Fix handling of oversized fragments
USB: serial: option: add MeiG Smart SLM828
USB: serial: option: add Telit Cinterion FN990B compositions
USB: serial: option: fix Telit Cinterion FN990A name
USB: serial: option: drop MeiG Smart defines
can: ctucanfd: handle skb allocation failure
can: c_can: fix unbalanced runtime PM disable in error path
can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
alpha: make stack 16-byte aligned (most cases)
efi: Avoid cold plugged memory for placing the kernel
cgroup: fix race between fork and cgroup.kill
serial: 8250: Fix fifo underflow on flush
alpha: align stack for page fault and user unaligned trap handlers
gpiolib: acpi: Add a quirk for Acer Nitro ANV14
gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
partitions: mac: fix handling of bogus partition table
regmap-irq: Add missing kfree()
arm64: Handle .ARM.attributes section in linker scripts
mmc: mtk-sd: Fix register settings for hs400(es) mode
mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
btrfs: fix hole expansion when writing at an offset beyond EOF
clocksource: Use pr_info() for "Checking clocksource synchronization" message
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
ipv4: add RCU protection to ip4_dst_hoplimit()
net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
net: add dev_net_rcu() helper
ipv4: use RCU protection in ipv4_default_advmss()
ipv4: use RCU protection in rt_is_expired()
ipv4: use RCU protection in inet_select_addr()
net: ipv4: Cache pmtu for all packet paths if multipath enabled
ipv4: use RCU protection in __ip_rt_update_pmtu()
ipv4: icmp: convert to dev_net_rcu()
flow_dissector: use RCU protection to fetch dev_net()
ipv6: use RCU protection in ip6_default_advmss()
ndisc: use RCU protection in ndisc_alloc_skb()
neighbour: delete redundant judgment statements
neighbour: use RCU protection in __neigh_notify()
arp: use RCU protection in arp_xmit()
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
ndisc: extend RCU protection in ndisc_send_skb()
ipv6: mcast: add RCU protection to mld_newpack()
drm/tidss: Fix issue in irq handling causing irq-flood issue
drm/tidss: Clear the interrupt status for interrupts being disabled
drm/v3d: Stop active perfmon if it is being destroyed
kdb: Do not assume write() callback available
x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
iommu: Return right value in iommu_sva_bind_device()
arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
mm: gup: fix infinite loop within __get_longterm_locked
alpha: replace hardcoded stack offsets with autogenerated ones
i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition
nilfs2: do not output warnings when clearing dirty buffers
nilfs2: do not force clear folio if buffer is referenced
nilfs2: protect access to buffers with no active references
can: ems_pci: move ASIX AX99100 ids to pci_ids.h
serial: 8250_pci: add support for ASIX AX99100
parport_pc: add support for ASIX AX99100
net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events
netdevsim: print human readable IP address
selftests: rtnetlink: update netdevsim ipsec output format
ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
f2fs: fix to wait dio completion
drm/amd/display: Add NULL pointer check for kzalloc
x86/i8253: Disable PIT timer 0 when not in use
Linux 6.1.129
Change-Id: I02497ad91676f262764450c910e1b123f1d97a1f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Greg Kroah-Hartman
|
5c2815ea50 |
Revert "cgroup: fix race between fork and cgroup.kill"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
f082ff3de7 |
Merge 0264d6b73e ("can: ems_pci: move ASIX AX99100 ids to pci_ids.h") into android14-6.1-lts
Steps on the way to 6.1.129 Resolves merge conflicts in: drivers/i3c/master/i3c-master-cdns.c include/linux/iommu.h net/ipv4/icmp.c Change-Id: I27a81ad93ee7a865b5eb17d7866220fd3cf0bb11 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
12b82de534 |
Merge db8686b24a ("usb: roles: set switch registered flag early on") into android14-6.1-lts
Steps on the way to 6.1.129 Merges this commit away as it depended on an upstream change that was previously reverted. Change-Id: I04aa99451c3e341dbf6c91d99633e7df83c2b8c7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
897e9179dd |
Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
97c6e8c639 |
Revert "pps: Fix a use-after-free"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
1a79d14d69 |
Merge a298df1bbe ("usb: dwc3: Fix timeout issue during controller enter/exit from halt state") into android14-6.1-lts
Steps on the way to 6.1.129 Resolves merge conflicts in: drivers/pps/clients/pps-ldisc.c Change-Id: Idc1822210eb87723c7e7e34ad8ba71d2ca1d4ad3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Greg Kroah-Hartman
|
43908d99f2 |
Merge 09b288fb7f ("maple_tree: simplify split calculation") into android14-6.1-lts
Steps on the way to 6.1.129 Change-Id: I0eb60408f7d9735b0d1cb27dbb9379661b50fdef Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |