Safae Ouajih authored 2 years ago and Mattijs Korpershoek committed 1 year ago

As required by AOSP, enable bootconfig in order to place
androidboot* kernel command line in bootconfig.

Signed-off-by: Safae Ouajih <souajih@baylibre.com>
Signed-off-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>

Add missing android-recommended for arm64 cfg file.

Change-Id: I0d8a308bcb9852cbdecb9d1c02f9288fe601c262
Signed-off-by: Guillaume La Roque <glaroque@baylibre.com>

After enable check in android build system add missing kernel config
flag to be able to build andorid image.

Change-Id: I5ebb4a3881303a3e0c178ab25386eeb3b354c4a9
Signed-off-by: Guillaume La Roque <glaroque@baylibre.com>

* bl/aosp/android13-5.10: (97 commits)
  BACKPORT: USB: gadget: Fix use-after-free during usb config switch
  ANDROID: sched/fair: Remove duplicated trace function
  ANDROID: fix ABI by undoing atomic64_t -> u64 type conversion
  UPSTREAM: net: retrieve netns cookie via getsocketopt
  UPSTREAM: net: initialize net->net_cookie at netns setup
  ANDROID: ABI: Add page_pinner_inited into symbols list
  ANDROID: page_pinner: prevent pp_buffer access before initialization
  UPSTREAM: hwrng: virtio - add an internal buffer
  UPSTREAM: ext4: fix another off-by-one fsmap error on 1k block filesystems
  UPSTREAM: dm verity: stop using WQ_UNBOUND for verify_wq
  BACKPORT: dm verity: enable WQ_HIGHPRI on verify_wq
  UPSTREAM: dm verity: remove WQ_CPU_INTENSIVE flag since using WQ_UNBOUND
  UPSTREAM: ext4: block range must be validated before use in ext4_mb_clear_bb()
  UPSTREAM: ext4: add strict range checks while freeing blocks
  UPSTREAM: ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid()
  UPSTREAM: ext4: refactor ext4_free_blocks() to pull out ext4_mb_clear_bb()
  UPSTREAM: usb: dwc3: core: do not use 3.0 clock when operating in 2.0 mode
  ANDROID: GKI: rockchip: Add symbols for clk api
  ANDROID: remove patch rejected file
  BACKPORT: arm64: mte: move register initialization to C
  ...

Change-Id: I06ab2618940b784d26047d4c84f42f1b7a1d132e

In the process of switching USB config from rndis to other config,
if the hardware does not support the ->pullup callback, or the
hardware encounters a low probability fault, both of them may cause
the ->pullup callback to fail, which will then cause a system panic
(use after free).

The gadget drivers sometimes need to be unloaded regardless of the
hardware's behavior.

Analysis as follows:
=======================================================================
(1) write /config/usb_gadget/g1/UDC "none"

gether_disconnect+0x2c/0x1f8
rndis_disable+0x4c/0x74
composite_disconnect+0x74/0xb0
configfs_composite_disconnect+0x60/0x7c
usb_gadget_disconnect+0x70/0x124
usb_gadget_unregister_driver+0xc8/0x1d8
gadget_dev_desc_UDC_store+0xec/0x1e4

(2) rm /config/usb_gadget/g1/configs/b.1/f1

rndis_deregister+0x28/0x54
rndis_free+0x44/0x7c
usb_put_function+0x14/0x1c
config_usb_cfg_unlink+0xc4/0xe0
configfs_unlink+0x124/0x1c8
vfs_unlink+0x114/0x1dc

(3) rmdir /config/usb_gadget/g1/functions/rndis.gs4

panic+0x1fc/0x3d0
do_page_fault+0xa8/0x46c
do_mem_abort+0x3c/0xac
el1_sync_handler+0x40/0x78
0xffffff801138f880
rndis_close+0x28/0x34
eth_stop+0x74/0x110
dev_close_many+0x48/0x194
rollback_registered_many+0x118/0x814
unregister_netdev+0x20/0x30
gether_cleanup+0x1c/0x38
rndis_attr_release+0xc/0x14
kref_put+0x74/0xb8
configfs_rmdir+0x314/0x374

If gadget->ops->pullup() return an error, function rndis_close() will be
called, then it will causes a use-after-free problem.
=======================================================================

Fixes: 0a55187a ("USB: gadget core: Issue ->disconnect() callback from usb_gadget_disconnect()")
Signed-off-by: Jiantao Zhang <water.zhangjiantao@huawei.com>
Signed-off-by: TaoXue <xuetao09@huawei.com>
Link: https://lore.kernel.org/r/20221121130805.10735-1-water.zhangjiantao@huawei.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 273510696
Bug: 275027942
Change-Id: I702f324c5852d3b2448081b092fef464f8691989
(cherry picked from commit afdc1288)
[ray: Resolved minor conflict in drivers/usb/gadget/udc/core.c]
Signed-off-by: Ray Chi <raychi@google.com>

trace_android_rvh_attach_entity_load_avg is added twice during code
merge, so remove it.

Bug: 275023187
Fixes: cac3a605 Merge 64f18041 ("Merge branch 'android13-5.10'
into branch 'android13-5.10-lts'") into android13-5.10-lts
Change-Id: I82454264aad7b21b4bfe3681cbe22dfabc4d13d4
Signed-off-by: Rick Yiu <rickyiu@google.com>

This is pretty much a no-op, but avoids changing struct net ABI.

Bug: 274789652
Test: builds, net_test
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia744bdf0a026adccaef8382aaecc771a8d0763a6
(cherry picked from commit 05fa7d8eee9ed5eaba4f7ea32472765fd8a7a9e9)

It's getting more common to run nested container environments for
testing cloud software. One of such examples is Kind [1] which runs a
Kubernetes cluster in Docker containers on a single host. Each container
acts as a Kubernetes node, and thus can run any Pod (aka container)
inside the former. This approach simplifies testing a lot, as it
eliminates complicated VM setups.

Unfortunately, such a setup breaks some functionality when cgroupv2 BPF
programs are used for load-balancing. The load-balancer BPF program
needs to detect whether a request originates from the host netns or a
container netns in order to allow some access, e.g. to a service via a
loopback IP address. Typically, the programs detect this by comparing
netns cookies with the one of the init ns via a call to
bpf_get_netns_cookie(NULL). However, in nested environments the latter
cannot be used given the Kubernetes node's netns is outside the init ns.
To fix this, we need to pass the Kubernetes node netns cookie to the
program in a different way: by extending getsockopt() with a
SO_NETNS_COOKIE option, the orchestrator which runs in the Kubernetes
node netns can retrieve the cookie and pass it to the program instead.

Thus, this is following up on Eric's commit 3d368ab8 ("net:
initialize net->net_cookie at netns setup") to allow retrieval via
SO_NETNS_COOKIE.  This is also in line in how we retrieve socket cookie
via SO_COOKIE.

  [1] https://kind.sigs.k8s.io/



Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Cc: Eric Dumazet <edumazet@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit e8b9eab9)
Bug: 274789652
Tested: builds, net_test passes
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If784a592450af38d70f16da61e36cbbaff80ebca

It is simpler to make net->net_cookie a plain u64
written once in setup_net() instead of looping
and using atomic64 helpers.

Lorenz Bauer wants to add SO_NETNS_COOKIE socket option
and this patch would makes his patch series simpler.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 3d368ab8)
Bug: 274789652
Tested: builds, net_test passes
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia4d018b37af2792f0a21de028f724193797c5138

ABI DIFFERENCES HAVE BEEN DETECTED!

1 variable symbol(s) added
  'struct static_key_false page_pinner_inited'

Bug: 273138535
Change-Id: I0de904601a8b99029b6deb06833fd1570860031d
Signed-off-by: Suren Baghdasaryan <surenb@google.com>

If page_pinner is configured with page_pinner_enabled=false and
failure_tracking=true, pp_buffer will be accessed without being
initialized. Prevent this by adding page_pinner_inited checks in
functions that access it.

Fixes: 898cfbf094a2 ("ANDROID: mm: introduce page_pinner")
Bug: 259024332
Bug: 260179017
Change-Id: I8f612cae3e74d36e8a4eee5edec25281246cbe5e
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
(cherry picked from commit 23fb3111f63e5fe239a769668275c20493a5849c)

This is the merge of the upstream LTS release of 5.10.168 into the
android13-5.10 branch.

It contains the following commits:

* d773f581 Revert "nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property"
*   0d78ce3b Merge 5.10.168 into android13-5.10-lts
|\
| * 707c4821 Linux 5.10.168
| * 0a626e27 Fix page corruption caused by racy check in __free_pages
| * 0ef2490a arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
| * 5bfc8f09 arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
| * 809f4acb arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
| * 8eee3521 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
| * 6ff8b482 ceph: flush cap releases when the session is flushed
| * 4f518a4a usb: typec: altmodes/displayport: Fix probe pin assign check
| * f25fa93e usb: core: add quirk for Alcor Link AK9563 smartcard reader
| * dd965ad3 btrfs: free device in btrfs_close_devices for a single device filesystem
| * 1be271c5 net: USB: Fix wrong-direction WARNING in plusb.c
| * 2b693fe3 cifs: Fix use-after-free in rdata->read_into_pages()
| * bbc85090 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
| * 4863f46d spi: dw: Fix wrong FIFO level setting for long xfers
| * 6e2a0521 pinctrl: single: fix potential NULL dereference
| * 61f8a493 pinctrl: aspeed: Fix confusing types in return value
| * ef3edede ALSA: pci: lx6464es: fix a debug loop
| * 3914b71d selftests: forwarding: lib: quote the sysctl values
| * c53f34ec rds: rds_rm_zerocopy_callback() use list_first_entry()
| * 3eb04ef2 net/mlx5: fw_tracer, Zero consumer index when reloading the tracer
| * fac1fb80 net/mlx5: fw_tracer, Clear load bit when freeing string DBs buffers
| * 703c3efa net/mlx5e: IPoIB, Show unknown speed instead of error
| * 896bd856 net: mscc: ocelot: fix VCAP filters not matching on MAC with "protocol 802.1Q"
| * 1ad4112c ice: Do not use WQ_MEM_RECLAIM flag for workqueue
| * 34a5af78 uapi: add missing ip/ipv6 header dependencies for linux/stddef.h
| * 4259a408 ionic: clean interrupt before enabling queue to avoid credit race
| * 07097ad3 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
| * cafa2ad4 bonding: fix error checking in bond_debug_reregister()
| * 30fdf660 xfrm: fix bug with DSCP copy to v6 from v4 tunnel
| * 491b7a5f RDMA/usnic: use iommu_map_atomic() under spin_lock()
| * b1afb666 IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
| * a893cc64 xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
| * 79b595d9 IB/hfi1: Restore allocated resources on failed copyout
| * 3797e94c xfrm: compat: change expression for switch in xfrm_xlate64
| * bc9771cd can: j1939: do not wait 250 ms if the same addr was already claimed
| * edaf5c71 of/address: Return an error when no valid dma-ranges are found
| * b7d5fa80 tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
| * 35452bf9 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro 360
| * e1646e2b ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
| * 1c657623 ALSA: hda/realtek: Add Positivo N14KP6-TG
| * f1fd16cd btrfs: zlib: zero-initialize zlib workspace
| * a1406d5a btrfs: limit device extents to the device size
| * dbe5a119 migrate: hugetlb: check for hugetlb shared PMD in node migration
| * 97a5104d mm/migration: return errno when isolate_huge_page failed
| * 91ad3104 iio:adc:twl6030: Enable measurement of VAC
| * e4c3ea9b bpf: Do not reject when the stack read size is different from the tracked scalar size
| * 34ec4c78 nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
| * b2e41287 wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
| * 914e38f0 f2fs: fix to do sanity check on i_extra_isize in is_alive()
| * 39310143 fbdev: smscufx: fix error handling code in ufx_usb_probe
| * 6c8a2c67 serial: 8250_dma: Fix DMA Rx rearm race
| * 967e726e serial: 8250_dma: Fix DMA Rx completion race
| * 1fd7a6a5 nvmem: core: fix cell removal on error
| * bb875f0a nvmem: core: initialise nvmem->id early
| * b591abac drm/i915: Fix potential bit_17 double-free
| * 5c4d4a83 Squashfs: fix handling and sanity checking of xattr_ids count
| * 30187be2 mm/swapfile: add cond_resched() in get_swap_pages()
| * 639b4000 fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
| * 0139d61d x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses
| * 55695932 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
| * 50d31309 riscv: disable generation of unwind tables
| * 71a4f39f parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
| * 2982b473 parisc: Fix return code of pdc_iodc_print()
| * 170e1cc3 nvmem: qcom-spmi-sdam: fix module autoloading
| * f11330b7 iio: imu: fxos8700: fix MAGN sensor scale and unit
| * 5b30998c iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN
| * 42e34a08 iio: imu: fxos8700: fix failed initialization ODR mode assignment
| * ab976ecd iio: imu: fxos8700: fix incorrect ODR mode readback
| * 9d6502ed iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback
| * aff4add6 iio: imu: fxos8700: fix map label of channel type to MAGN sensor
| * 9545ce72 iio: imu: fxos8700: fix IMU data bits returned to user space
| * 6d43eddc iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback
| * f7d996c9 iio: imu: fxos8700: fix ACCEL measurement range selection
| * 11ac43f7 iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
| * 5602f6a2 iio: adc: berlin2-adc: Add missing of_node_put() in error path
| * 33483172 iio: hid: fix the retval in accel_3d_capture_sample
| * 55cf6546 efi: Accept version 2 of memory attributes table
| * 8fb515c8 ALSA: hda/realtek: Add Acer Predator PH315-54
| * 192fd121 watchdog: diag288_wdt: fix __diag288() inline assembly
| * 5bcdcf43 watchdog: diag288_wdt: do not use stack buffers for hardware data
| * 0c76eddc net: qrtr: free memory on error path in radix_tree_insert()
| * 28d19088 fbcon: Check font dimension limits
| * 658e0d99 Input: i8042 - add Clevo PCX0DX to i8042 quirk table
| * a82d4936 Input: i8042 - add TUXEDO devices to i8042 quirk tables
| * 04d99a0a Input: i8042 - merge quirk tables
| * ab85074c Input: i8042 - move __initconst to fix code styling warning
| * 55515d7d vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
| * 434a36ed usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
| * 6e5565aa usb: dwc3: qcom: enable vbus override when in OTG dr-mode
| * 1ca86295 usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
| * 30d0e2cf iio: adc: stm32-dfsdm: fill module aliases
| * 4bbc3440 net/x25: Fix to not accept on connected socket
| * 2b1e8e20 platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table
| * ac4d9c86 i2c: rk3x: fix a bunch of kernel-doc warnings
| * 9758ffe1 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
| * 1b28bf86 scsi: target: core: Fix warning on RT kernels
| * 4e66ba3c i2c: mxs: suppress probe-deferral error message
| * d09b0bf9 qede: execute xdp_do_flush() before napi_complete_done()
| * 8aba483f qede: add netpoll support for qede driver
| * 87d4ff18 efi: fix potential NULL deref in efi_mem_reserve_persistent
| * 70154489 net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
| * 4fb430c6 virtio-net: Keep stop() to follow mirror sequence of open()
| * 812236bb selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
| * 9e7e2887 selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
| * 4babbd1f selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
| * a4a493e5 selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
| * 4d9c9627 ata: libata: Fix sata_down_spd_limit() when no link speed is reported
| * b6d44072 can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
| * 6362b861 igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp()
| * 98c93a01 net: phy: meson-gxl: Add generic dummy stubs for MMD register access
| * de2785aa squashfs: harden sanity check in squashfs_read_xattr_id_table
| * f53c6e7e netfilter: br_netfilter: disable sabotage_in hook after first suppression
| * dd699125 netrom: Fix use-after-free caused by accept on already connected socket
| * 362a2f55 net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
| * 6824169e sfc: correctly advertise tunneled IPv6 segmentation
| * 539fc3ef virtio-net: execute xdp_do_flush() before napi_complete_done()
| * 63d1c4ed fix "direction" argument of iov_iter_kvec()
| * 0c67fb77 fix iov_iter_bvec() "direction" argument
| * b5437e0b READ is "data destination", not source...
| * fefb47a8 WRITE is "data source", not destination...
| * f9815b30 vhost/net: Clear the pending messages when the backend is removed
| * de990d15 scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
| * d08a9b0a drm/vc4: hdmi: make CEC adapter name unique
| * 8c6b46d4 arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
| * 9bd6074e bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
| * 36dbb8da bpf: Fix to preserve reg parent/live fields when copying range info
| * 8de8c4a2 bpf: Support <8-byte scalar spill and refill
| * 2b557fa6 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
| * 1b1f56cc bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers
| * 2d0f276d powerpc/imc-pmu: Revert nest_init_lock to being a mutex
| * 9ff2bebc bpf: Fix incorrect state pruning for <8B spill/fill
| * 60c27e0e bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
| * d5a2dcee firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
* | 86008452 Merge 5.10.167 into android13-5.10-lts
|\|
| * a5acb54d Linux 5.10.167
| * 6446369f net: fix NULL pointer in skb_segment_list
| * 0f9db120 Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
| * d744c03c ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems
| * bd0050b7 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
| * 19c9a2ba blk-cgroup: fix missing pd_online_fn() while activating policy
| * a1c0263f bpf: Skip task with pid=1 in send_signal_common()
| * f1854686 arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
| * a26cef00 ARM: dts: vf610: Fix pca9548 i2c-mux node names
| * 67a8beb8 ARM: dts: imx: Fix pca9547 i2c-mux node name
* | 39026c8d Merge 5.10.166 into android13-5.10-lts
|\|
| * 8d823aaa Linux 5.10.166
| * 19f1f99b clk: Fix pointer casting to prevent oops in devm_clk_release()
| * f84c9b72 perf/x86/amd: fix potential integer overflow on shift of a int
| * 743435cd netfilter: conntrack: unify established states for SCTP paths
| * e284c273 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
| * 2eca102b block: fix and cleanup bio_check_ro
| * 7fe4fab8 Revert "selftests/ftrace: Update synthetic event syntax errors"
| * 032a7d5f nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
| * 8fe3e574 nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf
| * 9f3dd454 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
| * 230be65a tools: gpio: fix -c option of gpio-event-mon
| * 7ff8128b net: mdio-mux-meson-g12a: force internal PHY off on mux switch
| * 62a0806e net/tg3: resolve deadlock in tg3_reset_task() during EEH
| * e9c1b1e1 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
| * 3af20f63 net: ravb: Fix possible hang if RIS2_QFF1 happen
| * 6ef652f3 sctp: fail if no bound addresses can be used for a given scope
| * cf9a2ce0 net/sched: sch_taprio: do not schedule in taprio_reset()
| * 7de16d75 netrom: Fix use-after-free of a listening socket.
| * 498584cc netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
| * 7f9828fb ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
| * 34c6142f ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
| * 870a565b netlink: annotate data races around sk_state
| * 8583f52c netlink: annotate data races around dst_portid and dst_group
| * eccb532a netlink: annotate data races around nlk->portid
| * 0308b7df netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
| * 4aacf3d7 netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
| * d4c008f3 net: fix UaF in netns ops registration error path
| * 539ca5dc netlink: prevent potential spectre v1 gadgets
| * ed173f77 i2c: designware: use casting of u64 in clock multiplication to avoid overflow
| * 8949ef3a i2c: designware: Use DIV_ROUND_CLOSEST() macro
| * 8ebc2efc units: Add SI metric prefix definitions
| * 974aaf11 units: Add Watt units
| * 76d9ebb7 EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
| * 511f6c7c EDAC/device: Respect any driver-supplied workqueue polling value
| * 0cb922ce ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
| * 98d85586 thermal: intel: int340x: Protect trip temperature from concurrent updates
| * 76c56407 KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
| * e037baee cifs: Fix oops due to uncleared server->smbd_conn in reconnect
| * c42a6e68 ftrace/scripts: Update the instructions for ftrace-bisect.sh
| * 886aa449 trace_events_hist: add check for return value of 'create_hist_field'
| * de3930a4 tracing: Make sure trace_printk() can output as soon as it can be used
| * 083b3dda module: Don't wait for GOING modules
| * ce3aa769 scsi: hpsa: Fix allocation size for scsi_host_alloc()
| * 6da70558 xhci: Set HCD flag to defer primary roothub registration
| * 1d580d3e Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
| * b98a8b73 exit: Use READ_ONCE() for all oops/warn limit reads
| * 53f177b5 docs: Fix path paste-o for /sys/kernel/warn_count
| * b0bd5dcf panic: Expose "warn_count" to sysfs
| * 8c99d4c4 panic: Introduce warn_limit
| * 55eba182 panic: Consolidate open-coded panic_on_warn checks
| * 530cdae5 exit: Allow oops_limit to be disabled
| * 7cffbcd6 exit: Expose "oops_count" to sysfs
| * de586785 exit: Put an upper limit on how often we can oops
| * 191a3b17 panic: Separate sysctl logic from CONFIG_SMP
| * 1b9a33a9 ia64: make IA64_MCA_RECOVERY bool instead of tristate
| * 6d971830 csky: Fix function name in csky_alignment() and die()
| * 648d8b8c h8300: Fix build errors from do_exit() to make_task_dead() transition
| * 63d77c55 hexagon: Fix function name in die()
| * b2c178f3 objtool: Add a missing comma to avoid string concatenation
| * d9c740c7 exit: Add and use make_task_dead.
| * 715a6358 kasan: no need to unset panic_on_warn in end_report()
| * b857b42a ubsan: no need to unset panic_on_warn in ubsan_epilogue()
| * 590ba6fe panic: unset panic_on_warn inside panic()
| * e97ec099 kernel/panic: move panic sysctls to its own file
| * e6226917 sysctl: add a new register_sysctl_init() interface
| * c4097e84 fs: reiserfs: remove useless new_opts in reiserfs_remount
| * 1f676814 x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
| * 5fb884d7 netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
| * a7345145 Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
| * 20a02bc8 lockref: stop doing cpu_relax in the cmpxchg loop
| * f8ddf7db platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
| * 9968f9a8 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
| * 52249c21 scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
| * 71bd134c KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
| * 300da569 spi: spidev: remove debug messages that access spidev->spi without locking
| * a84def9b ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
| * d9a0752a ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
| * 00f23016 cpufreq: armada-37xx: stop using 0 as NULL pointer
| * 2ca345d1 s390/debug: add _ASM_S390_ prefix to header guard
| * ae108a5f drm: Add orientation quirk for Lenovo ideapad D330-10IGL
| * 96f4899a ASoC: fsl_micfil: Correct the number of steps on SX controls
| * 3b154d52 kcsan: test: don't put the expect array on the stack
| * b75e9fc4 cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
| * 6bc564f3 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
| * d79e7006 tcp: fix rate_app_limited to default to 1
| * a84240df net: dsa: microchip: ksz9477: port map correction in ALU table entry register
| * 704a423c driver core: Fix test_async_probe_init saves device in wrong array
| * 216f35db w1: fix WARNING after calling w1_process()
| * 8e5be0ae w1: fix deadloop in __w1_remove_master_device()
| * ddf16dae tcp: avoid the lookup process failing to get sk in ehash table
| * 5f10f7ef nvme-pci: fix timeout request state check
| * 98519ed6 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
| * 28fc6095 HID: betop: check shape of output reports
| * 16791d5a l2tp: prevent lockdep issue in l2tp_tunnel_register()
| * f96b2f69 net: macb: fix PTP TX timestamp failure due to packet padding
| * 42ecd72f dmaengine: Fix double increment of client_count in dma_chan_get()
| * 1e97e2e0 drm/panfrost: fix GENERIC_ATOMIC64 dependency
| * 31f63c62 net: mlx5: eliminate anonymous module_init & module_exit
| * 4b3b5cc1 usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
| * 6dd9ea05 usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
| * 55be77aa HID: revert CHERRY_MOUSE_000C quirk
| * 34f11949 net: stmmac: fix invalid call to mdiobus_get_phy()
| * 20fd4598 HID: check empty report_list in bigben_probe()
| * 5dc3469a HID: check empty report_list in hid_validate_values()
| * 4bc5f1f6 net: mdio: validate parameter addr in mdiobus_get_phy()
| * 67866b1e net: usb: sr9700: Handle negative len
| * 2d77e5c0 l2tp: close all race conditions in l2tp_tunnel_register()
| * 76c640d6 l2tp: convert l2tp_tunnel_list to idr
| * 5b209b8c l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
| * e34a965f l2tp: Serialize access to sk_user_data with sk_callback_lock
| * c60fe700 net/sched: sch_taprio: fix possible use-after-free
| * 802fd762 wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
| * 1af8071b gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
| * 613020d0 net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
| * ad1baab3 net: nfc: Fix use-after-free in local_cleanup()
| * 2a0156a4 phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
| * da75dec7 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
| * f351af45 amd-xgbe: Delay AN timeout during KR training
| * a65a8727 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
| * aa8b584c ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
| * fa566549 phy: ti: fix Kconfig warning and operator precedence
| * b1849013 PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
| * 39ab0fc4 affs: initialize fsdata in affs_truncate()
| * f6fa12fb IB/hfi1: Remove user expected buffer invalidate race
| * 6ce4382b IB/hfi1: Immediately remove invalid memory from hardware
| * 6dd8136f IB/hfi1: Fix expected receive setup error exit issues
| * ee474dd6 IB/hfi1: Reserve user expected TIDs
| * 73e5666b IB/hfi1: Reject a zero-length user expected buffer
| * d66c1d41 RDMA/core: Fix ib block iterator counter overflow
| * eab7a920 tomoyo: fix broken dependency on *.conf.default
| * 6813d8ba firmware: arm_scmi: Harden shared memory access in fetch_notification
| * e85df1db firmware: arm_scmi: Harden shared memory access in fetch_response
| * 329fbd26 EDAC/highbank: Fix memory leak in highbank_mc_probe()
| * 7b4516ba HID: intel_ish-hid: Add check for ishtp_dma_tx_map
| * d775671d ARM: imx: add missing of_node_put()
| * 5c1dcedd arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux
| * cccb0aea ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
| * 6805e392 ARM: dts: imx7d-pico: Use 'clock-frequency'
| * 2a3c3a01 ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency'
| * e57ea0c6 memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
| * 53f55d6e memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
| * 935ec78d clk: Provide new devm_clk helpers for prepared and enabled clocks
| * 0b8b21c0 clk: generalize devm_clk_get() a bit
* | 0b80f187 Revert "xhci: Add update_hub_device override for PCI xHCI hosts"
* | 9688a3b5 Revert "xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables"
* | 7cbaeac2 Revert "xhci: Add a flag to disable USB3 lpm on a xhci root port level."
* | c9d0f306 Merge 5.10.165 into android13-5.10-lts
|\|
| * 179624a5 Linux 5.10.165
| * e699cce2 io_uring/rw: remove leftover debug statement
| * 3d5f181b io_uring/rw: ensure kiocb_end_write() is always called
| * c1a279d7 io_uring: fix double poll leak on repolling
| * ddaaadf2 io_uring: Clean up a false-positive warning from GCC 9.3.0
| * 8bc72b49 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
| * 217721b7 Bluetooth: hci_qca: Fixed issue during suspend
| * c208f1e8 Bluetooth: hci_qca: check for SSR triggered flag while suspend
| * ef11bc4b Bluetooth: hci_qca: Wait for SSR completion during suspend
| * c392c350 soc: qcom: apr: Make qcom,protection-domain optional again
| * 71e5cd10 Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
| * be106742 net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
| * f6c201b4 net/ulp: use consistent error code when blocking ULP
| * fc249156 io_uring/net: fix fast_iov assignment in io_setup_async_msg()
| * 89a77271 io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
| * c6e3c12f tracing: Use alignof__(struct {type b;}) instead of offsetof()
| * 03ba86bb x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
| * 2f45b20c Revert "drm/amdgpu: make display pinning more flexible (v2)"
| * d6544bcc efi: rt-wrapper: Add missing include
| * 4012603c arm64: efi: Execute runtime services from a dedicated stack
| * bf1d287c drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
| * 75105d94 drm/amd/display: Calculate output_color_space after pixel encoding adjustment
| * a3ef5324 drm/amd/display: Fix set scaling doesn's work
| * 59590f50 drm/i915: re-disable RC6p on Sandy Bridge
| * d960fff8 mei: me: add meteor lake point M DID
| * ae2a9dcc gsmi: fix null-deref in gsmi_get_variable
| * a75e80d1 serial: atmel: fix incorrect baudrate setup
| * 5a7a0407 dmaengine: tegra210-adma: fix global intr clear
| * c9da2cb9 serial: pch_uart: Pass correct sg to dma_unmap_sg()
| * e924f79e dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
| * 31132df1 dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
| * a9f2658a usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
| * e92c7005 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
| * 06600ae7 usb: gadget: g_webcam: Send color matching descriptor per frame
| * 6107a8f1 usb: typec: altmodes/displayport: Fix pin assignment calculation
| * d26f38d1 usb: typec: altmodes/displayport: Add pin assignment helper
| * 9c58f1e9 usb: host: ehci-fsl: Fix module alias
| * 3dc896db USB: serial: cp210x: add SCALANCE LPE-9000 device id
| * 856e4b5e USB: gadgetfs: Fix race between mounting and unmounting
| * 89468168 tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
| * c4ab24e3 thunderbolt: Use correct function to calculate maximum USB3 link rate
| * 531268a8 cifs: do not include page data when checking signature
| * 3bd43374 btrfs: fix race between quota rescan and disable leading to NULL pointer deref
| * 6ee8feca mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
| * 79819909 mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
| * 2eed2376 comedi: adv_pci1760: Fix PWM instruction handling
| * 7efeed82 usb: core: hub: disable autosuspend for TI TUSB8041
| * b171d0d2 misc: fastrpc: Fix use-after-free race condition for maps
| * 193cd853 misc: fastrpc: Don't remove map on creater_process and device_release
| * e0db5d44 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
| * 20d0dedc staging: vchiq_arm: fix enum vchiq_status return types
| * a06e9ec5 USB: serial: option: add Quectel EM05CN modem
| * 2f44c60b USB: serial: option: add Quectel EM05CN (SG) modem
| * fcd49b23 USB: serial: option: add Quectel EC200U modem
| * 21c5b618 USB: serial: option: add Quectel EM05-G (RS) modem
| * 46b898f9 USB: serial: option: add Quectel EM05-G (CS) modem
| * 3774654f USB: serial: option: add Quectel EM05-G (GR) modem
| * 9f8e4572 prlimit: do_prlimit needs to have a speculation check
| * 96562a23 xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
| * 2551f8cb usb: acpi: add helper to check port lpm capability using acpi _DSM
| * 4d70a8a9 xhci: Add a flag to disable USB3 lpm on a xhci root port level.
| * 83e3a5be xhci: Add update_hub_device override for PCI xHCI hosts
| * 08110521 xhci: Fix null pointer dereference when host dies
| * 66fc1600 usb: xhci: Check endpoint is valid before dereferencing it
| * 8ca60d59 xhci-pci: set the dma max_seg_size
| * ea2e6286 io_uring/rw: defer fsnotify calls to task context
| * e90cfb96 io_uring: do not recalculate ppos unnecessarily
| * ea528eca io_uring: update kiocb->ki_pos at execution time
| * 076f8723 io_uring: remove duplicated calls to io_kiocb_ppos
| * e9c65567 io_uring: ensure that cached task references are always put on exit
| * e0140e9d io_uring: fix CQ waiting timeout handling
| * de77faee io_uring: lock overflowing for IOPOLL
| * 78e8151f io_uring: check for valid register opcode earlier
| * aa4c9b3e io_uring: fix async accept on O_NONBLOCK sockets
| * 4bc17e63 io_uring: allow re-poll if we made progress
| * f901b4bf io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
| * 96ccba4a io_uring: add flag for disabling provided buffer recycling
| * aadd9b09 io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
| * abdc16c8 io_uring: improve send/recv error handling
| * 2fd232bb io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
| * e84ec6e2 Bluetooth: hci_qca: Fix driver shutdown on closed serdev
| * 1ab00983 Bluetooth: hci_qca: Wait for timeout during suspend
| * 413638f6 drm/i915/gt: Reset twice
| * cab21235 ALSA: hda/realtek - Turn on power early
| * 5822baf9 efi: fix userspace infinite retry read efivars after EFI runtime services page fault
| * 712bd74e nilfs2: fix general protection fault in nilfs_btree_insert()
| * 03bf73e0 zonefs: Detect append writes at invalid locations
| * 20d0a6d1 Add exception protection processing for vd in axi_chan_handle_err function
| * 187523fa wifi: mac80211: sdata can be NULL during AMPDU start
| * 2d1fd99e wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
| * 72009139 f2fs: let's avoid panic if extent_tree is not created
| * bf6c7f18 x86/asm: Fix an assembler warning with current binutils
| * 18bd1c9c btrfs: always report error in run_one_delayed_ref()
| * 936b8b15 RDMA/srp: Move large values to a new enum for gcc13
| * 0040e484 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
| * f7845de2 tools/virtio: initialize spinlocks in vring_test.c
| * 30930271 selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
| * c7c36bb6 pNFS/filelayout: Fix coalescing test for single DS
| * 2cbd8159 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
* | ea147af0 Revert "xhci: Prevent infinite loop in transaction errors recovery for streams"
* | a89e24a9 Merge 5.10.164 into android13-5.10-lts
|\|
| * 3a9f1b90 Linux 5.10.164
| * 74985c57 Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
| * a88a0d16 io_uring/io-wq: only free worker if it was allocated for creation
| * b912ed13 io_uring/io-wq: free worker if task_work creation is canceled
| * 68bcd063 drm/virtio: Fix GEM handle creation UAF
| * 4ca71bc0 efi: fix NULL-deref in init error path
| * 057f5ddf arm64: cmpxchg_double*: hazard against entire exchange variable
| * 9a5fd084 arm64: atomics: remove LL/SC trampolines
| * 28840e46 arm64: atomics: format whitespace consistently
| * 5dac4c72 x86/resctrl: Fix task CLOSID/RMID update race
| * 446c7251 x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI
| * 196c6f0c KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
| * 0027164b Documentation: KVM: add API issues section
| * caaea2ab iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
| * cf38e762 iommu/mediatek-v1: Add error handle for mtk_iommu_probe
| * 60806adc mm: Always release pages to the buddy allocator in memblock_free_late().
| * 092f0c2d net/mlx5e: Don't support encap rules with gbp option
| * b3d47227 net/mlx5: Fix ptp max frequency adjustment range
| * 453277fe net/sched: act_mpls: Fix warning during failed attribute validation
| * 0ca78c99 nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
| * 92b30a27 hvc/xen: lock console list traversal
| * 14e72a56 octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
| * 8e2bfcfa octeontx2-af: Map NIX block from CGX connection
| * d9be5b57 octeontx2-af: Update get/set resource count functions
| * 0d0675bc tipc: fix unexpected link reset due to discovery messages
| * d83cac6c ASoC: wm8904: fix wrong outputs volume after power reactivation
| * d4aa749e regulator: da9211: Use irq handler when ready
| * 3ca8ef4d EDAC/device: Fix period calculation in edac_device_reset_delay_period()
| * 28b9a0e2 x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
| * 8cbeb603 powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
| * 4e6a70fd netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
| * a3a1114a xfrm: fix rcu lock in xfrm_notify_userpolicy()
| * 091f85db ext4: fix uninititialized value in 'ext4_evict_inode'
| * 98407a4a usb: ulpi: defer ulpi_register on ulpi_read_id timeout
| * 3d13818a xhci: Prevent infinite loop in transaction errors recovery for streams
| * 2f90fced xhci: move and rename xhci_cleanup_halted_endpoint()
| * cad965ce xhci: store TD status in the td struct instead of passing it along
| * 9b63a80c xhci: move xhci_td_cleanup so it can be called by more functions
| * 44c635c6 xhci: Add xhci_reset_halted_ep() helper function
| * 10287d18 xhci: adjust parameters passed to cleanup_halted_endpoint()
| * aaaa7cc4 xhci: get isochronous ring directly from endpoint structure
| * a81ace06 xhci: Avoid parsing transfer events several times
| * ba20d605 clk: imx: imx8mp: add shared clk gate for usb suspend clk
| * 2b331d21 dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
| * cb769960 clk: imx8mp: add clkout1/2 support
| * 85eaaa17 clk: imx8mp: Add DISP2 pixel clock
| * 6b210771 iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
| * 5badda81 iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
| * ab9bb65b bus: mhi: host: Fix race between channel preparation and M0 event
| * 6c9e2c11 ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
| * 112df4cd ixgbe: fix pci device refcount leak
| * f401062d platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
| * 785607e5 drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
| * 8c71777b drm/msm/adreno: Make adreno quirks not overwrite each other
| * afb6063a cifs: Fix uninitialized memory read for smb311 posix symlink create
| * 51dbedee s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
| * bddb3552 s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
| * 2adc64f3 ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
| * 5ee30833 s390/kexec: fix ipl report address for kdump
| * d1725dbf perf auxtrace: Fix address filter duplicate symbol selection
| * eaabceae docs: Fix the docs build with Sphinx 6.0
| * 38c4a17c efi: tpm: Avoid READ_ONCE() for accessing the event log
| * c4788310 KVM: arm64: Fix S1PTW handling on RO memslots
| * 443b390f ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
| * 550efeff netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
* | b7fd44c7 ANDROID: add __dev_kfree_skb_irq to virtual_device abi list
* | ee62ce0f Revert "ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire"
* | d317ff54 Revert "ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio"
* | 4305bea1 Revert "net: add atomic_long_t to net_device_stats fields"
* | d225424b Revert "PM/devfreq: governor: Add a private governor_data for governor"
* | 73cf3a70 UPSTREAM: ACPI: thermal: drop an always true check
* | 46fa5e23 Merge 5.10.163 into android13-5.10-lts
|\|
| * 19ff2d64 Linux 5.10.163
| * de4a20e1 ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
| * 0ad275c1 ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
| * df02234e ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
| * f8ed0a93 net/ulp: prevent ULP without clone op from entering the LISTEN status
| * 9f7bc28a net: sched: disallow noqueue for qdisc classes
| * 6eb02c59 mptcp: use proper req destructor for IPv6
| * f4c7afa9 mptcp: dedicated request sock for subflow in v6
| * 31472f94 mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
| * 5aa15a84 mptcp: mark ops structures as ro_after_init
| * f5ef2627 serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
| * 2ecf0819 fsl_lpuart: Don't enable interrupts too early
| * 23ad0347 ext4: don't set up encryption key during jbd2 transaction
| * d9ff5ad2 ext4: disable fast-commit of encrypted dir operations
| * 5b700b9c parisc: Align parisc MADV_XXX constants with all other architectures
| * 07b3672c io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
| * b57d7b1d efi: random: combine bootloader provided RNG seed with RNG protocol output
| * da20f56a mbcache: Avoid nesting of cache->c_list_lock under bit locks
| * be01f35e hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
| * 1f881d92 hfs/hfsplus: use WARN_ON for sanity check
| * 434909ed selftests: set the BUILD variable to absolute path
| * a41d63f2 ext4: don't allow journal inode to have encrypt flag
| * af90f8b3 drm/i915/gvt: fix vgpu debugfs clean in remove
| * bb7c7b2c drm/i915/gvt: fix gvt debugfs destroy
| * bc847857 riscv: uaccess: fix type of 0 variable on error in get_user()
| * f64e56fb fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
| * d0c46b55 nfsd: fix handling of readdir in v4root vs. mount upcall timeout
| * 67e39c4f x86/bugs: Flush IBP in ib_prctl_set()
| * f13301a6 nvme: fix multipath crash caused by flush request when blktrace is enabled
| * 3f257a98 ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
| * 6df376e2 udf: Fix extension of the last extent in the file
| * 84b2cc7b caif: fix memory leak in cfctrl_linkup_request()
| * e5a05837 drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
| * 232ef345 usb: rndis_host: Secure rndis_query check against int overflow
| * 2a9ee7c2 drivers/net/bonding/bond_3ad: return when there's no aggregator
| * bc6a0993 perf tools: Fix resources leak in perf_data__open_dir()
| * ee756980 netfilter: ipset: Rework long task execution when adding/deleting entries
| * ba5d2790 netfilter: ipset: fix hash:net,port,net hang with /0 subnet
| * b2c917e5 net: sched: cbq: dont intepret cls results when asked to drop
| * 5f65f485 net: sched: atm: dont intepret cls results when asked to drop
| * f4a2ad10 gpio: sifive: Fix refcount leak in sifive_gpio_probe
| * 7ec369e2 ceph: switch to vfs_inode_has_locks() to fix file lock bug
| * 40771042 filelock: new helper: vfs_inode_has_locks
| * 9f0ff5de drm/meson: Reduce the FIFO lines held when AFBC is not used
| * ae2639cd RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
| * 106d0d33 net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
| * 398e14bb net: amd-xgbe: add missed tasklet_kill
| * e3d90ca9 net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
| * 6d655a9d net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
| * 670b2061 net/mlx5: Avoid recovery in probe flows
| * 66b92b80 net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
| * b6c74d23 vhost: fix range used in translate_desc()
| * 264fb6dc vringh: fix range used in iotlb_translate()
| * eabb3ceb vhost/vsock: Fix error handling in vhost_vsock_init()
| * e0f5c962 nfc: Fix potential resource leaks
| * 513787ff qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
| * b314f6c3 net: sched: fix memory leak in tcindex_set_parms
| * 4226ce95 net: hns3: add interrupts re-initialization while doing VF FLR
| * 998ebbdc nfsd: shut down the NFSv4 state objects before the filecache
| * 69d896b6 veth: Fix race with AF_XDP exposing old or uninitialized descriptors
| * 5f41212d vmxnet3: correctly report csum_level for encapsulated packet
| * 0b70f6ea drm/panfrost: Fix GEM handle creation ref-counting
| * e68e088d bpf: pull before calling skb_postpull_rcsum()
| * cb0d627b SUNRPC: ensure the matching upcall is in-flight upon downcall
| * 1be16a0c ext4: fix deadlock due to mbcache entry corruption
| * 0da99012 mbcache: automatically delete entries from cache on freeing
| * 1a56cd97 ext4: fix race when reusing xattr blocks
| * 4cc218e2 ext4: unindent codeblock in ext4_xattr_block_set()
| * 0e6fbc56 ext4: remove EA inode entry from mbcache on inode eviction
| * 27c08673 mbcache: add functions to delete entry if unused
| * fb59d12a mbcache: don't reclaim used entries
| * 4c363e29 ext4: use kmemdup() to replace kmalloc + memcpy
| * b8b79223 ext4: fix leaking uninitialized memory in fast-commit journal
| * a5584ba9 ext4: fix various seppling typos
| * adfefe80 ext4: simplify ext4 error translation
| * 95eaa8a9 ext4: move functions in super.c
| * 769469f8 fs: ext4: initialize fsdata in pagecache_write()
| * b33e42d6 ext4: use memcpy_to_page() in pagecache_write()
| * 60d4383c mm/highmem: Lift memcpy_[to|from]_page to core
| * f86d3338 ext4: correct inconsistent error msg in nojournal mode
| * 99017eb3 ext4: goto right label 'failed_mount3a'
| * 56d87959 riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
| * ecb8e8b2 riscv/stacktrace: Fix stack output without ra on the stack top
| * b5c75efd ravb: Fix "failed to switch device to config mode" message during unbind
| * 5451efb2 staging: media: tegra-video: fix device_node use after free
| * f899baf6 x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
| * 5d112deb x86/kprobes: Convert to insn_decode()
| * a1766efc perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
| * b5d0f7c2 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
| * c0a3d215 media: s5p-mfc: Fix in register read and write for H264
| * 8ff64edf media: s5p-mfc: Clear workbit to handle error condition
| * dcd1a4ad media: s5p-mfc: Fix to handle reference queue during finishing
| * 97e78960 x86/MCE/AMD: Clear DFR errors found in THR handler
| * ec75bc43 x86/mce: Get rid of msr_ops
| * 58de7a95 btrfs: replace strncpy() with strscpy()
| * 7a04f850 perf/x86/intel/uncore: Clear attr_update properly
| * 53d24a95 perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure
| * 9620f8a5 ARM: renumber bits related to _TIF_WORK_MASK
| * 63027097 drm/amdgpu: make display pinning more flexible (v2)
| * dfc01905 drm/amdgpu: handle polaris10/11 overlap asics (v2)
| * 30e95fdc ext4: allocate extended attribute value in vmalloc area
| * 8d3e87d4 ext4: avoid unaccounted block allocation when expanding inode
| * 15d0cf84 ext4: initialize quota before expanding inode in setproject ioctl
| * 9882601e ext4: fix inode leak in ext4_xattr_inode_create() on an error path
| * 407f4772 ext4: avoid BUG_ON when creating xattrs
| * 00092b21 ext4: fix error code return to user-space in ext4_get_branch()
| * f06c9802 ext4: fix corruption when online resizing a 1K bigalloc fs
| * 9404839e ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
| * 84a2f2ed ext4: init quota for 'old.inode' in 'ext4_rename'
| * 71e99ec1 ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
| * 9020f56a ext4: check and assert if marking an no_delete evicting inode dirty
| * 86c2a2ec ext4: fix reserved cluster accounting in __es_remove_extent()
| * 98004f92 ext4: fix bug_on in __es_tree_search caused by bad quota inode
| * 20af6661 ext4: add helper to check quota inums
| * c0a73887 ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
| * f9cd6980 ext4: fix undefined behavior in bit shift for ext4_check_flag_values
| * 7223d5e7 ext4: fix use-after-free in ext4_orphan_cleanup
| * d6d18d6e ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
| * bdc698ce ext4: silence the warning when evicting inode with dioread_nolock
| * 68af1a48 drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
| * bf83a303 drm/i915/dsi: fix VBT send packet port selection for dual link DSI
| * 439cbbc1 drm/vmwgfx: Validate the box size for the snooped cursor
| * 0a0662d5 drm/connector: send hotplug uevent on connector cleanup
| * 21a773ec device_cgroup: Roll back to original exceptions after copy failure
| * 3505c187 parisc: led: Fix potential null-ptr-deref in start_task()
| * 2c7c487c remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
| * e291dea7 iommu/amd: Fix ivrs_acpihid cmdline parsing code
| * 28e71fd8 driver core: Fix bus_type.match() error handling in __driver_attach()
| * 772dbbfc crypto: n2 - add missing hash statesize
| * 7c442057 PCI/sysfs: Fix double free in error path
| * 99ef6cc7 PCI: Fix pci_device_is_present() for VFs by checking PF
| * f29d127b ipmi: fix use after free in _ipmi_destroy_user()
| * bfe1e039 ima: Fix a potential NULL pointer access in ima_restore_measurement_list
| * 62307558 mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
| * 4e17819c ipmi: fix long wait in unload when IPMI disconnect
| * 24bc27ea ASoC: jz4740-i2s: Handle independent FIFO flush bits
| * 652f1d66 wifi: wilc1000: sdio: fix module autoloading
| * d9f6614a efi: Add iMac Pro 2017 to uefi skip cert quirk
| * ffcf7167 md/bitmap: Fix bitmap chunk size overflow issues
| * e9444325 rtc: ds1347: fix value written to century register
| * 6155aed4 cifs: fix missing display of three mount options
| * 8c82733e cifs: fix confusing debug message
| * 3df07728 media: dvb-core: Fix UAF due to refcount races at releasing
| * 7dd5a68c media: dvb-core: Fix double free in dvb_register_device()
| * 1032520b ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
| * 13066144 staging: media: tegra-video: fix chan->mipi value on error
| * 52c0622e tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
| * b838b1b9 tracing/hist: Fix wrong return value in parse_action_params()
| * ff3dd2c1 x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
| * 362495bf ftrace/x86: Add back ftrace_expected for ftrace bug reports
| * b677629c x86/microcode/intel: Do not retry microcode reloading on the APs
| * 43dd2548 KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
| * e61eacf9 perf/core: Call LSM hook after copying perf_event_attr
| * 0cb31bd8 tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
| * 18a489a3 dm cache: set needs_check flag after aborting metadata
| * 2b170266 dm cache: Fix UAF in destroy()
| * 342cfd84 dm clone: Fix UAF in clone_dtr()
| * a506b5c9 dm integrity: Fix UAF in dm_integrity_dtr()
| * 34fe9c22 dm thin: Fix UAF in run_timer_softirq()
| * c84d1ca2 dm thin: resume even if in FAIL mode
| * 94f01ecc dm thin: Use last transaction's pmd->root when commit failed
| * 7e375780 dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
| * b45e77b7 dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
| * d9fa243a ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
| * 2437b062 ALSA: patch_realtek: Fix Dell Inspiron Plus 16
| * e379b88a cpufreq: Init completion before kobject_init_and_add()
| * cea018aa PM/devfreq: governor: Add a private governor_data for governor
| * d1d73c30 selftests: Use optional USERCFLAGS and USERLDFLAGS
| * 12576d2e arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
| * 8546f11c ARM: ux500: do not directly dereference __iomem
| * 0061ab51 btrfs: fix resolving backrefs for inline extent followed by prealloc
| * c0aa6e6a mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
| * e918762f arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
| * c023597b jbd2: use the correct print format
| * 8c444b30 ktest.pl minconfig: Unset configs instead of just removing them
| * 5148dfce kest.pl: Fix grub2 menu handling for rebooting
| * 780297af soc: qcom: Select REMAP_MMIO for LLCC driver
| * d5db9aaf media: stv0288: use explicitly signed char
| * 25dbd873 net/af_packet: make sure to pull mac header
| * c2137d56 net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
| * 7c15d7ec rcu: Prevent lockdep-RCU splats on lock acquisition/release
| * 4c57f612 torture: Exclude "NOHZ tick-stop error" from fatal errors
| * 289f512d wifi: rtlwifi: 8192de: correct checking of IQK reload
| * 0f6d6974 wifi: rtlwifi: remove always-true condition pointed out by GCC 12
| * 40b84479 net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
| * 8b20aab8 ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
| * 185c1419 ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
| * 7b3631a2 kcsan: Instrument memcpy/memset/memmove with newer Clang
| * 2cd6026e SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
| * 3b6c8222 tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
| * 0bd9b4be tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
| * 8ddc4806 tpm: acpi: Call acpi_put_table() to fix memory leak
| * b51d5fed mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
| * 252a7208 f2fs: should put a page when checking the summary info
| * 882734bb mm, compaction: fix fast_isolate_around() to stay within boundaries
| * ae779302 md: fix a crash in mempool_free
| * b591b291 pnode: terminate at peers of source
| * 66f359ad ALSA: line6: fix stack overflow in line6_midi_transmit
| * 5e79f77e ALSA: line6: correct midi status byte when receiving data from podxt
| * 56abf804 ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
| * c3e8bbcb binfmt: Fix error return code in load_elf_fdpic_binary()
| * 12407462 hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
| * 44cf5058 pstore/zone: Use GFP_ATOMIC to allocate zone buffer
| * 0d992c04 HID: plantronics: Additional PIDs for double volume key presses quirk
| * eaf0b782 HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
| * 6f7e2fca powerpc/rtas: avoid scheduling in rtas_os_term()
| * f2167f10 powerpc/rtas: avoid device tree lookups in rtas_os_term()
| * 0af0e115 objtool: Fix SEGFAULT
| * 57ae492f nvmet: don't defer passthrough commands with trivial effects to the workqueue
| * 4b3282a9 nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
| * ab711f3e ata: ahci: Fix PCS quirk application for suspend
| * cc512539 nvme-pci: fix page size checks
| * dfb6d548 nvme-pci: fix mempool alloc size
| * f5d8738f nvme-pci: fix doorbell buffer value endianness
| * fe6ea044 cifs: fix oops during encryption
| * f9089b95 usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
| * ce2462bc pwm: tegra: Fix 32 bit build
| * a8be7c27 media: dvbdev: fix refcnt bug
| * 15331967 media: dvbdev: fix build warning due to comments
| * 740c537f ovl: fix use inode directly in rcu-walk mode
| * f24474d1 gcov: add support for checksum field
| * 36be7afc regulator: core: fix deadlock on regulator enable
| * e12f4c32 iio: adc128s052: add proper .data members in adc128_of_match table
| * 9f604702 iio: adc: ad_sigma_delta: do not use internal iio_dev lock
| * 582f5fc2 reiserfs: Add missing calls to reiserfs_security_free()
| * 08371068 HID: mcp2221: don't connect hidraw
| * 7a203471 HID: wacom: Ensure bootloader PID is usable in hidraw mode
| * 723ffde7 usb: dwc3: core: defer probe on ulpi_read_id timeout
| * d17c82aa usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
| * 2b725b6f ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
| * c863b673 ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
| * d3767082 ALSA: usb-audio: add the quirk for KT0206 device
| * 7691fa41 ima: Simplify ima_lsm_copy_rule
| * 1d8dcc3d pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
| * 07b0ce90 afs: Fix lost servers_outstanding count
| * 1080729b perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
| * 1c7b03d0 pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
| * c3607ed7 LoadPin: Ignore the "contents" argument of the LSM hooks
| * 4138e1b7 ASoC: rt5670: Remove unbalanced pm_runtime_put()
| * fd49dc17 ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
| * c0ae4669 ASoC: wm8994: Fix potential deadlock
| * e4a8573b ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
| * 06c9d468 ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
| * 812a18e4 ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
| * c2eb1a38 ASoC: Intel: Skylake: Fix driver hang during shutdown
| * 72c0e552 ALSA: hda: add snd_hdac_stop_streams() helper
| * d3a8925d ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
| * 2727dbfe hwmon: (jc42) Fix missing unlock on error in jc42_write()
| * a076490b orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
| * b8affa0c orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
| * 6e3c4d3f drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
| * f3d3f356 drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
| * dcd28191 hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
| * efd025f3 clk: st: Fix memory leak in st_of_quadfs_setup()
| * 1c6447d0 media: si470x: Fix use-after-free in si470x_int_in_callback()
| * a63a1ae1 mmc: renesas_sdhi: better reset from HS400 mode
| * 58e21146 mmc: f-sdh30: Add quirks for broken timeout clock capability
| * 4b737246 regulator: core: fix use_count leakage when handling boot-on
| * 17c2eb9c libbpf: Avoid enum forward-declarations in public API in C++ mode
| * e8022da1 blk-mq: fix possible memleak when register 'hctx' failed
| * 7d7ab25e media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
| * 2abd7343 media: dvbdev: adopts refcnt to avoid UAF
| * b42580c8 media: dvb-frontends: fix leak of memory fw
| * dd1e1bf9 ethtool: avoiding integer overflow in ethtool_phys_id()
| * 329a7663 bpf: Prevent decl_tag from being referenced in func_proto arg
| * 148dcbd3 ppp: associate skb with a device at tx
| * 755eb087 mrp: introduce active flags to prevent UAF when applicant uninit
| * 037db10e net: add atomic_long_t to net_device_stats fields
| * e2d60023 drm/amd/display: fix array index out of bound error in bios parser
| * 10d71353 md/raid1: stop mdx_raid1 thread when raid1 array run failed
| * 100caacf drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
| * 7d86851c drm/sti: Use drm_mode_copy()
| * dd31d730 drm/rockchip: Use drm_mode_copy()
| * 4f238212 drm/msm: Use drm_mode_copy()
| * ebc3c777 s390/lcs: Fix return type of lcs_start_xmit()
| * 3ac0217c s390/netiucv: Fix return type of netiucv_tx()
| * eeb75f80 s390/ctcm: Fix return type of ctc{mp,}m_tx()
| * 9606bbc2 drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
| * a42a23bd drm/amdgpu: Fix type of second parameter in trans_msg() callback
| * 3cb18dea igb: Do not free q_vector unless new one was allocated
| * 87792567 wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
| * e7aa8a47 hamradio: baycom_epp: Fix return type of baycom_send_packet()
| * 5b0b6553 net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
| * 6d935a02 bpf: make sure skb->len != 0 when redirecting to a tunneling device
| * ebc2fb6a qed (gcc13): use u16 for fid to be big enough
| * 648cdb8b drm/amd/display: prevent memory leak
| * c69bc8e3 ipmi: fix memleak when unload ipmi driver
| * be4cd23c ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
| * 8af52492 wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
| * 1824ccab wifi: ath9k: verify the expected usb_endpoints are present
| * 2e8bb402 brcmfmac: return error when getting invalid max_flowrings from dongle
| * 6cd4865b drm/etnaviv: add missing quirks for GC300
| * 4fd3a118 hfs: fix OOB Read in __hfs_brec_find
| * 6edd0cde acct: fix potential integer overflow in encode_comp_t()
| * ec93b543 nilfs2: fix shift-out-of-bounds due to too large exponent of block size
| * d464b035 nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
| * b0b83d3f ACPICA: Fix error code path in acpi_ds_call_control_method()
| * 911999b1 fs: jfs: fix shift-out-of-bounds in dbDiscardAG
| * 40dba68d udf: Avoid double brelse() in udf_rename()
| * 3e997e4c fs: jfs: fix shift-out-of-bounds in dbAllocAG
| * dcbc51d3 binfmt_misc: fix shift-out-of-bounds in check_special_flags
| * 22c1d8f2 x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
| * 9b267051 video: hyperv_fb: Avoid taking busy spinlock on panic path
| * 0461a8c2 arm64: make is_ttbrX_addr() noinstr-safe
| * 5a52380b rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
| * 90624938 net: stream: purge sk_error_queue in sk_stream_kill_queues()
| * 7c3a20bf myri10ge: Fix an error handling path in myri10ge_probe()
| * 3c973736 rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
| * 5c544c7c net_sched: reject TCF_EM_SIMPLE case for complex ematch module
| * a39b4de0 mailbox: zynq-ipi: fix error handling while device_register() fails
| * 821be5a5 skbuff: Account for tail adjustment during pull operations
| * 6736b61e openvswitch: Fix flow lookup to use unmasked key
| * ea142200 selftests: devlink: fix the fd redirect in dummy_reporter_test
| * 57ce1a36 rtc: mxc_v2: Add missing clk_disable_unprepare()
| * 1e2a27da igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
| * edb995b5 igc: Lift TAPRIO schedule restriction
| * b48d3db8 igc: recalculate Qbv end_time by considering cycle time
| * 3f2a944c igc: Add checking for basetime less than zero
| * a0e2295c igc: Use strict cycles for Qbv scheduling
| * 413fe824 igc: Enhance Qbv scheduling by using first flag bit
| * a8f9698a net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
| * ae5d96ba net: igc: use skb_csum_is_sctp instead of protocol check
| * 4794d07f net: add inline function skb_csum_is_sctp
| * 67349025 net: switch to storing KCOV handle directly in sk_buff
| * 3d5f83a6 r6040: Fix kmemleak in probe and remove
| * aea9e64d nfc: pn533: Clear nfc_target before being used
| * 6939f84e mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
| * b58c8719 mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
| * 30e0a066 mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
| * 2a930b75 net: macsec: fix net device access prior to holding a lock
| * c1207219 nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
| * 452e85cc NFSD: Remove spurious cb_setup_err tracepoint
| * 09c007e2 rtc: pcf85063: fix pcf85063_clkout_control
| * e9453c13 rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
| * 34836c59 rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
| * 8e65e707 netfilter: flowtable: really fix NAT IPv6 offload
| * 1f5571cb powerpc/pseries/eeh: use correct API for error log size
| * 9dc96fee powerpc/eeh: Drop redundant spinlock initialization
| * 12654b7d remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
| * be5816b2 remoteproc: qcom_q6v5_pas: detach power domains on remove
| * 582dd58a remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
| * e4539eb5 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
| * 6a65f464 pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
| * 57f215a2 iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
| * dc02d8e5 selftests/powerpc: Fix resource leaks
| * 464506de powerpc/hv-gpci: Fix hv_gpci event list
| * 0abfe735 powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
| * da1a3379 powerpc/perf: callchain validate kernel stack pointer bounds
| * 8d2ff5b3 kbuild: refactor single builds of *.ko
| * e3bdda22 kbuild: unify modules(_install) for in-tree and external modules
| * e2155129 kbuild: remove unneeded mkdir for external modules_install
| * 195cb988 powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
| * f0bd6504 powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
| * 76957b6a powerpc/xmon: Enable breakpoints on 8xx
| * 81c8bbf5 cxl: Fix refcount leak in cxl_calc_capp_routing
| * 40b4be39 powerpc/52xx: Fix a resource leak in an error handling path
| * 7fded04f macintosh/macio-adb: check the return value of ioremap()
| * 2ac0a705 macintosh: fix possible memory leak in macio_add_one_device()
| * 0d240ac0 iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
| * 03f51c72 iommu/amd: Fix pci device refcount leak in ppr_notifier()
| * 3929576f rtc: pcf85063: Fix reading alarm
| * aaed333e rtc: snvs: Allow a time difference on clock register read
| * f0c36ea4 rtc: cmos: Disable ACPI RTC event on removal
| * ca8cb20c rtc: cmos: Rename ACPI-related functions
| * 9f9923ba rtc: cmos: Eliminate forward declarations of some functions
| * 462db582 rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
| * 14ad1353 rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
| * 45b96601 rtc: cmos: fix build on non-ACPI platforms
| * f2ece2c7 rtc: cmos: Fix wake alarm breakage
| * 0bcfccb4 rtc: cmos: Fix event handler registration ordering issue
| * 5814d77e rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
| * 490b2336 dmaengine: idxd: Fix crc_val field for completion record
| * a42e9554 pwm: tegra: Improve required rate calculation
| * ddd2bb08 include/uapi/linux/swab: Fix potentially missing __always_inline
| * c2a98433 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
| * ca31ad09 iommu/sun50i: Fix flush size
| * 147af0c1 iommu/sun50i: Fix R/W permission check
| * 3a63c4ff iommu/sun50i: Consider all fault sources for reset
| * 160b92ab iommu/sun50i: Fix reset release
| * aeef9341 RDMA/siw: Fix pointer cast warning
| * 5beadb55 power: supply: fix null pointer dereferencing in power_supply_get_battery_info
| * 72283ecf HSI: omap_ssi_core: Fix error handling in ssi_init()
| * 73ca3b19 perf symbol: correction while adjusting symbol
| * c8e77bd7 perf trace: Handle failure when trace point folder is missed
| * bd29da58 perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
| * 6364577a perf trace: Return error if a system call doesn't exist
| * 1d6d9099 power: supply: fix residue sysfs file in error handle route of __power_supply_register()
| * ae2eb995 HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
| * 6ba4b00f HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
| * ee13e2ae fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
| * 164857bc fbdev: vermilion: decrease reference count in error path
| * 71bca42b fbdev: via: Fix error in via_core_init()
| * 3922415e fbdev: pm2fb: fix missing pci_disable_device()
| * f279a7af fbdev: ssd1307fb: Drop optional dependency
| * c56c1449 thermal/drivers/imx8mm_thermal: Validate temperature range
| * 86fa7bb4 samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
| * 962f869b tracing/hist: Fix issue of losting command info in error_log
| * b7bf15aa usb: storage: Add check for kcalloc
| * 9ac541a0 i2c: ismt: Fix an out-of-bounds bug in ismt_access()
| * 61df25c4 i2c: mux: reg: check return value after calling platform_get_resource()
| * 6d795466 gpiolib: cdev: fix NULL-pointer dereferences
| * aeee7ad0 gpiolib: Get rid of redundant 'else'
| * 37d3de40 vme: Fix error not catched in fake_init()
| * b9fa01fb staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
| * daa8045a staging: rtl8192u: Fix use after free in ieee80211_rx()
| * 46b3885c i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
| * c46db608 chardev: fix error handling in cdev_device_add()
| * 7b289b79 mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
| * 0d1c2c8d drivers: mcb: fix resource leak in mcb_probe()
| * e88b89a0 usb: gadget: f_hid: fix refcount leak on error path
| * 1b6a53e4 usb: gadget: f_hid: fix f_hidg lifetime vs cdev
| * 52302c30 usb: gadget: f_hid: optional SETUP/SET_REPORT mode
| * c3767f81 usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
| * 07905a92 counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
| * bb5e9402 iio: adis: add '__adis_enable_irq()' implementation
| * 3feb8fd8 iio:imu:adis: Move exports into IIO_ADISLIB namespace
| * 83e321a2 iio: adis: stylistic changes
| * d1b73eeb iio: adis: handle devices that cannot unmask the drdy pin
| * 8eb2a679 iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
| * 50aaa6b1 genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
| * 6b22e715 iio: temperature: ltc2983: make bulk write buffer DMA-safe
| * 0f63c0dd cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
| * 170e8c2d cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
| * d3474224 firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
| * 0f67ed56 misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
| * 57c85735 misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
| * a40e1b0a ocxl: fix pci device refcount leak when calling get_function_0()
| * 7525741c misc: ocxl: fix possible name leak in ocxl_file_register_afu()
| * 0b5a89e8 test_firmware: fix memory leak in test_firmware_init()
| * d7c4331c serial: sunsab: Fix error handling in sunsab_init()
| * a26b13d1 serial: altera_uart: fix locking in polling mode
| * 8ff88d00 tty: serial: altera_uart_{r,t}x_chars() need only uart_port
| * af320d1a tty: serial: clean up stop-tx part in altera_uart_tx_chars()
| * 07f4ca68 serial: pch: Fix PCI device refcount leak in pch_request_dma()
| * 46d08b0e serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
| * d5b16eb0 serial: amba-pl011: avoid SBSA UART accessing DMACR register
| * fab27438 usb: typec: tipd: Fix spurious fwnode_handle_put in error path
| * d3b6c28a usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
| * 1ca02df8 usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
| * 5d2b286e staging: vme_user: Fix possible UAF in tsi148_dma_list_add
| * 775a6f8b usb: fotg210-udc: Fix ages old endianness issues
| * 2fcb7c7d uio: uio_dmem_genirq: Fix deadlock between irq config and handling
| * 9bf7a0b2 uio: uio_dmem_genirq: Fix missing unlock in irq configuration
| * 27b612bd vfio: platform: Do not pass return buffer to ACPI _RST method
| * 18a72006 class: fix possible memory leak in __class_register()
| * 7e74868a serial: tegra: Read DMA status before terminating
| * fce9890e drivers: dio: fix possible memory leak in dio_init()
| * d2171413 IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
| * aa96aff3 hwrng: geode - Fix PCI device refcount leak
| * 5998e5c3 hwrng: amd - Fix PCI device refcount leak
| * 38da26c8 crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
| * 15ca1489 RDMA/hns: Fix page size cap from firmware
| * 83b2c33b RDMA/hns: Fix PBL page MTR find
| * 73ab1c95 orangefs: Fix sysfs not cleanup when dev init failed
| * 0c53bb66 RDMA/srp: Fix error return code in srp_parse_options()
| * 7cbf2fc2 RDMA/hfi1: Fix error return code in parse_platform_config()
| * 61c5b47c riscv/mm: add arch hook arch_clear_hugepage_flags
| * 09814c66 crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
| * 75c7b5d6 crypto: amlogic - Remove kcalloc without check
| * 357f3e17 RDMA/nldev: Fix failure to send large messages
| * 25a8daba f2fs: avoid victim selection from previous victim section
| * d1b85d28 RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
| * ad27f74e scsi: snic: Fix possible UAF in snic_tgt_create()
| * 22e8c7a5 scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
| * f4ba143b scsi: ipr: Fix WARNING in ipr_init()
| * b520a327 scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
| * 9d0ad1e2 scsi: fcoe: Fix possible name leak when device_register() fails
| * 2b142f60 scsi: scsi_debug: Fix a warning in resp_report_zones()
| * eaa71cda scsi: scsi_debug: Fix a warning in resp_verify()
| * ac5cfe8b scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
| * f671a3f2 scsi: hpsa: Fix error handling in hpsa_add_sas_host()
| * ce1a69cc scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
| * 7ccfc2bb padata: Fix list iterator in padata_do_serial()
| * 8e0681dd padata: Always leave BHs disabled when running ->parallel()
| * 4a99e6a1 crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
| * c808edbf scsi: hpsa: Fix possible memory leak in hpsa_init_one()
| * 6bb5a62b RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
| * 164fa803 RDMA/hns: fix memory leak in hns_roce_alloc_mr()
| * 3d47544b crypto: ccree - Make cc_debugfs_global_fini() available for module init function
| * 34bab85c RDMA/hfi: Decrease PCI device reference count in error path
| * d8f2a0bc PCI: Check for alloc failure in pci_request_irq()
| * 8b5f1af3 RDMA/hns: Fix ext_sge num error when post send
| * cc5e9153 RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
| * ed97ade6 crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
| * 2dfe1d22 crypto: cryptd - Use request context instead of stack for sub-request
| * 1ab9e15b crypto: ccree - Remove debugfs when platform_driver_register failed
| * 33260f4c scsi: scsi_debug: Fix a warning in resp_write_scat()
| * 917bf4c0 RDMA/siw: Set defined status for work completion with undefined status
| * 237a8936 RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
| * 75af03fd RDMA/siw: Fix immediate work request flush to completion queue
| * ef8e2368 f2fs: fix normal discard process
| * 9a32aa87 apparmor: Fix memleak in alloc_ns()
| * 417ef568 crypto: rockchip - rework by using crypto_engine
| * 6cd8bbb0 crypto: rockchip - delete unneeded variable initialization
| * de041a2e crypto: rockchip - remove non-aligned handling
| * 0971bc99 crypto: rockchip - better handle cipher key
| * b0b9635f crypto: rockchip - add fallback for ahash
| * fbd5f112 crypto: rockchip - add fallback for cipher
| * 86f1e7f4 crypto: rockchip - do not store mode globally
| * a13c0ff8 crypto: rockchip - do not do custom power management
| * f1acf7e6 f2fs: Fix the race condition of resize flag between resizefs
| * c42d8120 PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
| * 16db9aaa RDMA/core: Fix order of nldev_exit call
| * 9784b01e PCI: dwc: Fix n_fts[] array overrun
| * 6962f682 apparmor: Use pointer to struct aa_label for lbs_cred
| * f4c917a4 scsi: core: Fix a race between scsi_done() and scsi_timeout()
| * 3bebfa5f crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
| * ee3cffc3 crypto: sun8i-ss - use dma_addr instead u32
| * bf4d7c66 apparmor: Fix abi check to include v8 abi
| * 78629ca9 apparmor: fix lockdep warning when removing a namespace
| * 935d86b2 apparmor: fix a memleak in multi_transaction_new()
| * f694e627 stmmac: fix potential division by 0
| * 815b961c Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
| * 4002180e Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
| * 82256faa Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
| * 33af776a Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
| * 5991402f Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
| * 0169acb4 Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
| * f7dc2770 Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
| * 214346a5 sctp: sysctl: make extra pointers netns aware
| * 13286ad1 ntb_netdev: Use dev_kfree_skb_any() in interrupt context
| * 4df544f5 net: lan9303: Fix read error execution path
| * 39b48a92 can: tcan4x5x: Remove invalid write in clear_interrupts
| * 334c9fb8 net: amd-xgbe: Check only the minimum speed for active/passive cables
| * 03ea9ba5 net: amd-xgbe: Fix logic around active and passive cables
| * 8eb5f8ae net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
| * ee3b1364 hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
| * b242358a net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
| * decede59 net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
| * c43def06 net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
| * 0e232501 net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
| * 91f09a77 net/tunnel: wait until all sk_user_data reader finish before releasing the sock
| * 51e2d1b8 net: farsync: Fix kmemleak when rmmods farsync
| * 0b3f452d ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
| * 2b4af99b of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
| * 14b349a1 drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
| * 787d1bae net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
| * 8ed99944 net: defxx: Fix missing err handling in dfx_init()
| * e2227eee net: vmw_vsock: vmci: Check memcpy_from_msg()
| * 3e8fd1d0 clk: socfpga: Fix memory leak in socfpga_gate_init()
| * 4b672ee7 clk: socfpga: use clk_hw_register for a5/c5
| * ae8190f1 clk: socfpga: clk-pll: Remove unused variable 'rc'
| * 782d0444 blktrace: Fix output non-blktrace event when blk_classic option enabled
| * 2484f159 wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
| * f89c0fbb wifi: rtl8xxxu: Fix the channel width reporting
| * d4300372 wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
| * 7f3b4fa4 spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
| * da13355b clk: samsung: Fix memory leak in _samsung_clk_register_pll()
| * d9b37ea8 media: coda: Add check for kmalloc
| * 35ddd00b media: coda: Add check for dcoda_iram_alloc
| * 6fdb8661 media: c8sectpfe: Add of_node_put() when breaking out of loop
| * 0b1e96d3 mmc: mmci: fix return value check of mmc_add_host()
| * 1922def5 mmc: wbsd: fix return value check of mmc_add_host()
| * 63400da6 mmc: via-sdmmc: fix return value check of mmc_add_host()
| * 64b2c441 mmc: meson-gx: fix return value check of mmc_add_host()
| * fb3d5962 mmc: omap_hsmmc: fix return value check of mmc_add_host()
| * 00ac0f5f mmc: atmel-mci: fix return value check of mmc_add_host()
| * 9bedf64d mmc: wmt-sdmmc: fix return value check of mmc_add_host()
| * 3049a3b9 mmc: vub300: fix return value check of mmc_add_host()
| * aabbedcb mmc: toshsd: fix return value check of mmc_add_host()
| * 7fa922c7 mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
| * b896a9b7 mmc: pxamci: fix return value check of mmc_add_host()
| * 3904eb97 mmc: mxcmmc: fix return value check of mmc_add_host()
| * 7c3b301c mmc: moxart: fix return value check of mmc_add_host()
| * 4a6e5d02 mmc: alcor: fix return value check of mmc_add_host()
| * 81ea3d96 NFSv4.x: Fail client initialisation if state manager thread can't run
| * 3fbc3c78 SUNRPC: Fix missing release socket in rpc_sockname()
| * be7d90fc xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
| * 06491293 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
| * 7df1fbe4 media: saa7164: fix missing pci_disable_device()
| * 46a9b313 ALSA: pcm: Set missing stop_operating flag at undoing trigger start
| * be719496 bpf, sockmap: fix race in sock_map_free()
| * 8c3ef38a hwmon: (jc42) Restore the min/max/critical temperatures on resume
| * e7720ef5 hwmon: (jc42) Convert register access and caching to regmap/regcache
| * 6a03c31d regulator: core: fix resource leak in regulator_register()
| * 74ac7c9e configfs: fix possible memory leak in configfs_create_dir()
| * 0cf92d23 hsr: Synchronize sequence number updates.
| * c671f2d1 hsr: Synchronize sending frames to have always incremented outgoing seq nr.
| * 28921ec5 hsr: Disable netpoll.
| * 8cee8543 net: hsr: generate supervision frame without HSR/PRP tag
| * 38d13a2a hsr: Add a rcu-read lock to hsr_forward_skb().
| * ee4425e8 clk: qcom: clk-krait: fix wrong div2 functions
| * 6f25402d regulator: core: fix module refcount leak in set_supply()
| * f532db69 wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
| * 4ecb7a6e wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
| * b2c0b94f wifi: mac80211: fix memory leak in ieee80211_if_add()
| * b0163248 spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
| * ab19f402 bonding: uninitialized variable in bond_miimon_inspect()
| * c58df40e bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
| * 28e4a763 bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
| * 429a2a42 netfilter: conntrack: set icmpv6 redirects as RELATED
| * cd0e9ee5 ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
| * 7c1ddf7c drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
| * 3991d98a drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
| * a012cdd4 drm/amd/pm/smu11: BACO is supported when it's in BACO state
| * 57491967 ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
| * 52c9ad56 ASoC: mediatek: mt8173: Fix debugfs registration for components
| * ae966649 wifi: iwlwifi: mvm: fix double free on tx path.
| * ae66695a ALSA: asihpi: fix missing pci_disable_device()
| * 5458bc0f NFS: Fix an Oops in nfs_d_automount()
| * bc60485b NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
| * d16d7870 NFSv4.2: Fix initialisation of struct nfs4_label
| * 15feece7 NFSv4.2: Fix a memory stomp in decode_attr_security_label
| * 58a1023e NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
| * 193691ff ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
| * 6013c3de ASoC: dt-bindings: wcd9335: fix reset line polarity in example
| * cf2cbca7 drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
| * 54ab1276 media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
| * 559891d4 media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
| * e34cf6ca media: dvb-core: Fix ignored return value in dvb_register_frontend()
| * 05be5d56 pinctrl: pinconf-generic: add missing of_node_put()
| * 9916497a clk: imx: replace osc_hdmi with dummy
| * dabf7b67 media: imon: fix a race condition in send_packet()
| * 14d85b60 media: vimc: Fix wrong function called when vimc_init() fails
| * 4518d7cc ASoC: qcom: Add checks for devm_kcalloc
| * b73fac67 drbd: fix an invalid memory access caused by incorrect use of list iterator
| * 1d0c2b76 mtd: maps: pxa2xx-flash: fix memory leak in probe
| * 7d1e0d23 bonding: fix link recovery in mode 2 when updelay is nonzero
| * 3725a8f2 drm/amdgpu: fix pci device refcount leak
| * f4d70c13 clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
| * a065be02 regulator: core: use kfree_const() to free space conditionally
| * d7198b63 ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
| * 88550b44 ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
| * ad2d0a3d HID: hid-sensor-custom: set fixed size for custom attributes
| * 0d6ae25d bpf: Move skb->len == 0 checks into __bpf_redirect
| * 9920e87a inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
| * 49aa0809 media: videobuf-dma-contig: use dma_mmap_coherent
| * 84700600 media: platform: exynos4-is: Fix error handling in fimc_md_init()
| * 49060c0d media: solo6x10: fix possible memory leak in solo_sysfs_init()
| * 0369af6f media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
| * 3afd738e Input: elants_i2c - properly handle the reset GPIO when power is off
| * 0919982a mtd: lpddr2_nvm: Fix possible null-ptr-deref
| * effbf636 wifi: ath10k: Fix return value in ath10k_pci_init()
| * adf03c30 ima: Fix misuse of dereference of pointer in template_desc_init_fields()
| * 3bd73728 integrity: Fix memory leakage in keyring allocation error path
| * 102df01c drm/fourcc: Fix vsub/hsub for Q410 and Q401
| * 6f6a99fb drm/fourcc: Add packed 10bit YUV 4:2:0 format
| * 85273b4a amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
| * f48c474e regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
| * 21a1409e ASoC: pxa: fix null-pointer dereference in filter()
| * 698bbaf0 drm/mediatek: Modify dpi power on/off sequence.
| * b4b30f56 drm/radeon: Add the missed acpi_put_table() to fix memory leak
| * cea79ae8 rxrpc: Fix ack.bufferSize to be 0 when generating an ack
| * 00fce49d net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
| * 3d5cab72 media: camss: Clean up received buffers on failed start of streaming
| * 61c96d99 wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
| * 62443819 Input: joystick - fix Kconfig warning for JOYSTICK_ADC
| * 330bc553 mtd: Fix device name leak when register device failed in add_mtd_device()
| * 1a79539f clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
| * e1989d80 bpf: propagate precision across all frames, not just the last one
| * cdd73a5e bpf: Check the other end of slot_type for STACK_SPILL
| * 42b2b738 bpf: propagate precision in ALU/ALU64 operations
| * 7fc38327 media: platform: exynos4-is: fix return value check in fimc_md_probe()
| * f9d19f3a media: vivid: fix compose size exceed boundary
| * 72e8d9c7 bpf: Fix slot type check in check_stack_write_var_off
| * d959ff7f drm/msm/hdmi: drop unused GPIO support
| * b12f354f drm/msm/hdmi: switch to drm_bridge_connector
| * c4b035b1 ima: Handle -ESTALE returned by ima_filter_rule_match()
| * d5b227f0 ima: Fix fall-through warnings for Clang
| * 576828e5 drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
| * f1aa9768 spi: Update reference to struct spi_controller
| * dd958c7f clk: renesas: r9a06g032: Repair grave increment error
| * 110bf158 drm/rockchip: lvds: fix PM usage counter unbalance in poweron
| * 1874f914 can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
| * 669bdf12 can: kvaser_usb: Add struct kvaser_usb_busparams
| * a50ad677 can: kvaser_usb_leaf: Fix bogus restart events
| * cd56718e can: kvaser_usb_leaf: Fix wrong CAN state after stopping
| * f8374228 can: kvaser_usb_leaf: Fix improved state not being reported
| * fbd155fe can: kvaser_usb_leaf: Set Warning state even without bus errors
| * 96af45b1 can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
| * caea6294 can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
| * eafcf1b5 can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
| * cd50258e can: kvaser_usb: do not increase tx statistics when sending error message frames
| * 580c79fd media: exynos4-is: don't rely on the v4l2_async_subdev internals
| * c93cac58 media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev
| * 4882492a venus: pm_helpers: Fix error check in vcodec_domains_get()
| * 86d531c1 media: i2c: ad5820: Fix error path
| * 83f7e3c9 media: coda: jpeg: Add check for kmalloc
| * 7e0ba56c pata_ipx4xx_cf: Fix unsigned comparison with less than zero
| * 85b297d7 libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
| * c61650b8 libbpf: Fix use-after-free in btf_dump_name_dups
| * 26ce3f0c drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
| * 9b6851c1 wifi: rtl8xxxu: Fix reading the vendor of combo chips
| * 98d91728 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
| * c3fb3e9a wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
| * 53915ecc rapidio: devices: fix missing put_device in mport_cdev_open
| * cff9fefd hfs: Fix OOB Write in hfs_asc2mac
| * 93cdd126 relay: fix type mismatch when allocating memory in relay_create_buf()
| * bbaa9ca0 eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
| * 5ee85064 rapidio: fix possible UAF when kfifo_alloc() fails
| * ad484263 fs: sysv: Fix sysv_nblocks() returns wrong value
| * 6f8ef1de MIPS: OCTEON: warn only once if deprecated link status is being used
| * 7b88747d MIPS: BCM63xx: Add check for NULL for clk in clk_enable
| * d4c38ee6 platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
| * 17cd8c46 platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
| * f983afc4 PM: runtime: Do not call __rpm_callback() from rpm_idle()
| * 2cbbd78e PM: runtime: Improve path in rpm_idle() when no callback
| * 46026bb0 xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
| * 70e7f308 x86/xen: Fix memory leak in xen_init_lock_cpu()
| * fc134c35 x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
| * 95dbcb7e uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
| * 02617006 ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
| * 7bc9c5ad clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
| * 270700e7 cpu/hotplug: Make target_store() a nop when target == state
| * fc89b885 futex: Resend potentially swallowed owner death notification
| * 4750cac4 futex: Move to kernel/futex/
| * d8e7a44f clocksource/drivers/sh_cmt: Access registers according to spec
| * 0853787d clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
| * 97d9eb45 rapidio: rio: fix possible name leak in rio_register_mport()
| * 88fa351b rapidio: fix possible name leaks when rio_add_device() fails
| * 2b7e59ed ocfs2: fix memory leak in ocfs2_mount_volume()
| * 45dabd8f ocfs2: rewrite error handling of ocfs2_fill_super
| * e403024c ocfs2: ocfs2_mount_volume does cleanup job before return error
| * 81d26aa9 debugfs: fix error when writing negative value to atomic_t debugfs file
| * f649e18c docs: fault-injection: fix non-working usage of negative values
| * 869a37ad lib/notifier-error-inject: fix error when writing -errno to debugfs file
| * c39aa503 libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
| * 00804616 cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
| * 9346517e genirq/irqdesc: Don't try to remove non-existing sysfs files
| * d97e58f7 nfsd: don't call nfsd_file_put from client states seqfile display
| * 2db53c70 EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
| * f870d586 irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
| * 5c0cacdd platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
| * 0afcb759 perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
| * d2afced5 perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
| * c0539d5d perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
| * dac87e29 PNP: fix name memory leak in pnp_alloc_dev()
| * e1049bf0 selftests/efivarfs: Add checking of the test return value
| * 911773f0 MIPS: vpe-cmp: fix possible memory leak while module exiting
| * 48d42f44 MIPS: vpe-mt: fix possible memory leak while module exiting
| * f5f2682d ocfs2: fix memory leak in ocfs2_stack_glue_init()
| * c9a9aa02 lib/fonts: fix undefined behavior in bit shift for get_default_font
| * 9f6ea28f proc: fixup uptime selftest
| * d5bf025c timerqueue: Use rb_entry_safe() in timerqueue_getnext()
| * 2f2ae35c platform/x86: huawei-wmi: fix return value calculation
| * a1014fbc lib/debugobjects: fix stat count and optimize debug_objects_mem_init
| * 60a7a0aa perf: Fix possible memleak in pmu_dev_alloc()
| * 294ed8bf selftests/ftrace: event_triggers: wait longer for test_event_enable
| * 3ef12a4a cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
| * aa5f2912 fs: don't audit the capability check in simple_xattr_list()
| * 9e760e0c PM: hibernate: Fix mistake in kerneldoc comment
| * ef875e1c alpha: fix syscall entry in !AUDUT_SYSCALL case
| * 1498d272 cpuidle: dt: Return the correct numbers of parsed idle states
| * 2ff40144 sched/uclamp: Fix relationship between uclamp and migration margin
| * ca9ef12b sched/fair: Cleanup task_util and capacity type
| * 6389c163 tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
| * 5b217f4e tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
| * 295f59cd pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
| * 480bc6a1 ARM: mmp: fix timer_read delay
| * d1b3164d pstore/ram: Fix error return code in ramoops_probe()
| * 4dad729f arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
| * 872865db ARM: dts: turris-omnia: Add switch port 6 node
| * c1322d5f ARM: dts: turris-omnia: Add ethernet aliases
| * d050513e ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
| * bac1a77b ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
| * ea907f30 ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
| * ea8e313b ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
| * 697b92a6 ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
| * 73ab831a ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
| * c2cb1683 arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
| * 12613528 arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
| * 853d57e9 arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
| * 436ac713 arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
| * 148e7735 arm64: dts: mt2712e: Fix unit address for pinctrl node
| * a938c2a7 arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
| * a455b0c5 arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
| * 42d97a02 arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
| * 359286f8 perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
| * 9afac95b perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
| * 5e88aec6 soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
| * 6a9a31c5 soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
| * e325b4ee soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
| * 0542d56e arm: dts: spear600: Fix clcd interrupt
| * a8d4fb0b soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
| * 6213df4f soc: qcom: apr: make code more reuseable
| * 45d180a9 soc: qcom: llcc: make irq truly optional
| * 8fb204a4 drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
| * 6a2faf6f ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
| * 6d1b6dc3 ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
| * 933499be objtool, kcsan: Add volatile read/write instrumentation to whitelist
| * 275a67e9 arm64: dts: qcom: msm8916: Drop MSS fallback compatible
| * 82baee22 arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
| * 82569f7e arm64: dts: qcom: sdm630: fix UART1 pin bias
| * 4cef81de ARM: dts: qcom: apq8064: fix coresight compatible
| * 5465b9a8 arm64: dts: qcom: msm8996: fix GPU OPP table
| * 6cad948c arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
| * 60184b14 usb: musb: remove extra check in musb_gadget_vbus_draw
* | 56390fd0 ANDROID: fix up struct task_struct ABI change in 5.10.162
* | 380302e7 ANDROID: struct io_uring ABI preservation hack for 5.10.162 changes
* | 8f023451 ANDROID: add flags variable back to struct proto_ops
* | 6654dea4 Merge 5.10.162 into android13-5.10-lts
|\|
| * 0fe45486 Linux 5.10.162
| * 189556b0 io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups
| * 4ef66581 eventfd: provide a eventfd_signal_mask() helper
| * 2f093775 eventpoll: add EPOLL_URING_WAKE poll wakeup flag
| * b76c5373 Revert "proc: don't allow async path resolution of /proc/self components"
| * 87cb08dc Revert "proc: don't allow async path resolution of /proc/thread-self components"
| * a3025359 net: remove cmsg restriction from io_uring based send/recvmsg calls
| * 6ef2b472 task_work: unconditionally run task_work from get_signal()
| * c91ab047 signal: kill JOBCTL_TASK_WORK
| * 788d0824 io_uring: import 5.15-stable io_uring
| * ed300503 task_work: add helper for more targeted task_work canceling
| * 831cb78a kernel: don't call do_exit() for PF_IO_WORKER threads
| * 9ded44b6 kernel: stop masking signals in create_io_thread()
| * f0a5f0dc x86/process: setup io_threads more like normal user space threads
| * dd26e2ce arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread()
| * 320c8057 arch: setup PF_IO_WORKER threads like PF_KTHREAD
| * 000de389 entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set
| * 0f735cf5 kernel: allow fork with TIF_NOTIFY_SIGNAL pending
| * 4b4d2c79 coredump: Limit what can interrupt coredumps
| * 90a2c382 kernel: remove checking for TIF_NOTIFY_SIGNAL
| * 61bdeb14 task_work: remove legacy TWA_SIGNAL path
| * 6e2bce21 alpha: fix TIF_NOTIFY_SIGNAL handling
| * db911277 ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling
| * a1240cc4 ia64: don't call handle_signal() unless there's actually a signal queued
| * e1402ba4 sparc: add support for TIF_NOTIFY_SIGNAL
| * 78a53ff0 riscv: add support for TIF_NOTIFY_SIGNAL
| * 57e833a0 nds32: add support for TIF_NOTIFY_SIGNAL
| * 751fedb9 ia64: add support for TIF_NOTIFY_SIGNAL
| * 48e9e35d h8300: add support for TIF_NOTIFY_SIGNAL
| * c82617d9 c6x: add support for TIF_NOTIFY_SIGNAL
| * 30b78a17 alpha: add support for TIF_NOTIFY_SIGNAL
| * bf0b6195 xtensa: add support for TIF_NOTIFY_SIGNAL
| * 1bee9dbb arm: add support for TIF_NOTIFY_SIGNAL
| * 02d383a5 microblaze: add support for TIF_NOTIFY_SIGNAL
| * 19f3e328 hexagon: add support for TIF_NOTIFY_SIGNAL
| * c2037d61 csky: add support for TIF_NOTIFY_SIGNAL
| * 12284aec openrisc: add support for TIF_NOTIFY_SIGNAL
| * 3fde31e9 sh: add support for TIF_NOTIFY_SIGNAL
| * dc808ffd um: add support for TIF_NOTIFY_SIGNAL
| * 0aef2ec0 s390: add support for TIF_NOTIFY_SIGNAL
| * 8ca2e570 mips: add support for TIF_NOTIFY_SIGNAL
| * abab3d44 powerpc: add support for TIF_NOTIFY_SIGNAL
| * 45b365bc parisc: add support for TIF_NOTIFY_SIGNAL
| * cf3c6486 nios32: add support for TIF_NOTIFY_SIGNAL
| * fe137f46 m68k: add support for TIF_NOTIFY_SIGNAL
| * 79a9991e arm64: add support for TIF_NOTIFY_SIGNAL
| * 2dbb0354 arc: add support for TIF_NOTIFY_SIGNAL
| * 4b1dcf8e x86: Wire up TIF_NOTIFY_SIGNAL
| * eb42e7b3 task_work: Use TIF_NOTIFY_SIGNAL if available
| * 3c295bd2 entry: Add support for TIF_NOTIFY_SIGNAL
| * d2136fc1 fs: provide locked helper variant of close_fd_get_file()
| * 57b20530 file: Rename __close_fd_get_file close_fd_get_file
| * 214f80e2 fs: make do_renameat2() take struct filename
| * 52cfde6b signal: Add task_sigpending() helper
| * ad0b0137 net: add accept helper not installing fd
| * 069ac28d net: provide __sys_shutdown_sock() that takes a socket
| * 0b8cd5d8 tools headers UAPI: Sync openat2.h with the kernel sources
| * 5683caa7 fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED
| * 0cf0ce8f Make sure nd->path.mnt and nd->path.dentry are always valid pointers
| * 146fe79f fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy*
| * c1fe7bd3 fs: add support for LOOKUP_CACHED
| * 36ec3120 saner calling conventions for unlazy_child()
| * e86db871 iov_iter: add helper to save iov_iter state
| * 1500fed0 kernel: provide create_io_thread() helper
* | 6a3863be Merge branch 'android13-5.10' into android13-5.10-lts
* | 31dc70f0 Merge 5.10.161 into android13-5.10-lts
|\|
| * 1a9148df Linux 5.10.161
| * eec1c3ad net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
| * f3fe6817 Bluetooth: L2CAP: Fix u8 overflow
| * 7c3a523c HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
| * 1d5db0c3 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
| * 263a1782 HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E
| * a20b5eec HID: ite: Add support for Acer S1002 keyboard-dock
| * f2479c3d igb: Initialize mailbox message for VF reset
| * 9ff7aff4 xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
| * c8bf31a0 USB: serial: f81534: fix division by zero on line-speed change
| * 5b75a004 USB: serial: f81232: fix division by zero on line-speed change
| * 9895ce5e USB: serial: cp210x: add Kamstrup RF sniffer PIDs
| * 398215f7 USB: serial: option: add Quectel EM05-G modem
| * c79538f3 usb: gadget: uvc: Prevent buffer overflow in setup handler
| * 8b2f86f8 udf: Fix extending file within last block
| * db873b77 udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
| * 1a075f4a udf: Fix preallocation discarding at indirect extent boundary
| * 1f7f7365 udf: Discard preallocation before extending file with a hole
* | 1a6be252 Merge 5.10.160 into android13-5.10-lts
|\|
| * a2428a8d Linux 5.10.160
| * 54c15f67 ASoC: ops: Correct bounds check for second channel on SX controls
| * 74b139c6 nvme-pci: clear the prp2 field when not used
| * 77ebf88e ASoC: cs42l51: Correct PGA Volume minimum value
| * 4db1d19b can: mcba_usb: Fix termination command argument
| * 683837f2 can: sja1000: fix size of OCR_MODE_MASK define
| * 434b5236 pinctrl: meditatek: Startup with the IRQs disabled
| * 5cb4abb0 libbpf: Use page size as max_entries when probing ring buffer map
| * 50b5f6d4 ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
| * 344739dc ASoC: fsl_micfil: explicitly clear CHnF flags
| * a49c1a73 ASoC: fsl_micfil: explicitly clear software reset bit
| * 75454b4b io_uring: add missing item types for splice request
| * 17f386e6 fuse: always revalidate if exclusive create
| * eb6313c1 nfp: fix use-after-free in area_cache_get()
| * 965d93fb vfs: fix copy_file_range() averts filesystem freeze protection
| * ed967339 vfs: fix copy_file_range() regression in cross-fs copies
| * 970862a9 x86/smpboot: Move rcu_cpu_starting() earlier
* | a44cdab3 Merge 5.10.159 into android13-5.10-lts
|\|
| * 931578be Linux 5.10.159
| * 4fd6f84e can: esd_usb: Allow REC and TEC to return to zero
| * cf0e4231 macsec: add missing attribute validation for offload
| * 6b03e417 net: mvneta: Fix an out of bounds check
| * 8208d7e5 ipv6: avoid use-after-free in ip6_fragment()
| * 3d59adad net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
| * a00444e2 xen/netback: fix build warning
| * 87277bdf ethernet: aeroflex: fix potential skb leak in greth_init_rings()
| * cc668fdd tipc: call tipc_lxc_xmit without holding node_read_lock
| * 4be43e46 net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
| * 8e3f9ac0 ipv4: Fix incorrect route flushing when table ID 0 is used
| * 5211e5ff ipv4: Fix incorrect route flushing when source address is deleted
| * 36e24826 tipc: Fix potential OOB in tipc_link_proto_rcv()
| * 93aaa4bb net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
| * 296a50aa net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
| * 8d1aed7a net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
| * a5cfbc19 ip_gre: do not report erspan version on GRE interface
| * 696e34d5 net: stmmac: fix "snps,axi-config" node property parsing
| * ca26f450 nvme initialize core quirks before calling nvme_init_subsystem
| * 27eb2d7a NFC: nci: Bounds check struct nfc_target arrays
| * a2506b19 i40e: Disallow ip4 and ip6 l4_4_bytes
| * 8329b65e i40e: Fix for VF MAC address 0
| * 215f3ac5 i40e: Fix not setting default xps_cpus after reset
| * 146ebee8 net: mvneta: Prevent out of bounds read in mvneta_config_rss()
| * e6860c88 xen-netfront: Fix NULL sring after live migration
| * 3d3b3071 net: encx24j600: Fix invalid logic in reading of MISTAT register
| * 51ba1820 net: encx24j600: Add parentheses to fix precedence
| * 42c31963 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
| * 4c693330 selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
| * bccda3ad net: dsa: ksz: Check return value
| * e7b95045 Bluetooth: Fix not cleanup led when bt_init fails
| * 1717354d Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
| * 80c69b31 vmxnet3: correctly report encapsulated LRO packet
| * 575a6266 af_unix: Get user_ns from in_skb in unix_diag_get_exact().
| * 6c788c0a drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420
| * de918d97 igb: Allocate MSI-X vector when testing
| * 6595c920 e1000e: Fix TX dispatch condition
| * 5ee6413d gpio: amd8111: Fix PCI device reference count leak
| * b9aca69a drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
| * b46e8c50 netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
| * 0a8e66e3 ca8210: Fix crash by zero initializing data
| * 27c71825 ieee802154: cc2520: Fix error return code in cc2520_hw_init()
| * a0418d0a netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
| * cb283cca rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
| * 5c432383 rtc: mc146818-lib: fix locking in mc146818_set_time
| * 5e26531d rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
| * fccee93e mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
| * c42221ef can: af_can: fix NULL pointer dereference in can_rcv_filter
| * bc03f809 HID: core: fix shift-out-of-bounds in hid_report_raw_event
| * 959a23a4 HID: hid-lg4ff: Add check for empty lbuf
| * 4dde7594 HID: usbhid: Add ALWAYS_POLL quirk for some mice
| * 11e95d85 drm/shmem-helper: Avoid vm_open error paths
| * 6a4da05a drm/shmem-helper: Remove errant put in error path
| * 007f561f drm/vmwgfx: Don't use screen objects when SEV is active
| * 3cb78c39 KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
| * 549b46f8 Bluetooth: Fix crash when replugging CSR fake controllers
| * 380d183e Bluetooth: btusb: Add debug message for CSR controllers
| * f1cf8561 mm/gup: fix gup_pud_range() for dax
| * f1f7f36c memcg: fix possible use-after-free in memcg_write_event_control()
| * 32f01f03 media: v4l2-dv-timings.c: fix too strict blanking sanity checks
| * 043b2bc9 Revert "ARM: dts: imx7: Fix NAND controller size-cells"
| * abfb8ae6 media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
| * 83632fc4 xen/netback: don't call kfree_skb() with interrupts disabled
| * 3eecd2bc xen/netback: do some code cleanup
| * 49e07c07 xen/netback: Ensure protocol headers don't fall in the non-linear area
| * db44a944 rtc: mc146818: Reduce spinlock section in mc146818_set_time()
| * 17293d63 rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ
| * acfd8ef6 rtc: cmos: avoid UIP when reading alarm time
| * 949bae02 rtc: cmos: avoid UIP when writing alarm time
| * 33ac73a4 rtc: mc146818-lib: extract mc146818_avoid_UIP
| * 8bb5fe58 rtc: mc146818-lib: fix RTC presence check
| * 775d4661 rtc: Check return value from mc146818_get_time()
| * b9a5c470 rtc: mc146818-lib: change return values of mc146818_get_time()
| * 94eaf996 rtc: cmos: remove stale REVISIT comments
| * f5b51f85 rtc: mc146818: Dont test for bit 0-5 in Register D
| * 37369723 rtc: mc146818: Detect and handle broken RTCs
| * 7c7075c8 rtc: mc146818: Prevent reading garbage
| * 7f445ca2 mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
| * 4a1cdb49 mm/khugepaged: fix GUP-fast interaction by sending IPI
| * cdfd3739 mm/khugepaged: take the right locks for page table retraction
| * 1c0eec6a net: usb: qmi_wwan: add u-blox 0x1342 composition
| * a8c5ffb4 9p/xen: check logical size for buffer size
| * ec36ebae usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
| * d9b53caf fbcon: Use kzalloc() in fbcon_prepare_logo()
| * 8b130c77 regulator: twl6030: fix get status of twl6032 regulators
| * f6f45e53 ASoC: soc-pcm: Add NULL check in BE reparenting
| * 688a45af btrfs: send: avoid unaligned encoded writes when attempting to clone range
| * 15c42ab8 ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
| * d38e0214 regulator: slg51000: Wait after asserting CS pin
| * 1331bcfc 9p/fd: Use P9_HDRSZ for header size
| * 96b43f36 ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
| * ddf58f59 ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
| * dbd78abd ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
| * bb1866cf ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
| * b1f40a0c ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
| * 5f9474d0 arm64: dts: rockchip: fix ir-receiver node names
| * 060d5892 ARM: dts: rockchip: fix ir-receiver node names
| * 3e0c4667 arm: dts: rockchip: fix node name for hym8563 rtc
| * 3ada63a8 arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
* | 62210e26 ANDROID: fix up ABI break in commit 940b7740 ("mmc: sdhci: Fix voltage switch delay")
* | 0e1f2c87 ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
* | 4c150135 Merge 5.10.158 into android13-5.10-lts
|/
* 592346d5 Linux 5.10.158
* cc1b4718 ipc/sem: Fix dangling sem_array access in semtimedop race
* d072a10c v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
* 9ba38986 proc: proc_skip_spaces() shouldn't think it is working on C strings
* 4aa32aae proc: avoid integer type confusion in get_proc_long
* 5f2f7756 block: unhash blkdev part inode when the part is deleted
* a82869ac Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
* 4e0d6c68 char: tpm: Protect tpm_pm_suspend with locks
* 5a6f935e Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
* f075cf13 ACPI: HMAT: Fix initiator registration for single-initiator systems
* f3b76b4d ACPI: HMAT: remove unnecessary variable initialization
* 63e72417 i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
* df761365 i2c: npcm7xx: Fix error handling in npcm_i2c_init()
* 7462cd24 x86/pm: Add enumeration check before spec MSRs save/restore setup
* 5e3d4a68 x86/tsx: Add a feature bit for TSX control MSR support
* b7f7a040 Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
* 481f9ed8 ipv4: Fix route deletion when nexthop info is not specified
* 0b539422 ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
* 49195034 selftests: net: fix nexthop warning cleanup double ip typo
* 7ca14c5f selftests: net: add delete nexthop route warning test
* f09ac62f Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
* 19d91d37 parisc: Increase FRAME_WARN to 2048 bytes on parisc
* fcf20da0 xtensa: increase size of gcc stack frame check
* a1877001 parisc: Increase size of gcc stack frame check
* a5c65cd5 iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
* 10ed7655 iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
* 302edce1 pinctrl: single: Fix potential division by zero
* b50c9641 ASoC: ops: Fix bounds check for _sx controls
* a2efc465 io_uring: don't hold uring_lock when calling io_run_task_work*
* be111ebd tracing: Free buffers when a used dynamic event is removed
* 648b92e5 drm/i915: Never return 0 if not all requests retired
* 8649c023 drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
* 940b7740 mmc: sdhci: Fix voltage switch delay
* ed1966245307 mmc: sdhci-sprd: Fix no reset data and command after voltage switch
* ef767907e77d mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
* 46ee041cd655 mmc: core: Fix ambiguous TRIM and DISCARD arg
* b79be962b567 mmc: mmc_test: Fix removal of debugfs file
* d4fc344c0d9c net: stmmac: Set MAC's flow control register to reflect current settings
* 549e24409ac5 pinctrl: intel: Save and restore pins in "direct IRQ" mode
* 471fb7b735bf x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
* e858917ab785 nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
* 6ddf788400dd tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
* c099d12c5502 error-injection: Add prompt for function error injection
* 26b6f927bb86 riscv: vdso: fix section overlapping under some conditions
* 2b1d8f27e205 net/mlx5: DR, Fix uninitialized var warning
* c40db1e5f316 hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
* f06e0cd01eab hwmon: (coretemp) Check for null before removing sysfs attrs
* d93522d04f84 net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
* 176ee6c673cc sctp: fix memory leak in sctp_stream_outq_migrate()
* 1c38c88acc96 packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
* 5f442e1d403e net: tun: Fix use-after-free in tun_detach()
* 5fa0fc5876b5 afs: Fix fileserver probe RTT handling
* 7ca81a161e40 net: hsr: Fix potential use-after-free
* a1ba595e35aa tipc: re-fetch skb cb after tipc_msg_validate
* 4621bdfff5f8 dsa: lan9303: Correct stat name
* 45752af02475 net: ethernet: nixge: fix NULL dereference
* e01c1542379f net/9p: Fix a potential socket leak in p9_socket_open
* b080d4668f3f net: net_netdev: Fix error handling in ntb_netdev_init_module()
* fe6bc99c27c2 net: phy: fix null-ptr-deref while probe() failed
* 0184ede0ec61 wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
* e2ed90fd3ae0 wifi: cfg80211: don't allow multi-BSSID in S1G
* 9e6b79a3cd17 wifi: cfg80211: fix buffer overflow in elem comparison
* 6922948c2ec1 aquantia: Do not purge addresses when setting the number of rings
* fa59d49a49b0 qlcnic: fix sleep-in-atomic-context bugs caused by msleep
* d753f554f25d can: cc770: cc770_isa_probe(): add missing free_cc770dev()
* e74746bf0453 can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
* 0d2f9d95d9fb net/mlx5e: Fix use-after-free when reverting termination table
* 2cb84ff34938 net/mlx5: Fix uninitialized variable bug in outlen_write()
* b775f37d9439 e100: Fix possible use after free in e100_xmit_prepare
* 086f656e447b e100: switch from 'pci_' to 'dma_' API
* 971c55f0763b iavf: Fix error handling in iavf_init_module()
* d389a4c69877 iavf: remove redundant ret variable
* fd4960ea5362 fm10k: Fix error handling in fm10k_init_module()
* dd425cec79ba i40e: Fix error handling in i40e_init_module()
* f166c62cad79 ixgbevf: Fix resource leak in ixgbevf_init_module()
* 8f7047f41810 of: property: decrement node refcount in of_fwnode_get_reference_args()
* be006212bd53 bpf: Do not copy spin lock field from user in bpf_selem_alloc
* 90907cd4d113 hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
* 7649bba2633d hwmon: (i5500_temp) fix missing pci_disable_device()
* dddfc03f044b hwmon: (ina3221) Fix shunt sum critical calculation
* 984fcd3ec1aa hwmon: (ltc2947) fix temperature scaling
* 8a549ab67245 libbpf: Handle size overflow for ringbuf mmap
* cc140c729c68 ARM: at91: rm9200: fix usb device clock id
* 592724b14da7 scripts/faddr2line: Fix regression in name resolution on ppc64le
* 353c3aaaf3c4 bpf, perf: Use subprog name when reporting subprog ksymbol
* d48f6a578405 iio: light: rpr0521: add missing Kconfig dependencies
* 5eb114f55b37 iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
* b1756af172fb iio: health: afe4403: Fix oob read in afe4403_read_raw
* 01d7c41eac91 btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
* d3f5be824669 drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
* 00570fafc2bc drm/amdgpu: update drm_display_info correctly when the edid is read
* 44b204730bf3 drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
* 1faf21bdd111 btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
* 6050872f9f31 spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
* 7b020665d482 btrfs: free btrfs_path before copying inodes to userspace
* d5b7a34379fa btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino

Update the .xml file to support the ABI fixup and new symbol being
tracked:

1 function symbol(s) added
  'void __dev_kfree_skb_irq(struct sk_buff *, enum skb_free_reason)'

type 'struct sdhci_host' changed
  member 'union { struct { u8 drv_type; bool reinit_uhs; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
  member 'u64 android_kabi_reserved1' was removed

Change-Id: I34c776f826fb74cdf19825a58e5fc86a95550be6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

hwrng core uses two buffers that can be mixed in the
virtio-rng queue.

If the buffer is provided with wait=0 it is enqueued in the
virtio-rng queue but unused by the caller.
On the next call, core provides another buffer but the
first one is filled instead and the new one queued.
And the caller reads the data from the new one that is not
updated, and the data in the first one are lost.

To avoid this mix, virtio-rng needs to use its own unique
internal buffer at a cost of a data copy to the caller buffer.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Link: https://lore.kernel.org/r/20211028101111.128049-2-lvivier@redhat.com


Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit bf3175bc)
Bug: 249566340
Change-Id: Ica2fd680de4bb359923b94dae48c00f6207a6876
Signed-off-by: Alistair Delva <adelva@google.com>

commit c993799b upstream.

Apparently syzbot figured out that issuing this FSMAP call:

struct fsmap_head cmd = {
	.fmh_count	= ...;
	.fmh_keys	= {
		{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
		{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
	},
...
};
ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);

Produces this crash if the underlying filesystem is a 1k-block ext4
filesystem:

kernel BUG at fs/ext4/ext4.h:3331!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G        W  O       6.2.0-rc8-achx
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]
RSP: 0018:ffffc90007c03998 EFLAGS: 00010246
RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000
RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11
RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400
R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001
R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398
FS:  00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0
Call Trace:
 <TASK>
 ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
 ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
 ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
 ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
 __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
 __x64_sys_ioctl+0x82/0xa0
 do_syscall_64+0x2b/0x80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf20558aff
RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff
RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003
RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010
R13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000

For GETFSMAP calls, the caller selects a physical block device by
writing its block number into fsmap_head.fmh_keys[01].fmr_device.
To query mappings for a subrange of the device, the starting byte of the
range is written to fsmap_head.fmh_keys[0].fmr_physical and the last
byte of the range goes in fsmap_head.fmh_keys[1].fmr_physical.

IOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd
set the inputs as follows:

	fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3},
	fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14},

Which would return you whatever is mapped in the 12 bytes starting at
physical offset 3.

The crash is due to insufficient range validation of keys[1] in
ext4_getfsmap_datadev.  On 1k-block filesystems, block 0 is not part of
the filesystem, which means that s_first_data_block is nonzero.
ext4_get_group_no_and_offset subtracts this quantity from the blocknr
argument before cracking it into a group number and a block number
within a group.  IOWs, block group 0 spans blocks 1-8192 (1-based)
instead of 0-8191 (0-based) like what happens with larger blocksizes.

The net result of this encoding is that blocknr < s_first_data_block is
not a valid input to this function.  The end_fsb variable is set from
the keys that are copied from userspace, which means that in the above
example, its value is zero.  That leads to an underflow here:

	blocknr = blocknr - le32_to_cpu(es->s_first_data_block);

The division then operates on -1:

	offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) >>
		EXT4_SB(sb)->s_cluster_bits;

Leaving an impossibly large group number (2^32-1) in blocknr.
ext4_getfsmap_check_keys checked that keys[0].fmr_physical and
keys[1].fmr_physical are in increasing order, but
ext4_getfsmap_datadev adjusts keys[0].fmr_physical to be at least
s_first_data_block.  This implies that we have to check it again after
the adjustment, which is the piece that I forgot.

Reported-by:  <syzbot+6be2b977c89f79b6b153@syzkaller.appspotmail.com>
Fixes: 4a495624 ("ext4: fix off-by-one fsmap error on 1k block filesystems")
Link: https://syzkaller.appspot.com/bug?id=79d5768e9bfe362911ac1a5057a36fc6b5c30002


Cc: stable@vger.kernel.org
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Link: https://lore.kernel.org/r/Y+58NPTH7VNGgzdd@magnolia


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 260486287
Change-Id: I07ac9fcb91671016f4b6a10ef5c8711eea74fb26
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

Setting WQ_UNBOUND increases scheduler latency on ARM64.  This is
likely due to the asymmetric architecture of ARM64 processors.

I've been unable to reproduce the results that claim WQ_UNBOUND gives
a performance boost on x86-64.

This flag is causing performance issues for multiple subsystems within
Android.  Notably, the same slowdown exists for decompression with
EROFS.

| open-prebuilt-camera  | WQ_UNBOUND | ~WQ_UNBOUND   |
|-----------------------|------------|---------------|
| verity wait time (us) | 11746      | 119 (-98%)    |
| erofs wait time (us)  | 357805     | 174205 (-51%) |

| sha256 ramdisk random read | WQ_UNBOUND    | ~WQ_UNBOUND |
|----------------------------|-----------=---|-------------|
| arm64 (accelerated)        | bw=42.4MiB/s  | bw=212MiB/s |
| arm64 (generic)            | bw=16.5MiB/s  | bw=48MiB/s  |
| x86_64 (generic)           | bw=233MiB/s   | bw=230MiB/s |

Using a alloc_workqueue() @max_active arg of num_online_cpus() only
made sense with WQ_UNBOUND. Switch the @max_active arg to 0 (aka
default, which is 256 per-cpu).

Also, eliminate 'wq_flags' since it really doesn't serve a purpose.

Cc: Sami Tolvanen <samitolvanen@google.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

Bug: 233247259
(cherry picked from commit c25da5b7)
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:0b8c60f03740004a9693d63a2d31618b00469107)
Merged-In: Iea437fcfaa978a1389a57ef4d4adcb976d89089c

Change-Id: Iecdc2ef25cc59ca53bfe3bca775f93cfda57f9d7

WQ_HIGHPRI increases throughput and decreases disk latency when using
dm-verity. This is important in Android for camera startup speed.

The following tests were run by doing 60 seconds of random reads using
a dm-verity device backed by two ramdisks.

Without WQ_HIGHPRI
lat (usec): min=13, max=3947, avg=69.53, stdev=50.55
READ: bw=51.1MiB/s (53.6MB/s), 51.1MiB/s-51.1MiB/s (53.6MB/s-53.6MB/s)

With WQ_HIGHPRI:
lat (usec): min=13, max=7854, avg=31.15, stdev=30.42
READ: bw=116MiB/s (121MB/s), 116MiB/s-116MiB/s (121MB/s-121MB/s)

Further testing was done by measuring how long it takes to open a
camera on an Android device.

Without WQ_HIGHPRI
Total verity work queue wait times (ms):
880.960, 789.517, 898.852

With WQ_HIGHPRI:
Total verity work queue wait times (ms):
528.824, 439.191, 433.300

The average time to open the camera is reduced by 350ms (or 40-50%).

Signed-off-by: Nathan Huckleberry <nhuck@google.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

Bug: 233247259
(cherry picked from commit afd41fff)
[nhuck: Resolved minor conflict in drivers/md/dm-verity-target.c ]
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:fd4631f8568f5bf16ac5c8b0686d40fad6e4e047)
Merged-In: I7d600c924b4a3e793b9a26c2852139683061a831

Change-Id: Ib858d388aa24e4a625085804c097ad66aa179a14

The documentation [1] says that WQ_CPU_INTENSIVE is "meaningless" for
unbound wq. So remove WQ_CPU_INTENSIVE from the verify_wq allocation.

1. https://www.kernel.org/doc/html/latest/core-api/workqueue.html#flags



Suggested-by: Maksym Planeta <mplaneta@os.inf.tu-dresden.de>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>

Bug: 233247259
(cherry picked from commit 43fa47cb)
Signed-off-by: Nathan Huckleberry <nhuck@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:407f5e1a1ddada4de7085798973bbf9135e3bfc5)
Merged-In: I13c8916a24274d586a5f462541345d149c602ca3

Change-Id: Ic4d07ccdbd017c4f89e3de5805c9e733a3df9de6

commit 1e1c2b86 upstream.

Block range to free is validated in ext4_free_blocks() using
ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().
However in some situations on bigalloc file system the range might be
adjusted after the validation in ext4_free_blocks() which can lead to
troubles on corrupted file systems such as one found by syzkaller that
resulted in the following BUG

kernel BUG at fs/ext4/ext4.h:3319!
PREEMPT SMP NOPTI
CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014
RIP: 0010:ext4_free_blocks+0x95e/0xa90
Call Trace:
 <TASK>
 ? lock_timer_base+0x61/0x80
 ? __es_remove_extent+0x5a/0x760
 ? __mod_timer+0x256/0x380
 ? ext4_ind_truncate_ensure_credits+0x90/0x220
 ext4_clear_blocks+0x107/0x1b0
 ext4_free_data+0x15b/0x170
 ext4_ind_truncate+0x214/0x2c0
 ? _raw_spin_unlock+0x15/0x30
 ? ext4_discard_preallocations+0x15a/0x410
 ? ext4_journal_check_start+0xe/0x90
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_truncate+0x1b5/0x460
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_evict_inode+0x2b4/0x6f0
 evict+0xd0/0x1d0
 ext4_enable_quotas+0x11f/0x1f0
 ext4_orphan_cleanup+0x3de/0x430
 ? proc_create_seq_private+0x43/0x50
 ext4_fill_super+0x295f/0x3ae0
 ? snprintf+0x39/0x40
 ? sget_fc+0x19c/0x330
 ? ext4_reconfigure+0x850/0x850
 get_tree_bdev+0x16d/0x260
 vfs_get_tree+0x25/0xb0
 path_mount+0x431/0xa70
 __x64_sys_mount+0xe2/0x120
 do_syscall_64+0x5b/0x80
 ? do_user_addr_fault+0x1e2/0x670
 ? exc_page_fault+0x70/0x170
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf4e512ace

Fix it by making sure that the block range is properly validated before
used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().

Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c


Reported-by:  <syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
Tested-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Link: https://lore.kernel.org/r/20220714165903.58260-1-lczerner@redhat.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 237951970
Change-Id: I2a45df5fe3f47c9408bed79f83a61b68c00efa22
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

commit a00b482b upstream.

Currently ext4_mb_clear_bb() & ext4_group_add_blocks() only checks
whether the given block ranges (which is to be freed) belongs to any FS
metadata blocks or not, of the block's respective block group.
But to detect any FS error early, it is better to add more strict
checkings in those functions which checks whether the given blocks
belongs to any critical FS metadata or not within system-zone.

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/ddd9143d064774e32d6364a99667817c6e8bfdc0.1644992610.git.riteshh@linux.ibm.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 237951970
Change-Id: Ibab39a43f13af206af8c384e7c5590925a089f00
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

commit 6bc6c2bd upstream.

This API will be needed at places where we don't have an inode
for e.g. while freeing blocks in ext4_group_add_blocks()

Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Link: https://lore.kernel.org/r/dd34a236543ad5ae7123eeebe0cb69e6bdd44f34.1644992610.git.riteshh@linux.ibm.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 237951970
Change-Id: I4a63d1f1c720bce9612600c9c6034ddeda389d01
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

commit 8ac3939d upstream.

ext4_free_blocks() function became too long and confusing, this patch
just pulls out the ext4_mb_clear_bb() function logic from it
which clears the block bitmap and frees it.

No functionality change in this patch

Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/22c30fbb26ba409cf8aa5f0c7912970272c459e8.1644992610.git.riteshh@linux.ibm.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 237951970
Change-Id: Ib8c113a85e620eff6d4561a38c97f875a476ab7b
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

In the 3.0 device core, if the core is programmed to operate in
2.0 only, then setting the GUCTL1.DEV_FORCE_20_CLK_FOR_30_CLK makes
the internal 2.0(utmi/ulpi) clock to be routed as the 3.0 (pipe)
clock. Enabling this feature allows the pipe3 clock to be not-running
when forcibly operating in 2.0 device mode.

Tested-by: Michael Riesch <michael.riesch@wolfvision.net>
Signed-off-by: Bin Yang <yangbin@rock-chips.com>
Signed-off-by: Peter Geis <pgwipeout@gmail.com>
Link: https://lore.kernel.org/r/20220228135700.1089526-6-pgwipeout@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 62b20e6e)
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Change-Id: I7e53aaa54dd247f399a16406acb832a9f9a5a5eb

3 function symbol(s) added
  'struct clk_hw * __clk_hw_register_gate(struct device *, struct device_node *, const char *, const char *, const struct clk_hw *, const struct clk_parent_data *, unsigned long int, void *, u8, u8, spinlock_t *)'
  'bool clk_has_parent(struct clk *, struct clk *)'
  'int of_clk_parent_fill(struct device_node *, const char * *, unsigned int)'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: I9b24763ccc7f374331a99da7d4a42d7cb11e5378

I stumbled upon this *.rej file while looking for something else, it
seems this was included in 74d428eb ("UPSTREAM: Linux 5.10.110") by
mistake. Let's remove it.

Fixes: 74d428eb ("UPSTREAM: Linux 5.10.110")
Change-Id: If34dff4ad2eab975fd69d10e7ab3df816331eed7
Signed-off-by: Carlos Llamas <cmllamas@google.com>

If FEAT_MTE2 is disabled via the arm64.nomte command line argument on a
CPU that claims to support FEAT_MTE2, the kernel will use Tagged Normal
in the MAIR. If we interpret arm64.nomte to mean that the CPU does not
in fact implement FEAT_MTE2, setting the system register like this may
lead to UNSPECIFIED behavior. Fix it by arranging for MAIR to be set
in the C function cpu_enable_mte which is called based on the sanitized
version of the system register.

There is no need for the rest of the MTE-related system register
initialization to happen from assembly, with the exception of TCR_EL1,
which must be set to include at least TBI1 because the secondary CPUs
access KASan-allocated data structures early. Therefore, make the TCR_EL1
initialization unconditional and move the rest of the initialization to
cpu_enable_mte so that we no longer have a dependency on the unsanitized
ID register value.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Signed-off-by: Evgenii Stepanov <eugenis@google.com>
Signed-off-by: Qun-Wei Lin <qun-wei.lin@mediatek.corp-partner.google.com>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/linux-arm-kernel/20220907003630.1115439-1-eugenis@google.com/
Bug: 239834217
Change-Id: I7bd247ae5802295c198bac42df86fab9e9e9cefd
(cherry picked from commit 6a2905d35289caeeecbafa93ae4ff7cefafd02ed)

Add 6 symbols to android/abi_gki_aarch64_generic.

2 function symbol(s) added
  'void init_iova_domain(struct iova_domain *, unsigned long int, unsigned long int)'
  'void put_iova_domain(struct iova_domain *)'

Bug: 273201558
Change-Id: I8161ce6da67a4a4e27b94e2329ad66e58a159e70
Signed-off-by: David Chiang <davidchiang@google.com>

1 function symbol(s) added
  'struct pwm_device * devm_of_pwm_get(struct device *, struct device_node *, const char *)'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: Idc854ea25c83982853eeb3d3d09c84c440d0af52

14 function symbol(s) added
  'void cfg80211_auth_timeout(struct net_device *, const u8 *)'
  'void cfg80211_report_wowlan_wakeup(struct wireless_dev *, struct cfg80211_wowlan_wakeup *, gfp_t)'
  'bool cpu_latency_qos_request_active(struct pm_qos_request *)'
  'int hidraw_report_event(struct hid_device *, u8 *, int)'
  'int in4_pton(const char *, int, u8 *, int, const char * *)'
  'int iw_handler_get_spy(struct net_device *, struct iw_request_info *, union iwreq_data *, char *)'
  'int iw_handler_get_thrspy(struct net_device *, struct iw_request_info *, union iwreq_data *, char *)'
  'int iw_handler_set_spy(struct net_device *, struct iw_request_info *, union iwreq_data *, char *)'
  'int iw_handler_set_thrspy(struct net_device *, struct iw_request_info *, union iwreq_data *, char *)'
  'void netdev_set_default_ethtool_ops(struct net_device *, const struct ethtool_ops *)'
  'int schedule_hrtimeout(ktime_t *, const enum hrtimer_mode)'
  'int sdio_claim_irq(struct sdio_func *, sdio_irq_handler_t *)'
  'int sdio_release_irq(struct sdio_func *)'
  'unsigned int snd_pcm_rate_to_rate_bit(unsigned int)'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: Ia88dae6a1708d0adb7fab8f1b0d18c8476abb12c

commit f31173c1 upstream.

The ea block expansion need to access s_root while it is
already set as NULL when umount is triggered. Refuse this
request to avoid panic.

Reported-by:  <syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08
Link: https://lore.kernel.org/r/20230103014517.495275-3-jun.nie@linaro.org


Cc: stable@kernel.org
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 262267471
Change-Id: I0a5c974e696cf7a132f3cbb8acbe066edba4660f
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

commit 1e9d62d2 upstream.

Copy ea data from inode entry when expanding ea block if possible.
Then remove the ea entry if expansion success. Thus memcpy to a
temporary buffer may be avoided.

If the expansion fails, we do not need to recovery the removed ea
entry neither in this way.

Reported-by:  <syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08
Link: https://lore.kernel.org/r/20230103014517.495275-2-jun.nie@linaro.org


Cc: stable@kernel.org
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 262267471
Change-Id: I26e7d45ab21bcf9e38eeb66601067f42b01c11f5
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

commit cc12a6f2 upstream.

Now, extended attribute value maximum length is 64K. The memory
requested here does not need continuous physical addresses, so it is
appropriate to use kvmalloc to request memory. At the same time, it
can also cope with the situation that the extended attribute will
become longer in the future.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221208023233.1231330-3-yebin@huaweicloud.com


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 262267471
Change-Id: I92a4a66d8220f46f26a89100ba41c659559443a7
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>

Update the ABI because of the ANDROID_KABI_RESERVE() into
ANDROID_KABI_USE() change in a previous CL.

type 'struct scsi_host_template' changed
  member 'union { enum scsi_timeout_action(* eh_timed_out2)(struct scsi_cmnd *); struct { u64 android_kabi_reserved1; }; union { }; }' was added
  member 'u64 android_kabi_reserved1' was removed

Bug: 258442751
Change-Id: I54ce181074ad66626dfa401c4757bbb91636aeac
Signed-off-by: Bart Van Assche <bvanassche@google.com>

The following deadlock has been observed on multiple test setups:

 * ufshcd_wl_suspend() is waiting for blk_execute_rq(START STOP UNIT) to
   complete while ufshcd_wl_suspend() holds host_sem.

 * The SCSI error handler is activated, changes the host state to
   SHOST_RECOVERY, ufshcd_eh_host_reset_handler() and ufshcd_err_handler()
   are called and the latter function tries to obtain host_sem.

This is a deadlock because blk_execute_rq() can't execute SCSI commands
while the host is in the SHOST_RECOVERY state and because the error handler
cannot make progress because host_sem is held by another thread.

Fix this deadlock as follows:

 * Fail attempts to suspend the system while the SCSI error handler is in
   progress by setting the SCMD_FAIL_IF_RECOVERING flag for START STOP UNIT
   commands.

 * If the system is suspending and a START STOP UNIT command times out,
   handle the SCSI command timeout from inside the context of the SCSI
   timeout handler instead of activating the SCSI error handler.

The runtime power management code is not affected by this deadlock since
hba->host_sem is not touched by the runtime power management functions in
the UFS driver.

Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
Change-Id: I972d9ab8492552f25e51a144a6644111bbbf2ab3
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20221018202958.1902564-11-bvanassche@acm.org


Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 258442751
(cherry picked from commit 7029e215)
Signed-off-by: Bart Van Assche <bvanassche@google.com>

Commit 6600593c ("block: rename BLK_EH_NOT_HANDLED to BLK_EH_DONE")
made it impossible for .eh_timed_out() implementations to call
scsi_done() without causing a crash.

Restore support for SCSI timeout handlers to call scsi_done() as follows:

 * Change all .eh_timed_out() handlers as follows:

   - Change the return type into enum scsi_timeout_action.
   - Change BLK_EH_RESET_TIMER into SCSI_EH_RESET_TIMER.
   - Change BLK_EH_DONE into SCSI_EH_NOT_HANDLED.

 * In scsi_timeout(), convert the SCSI_EH_* values into BLK_EH_* values.

Reviewed-by: Lee Duncan <lduncan@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: John Garry <john.garry@huawei.com>
Cc: Mike Christie <michael.christie@oracle.com>
Cc: Hannes Reinecke <hare@suse.de>
Change-Id: I2971180d906e581447cacf89c0f5cc9f9d0d02e9
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20221018202958.1902564-3-bvanassche@acm.org


Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 258442751
(cherry picked from commit dee7121e)
[ bvanassche: modified this patch such that a new callback is added
  instead of modifying an existing callback ]
Signed-off-by: Bart Van Assche <bvanassche@google.com>

For AOA re-connection, since the string ID of accessory has been changed
into a non-zero value, the f_accessory failes to call `usb_string_id` to
increment `next_string_id`. This makes the ADB interface display a wrong
name.

Bug: 270044830
Test: CTS Verifier: USB Accessory Test
Test: manual test
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Change-Id: I807164588e80b28065e8715591a100392b04d3de

12 function symbol(s) added
  'int usb_add_config(struct usb_composite_dev *, struct usb_configuration *, int(*)(struct usb_configuration *))'
  'void usb_composite_overwrite_options(struct usb_composite_dev *, struct usb_composite_overwrite *)'
  'int usb_composite_probe(struct usb_composite_driver *)'
  'void usb_composite_unregister(struct usb_composite_driver *)'
  'void usb_ep_autoconfig_reset(struct usb_gadget *)'
  'int usb_gadget_connect(struct usb_gadget *)'
  'int usb_gadget_disconnect(struct usb_gadget *)'
  'struct usb_function * usb_get_function(struct usb_function_instance *)'
  'struct usb_function_instance * usb_get_function_instance(const char *)'
  'void usb_put_function(struct usb_function *)'
  'void usb_remove_function(struct usb_configuration *, struct usb_function *)'
  'int usb_string_ids_tab(struct usb_composite_dev *, struct usb_string *)'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: I90e2ac5054817660b8dc480e3f0b4e35ce23c21c

23 function symbol(s) added
  'void cfg80211_assoc_timeout(struct net_device *, struct cfg80211_bss *)'
  'void cfg80211_cac_event(struct net_device *, const struct cfg80211_chan_def *, enum nl80211_radar_event, gfp_t)'
  'void cfg80211_ch_switch_started_notify(struct net_device *, struct cfg80211_chan_def *, u8)'
  'void cfg80211_cqm_pktloss_notify(struct net_device *, const u8 *, u32, gfp_t)'
  'void cfg80211_cqm_rssi_notify(struct net_device *, enum nl80211_cqm_rssi_threshold_event, s32, gfp_t)'
  'void cfg80211_ft_event(struct net_device *, struct cfg80211_ft_event_params *)'
  'void cfg80211_notify_new_peer_candidate(struct net_device *, const u8 *, const u8 *, u8, int, gfp_t)'
  'void cfg80211_probe_status(struct net_device *, const u8 *, u64, bool, s32, bool, gfp_t)'
  'void cfg80211_radar_event(struct wiphy *, struct cfg80211_chan_def *, gfp_t)'
  'void cfg80211_report_obss_beacon_khz(struct wiphy *, const u8 *, size_t, int, int)'
  'void cfg80211_rx_assoc_resp(struct net_device *, struct cfg80211_bss *, const u8 *, size_t, int, const u8 *, size_t)'
  'void cfg80211_rx_mlme_mgmt(struct net_device *, const u8 *, size_t)'
  'bool cfg80211_rx_unexpected_4addr_frame(struct net_device *, const u8 *, gfp_t)'
  'void cfg80211_tx_mlme_mgmt(struct net_device *, const u8 *, size_t)'
  'bool dev_valid_name(const char *)'
  'void ieee80211_amsdu_to_8023s(struct sk_buff *, struct sk_buff_head *, const u8 *, enum nl80211_iftype, const unsigned int, const u8 *, const u8 *)'
  'bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *, u8 *)'
  'void sched_set_normal(struct task_struct *, int)'
  'void skb_append(struct sk_buff *, struct sk_buff *, struct sk_buff_head *)'
  'void * skb_pull_rcsum(struct sk_buff *, unsigned int)'
  'int usb_anchor_empty(struct usb_anchor *)'
  'void usb_reset_endpoint(struct usb_device *, unsigned int)'
  'int usb_string(struct usb_device *, int, char *, size_t)'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: I9ab5b9b161ad70b295ace0a7897c8ae7bcc609ef

This reverts commit 76d62f24.

So while priority inversion on the pmsg_lock is an occasional
problem that an rt_mutex would help with, in uses where logging
is writing to pmsg heavily from multiple threads, the pmsg_lock
can be heavily contended.

After this change landed, it was reported that cases where the
mutex locking overhead was commonly adding on the order of 10s
of usecs delay had suddenly jumped to ~msec delay with rtmutex.

It seems the slight differences in the locks under this level
of contention causes the normal mutexes to utilize the spinning
optimizations, while the rtmutexes end up in the sleeping
slowpath (which allows additional threads to pile on trying
to take the lock).

In this case, it devolves to a worse case senerio where the lock
acquisition and scheduling overhead dominates, and each thread
is waiting on the order of ~ms to do ~us of work.

Obviously, having tons of threads all contending on a single
lock for logging is non-optimal, so the proper fix is probably
reworking pstore pmsg to have per-cpu buffers so we don't have
contention.

Additionally, Steven Rostedt has provided some furhter
optimizations for rtmutexes that improves the rtmutex spinning
path, but at least in my testing, I still see the test tripping
into the sleeping path on rtmutexes while utilizing the spinning
path with mutexes.

But in the short term, lets revert the change to the rt_mutex
and go back to normal mutexes to avoid a potentially major
performance regression. And we can work on optimizations to both
rtmutexes and finer-grained locking for pstore pmsg in the
future.

Cc: Wei Wang <wvw@google.com>
Cc: Midas Chien<midaschieh@google.com>
Cc: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Anton Vorontsov <anton@enomsg.org>
Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: kernel-team@android.com
Fixes: 76d62f24 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion")
Reported-by: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com
Bug: 271041816
Bug: 272453930
(cherry picked from commit 5239a89b
 https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git

 for-next/pstore )
Change-Id: Iadf30bcbf5ba3895dd4af8c15c3a8aecf4301acb
Signed-off-by: John Stultz <jstultz@google.com>

Open-code scsi_execute() because a later patch will modify scmd->flags and
because scsi_execute() does not support setting scmd->flags. No
functionality is changed.

Change-Id: Ic7b011fdcb575bcad5b981e7beb12bb43f53627f
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20221018202958.1902564-10-bvanassche@acm.org


Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Bug: 258442751
(cherry picked from commit 6a354a7e)
Signed-off-by: Bart Van Assche <bvanassche@google.com>