[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ]
bigben_probe() does not validate that the output report has the
needed report values in the first field.
A malicious device registering a report with one field and a single
value causes an head OOB write in bigben_worker() when
accessing report_field->value[1] to report_field->value[7].
Use hid_validate_values() which takes care of all the needed checks.
Bug: 268589017
Fixes: 256a90ed9e ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I575c5d4c8a63a2065752a45c47b23cf725cc57ae
[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ]
Use spinlocks to deal with workers introducing a wrapper
bigben_schedule_work(), and several spinlock checks.
Otherwise, bigben_set_led() may schedule bigben->worker after the
structure has been freed, causing a use-after-free.
Bug: 268589017
Fixes: 4eb1b01de5 ("HID: hid-bigbenff: fix race condition for scheduled work during removal")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ia3f47b68264f6c492597b0b0603f6822dc624f2b
[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ]
bigben_worker() checks report_field to be non-NULL.
The check has been added in commit
918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
to prevent a NULL pointer crash.
However, the true root cause was a missing check for output
reports, patched in commit
c7bf714f8755 ("HID: check empty report_list in bigben_probe()"),
where the type-confused report list_entry was overlapping with
a NULL pointer, which was then causing the crash.
Bug: 268589017
Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ide36490e2e4482f6cf9af931bef052f172419e31
[ Upstream commit ccf1e1626d37745d0a697db67407beec9ae9d4b8 ]
Make sure calibration values are defined to prevent potential kernel
crashes. This fixes a hypothetical issue for virtual or clone devices
inspired by a similar fix for DS4.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Changes in 5.15.91
memory: tegra: Remove clients SID override programming
memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG
arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property
ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency'
ARM: dts: imx7d-pico: Use 'clock-frequency'
ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux
ARM: imx: add missing of_node_put()
HID: intel_ish-hid: Add check for ishtp_dma_tx_map
arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity
soc: imx8m: Fix incorrect check for of_clk_get_by_name()
reset: uniphier-glue: Use reset_control_bulk API
reset: uniphier-glue: Fix possible null-ptr-deref
EDAC/highbank: Fix memory leak in highbank_mc_probe()
firmware: arm_scmi: Harden shared memory access in fetch_response
firmware: arm_scmi: Harden shared memory access in fetch_notification
tomoyo: fix broken dependency on *.conf.default
RDMA/core: Fix ib block iterator counter overflow
IB/hfi1: Reject a zero-length user expected buffer
IB/hfi1: Reserve user expected TIDs
IB/hfi1: Fix expected receive setup error exit issues
IB/hfi1: Immediately remove invalid memory from hardware
IB/hfi1: Remove user expected buffer invalidate race
affs: initialize fsdata in affs_truncate()
PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe()
arm64: dts: qcom: msm8992: Don't use sfpb mutex
arm64: dts: qcom: msm8992-libra: Add CPU regulators
arm64: dts: qcom: msm8992-libra: Fix the memory map
phy: ti: fix Kconfig warning and operator precedence
NFSD: fix use-after-free in nfsd4_ssc_setup_dul()
ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60
amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
amd-xgbe: Delay AN timeout during KR training
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
net: nfc: Fix use-after-free in local_cleanup()
net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
net: enetc: avoid deadlock in enetc_tx_onestep_tstamp()
sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb
gpio: use raw spinlock for gpio chip shadowed data
gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock
gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
pinctrl/rockchip: Use temporary variable for struct device
pinctrl/rockchip: add error handling for pull/drive register getters
pinctrl: rockchip: fix reading pull type on rk3568
net: stmmac: Fix queue statistics reading
net/sched: sch_taprio: fix possible use-after-free
l2tp: Serialize access to sk_user_data with sk_callback_lock
l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
l2tp: convert l2tp_tunnel_list to idr
l2tp: close all race conditions in l2tp_tunnel_register()
octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
net: usb: sr9700: Handle negative len
net: mdio: validate parameter addr in mdiobus_get_phy()
HID: check empty report_list in hid_validate_values()
HID: check empty report_list in bigben_probe()
net: stmmac: fix invalid call to mdiobus_get_phy()
pinctrl: rockchip: fix mux route data for rk3568
HID: revert CHERRY_MOUSE_000C quirk
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
net: ipa: disable ipa interrupt during suspend
net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT
net: mlx5: eliminate anonymous module_init & module_exit
drm/panfrost: fix GENERIC_ATOMIC64 dependency
dmaengine: Fix double increment of client_count in dma_chan_get()
net: macb: fix PTP TX timestamp failure due to packet padding
virtio-net: correctly enable callback during start_xmit
l2tp: prevent lockdep issue in l2tp_tunnel_register()
HID: betop: check shape of output reports
cifs: fix potential deadlock in cache_refresh_path()
dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
phy: phy-can-transceiver: Skip warning if no "max-bitrate"
drm/amd/display: fix issues with driver unload
nvme-pci: fix timeout request state check
tcp: avoid the lookup process failing to get sk in ehash table
octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
ptdma: pt_core_execute_cmd() should use spinlock
device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
w1: fix deadloop in __w1_remove_master_device()
w1: fix WARNING after calling w1_process()
driver core: Fix test_async_probe_init saves device in wrong array
selftests/net: toeplitz: fix race on tpacket_v3 block close
net: dsa: microchip: ksz9477: port map correction in ALU table entry register
thermal/core: Remove duplicate information when an error occurs
thermal/core: Rename 'trips' to 'num_trips'
thermal: Validate new state in cur_state_store()
thermal/core: fix error code in __thermal_cooling_device_register()
thermal: core: call put_device() only after device_register() fails
net: stmmac: enable all safety features by default
tcp: fix rate_app_limited to default to 1
scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace
cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
kcsan: test: don't put the expect array on the stack
cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist
ASoC: fsl_micfil: Correct the number of steps on SX controls
net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem
drm: Add orientation quirk for Lenovo ideapad D330-10IGL
s390/debug: add _ASM_S390_ prefix to header guard
s390: expicitly align _edata and _end symbols on page boundary
perf/x86/msr: Add Emerald Rapids
perf/x86/intel/uncore: Add Emerald Rapids
cpufreq: armada-37xx: stop using 0 as NULL pointer
ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
spi: spidev: remove debug messages that access spidev->spi without locking
KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
r8152: add vendor/device ID pair for Microsoft Devkit
platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
lockref: stop doing cpu_relax in the cmpxchg loop
firmware: coreboot: Check size of table entry and use flex-array
drm/i915: Allow switching away via vga-switcheroo if uninitialized
Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
drm/i915: Remove unused variable
x86: ACPI: cstate: Optimize C3 entry on AMD CPUs
fs: reiserfs: remove useless new_opts in reiserfs_remount
sysctl: add a new register_sysctl_init() interface
kernel/panic: move panic sysctls to its own file
panic: unset panic_on_warn inside panic()
ubsan: no need to unset panic_on_warn in ubsan_epilogue()
kasan: no need to unset panic_on_warn in end_report()
exit: Add and use make_task_dead.
objtool: Add a missing comma to avoid string concatenation
hexagon: Fix function name in die()
h8300: Fix build errors from do_exit() to make_task_dead() transition
csky: Fix function name in csky_alignment() and die()
ia64: make IA64_MCA_RECOVERY bool instead of tristate
panic: Separate sysctl logic from CONFIG_SMP
exit: Put an upper limit on how often we can oops
exit: Expose "oops_count" to sysfs
exit: Allow oops_limit to be disabled
panic: Consolidate open-coded panic_on_warn checks
panic: Introduce warn_limit
panic: Expose "warn_count" to sysfs
docs: Fix path paste-o for /sys/kernel/warn_count
exit: Use READ_ONCE() for all oops/warn limit reads
Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
drm/amdgpu: complete gfxoff allow signal during suspend without delay
scsi: hpsa: Fix allocation size for scsi_host_alloc()
KVM: SVM: fix tsc scaling cache logic
module: Don't wait for GOING modules
tracing: Make sure trace_printk() can output as soon as it can be used
trace_events_hist: add check for return value of 'create_hist_field'
ftrace/scripts: Update the instructions for ftrace-bisect.sh
cifs: Fix oops due to uncleared server->smbd_conn in reconnect
i2c: mv64xxx: Remove shutdown method from driver
i2c: mv64xxx: Add atomic_xfer method to driver
ksmbd: add smbd max io size parameter
ksmbd: add max connections parameter
ksmbd: do not sign response to session request for guest login
ksmbd: downgrade ndr version error message to debug
ksmbd: limit pdu length size according to connection status
ovl: fail on invalid uid/gid mapping at copy up
KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation
thermal: intel: int340x: Protect trip temperature from concurrent updates
ipv6: fix reachability confirmation with proxy_ndp
ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
EDAC/device: Respect any driver-supplied workqueue polling value
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
net: mana: Fix IRQ name - add PCI and queue number
scsi: ufs: core: Fix devfreq deadlocks
i2c: designware: use casting of u64 in clock multiplication to avoid overflow
netlink: prevent potential spectre v1 gadgets
net: fix UaF in netns ops registration error path
drm/i915/selftest: fix intel_selftest_modify_policy argument types
netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
netlink: annotate data races around nlk->portid
netlink: annotate data races around dst_portid and dst_group
netlink: annotate data races around sk_state
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
netrom: Fix use-after-free of a listening socket.
net/sched: sch_taprio: do not schedule in taprio_reset()
sctp: fail if no bound addresses can be used for a given scope
riscv/kprobe: Fix instruction simulation of JALR
nvme: fix passthrough csi check
gpio: mxc: Unlock on error path in mxc_flip_edge()
ravb: Rename "no_ptp_cfg_active" and "ptp_cfg_active" variables
net: ravb: Fix lack of register setting after system resumed for Gen3
net: ravb: Fix possible hang if RIS2_QFF1 happen
net: mctp: mark socks as dead on unhash, prevent re-add
thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
net/tg3: resolve deadlock in tg3_reset_task() during EEH
net: mdio-mux-meson-g12a: force internal PHY off on mux switch
treewide: fix up files incorrectly marked executable
tools: gpio: fix -c option of gpio-event-mon
Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
cpufreq: Move to_gov_attr_set() to cpufreq.h
cpufreq: governor: Use kobject release() method to free dbs_data
kbuild: Allow kernel installation packaging to override pkg-config
block: fix and cleanup bio_check_ro
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
netfilter: conntrack: unify established states for SCTP paths
perf/x86/amd: fix potential integer overflow on shift of a int
Linux 5.15.91
Change-Id: I1a0a227ff3f034e4a07501ebbd97458fb1fec818
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ]
betopff_init() only checks the total sum of the report counts for each
report field to be at least 4, but hid_betopff_play() expects 4 report
fields.
A device advertising an output report with one field and 4 report counts
would pass the check but crash the kernel with a NULL pointer dereference
in hid_betopff_play().
Fixes: 52cd7785f3 ("HID: betop: add drivers/hid/hid-betopff.c")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cbf44580ce6b310272a73e3e794233fd064330bd ]
This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk
for some mice"), as it turns out to break reboot on some platforms for reason
yet to be understood.
Fixes: f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice")
Reported-by: Christian Zigotzky <chzigotzky@xenosoft.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d ]
Add a check for empty report_list in bigben_probe().
The missing check causes a type confusion when issuing a list_entry()
on an empty report_list.
The problem is caused by the assumption that the device must
have valid report_list. While this will be true for all normal HID
devices, a suitably malicious device can violate the assumption.
Fixes: 256a90ed9e ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b12fece4c64857e5fab4290bf01b2e0317a88456 ]
Add a check for empty report_list in hid_validate_values().
The missing check causes a type confusion when issuing a list_entry()
on an empty report_list.
The problem is caused by the assumption that the device must
have valid report_list. While this will be true for all normal HID
devices, a suitably malicious device can violate the assumption.
Fixes: 1b15d2e5b8 ("HID: core: fix validation of report id 0")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ]
As the kcalloc may return NULL pointer,
it should be better to check the ishtp_dma_tx_map
before use in order to avoid NULL pointer dereference.
Fixes: 3703f53b99 ("HID: intel_ish-hid: ISH Transport layer")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Changes in 5.15.87
usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
cifs: fix oops during encryption
Revert "selftests/bpf: Add test for unstable CT lookup API"
nvme-pci: fix doorbell buffer value endianness
nvme-pci: fix mempool alloc size
nvme-pci: fix page size checks
ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
ACPI: resource: do IRQ override on LENOVO IdeaPad
ACPI: resource: do IRQ override on XMG Core 15
ACPI: resource: do IRQ override on Lenovo 14ALC7
block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
ata: ahci: Fix PCS quirk application for suspend
nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
nvmet: don't defer passthrough commands with trivial effects to the workqueue
fs/ntfs3: Validate BOOT record_size
fs/ntfs3: Add overflow check for attribute size
fs/ntfs3: Validate data run offset
fs/ntfs3: Add null pointer check to attr_load_runs_vcn
fs/ntfs3: Fix memory leak on ntfs_fill_super() error path
fs/ntfs3: Add null pointer check for inode operations
fs/ntfs3: Validate attribute name offset
fs/ntfs3: Validate buffer length while parsing index
fs/ntfs3: Validate resident attribute name
fs/ntfs3: Fix slab-out-of-bounds read in run_unpack
soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15
fs/ntfs3: Validate index root when initialize NTFS security
fs/ntfs3: Use __GFP_NOWARN allocation at wnd_init()
fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_fill_super()
fs/ntfs3: Delete duplicate condition in ntfs_read_mft()
fs/ntfs3: Fix slab-out-of-bounds in r_page
objtool: Fix SEGFAULT
powerpc/rtas: avoid device tree lookups in rtas_os_term()
powerpc/rtas: avoid scheduling in rtas_os_term()
HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
HID: plantronics: Additional PIDs for double volume key presses quirk
pstore: Properly assign mem_type property
pstore/zone: Use GFP_ATOMIC to allocate zone buffer
hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
binfmt: Fix error return code in load_elf_fdpic_binary()
ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
ALSA: line6: correct midi status byte when receiving data from podxt
ALSA: line6: fix stack overflow in line6_midi_transmit
pnode: terminate at peers of source
mfd: mt6360: Add bounds checking in Regmap read/write call-backs
md: fix a crash in mempool_free
mm, compaction: fix fast_isolate_around() to stay within boundaries
f2fs: should put a page when checking the summary info
f2fs: allow to read node block after shutdown
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
tpm: acpi: Call acpi_put_table() to fix memory leak
tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
kcsan: Instrument memcpy/memset/memmove with newer Clang
ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
rcu-tasks: Simplify trc_read_check_handler() atomic operations
net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
net/af_packet: make sure to pull mac header
media: stv0288: use explicitly signed char
soc: qcom: Select REMAP_MMIO for LLCC driver
kest.pl: Fix grub2 menu handling for rebooting
ktest.pl minconfig: Unset configs instead of just removing them
jbd2: use the correct print format
perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D
perf/x86/intel/uncore: Clear attr_update properly
arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
btrfs: fix resolving backrefs for inline extent followed by prealloc
ARM: ux500: do not directly dereference __iomem
arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
selftests: Use optional USERCFLAGS and USERLDFLAGS
PM/devfreq: governor: Add a private governor_data for governor
cpufreq: Init completion before kobject_init_and_add()
ALSA: patch_realtek: Fix Dell Inspiron Plus 16
ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
fs: dlm: fix sock release if listen fails
fs: dlm: retry accept() until -EAGAIN or error returns
mptcp: mark ops structures as ro_after_init
mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
dm thin: Use last transaction's pmd->root when commit failed
dm thin: resume even if in FAIL mode
dm thin: Fix UAF in run_timer_softirq()
dm integrity: Fix UAF in dm_integrity_dtr()
dm clone: Fix UAF in clone_dtr()
dm cache: Fix UAF in destroy()
dm cache: set needs_check flag after aborting metadata
tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
perf/core: Call LSM hook after copying perf_event_attr
of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values
KVM: VMX: Resume guest immediately when injecting #GP on ECREATE
KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1
x86/microcode/intel: Do not retry microcode reloading on the APs
ftrace/x86: Add back ftrace_expected for ftrace bug reports
x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
tracing: Fix race where eprobes can be called before the event
tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE
tracing/hist: Fix wrong return value in parse_action_params()
tracing/probes: Handle system names with hyphens
tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
staging: media: tegra-video: fix chan->mipi value on error
staging: media: tegra-video: fix device_node use after free
ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
media: dvb-core: Fix double free in dvb_register_device()
media: dvb-core: Fix UAF due to refcount races at releasing
cifs: fix confusing debug message
cifs: fix missing display of three mount options
rtc: ds1347: fix value written to century register
block: mq-deadline: Do not break sequential write streams to zoned HDDs
md/bitmap: Fix bitmap chunk size overflow issues
efi: Add iMac Pro 2017 to uefi skip cert quirk
wifi: wilc1000: sdio: fix module autoloading
ASoC: jz4740-i2s: Handle independent FIFO flush bits
ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()
ipmi: fix long wait in unload when IPMI disconnect
mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
ima: Fix a potential NULL pointer access in ima_restore_measurement_list
ipmi: fix use after free in _ipmi_destroy_user()
PCI: Fix pci_device_is_present() for VFs by checking PF
PCI/sysfs: Fix double free in error path
riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
riscv: mm: notify remote harts about mmu cache updates
crypto: n2 - add missing hash statesize
crypto: ccp - Add support for TEE for PCI ID 0x14CA
driver core: Fix bus_type.match() error handling in __driver_attach()
phy: qcom-qmp-combo: fix sc8180x reset
iommu/amd: Fix ivrs_acpihid cmdline parsing code
remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
parisc: led: Fix potential null-ptr-deref in start_task()
device_cgroup: Roll back to original exceptions after copy failure
drm/connector: send hotplug uevent on connector cleanup
drm/vmwgfx: Validate the box size for the snooped cursor
drm/i915/dsi: fix VBT send packet port selection for dual link DSI
drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
ext4: silence the warning when evicting inode with dioread_nolock
ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
ext4: remove trailing newline from ext4_msg() message
fs: ext4: initialize fsdata in pagecache_write()
ext4: fix use-after-free in ext4_orphan_cleanup
ext4: fix undefined behavior in bit shift for ext4_check_flag_values
ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
ext4: add helper to check quota inums
ext4: fix bug_on in __es_tree_search caused by bad quota inode
ext4: fix reserved cluster accounting in __es_remove_extent()
ext4: check and assert if marking an no_delete evicting inode dirty
ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
ext4: fix leaking uninitialized memory in fast-commit journal
ext4: fix uninititialized value in 'ext4_evict_inode'
ext4: init quota for 'old.inode' in 'ext4_rename'
ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
ext4: fix corruption when online resizing a 1K bigalloc fs
ext4: fix error code return to user-space in ext4_get_branch()
ext4: avoid BUG_ON when creating xattrs
ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
ext4: initialize quota before expanding inode in setproject ioctl
ext4: avoid unaccounted block allocation when expanding inode
ext4: allocate extended attribute value in vmalloc area
drm/amdgpu: handle polaris10/11 overlap asics (v2)
drm/amdgpu: make display pinning more flexible (v2)
block: mq-deadline: Fix dd_finish_request() for zoned devices
tracing: Fix issue of missing one synthetic field
ext4: remove unused enum EXT4_FC_COMMIT_FAILED
ext4: use ext4_debug() instead of jbd_debug()
ext4: introduce EXT4_FC_TAG_BASE_LEN helper
ext4: factor out ext4_fc_get_tl()
ext4: fix potential out of bound read in ext4_fc_replay_scan()
ext4: disable fast-commit of encrypted dir operations
ext4: don't set up encryption key during jbd2 transaction
ext4: add missing validation of fast-commit record lengths
ext4: fix unaligned memory access in ext4_fc_reserve_space()
ext4: fix off-by-one errors in fast-commit block filling
ARM: renumber bits related to _TIF_WORK_MASK
phy: qcom-qmp-combo: fix out-of-bounds clock access
btrfs: replace strncpy() with strscpy()
btrfs: move missing device handling in a dedicate function
btrfs: fix extent map use-after-free when handling missing device in read_one_chunk
x86/mce: Get rid of msr_ops
x86/MCE/AMD: Clear DFR errors found in THR handler
media: s5p-mfc: Fix to handle reference queue during finishing
media: s5p-mfc: Clear workbit to handle error condition
media: s5p-mfc: Fix in register read and write for H264
perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
ravb: Fix "failed to switch device to config mode" message during unbind
ext4: goto right label 'failed_mount3a'
ext4: correct inconsistent error msg in nojournal mode
mbcache: automatically delete entries from cache on freeing
ext4: fix deadlock due to mbcache entry corruption
drm/i915/migrate: don't check the scratch page
drm/i915/migrate: fix offset calculation
drm/i915/migrate: fix length calculation
SUNRPC: ensure the matching upcall is in-flight upon downcall
btrfs: fix an error handling path in btrfs_defrag_leaves()
bpf: pull before calling skb_postpull_rcsum()
drm/panfrost: Fix GEM handle creation ref-counting
netfilter: nf_tables: consolidate set description
netfilter: nf_tables: add function to create set stateful expressions
netfilter: nf_tables: perform type checking for existing sets
vmxnet3: correctly report csum_level for encapsulated packet
netfilter: nf_tables: honor set timeout and garbage collection updates
veth: Fix race with AF_XDP exposing old or uninitialized descriptors
nfsd: shut down the NFSv4 state objects before the filecache
net: hns3: add interrupts re-initialization while doing VF FLR
net: hns3: refactor hns3_nic_reuse_page()
net: hns3: extract macro to simplify ring stats update code
net: hns3: fix miss L3E checking for rx packet
net: hns3: fix VF promisc mode not update when mac table full
net: sched: fix memory leak in tcindex_set_parms
qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
net: dsa: mv88e6xxx: depend on PTP conditionally
nfc: Fix potential resource leaks
vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()
vhost/vsock: Fix error handling in vhost_vsock_init()
vringh: fix range used in iotlb_translate()
vhost: fix range used in translate_desc()
vdpa_sim: fix vringh initialization in vdpasim_queue_ready()
net/mlx5: E-Switch, properly handle ingress tagged packets on VST
net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
net/mlx5: Avoid recovery in probe flows
net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
net/mlx5e: TC, Refactor mlx5e_tc_add_flow_mod_hdr() to get flow attr
net/mlx5e: Always clear dest encap in neigh-update-del
net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
net: amd-xgbe: add missed tasklet_kill
net: ena: Fix toeplitz initial hash value
net: ena: Don't register memory info on XDP exchange
net: ena: Account for the number of processed bytes in XDP
net: ena: Use bitmask to indicate packet redirection
net: ena: Fix rx_copybreak value update
net: ena: Set default value for RX interrupt moderation
net: ena: Update NUMA TPH hint register upon NUMA node update
net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device
RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
drm/meson: Reduce the FIFO lines held when AFBC is not used
filelock: new helper: vfs_inode_has_locks
ceph: switch to vfs_inode_has_locks() to fix file lock bug
gpio: sifive: Fix refcount leak in sifive_gpio_probe
net: sched: atm: dont intepret cls results when asked to drop
net: sched: cbq: dont intepret cls results when asked to drop
net: sparx5: Fix reading of the MAC address
netfilter: ipset: fix hash:net,port,net hang with /0 subnet
netfilter: ipset: Rework long task execution when adding/deleting entries
perf tools: Fix resources leak in perf_data__open_dir()
drm/imx: ipuv3-plane: Fix overlay plane width
fs/ntfs3: don't hold ni_lock when calling truncate_setsize()
drivers/net/bonding/bond_3ad: return when there's no aggregator
octeontx2-pf: Fix lmtst ID used in aura free
usb: rndis_host: Secure rndis_query check against int overflow
perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode
drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
caif: fix memory leak in cfctrl_linkup_request()
udf: Fix extension of the last extent in the file
ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
nvme: fix multipath crash caused by flush request when blktrace is enabled
io_uring: check for valid register opcode earlier
nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it
nvme: also return I/O command effects from nvme_command_effects
btrfs: check superblock to ensure the fs was not modified at thaw time
x86/kexec: Fix double-free of elf header buffer
x86/bugs: Flush IBP in ib_prctl_set()
nfsd: fix handling of readdir in v4root vs. mount upcall timeout
fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
block: don't allow splitting of a REQ_NOWAIT bio
io_uring: fix CQ waiting timeout handling
thermal: int340x: Add missing attribute for data rate base
riscv: uaccess: fix type of 0 variable on error in get_user()
riscv, kprobes: Stricter c.jr/c.jalr decoding
drm/i915/gvt: fix gvt debugfs destroy
drm/i915/gvt: fix vgpu debugfs clean in remove
hfs/hfsplus: use WARN_ON for sanity check
hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob
Revert "ACPI: PM: Add support for upcoming AMD uPEP HID AMDI007"
mptcp: dedicated request sock for subflow in v6
mptcp: use proper req destructor for IPv6
ext4: don't allow journal inode to have encrypt flag
selftests: set the BUILD variable to absolute path
btrfs: make thaw time super block check to also verify checksum
net: hns3: fix return value check bug of rx copybreak
mbcache: Avoid nesting of cache->c_list_lock under bit locks
efi: random: combine bootloader provided RNG seed with RNG protocol output
io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
drm/mgag200: Fix PLL setup for G200_SE_A rev >=4
Linux 5.15.87
Change-Id: I1df39ccb245b1e224417ee8deb8c7a5f9be2650a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.15.86
drm/amd/display: Manually adjust strobe for DCN303
usb: musb: remove extra check in musb_gadget_vbus_draw
arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable
arm64: dts: qcom: msm8996: Add MSM8996 Pro support
arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables
arm64: dts: qcom: msm8996: fix GPU OPP table
ARM: dts: qcom: apq8064: fix coresight compatible
arm64: dts: qcom: sdm630: fix UART1 pin bias
arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
arm64: dts: qcom: msm8916: Drop MSS fallback compatible
objtool, kcsan: Add volatile read/write instrumentation to whitelist
ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name
arm64: dts: qcom: sm8250: correct LPASS pin pull down
soc: qcom: llcc: make irq truly optional
arm64: dts: qcom: Correct QMP PHY child node name
arm64: dts: qcom: sm8150: fix UFS PHY registers
arm64: dts: qcom: sm8250: fix UFS PHY registers
arm64: dts: qcom: sm8350: fix UFS PHY registers
arm64: dts: qcom: sm8250: drop bogus DP PHY clock
soc: qcom: apr: make code more reuseable
soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
arm64: dts: qcom: sm6125: fix SDHCI CQE reg names
arm: dts: spear600: Fix clcd interrupt
soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
arm64: Treat ESR_ELx as a 64-bit register
arm64: mm: kfence: only handle translation faults
perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes
arm64: dts: mt6779: Fix devicetree build warnings
arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
arm64: dts: mt2712e: Fix unit address for pinctrl node
arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: turris-omnia: Add ethernet aliases
ARM: dts: turris-omnia: Add switch port 6 node
arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
seccomp: Move copy_seccomp() to no failure path.
pstore/ram: Fix error return code in ramoops_probe()
ARM: mmp: fix timer_read delay
pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
ovl: store lower path in ovl_inode
ovl: use ovl_copy_{real,upper}attr() wrappers
ovl: remove privs in ovl_copyfile()
ovl: remove privs in ovl_fallocate()
sched/fair: Cleanup task_util and capacity type
sched/uclamp: Fix relationship between uclamp and migration margin
sched/uclamp: Make task_fits_capacity() use util_fits_cpu()
sched/uclamp: Make select_idle_capacity() use util_fits_cpu()
sched/fair: Removed useless update of p->recent_used_cpu
sched/core: Introduce sched_asym_cpucap_active()
sched/uclamp: Make asym_fits_capacity() use util_fits_cpu()
cpuidle: dt: Return the correct numbers of parsed idle states
alpha: fix TIF_NOTIFY_SIGNAL handling
alpha: fix syscall entry in !AUDUT_SYSCALL case
x86/sgx: Reduce delay and interference of enclave release
PM: hibernate: Fix mistake in kerneldoc comment
fs: don't audit the capability check in simple_xattr_list()
cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
selftests/ftrace: event_triggers: wait longer for test_event_enable
perf: Fix possible memleak in pmu_dev_alloc()
lib/debugobjects: fix stat count and optimize debug_objects_mem_init
platform/x86: huawei-wmi: fix return value calculation
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
proc: fixup uptime selftest
lib/fonts: fix undefined behavior in bit shift for get_default_font
ocfs2: fix memory leak in ocfs2_stack_glue_init()
MIPS: vpe-mt: fix possible memory leak while module exiting
MIPS: vpe-cmp: fix possible memory leak while module exiting
selftests/efivarfs: Add checking of the test return value
PNP: fix name memory leak in pnp_alloc_dev()
perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology()
perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
thermal: core: fix some possible name leaks in error paths
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
SUNRPC: Return true/false (not 1/0) from bool functions
NFSD: Finish converting the NFSv2 GETACL result encoder
nfsd: don't call nfsd_file_put from client states seqfile display
genirq/irqdesc: Don't try to remove non-existing sysfs files
cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
lib/notifier-error-inject: fix error when writing -errno to debugfs file
debugfs: fix error when writing negative value to atomic_t debugfs file
rapidio: fix possible name leaks when rio_add_device() fails
rapidio: rio: fix possible name leak in rio_register_mport()
clocksource/drivers/sh_cmt: Access registers according to spec
mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem
mips: ralink: mt7621: soc queries and tests as functions
mips: ralink: mt7621: do not use kzalloc too early
futex: Move to kernel/futex/
futex: Resend potentially swallowed owner death notification
cpu/hotplug: Make target_store() a nop when target == state
cpu/hotplug: Do not bail-out in DYING/STARTING sections
clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
x86/xen: Fix memory leak in xen_init_lock_cpu()
xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
PM: runtime: Do not call __rpm_callback() from rpm_idle()
platform/chrome: cros_ec_typec: Cleanup switch handle return paths
platform/chrome: cros_ec_typec: zero out stale pointers
platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
MIPS: BCM63xx: Add check for NULL for clk in clk_enable
MIPS: OCTEON: warn only once if deprecated link status is being used
lockd: set other missing fields when unlocking files
fs: sysv: Fix sysv_nblocks() returns wrong value
rapidio: fix possible UAF when kfifo_alloc() fails
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
relay: fix type mismatch when allocating memory in relay_create_buf()
hfs: Fix OOB Write in hfs_asc2mac
rapidio: devices: fix missing put_device in mport_cdev_open
platform/mellanox: mlxbf-pmc: Fix event typo
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
wifi: rtl8xxxu: Fix reading the vendor of combo chips
drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
libbpf: Fix use-after-free in btf_dump_name_dups
libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros
ata: add/use ata_taskfile::{error|status} fields
ata: libata: fix NCQ autosense logic
ipmi: kcs: Poll OBF briefly to reduce OBE latency
drm/amdgpu/powerplay/psm: Fix memory leak in power state init
media: v4l2-ctrls: Fix off-by-one error in integer menu control check
media: coda: jpeg: Add check for kmalloc
media: adv748x: afe: Select input port when initializing AFE
media: i2c: ad5820: Fix error path
venus: pm_helpers: Fix error check in vcodec_domains_get()
soreuseport: Fix socket selection for SO_INCOMING_CPU.
media: exynos4-is: don't rely on the v4l2_async_subdev internals
libbpf: Btf dedup identical struct test needs check for nested structs/arrays
can: kvaser_usb: do not increase tx statistics when sending error message frames
can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
can: kvaser_usb_leaf: Set Warning state even without bus errors
can: kvaser_usb: make use of units.h in assignment of frequency
can: kvaser_usb_leaf: Fix improved state not being reported
can: kvaser_usb_leaf: Fix wrong CAN state after stopping
can: kvaser_usb_leaf: Fix bogus restart events
can: kvaser_usb: Add struct kvaser_usb_busparams
can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
drm/rockchip: lvds: fix PM usage counter unbalance in poweron
clk: renesas: r9a06g032: Repair grave increment error
spi: Update reference to struct spi_controller
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
ima: Handle -ESTALE returned by ima_filter_rule_match()
drm/msm/hdmi: drop unused GPIO support
drm/msm/hdmi: use devres helper for runtime PM management
bpf: Fix slot type check in check_stack_write_var_off
media: vivid: fix compose size exceed boundary
media: platform: exynos4-is: fix return value check in fimc_md_probe()
bpf: propagate precision in ALU/ALU64 operations
bpf: Check the other end of slot_type for STACK_SPILL
bpf: propagate precision across all frames, not just the last one
clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
mtd: Fix device name leak when register device failed in add_mtd_device()
Input: joystick - fix Kconfig warning for JOYSTICK_ADC
wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
media: camss: Clean up received buffers on failed start of streaming
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
rxrpc: Fix ack.bufferSize to be 0 when generating an ack
bfq: fix waker_bfqq inconsistency crash
drm/radeon: Add the missed acpi_put_table() to fix memory leak
drm/mediatek: Modify dpi power on/off sequence.
ASoC: pxa: fix null-pointer dereference in filter()
libbpf: Fix uninitialized warning in btf_dump_dump_type_data
nvmet: only allocate a single slab for bvecs
regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
nvme: return err on nvme_init_non_mdts_limits fail
regulator: qcom-rpmh: Fix PMR735a S3 regulator spec
drm/fourcc: Add packed 10bit YUV 4:2:0 format
drm/fourcc: Fix vsub/hsub for Q410 and Q401
integrity: Fix memory leakage in keyring allocation error path
ima: Fix misuse of dereference of pointer in template_desc_init_fields()
block: clear ->slave_dir when dropping the main slave_dir reference
wifi: ath10k: Fix return value in ath10k_pci_init()
drm/msm/a6xx: Fix speed-bin detection vs probe-defer
mtd: lpddr2_nvm: Fix possible null-ptr-deref
Input: elants_i2c - properly handle the reset GPIO when power is off
media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
media: solo6x10: fix possible memory leak in solo_sysfs_init()
media: platform: exynos4-is: Fix error handling in fimc_md_init()
media: videobuf-dma-contig: use dma_mmap_coherent
inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
mtd: spi-nor: hide jedec_id sysfs attribute if not present
mtd: spi-nor: Fix the number of bytes for the dummy cycles
bpf: Move skb->len == 0 checks into __bpf_redirect
HID: hid-sensor-custom: set fixed size for custom attributes
pinctrl: k210: call of_node_put()
ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
regulator: core: use kfree_const() to free space conditionally
clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
drm/amdgpu: fix pci device refcount leak
bonding: fix link recovery in mode 2 when updelay is nonzero
mtd: maps: pxa2xx-flash: fix memory leak in probe
drbd: remove call to memset before free device/resource/connection
drbd: destroy workqueue when drbd device was freed
ASoC: qcom: Add checks for devm_kcalloc
media: vimc: Fix wrong function called when vimc_init() fails
media: imon: fix a race condition in send_packet()
clk: imx8mn: rename vpu_pll to m7_alt_pll
clk: imx: replace osc_hdmi with dummy
clk: imx8mn: fix imx8mn_sai2_sels clocks list
clk: imx8mn: fix imx8mn_enet_phy_sels clocks list
pinctrl: pinconf-generic: add missing of_node_put()
media: dvb-core: Fix ignored return value in dvb_register_frontend()
media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
ASoC: dt-bindings: wcd9335: fix reset line polarity in example
ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
NFSv4.2: Fix a memory stomp in decode_attr_security_label
NFSv4.2: Fix initialisation of struct nfs4_label
NFSv4: Fix a credential leak in _nfs4_discover_trunking()
NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
NFS: Fix an Oops in nfs_d_automount()
ALSA: asihpi: fix missing pci_disable_device()
wifi: iwlwifi: mvm: fix double free on tx path.
ASoC: mediatek: mt8173: Fix debugfs registration for components
ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
drm/amd/pm/smu11: BACO is supported when it's in BACO state
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
drm/amdkfd: Fix memory leakage
ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
netfilter: conntrack: set icmpv6 redirects as RELATED
Input: wistron_btns - disable on UML
bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
bonding: uninitialized variable in bond_miimon_inspect()
spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
wifi: mac80211: fix memory leak in ieee80211_if_add()
wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
mt76: stop the radar detector after leaving dfs channel
wifi: mt76: mt7921: fix reporting of TX AGGR histogram
wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
regulator: core: fix module refcount leak in set_supply()
clk: qcom: lpass-sc7180: Fix pm_runtime usage
clk: qcom: clk-krait: fix wrong div2 functions
hsr: Add a rcu-read lock to hsr_forward_skb().
hsr: Avoid double remove of a node.
hsr: Disable netpoll.
hsr: Synchronize sending frames to have always incremented outgoing seq nr.
hsr: Synchronize sequence number updates.
configfs: fix possible memory leak in configfs_create_dir()
regulator: core: fix resource leak in regulator_register()
hwmon: (jc42) Convert register access and caching to regmap/regcache
hwmon: (jc42) Restore the min/max/critical temperatures on resume
bpf, sockmap: fix race in sock_map_free()
ALSA: pcm: Set missing stop_operating flag at undoing trigger start
media: saa7164: fix missing pci_disable_device()
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
SUNRPC: Fix missing release socket in rpc_sockname()
NFSv4.x: Fail client initialisation if state manager thread can't run
riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC
mmc: alcor: fix return value check of mmc_add_host()
mmc: moxart: fix return value check of mmc_add_host()
mmc: mxcmmc: fix return value check of mmc_add_host()
mmc: pxamci: fix return value check of mmc_add_host()
mmc: rtsx_pci: fix return value check of mmc_add_host()
mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
mmc: toshsd: fix return value check of mmc_add_host()
mmc: vub300: fix return value check of mmc_add_host()
mmc: wmt-sdmmc: fix return value check of mmc_add_host()
mmc: atmel-mci: fix return value check of mmc_add_host()
mmc: omap_hsmmc: fix return value check of mmc_add_host()
mmc: meson-gx: fix return value check of mmc_add_host()
mmc: via-sdmmc: fix return value check of mmc_add_host()
mmc: wbsd: fix return value check of mmc_add_host()
mmc: mmci: fix return value check of mmc_add_host()
mmc: renesas_sdhi: alway populate SCC pointer
memstick: ms_block: Add error handling support for add_disk()
memstick/ms_block: Add check for alloc_ordered_workqueue
mmc: core: Normalize the error handling branch in sd_read_ext_regs()
regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe()
media: c8sectpfe: Add of_node_put() when breaking out of loop
media: coda: Add check for dcoda_iram_alloc
media: coda: Add check for kmalloc
clk: samsung: Fix memory leak in _samsung_clk_register_pll()
spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
wifi: rtl8xxxu: Fix the channel width reporting
wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
blktrace: Fix output non-blktrace event when blk_classic option enabled
bpf: Do not zero-extend kfunc return values
clk: socfpga: Fix memory leak in socfpga_gate_init()
net: vmw_vsock: vmci: Check memcpy_from_msg()
net: defxx: Fix missing err handling in dfx_init()
net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
net: stmmac: fix possible memory leak in stmmac_dvr_probe()
drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
net: farsync: Fix kmemleak when rmmods farsync
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
af_unix: call proto_unregister() in the error path in af_unix_init()
net: amd-xgbe: Fix logic around active and passive cables
net: amd-xgbe: Check only the minimum speed for active/passive cables
can: tcan4x5x: Remove invalid write in clear_interrupts
can: m_can: Call the RAM init directly from m_can_chip_config
can: tcan4x5x: Fix use of register error status mask
net: lan9303: Fix read error execution path
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
sctp: sysctl: make extra pointers netns aware
Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS
Bluetooth: btintel: Fix missing free skb in btintel_setup_combined()
Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
stmmac: fix potential division by 0
i40e: Fix the inability to attach XDP program on downed interface
net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path
apparmor: fix a memleak in multi_transaction_new()
apparmor: fix lockdep warning when removing a namespace
apparmor: Fix abi check to include v8 abi
crypto: hisilicon/qm - fix missing destroy qp_idr
crypto: sun8i-ss - use dma_addr instead u32
crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
scsi: core: Fix a race between scsi_done() and scsi_timeout()
apparmor: Use pointer to struct aa_label for lbs_cred
PCI: dwc: Fix n_fts[] array overrun
RDMA/core: Fix order of nldev_exit call
PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
f2fs: Fix the race condition of resize flag between resizefs
crypto: rockchip - do not do custom power management
crypto: rockchip - do not store mode globally
crypto: rockchip - add fallback for cipher
crypto: rockchip - add fallback for ahash
crypto: rockchip - better handle cipher key
crypto: rockchip - remove non-aligned handling
crypto: rockchip - rework by using crypto_engine
apparmor: Fix memleak in alloc_ns()
f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
f2fs: fix normal discard process
f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super()
RDMA/irdma: Report the correct link speed
scsi: qla2xxx: Fix set-but-not-used variable warnings
RDMA/siw: Fix immediate work request flush to completion queue
IB/mad: Don't call to function that might sleep while in atomic context
PCI: vmd: Disable MSI remapping after suspend
RDMA/restrack: Release MR restrack when delete
RDMA/core: Make sure "ib_port" is valid when access sysfs node
RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
RDMA/siw: Set defined status for work completion with undefined status
scsi: scsi_debug: Fix a warning in resp_write_scat()
crypto: ccree - Remove debugfs when platform_driver_register failed
crypto: cryptd - Use request context instead of stack for sub-request
crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
RDMA/hns: Fix ext_sge num error when post send
PCI: Check for alloc failure in pci_request_irq()
RDMA/hfi: Decrease PCI device reference count in error path
crypto: ccree - Make cc_debugfs_global_fini() available for module init function
RDMA/hns: fix memory leak in hns_roce_alloc_mr()
RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq
dt-bindings: visconti-pcie: Fix interrupts array max constraints
scsi: hpsa: Fix possible memory leak in hpsa_init_one()
crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
padata: Always leave BHs disabled when running ->parallel()
padata: Fix list iterator in padata_do_serial()
scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
scsi: hpsa: Fix error handling in hpsa_add_sas_host()
scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
scsi: efct: Fix possible memleak in efct_device_init()
scsi: scsi_debug: Fix a warning in resp_verify()
scsi: scsi_debug: Fix a warning in resp_report_zones()
scsi: fcoe: Fix possible name leak when device_register() fails
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
scsi: ipr: Fix WARNING in ipr_init()
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
scsi: snic: Fix possible UAF in snic_tgt_create()
RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
f2fs: avoid victim selection from previous victim section
RDMA/nldev: Fix failure to send large messages
crypto: amlogic - Remove kcalloc without check
crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
riscv/mm: add arch hook arch_clear_hugepage_flags
RDMA/hfi1: Fix error return code in parse_platform_config()
RDMA/srp: Fix error return code in srp_parse_options()
PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_
PCI: mt7621: Add sentinel to quirks table
orangefs: Fix sysfs not cleanup when dev init failed
RDMA/hns: Fix AH attr queried by query_qp
RDMA/hns: Fix PBL page MTR find
RDMA/hns: Fix page size cap from firmware
RDMA/hns: Fix error code of CMD
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
hwrng: amd - Fix PCI device refcount leak
hwrng: geode - Fix PCI device refcount leak
IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
RISC-V: Align the shadow stack
drivers: dio: fix possible memory leak in dio_init()
serial: tegra: Read DMA status before terminating
serial: 8250_bcm7271: Fix error handling in brcmuart_init()
class: fix possible memory leak in __class_register()
vfio: platform: Do not pass return buffer to ACPI _RST method
uio: uio_dmem_genirq: Fix missing unlock in irq configuration
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
usb: fotg210-udc: Fix ages old endianness issues
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails
usb: typec: tipd: Fix spurious fwnode_handle_put in error path
extcon: usbc-tusb320: Add support for mode setting and reset
extcon: usbc-tusb320: Add support for TUSB320L
usb: typec: Factor out non-PD fwnode properties
extcon: usbc-tusb320: Factor out extcon into dedicated functions
extcon: usbc-tusb320: Add USB TYPE-C support
extcon: usbc-tusb320: Update state on probe even if no IRQ pending
serial: amba-pl011: avoid SBSA UART accessing DMACR register
serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
serial: stm32: move dma_request_chan() before clk_prepare_enable()
serial: pch: Fix PCI device refcount leak in pch_request_dma()
tty: serial: clean up stop-tx part in altera_uart_tx_chars()
tty: serial: altera_uart_{r,t}x_chars() need only uart_port
serial: altera_uart: fix locking in polling mode
serial: sunsab: Fix error handling in sunsab_init()
test_firmware: fix memory leak in test_firmware_init()
misc: ocxl: fix possible name leak in ocxl_file_register_afu()
ocxl: fix pci device refcount leak when calling get_function_0()
misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
iio: temperature: ltc2983: make bulk write buffer DMA-safe
iio: adis: handle devices that cannot unmask the drdy pin
iio: adis: stylistic changes
iio:imu:adis: Move exports into IIO_ADISLIB namespace
iio: adis: add '__adis_enable_irq()' implementation
counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
coresight: trbe: remove cpuhp instance node before remove cpuhp state
usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
usb: gadget: f_hid: fix f_hidg lifetime vs cdev
usb: gadget: f_hid: fix refcount leak on error path
drivers: mcb: fix resource leak in mcb_probe()
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
chardev: fix error handling in cdev_device_add()
i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
staging: rtl8192u: Fix use after free in ieee80211_rx()
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
vme: Fix error not catched in fake_init()
gpiolib: Get rid of redundant 'else'
gpiolib: cdev: fix NULL-pointer dereferences
gpiolib: make struct comments into real kernel docs
gpiolib: protect the GPIO device against being dropped while in use by user-space
i2c: mux: reg: check return value after calling platform_get_resource()
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
usb: storage: Add check for kcalloc
tracing/hist: Fix issue of losting command info in error_log
ksmbd: Fix resource leak in ksmbd_session_rpc_open()
samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
thermal/drivers/imx8mm_thermal: Validate temperature range
thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2
thermal/drivers/qcom/lmh: Fix irq handler return value
fbdev: ssd1307fb: Drop optional dependency
fbdev: pm2fb: fix missing pci_disable_device()
fbdev: via: Fix error in via_core_init()
fbdev: vermilion: decrease reference count in error path
fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe()
fbdev: geode: don't build on UML
fbdev: uvesafb: don't build on UML
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
power: supply: fix residue sysfs file in error handle route of __power_supply_register()
perf trace: Return error if a system call doesn't exist
perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
perf trace: Handle failure when trace point folder is missed
perf symbol: correction while adjusting symbol
power: supply: z2_battery: Fix possible memleak in z2_batt_probe()
HSI: omap_ssi_core: Fix error handling in ssi_init()
power: supply: ab8500: Fix error handling in ab8500_charger_init()
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
perf stat: Refactor __run_perf_stat() common code
perf stat: Do not delay the workload with --delay
RDMA/siw: Fix pointer cast warning
fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst()
overflow: Implement size_t saturating arithmetic helpers
fs/ntfs3: Harden against integer overflows
iommu/sun50i: Fix reset release
iommu/sun50i: Consider all fault sources for reset
iommu/sun50i: Fix R/W permission check
iommu/sun50i: Fix flush size
iommu/rockchip: fix permission bits in page table entries v2
phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
include/uapi/linux/swab: Fix potentially missing __always_inline
pwm: tegra: Improve required rate calculation
fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
dmaengine: idxd: Fix crc_val field for completion record
rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
rtc: cmos: Fix event handler registration ordering issue
rtc: cmos: Fix wake alarm breakage
rtc: cmos: fix build on non-ACPI platforms
rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
rtc: cmos: Eliminate forward declarations of some functions
rtc: cmos: Rename ACPI-related functions
rtc: cmos: Disable ACPI RTC event on removal
rtc: snvs: Allow a time difference on clock register read
rtc: pcf85063: Fix reading alarm
iommu/amd: Fix pci device refcount leak in ppr_notifier()
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
macintosh: fix possible memory leak in macio_add_one_device()
macintosh/macio-adb: check the return value of ioremap()
powerpc/52xx: Fix a resource leak in an error handling path
cxl: Fix refcount leak in cxl_calc_capp_routing
powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
powerpc/perf: callchain validate kernel stack pointer bounds
powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
powerpc/hv-gpci: Fix hv_gpci event list
selftests/powerpc: Fix resource leaks
iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm
pwm: mediatek: always use bus clock for PWM on MT7622
remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()
remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
remoteproc: qcom_q6v5_pas: detach power domains on remove
remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on()
powerpc/eeh: Drop redundant spinlock initialization
powerpc/pseries/eeh: use correct API for error log size
mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ
mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe()
mfd: pm8008: Remove driver data structure pm8008_data
mfd: pm8008: Fix return value check in pm8008_probe()
netfilter: flowtable: really fix NAT IPv6 offload
rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
rtc: pcf85063: fix pcf85063_clkout_control
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
net: macsec: fix net device access prior to holding a lock
mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
block, bfq: fix possible uaf for 'bfqq->bic'
selftests/bpf: Add test for unstable CT lookup API
net: enetc: avoid buffer leaks on xdp_do_redirect() failure
nfc: pn533: Clear nfc_target before being used
unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg()
r6040: Fix kmemleak in probe and remove
igc: Enhance Qbv scheduling by using first flag bit
igc: Use strict cycles for Qbv scheduling
igc: Add checking for basetime less than zero
igc: allow BaseTime 0 enrollment for Qbv
igc: recalculate Qbv end_time by considering cycle time
igc: Lift TAPRIO schedule restriction
igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
rtc: mxc_v2: Add missing clk_disable_unprepare()
selftests: devlink: fix the fd redirect in dummy_reporter_test
openvswitch: Fix flow lookup to use unmasked key
soc: mediatek: pm-domains: Fix the power glitch issue
arm64: dts: mt8183: Fix Mali GPU clock
skbuff: Account for tail adjustment during pull operations
mailbox: mpfs: read the system controller's status
mailbox: arm_mhuv2: Fix return value check in mhuv2_probe()
mailbox: zynq-ipi: fix error handling while device_register() fails
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
myri10ge: Fix an error handling path in myri10ge_probe()
net: stream: purge sk_error_queue in sk_stream_kill_queues()
HID: amd_sfh: Add missing check for dma_alloc_coherent
rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
arm64: make is_ttbrX_addr() noinstr-safe
video: hyperv_fb: Avoid taking busy spinlock on panic path
x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
binfmt_misc: fix shift-out-of-bounds in check_special_flags
fs: jfs: fix shift-out-of-bounds in dbAllocAG
udf: Avoid double brelse() in udf_rename()
jfs: Fix fortify moan in symlink
fs: jfs: fix shift-out-of-bounds in dbDiscardAG
ACPICA: Fix error code path in acpi_ds_call_control_method()
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
acct: fix potential integer overflow in encode_comp_t()
hfs: fix OOB Read in __hfs_brec_find
drm/etnaviv: add missing quirks for GC300
media: imx-jpeg: Disable useless interrupt to avoid kernel panic
brcmfmac: return error when getting invalid max_flowrings from dongle
wifi: ath9k: verify the expected usb_endpoints are present
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
ipmi: fix memleak when unload ipmi driver
drm/amd/display: prevent memory leak
Revert "drm/amd/display: Limit max DSC target bpp for specific monitors"
qed (gcc13): use u16 for fid to be big enough
bpf: make sure skb->len != 0 when redirecting to a tunneling device
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
hamradio: baycom_epp: Fix return type of baycom_send_packet()
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
igb: Do not free q_vector unless new one was allocated
drm/amdgpu: Fix type of second parameter in trans_msg() callback
drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
s390/ctcm: Fix return type of ctc{mp,}m_tx()
s390/netiucv: Fix return type of netiucv_tx()
s390/lcs: Fix return type of lcs_start_xmit()
drm/msm: Use drm_mode_copy()
drm/rockchip: Use drm_mode_copy()
drm/sti: Use drm_mode_copy()
drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid()
drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
md/raid1: stop mdx_raid1 thread when raid1 array run failed
drm/amd/display: fix array index out of bound error in bios parser
net: add atomic_long_t to net_device_stats fields
ipv6/sit: use DEV_STATS_INC() to avoid data-races
mrp: introduce active flags to prevent UAF when applicant uninit
ppp: associate skb with a device at tx
bpf: Prevent decl_tag from being referenced in func_proto arg
ethtool: avoiding integer overflow in ethtool_phys_id()
media: dvb-frontends: fix leak of memory fw
media: dvbdev: adopts refcnt to avoid UAF
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
blk-mq: fix possible memleak when register 'hctx' failed
drm/amd/display: Use the largest vready_offset in pipe group
libbpf: Avoid enum forward-declarations in public API in C++ mode
regulator: core: fix use_count leakage when handling boot-on
wifi: mt76: do not run mt76u_status_worker if the device is not running
mmc: f-sdh30: Add quirks for broken timeout clock capability
mmc: renesas_sdhi: better reset from HS400 mode
media: si470x: Fix use-after-free in si470x_int_in_callback()
clk: st: Fix memory leak in st_of_quadfs_setup()
crypto: hisilicon/hpre - fix resource leak in remove process
scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs
scsi: ufs: Reduce the START STOP UNIT timeout
scsi: elx: libefc: Fix second parameter type in state callbacks
hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
tools/include: Add _RET_IP_ and math definitions to kernel.h
KVM: selftests: Fix build regression by using accessor function
hwmon: (jc42) Fix missing unlock on error in jc42_write()
ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
ALSA: hda: add snd_hdac_stop_streams() helper
ASoC: Intel: Skylake: Fix driver hang during shutdown
ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe()
ASoC: wm8994: Fix potential deadlock
ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
ASoC: rt5670: Remove unbalanced pm_runtime_put()
drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern
LoadPin: Ignore the "contents" argument of the LSM hooks
pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
afs: Fix lost servers_outstanding count
pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
ima: Simplify ima_lsm_copy_rule
ALSA: usb-audio: add the quirk for KT0206 device
ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
usb: cdnsp: fix lack of ZLP for ep0
usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq
arm64: dts: qcom: sm8250: fix USB-DP PHY registers
usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
usb: dwc3: core: defer probe on ulpi_read_id timeout
xhci: Prevent infinite loop in transaction errors recovery for streams
HID: wacom: Ensure bootloader PID is usable in hidraw mode
HID: mcp2221: don't connect hidraw
loop: Fix the max_loop commandline argument treatment when it is set to 0
9p: set req refcount to zero to avoid uninitialized usage
security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6
reiserfs: Add missing calls to reiserfs_security_free()
iio: fix memory leak in iio_device_register_eventset()
iio: adc: ad_sigma_delta: do not use internal iio_dev lock
iio: adc128s052: add proper .data members in adc128_of_match table
regulator: core: fix deadlock on regulator enable
floppy: Fix memory leak in do_floppy_init()
gcov: add support for checksum field
fbdev: fbcon: release buffer when fbcon_do_set_font() failed
ovl: fix use inode directly in rcu-walk mode
btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range
scsi: qla2xxx: Fix crash when I/O abort times out
net: stmmac: fix errno when create_singlethread_workqueue() fails
media: dvbdev: fix build warning due to comments
media: dvbdev: fix refcnt bug
extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered
mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code
pwm: tegra: Fix 32 bit build
Linux 5.15.86
Change-Id: I4ec30b690e8dbd554044495e26360a86cc042069
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.15.85
udf: Discard preallocation before extending file with a hole
udf: Fix preallocation discarding at indirect extent boundary
udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
udf: Fix extending file within last block
usb: gadget: uvc: Prevent buffer overflow in setup handler
USB: serial: option: add Quectel EM05-G modem
USB: serial: cp210x: add Kamstrup RF sniffer PIDs
USB: serial: f81232: fix division by zero on line-speed change
USB: serial: f81534: fix division by zero on line-speed change
xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N
igb: Initialize mailbox message for VF reset
usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake
HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk
Bluetooth: L2CAP: Fix u8 overflow
selftests: net: Use "grep -E" instead of "egrep"
net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
Linux 5.15.85
Change-Id: I0e9aead7abc736a094e48a563a0fb8d23a536e43
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.15.83
clk: generalize devm_clk_get() a bit
clk: Provide new devm_clk helpers for prepared and enabled clocks
mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse()
arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
arm: dts: rockchip: fix node name for hym8563 rtc
arm: dts: rockchip: remove clock-frequency from rtc
ARM: dts: rockchip: fix ir-receiver node names
arm64: dts: rockchip: fix ir-receiver node names
ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
fs: use acquire ordering in __fget_light()
ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
spi: mediatek: Fix DEVAPC Violation at KO Remove
ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
ASoC: rt711-sdca: fix the latency time of clock stop prepare state machine transitions
9p/fd: Use P9_HDRSZ for header size
regulator: slg51000: Wait after asserting CS pin
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
selftests/net: Find nettest in current directory
btrfs: send: avoid unaligned encoded writes when attempting to clone range
ASoC: soc-pcm: Add NULL check in BE reparenting
regulator: twl6030: fix get status of twl6032 regulators
fbcon: Use kzalloc() in fbcon_prepare_logo()
usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
9p/xen: check logical size for buffer size
net: usb: qmi_wwan: add u-blox 0x1342 composition
mm/khugepaged: take the right locks for page table retraction
mm/khugepaged: fix GUP-fast interaction by sending IPI
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
rtc: mc146818-lib: extract mc146818_avoid_UIP
rtc: cmos: avoid UIP when writing alarm time
rtc: cmos: avoid UIP when reading alarm time
cifs: fix use-after-free caused by invalid pointer `hostname`
drm/bridge: anx7625: Fix edid_read break case in sp_tx_edid_read()
xen/netback: Ensure protocol headers don't fall in the non-linear area
xen/netback: do some code cleanup
xen/netback: don't call kfree_skb() with interrupts disabled
media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
soundwire: intel: Initialize clock stop timeout
Revert "ARM: dts: imx7: Fix NAND controller size-cells"
media: v4l2-dv-timings.c: fix too strict blanking sanity checks
memcg: fix possible use-after-free in memcg_write_event_control()
mm/gup: fix gup_pud_range() for dax
Bluetooth: btusb: Add debug message for CSR controllers
Bluetooth: Fix crash when replugging CSR fake controllers
net: mana: Fix race on per-CQ variable napi work_done
KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
drm/vmwgfx: Don't use screen objects when SEV is active
drm/amdgpu/sdma_v4_0: turn off SDMA ring buffer in the s2idle suspend
drm/shmem-helper: Remove errant put in error path
drm/shmem-helper: Avoid vm_open error paths
net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()
HID: usbhid: Add ALWAYS_POLL quirk for some mice
HID: hid-lg4ff: Add check for empty lbuf
HID: core: fix shift-out-of-bounds in hid_report_raw_event
HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10
can: af_can: fix NULL pointer dereference in can_rcv_filter
clk: Fix pointer casting to prevent oops in devm_clk_release()
gpiolib: improve coding style for local variables
gpiolib: check the 'ngpios' property in core gpiolib code
gpiolib: fix memory leak in gpiochip_setup_dev()
netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
drm/vmwgfx: Fix race issue calling pin_user_pages
ieee802154: cc2520: Fix error return code in cc2520_hw_init()
ca8210: Fix crash by zero initializing data
netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
gpio: amd8111: Fix PCI device reference count leak
e1000e: Fix TX dispatch condition
igb: Allocate MSI-X vector when testing
net: broadcom: Add PTP_1588_CLOCK_OPTIONAL dependency for BCMGENET under ARCH_BCM2835
drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420
af_unix: Get user_ns from in_skb in unix_diag_get_exact().
vmxnet3: correctly report encapsulated LRO packet
vmxnet3: use correct intrConf reference when using extended queues
Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
Bluetooth: Fix not cleanup led when bt_init fails
net: dsa: ksz: Check return value
net: dsa: hellcreek: Check return value
net: dsa: sja1105: Check return value
selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
net: encx24j600: Add parentheses to fix precedence
net: encx24j600: Fix invalid logic in reading of MISTAT register
net: mdiobus: fwnode_mdiobus_register_phy() rework error handling
net: mdiobus: fix double put fwnode in the error path
octeontx2-pf: Fix potential memory leak in otx2_init_tc()
xen-netfront: Fix NULL sring after live migration
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
i40e: Fix not setting default xps_cpus after reset
i40e: Fix for VF MAC address 0
i40e: Disallow ip4 and ip6 l4_4_bytes
NFC: nci: Bounds check struct nfc_target arrays
nvme initialize core quirks before calling nvme_init_subsystem
gpio/rockchip: fix refcount leak in rockchip_gpiolib_register()
net: stmmac: fix "snps,axi-config" node property parsing
ip_gre: do not report erspan version on GRE interface
net: microchip: sparx5: Fix missing destroy_workqueue of mact_queue
net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
net: mdio: fix unbalanced fwnode reference count in mdio_device_release()
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
tipc: Fix potential OOB in tipc_link_proto_rcv()
ipv4: Fix incorrect route flushing when source address is deleted
ipv4: Fix incorrect route flushing when table ID 0 is used
net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
tipc: call tipc_lxc_xmit without holding node_read_lock
ethernet: aeroflex: fix potential skb leak in greth_init_rings()
dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove()
xen/netback: fix build warning
net: phy: mxl-gpy: fix version reporting
net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
ipv6: avoid use-after-free in ip6_fragment()
net: thunderbolt: fix memory leak in tbnet_open()
net: mvneta: Fix an out of bounds check
macsec: add missing attribute validation for offload
s390/qeth: fix various format strings
s390/qeth: fix use-after-free in hsci
can: esd_usb: Allow REC and TEC to return to zero
block: move CONFIG_BLOCK guard to top Makefile
io_uring: move to separate directory
io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()
Linux 5.15.83
Change-Id: I6fa315bcb552a500c6bfe8331d4f630f75065798
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Sync up with android13-5.15 for the following commits:
a60104c6cc Merge tag 'android13-5.15.78_r00' into android13-5.15
0c8a58469b UPSTREAM: usb: gadget: uvc: Prevent buffer overflow in setup handler
85b6370411 UPSTREAM: usb: gadget: uvc: also use try_format in set_format
0a1c1e4f64 UPSTREAM: usb: gadget: uvc: default the ctrl request interface offsets
fce2002702 UPSTREAM: usb: gadget: uvc: don't put item still in use
38ce45512f UPSTREAM: usb: gadget: uvc: Fix argument to sizeof() in uvc_register_video()
eae0c310a5 UPSTREAM: usb: gadget: uvc: add v4l2 try_format api call
5f385970be UPSTREAM: usb: gadget: uvc: add v4l2 enumeration api calls
4aa53ed66b BACKPORT: media: uvcvideo: move uvc_format_desc to common header
fc7969e41e BACKPORT: media: v4l: move helper functions for fractions from uvc to v4l2-common
0f48a44f70 UPSTREAM: usb: gadget: uvc: increase worker prio to WQ_HIGHPRI
8792df01c4 UPSTREAM: usb: move from strlcpy with unused retval to strscpy
1b2bc88b59 UPSTREAM: usb: gadget: uvc: Fix comment blocks style
8bc4e80471 UPSTREAM: usb: gadget: uvc: track frames in format entries
28431ab172 ANDROID: clocksource/arm_arch_timer: Add workaround for erratum 858921
6b4d1d8995 UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
001fc069da UPSTREAM: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
c190539f4e UPSTREAM: usb: gadget: uvc: move structs to common header
e5fe1a95c3 UPSTREAM: usb: gadget: uvc: prevent index variables to start from 0
413bfd5f1b UPSTREAM: usb: gadget: uvc: implement dwPresentationTime and scrSourceClock
baa5c6d923 UPSTREAM: usb: gadget: uvc: ensure the vdev is unset
82beac34d8 BACKPORT: UPSTREAM: usb: dwc3: EP clear halt leading to clearing of delayed_status
016d61094b ANDROID: mm/oom_kill: fix task_struct refcount_t: underflow; use-after-free.
2f40ae382f ANDROID: ABI: Update allowed list for QCOM
c7562e628c ANDROID: GKI: update allowed list for exynosauto SoC
8945ccdb22 ANDROID: GKI: update xiaomi symbol list
8501db9cda ANDROID: loop: Add vendor hook to update cmd
b73474bacc ANDROID: GKI: Update abi_gki_aarch64_qcom
0f1629ced8 ANDROID: direct_io: Add a vendor hook to update OEM-specific field of struct bio
647d9c21bc ANDROID: GKI: update xiaomi symbol list
5e05d41272 ANDROID: GKI: Update abi_gki_aarch64_qcom symbols.
4fa690983d ANDROID: GKI: Update abi_gki_aarch64_qcom
5d96c24be9 ANDROID: uid_sys_stats: defer process_notifier work if uid_lock is contended
75aa4c087e FROMGIT: bpf: btf: limit logging of ignored BTF mismatches
f162762e3a UPSTREAM: skbuff: Account for tail adjustment during pull operations
25f2c8b4c7 ANDROID: Update the ABI symbol list and xml
d0822a3f9b ANDROID: mm: Export find_vm_area
37d8fe8dc3 ANDROID: GKI: update xiaomi symbol list
b3084d784b ANDROID: vendor_hooks:vendor hook for control memory dirty rate
6d9e986186 FROMGIT: mm/cma.c: delete kmemleak objects when freeing CMA areas to buddy at boot
e51492910c BACKPORT: FROMGIT: mm/cma.c: make kmemleak aware of all CMA regions
bac2fa84f7 UPSTREAM: mm: kmemleak: alloc gray object for reserved region with direct map
b1b50c61eb UPSTREAM: usb: dwc3: gadget: Don't delay End Transfer on delayed_status
f77134986a UPSTREAM: usb: dwc3: gadget: Do not clear ep delayed stop flag during ep disable
70947d4104 UPSTREAM: usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer
6cac29527d UPSTREAM: usb: dwc3: Increase DWC3 controller halt timeout
c24377e58a ANDROID: mm: fix vma refcounting for SPF in vm_area_dup
1b8d144a47 UPSTREAM: usb: dwc3: Remove DWC3 locking during gadget suspend/resume
25e07b302b UPSTREAM: usb: dwc3: Avoid unmapping USB requests if endxfer is not complete
adcf982b9a UPSTREAM: usb: dwc3: gadget: Continue handling EP0 xfercomplete events
5dedf5e350 UPSTREAM: usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect
4483376b15 UPSTREAM: usb: dwc3: gadget: Force sending delayed status during soft disconnect
fec000d477 UPSTREAM: usb: dwc3: Do not service EP0 and conndone events if soft disconnected
c2a767880d UPSTREAM: usb: dwc3: gadget: conditionally remove requests
ad7838324a UPSTREAM: usb: dwc3: ep0: Properly handle setup_packet_pending scenario in data stage
f0c8e8fb26 UPSTREAM: usb: dwc3: gadget: Fix IN endpoint max packet size allocation
7dcee70181 UPSTREAM: usb: dwc3: gadget: Delay issuing End Transfer
7ec08af1cc UPSTREAM: usb: dwc3: gadget: Only End Transfer for ep0 data phase
1fd897b8fd UPSTREAM: usb: dwc3: ep0: Don't prepare beyond Setup stage
aa96dec5f3 UPSTREAM: usb: dwc3: gadget: move cmd_endtransfer to extra function
fd0d0cdd6d UPSTREAM: usb: dwc3: gadget: ep_queue simplify isoc start condition
8dd53dc29a UPSTREAM: usb: dwc3: gadget: Skip reading GEVNTSIZn
f99c14b160 UPSTREAM: usb: dwc3: gadget: Ignore Update Transfer cmd params
3c022868a2 UPSTREAM: usb: dwc3: gadget: Skip checking Update Transfer status
4baf5030d0 ANDROID: fips140: add crypto_memneq() back to the module
55dd45162b ANDROID: kbuild: Search external devicetree path when running clean target
a2593b3a74 ANDROID: Re-enable fast mremap and fix UAF with SPF
28e537ca36 Revert "ANDROID: Make SPF aware of fast mremaps"
11662bc7d0 ANDROID: fips140: add dump_jitterentropy command to fips140_lab_util
8e10ceb0f1 ANDROID: GKI: Update allowed list for QCOM
74ccad59c9 Revert "ANDROID: ABI: Update symbols to unisoc whitelist"
ab2dfaed45 ANDROID: page_pinner: prevent pp_buffer uninitialized access
0ef8ae8d3a ANDROID: cpufreq: add macro guard to protect vendor hook
7a3d34495c ANDROID: remove unnecessary SPECULATIVE_PAGE_FAULT config dependency
f5ade1a7ad ANDROID: usb: gadget: f_accessory: update SS/SSP descriptors
c265df840a ANDROID: Update the ABI symbol list and xml
ed6f0796dd ANDROID: sched/pelt: export ___update_load_[sum|avg]
85aa38928c ANDROID: GKI: add symbol list file for honor
6525e159bb ANDROID: Update the GKI symbol list and ABI XML
9d0ccb89bc ANDROID: irqchip/irq-gic-v3: Add vendor hook for gic suspend
b3c4378d24 ANDROID: ABI: Update symbols to unisoc whitelist
af027c97fc ANDROID: Make SPF aware of fast mremaps
8d58de2c76 ANDROID: abi_gki_aarch64_qcom: Add secure hibernation APIs
57c0c76264 ANDROID: GKI: Update symbol list for mtk
cb0ff59972 ANDROID: cpufreq: add vendor hook in cpufreq_offline
b5b2dbf1a2 UPSTREAM: locks: fix TOCTOU race when granting write lease
22b130dfad ANDROID: Update symbol list for sunxi
69fefbb3db ANDROID: GKI: Source GKI_BUILD_CONFIG_FRAGMENT after setting all variables
e80bb46694 ANDROID: Revert "ANDROID: allmodconfig: disable WERROR"
6bbccfc63e UPSTREAM: drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
0667e5dfa3 BACKPORT: Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
9c8074484f UPSTREAM: crypto: algboss - compile out test-related code when tests disabled
02ffa3bd9d UPSTREAM: crypto: api - compile out crypto_boot_test_finished when tests disabled
7bf98ba526 UPSTREAM: crypto: algboss - optimize registration of internal algorithms
46b75c8648 BACKPORT: crypto: api - optimize algorithm registration when self-tests disabled
9662706fb0 UPSTREAM: crypto: api - Fix boot-up crash when crypto manager is disabled
3f5a00a5ef UPSTREAM: crypto: api - Do not create test larvals if manager is disabled
da83ad2055 UPSTREAM: crypto: api - Export crypto_boot_test_finished
e07f20669c UPSTREAM: crypto: api - Fix built-in testing dependency failures
f72cb1622f ANDROID: GKI: Add a general aarch64 symbol list
ac16892391 ANDROID: GKI: db845c: remove led-multicolor override
39b026b051 ANDROID: GKI: enable mulitcolor-led
cf8edf1928 UPSTREAM: HID: playstation: support updated DualSense rumble mode.
a7bb941a00 UPSTREAM: HID: playstation: add initial DualSense Edge controller support
72fd652689 UPSTREAM: HID: playstation: stop DualSense output work on remove.
2096eced42 UPSTREAM: HID: playstation: convert to use dev_groups
4281e23610 UPSTREAM: HID: playstation: fix return from dualsense_player_led_set_brightness()
1c2aceb8d7 UPSTREAM: HID: playstation: expose DualSense player LEDs through LED class.
8abc9ed234 UPSTREAM: leds: add new LED_FUNCTION_PLAYER for player LEDs for game controllers.
392b327fe0 UPSTREAM: HID: playstation: expose DualSense lightbar through a multi-color LED.
f0ecfd1af7 ANDROID: GKI: Add Tuxera symbol list
ac26e9c7b8 ANDROID: cma: allow to use CMA in swap-in path
60a61c1a04 ANDROID: GKI: update xiaomi symbol list
cac282fc1a ANDROID: dm: Add a vendor hook to update bio after clone
be6c9a9b11 ANDROID: GKI: Update symbol list
4ff88497a3 ANDROID: GKI: export symbols to modify lru stats
f8c2625ba0 ANDROID: GKI: Update exynos_wear symbol list
3cc69a0a0a ANDROID: vendor hooks: Encrypt snapshot for bootloader based hibernation
72ec9e1cd2 ANDROID: vendor hooks: Export symbols for bootloader based hibernation
37a7d66607 ANDROID: abi_gki_aarch64_qcom: Update symbol list
474a540f29 ANDROID: irq: put irq_resolve_mapping under protection of __irq_enter_raw
aea6e535a2 BACKPORT: UPSTREAM: usb: typec: ucsi: Wait for the USB role switches
680c12419c UPSTREAM: rpmsg: char: Avoid double destroy of default endpoint
1a1ee4bb87 BACKPORT: exfat: fix overflow for large capacity partition
737bf2358f UPSTREAM: usb: gadget: uvc: fix changing interface name via configfs
1b90823b62 UPSTREAM: dma-mapping: Fix build error unused-value
6fcc6343c3 UPSTREAM: bpf: Ensure correct locking around vulnerable function find_vpid()
5df791308b ANDROID: abi_gki_aarch64_qcom: whitelist symbols added for cma retries
6f0ba6ad99 ANDROID: mm/cma: add vendor_hook in cma_alloc for retries
8022d8faf6 ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area
28f65c4aa3 FROMLIST: sched: Fix use-after-free bug in dup_user_cpus_ptr()
6be735d61e UPSTREAM: HID: roccat: Fix use-after-free in roccat_read()
8e0c2cedbc UPSTREAM: mm/damon: use set_huge_pte_at() to make huge pte old
1d0c369729 UPSTREAM: usb: gadget: f_mass_storage: Make CD-ROM emulation works with Windows OS
bcf5cce758 UPSTREAM: gen_compile_commands: handle multiple lines per .mod file
96ce46922d UPSTREAM: scripts/nsdeps: adjust to the format change of *.mod files
19be6b818a BACKPORT: kbuild: avoid regex RS for POSIX awk
61f4b98fe0 UPSTREAM: KVM: arm64: Always start with clearing SVE flag on load
a11aae86d8 UPSTREAM: powerpc/64: Include cache.h directly in paca.h
a3eb9c5744 UPSTREAM: KVM: arm64: vgic-v3: Consistently populate ID_AA64PFR0_EL1.GIC
bf995d5fbf UPSTREAM: module.h: simplify MODULE_IMPORT_NS
4009f67147 UPSTREAM: mac80211_hwsim: fix RCU protected chanctx access
e295ae9c84 UPSTREAM: KVM: arm64: nvhe: Eliminate kernel-doc warnings
b1cad5be29 BACKPORT: KVM: arm64: Actually prevent SMC64 SYSTEM_RESET2 from AArch32
46d726e380 UPSTREAM: KVM: arm64: Generally disallow SMC64 for AArch32 guests
35c5fa9834 UPSTREAM: virtio: use virtio_device_ready() in virtio_device_restore()
aa7f73725f UPSTREAM: mm: fix use-after-free bug when mm->mmap is reused after being freed
bc920538bb UPSTREAM: kasan: test: prevent cache merging in kmem_cache_double_destroy
435eac40de UPSTREAM: arm64: Ensure that the 'bti' macro is defined where linkage.h is included
03a56596ef UPSTREAM: mmc: mediatek: free the ext_csd when mmc_get_ext_csd success
ac6122b362 UPSTREAM: scsi: ufs: Fix double space in SCSI_UFS_HWMON description
a094f7c2d4 UPSTREAM: scsi: ufs: mediatek: Avoid sched_clock() misuse
9fe6ac18f7 UPSTREAM: scsi: ufs: core: SCSI_UFS_HWMON depends on HWMON=y
ce550b4d77 ANDROID: GKI: db845c: Update symbols list and ABI
f9bfdf7a59 BACKPORT: f2fs: invalidate meta pages only for post_read required inode
9b96bd8907 ANDROID: GKI: Update symbols to symbol list
65d4d9d5da ANDROID: cpu/hotplug: call perf event through function pointer
5feed5b144 Merge tag 'android13-5.15.74_r00' into android13-5.15
35c0e672b8 ANDROID: abi_gki_aarch64_qcom: Update symbol list
f5cbc8d09c UPSTREAM: usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
150b3c4e4b BACKPORT: ANDROID: dma-buf: heaps: replace mutex lock with spinlock
1e8b8c6263 ANDROID: Update symbol list for mtk
fa068ecbc8 ANDROID: Fix license for BUILD.bazel file.
d47ef1a984 UPSTREAM: gcov: clang: fix the buffer overflow issue
4951a62804 ANDROID: kleaf: load() then package().
d2cfc10a38 UPSTREAM: perf/arm-cmn: Add debugfs topology info
942d043ca8 UPSTREAM: perf/arm-cmn: Add CI-700 Support
ef74c2d064 UPSTREAM: dt-bindings: perf: arm-cmn: Add CI-700
d14ad92dd0 UPSTREAM: perf/arm-cmn: Support new IP features
d0205771e2 UPSTREAM: perf/arm-cmn: Demarcate CMN-600 specifics
b6a7974310 UPSTREAM: perf/arm-cmn: Move group validation data off-stack
9a74f34abd UPSTREAM: perf/arm-cmn: Optimise DTC counter accesses
fb9091356e UPSTREAM: perf/arm-cmn: Optimise DTM counter reads
86d818633c UPSTREAM: perf/arm-cmn: Refactor DTM handling
3081baf827 UPSTREAM: perf/arm-cmn: Streamline node iteration
534bc126aa UPSTREAM: perf/arm-cmn: Refactor node ID handling
11319db7b8 UPSTREAM: perf/arm-cmn: Drop compile-test restriction
40b2978978 UPSTREAM: perf/arm-cmn: Account for NUMA affinity
e82a3f108d UPSTREAM: fs: erofs: add sanity check for kobject in erofs_unregister_sysfs
8ff9996c5d ANDROID: cpufreq: times: record fast switch frequency transitions
09d0ae9798 ANDROID: abi_gki_aarch64_qcom: Add android_vh_madvise_cold_or_pageout
485c0121e7 ANDROID: GKI: MGLRU ABI Fixup
3263c8d514 ANDROID: GKI: Build multi-gen LRU
383505860c BACKPORT: mm: multi-gen LRU: design doc
3fa3e8ad5d UPSTREAM: mm: multi-gen LRU: admin guide
a95784fdac BACKPORT: mm: multi-gen LRU: debugfs interface
dd4f2bd6c0 UPSTREAM: mm: multi-gen LRU: thrashing prevention
94d1a38c47 BACKPORT: mm: multi-gen LRU: kill switch
8726e22e86 BACKPORT: mm: multi-gen LRU: optimize multiple memcgs
35e2163024 BACKPORT: mm: multi-gen LRU: support page table walks
009d857059 BACKPORT: mm: multi-gen LRU: exploit locality in rmap
53af55e4cc BACKPORT: mm: multi-gen LRU: minimal implementation
f4d4c46c3a BACKPORT: mm: multi-gen LRU: groundwork
ce62ece686 UPSTREAM: Revert "include/linux/mm_inline.h: fold __update_lru_size() into its sole caller"
3cebab25d5 BACKPORT: mm/vmscan.c: refactor shrink_node()
f3f123ebb5 BACKPORT: mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG
de96dbc641 BACKPORT: mm: x86, arm64: add arch_has_hw_pte_young()
970353b36e Revert "FROMLIST: mm: x86, arm64: add arch_has_hw_pte_young()"
475108fadd Revert "FROMLIST: mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG"
8d47a32fa8 Revert "FROMLIST: mm/vmscan.c: refactor shrink_node()"
e849bd2f88 Revert "FROMLIST: Revert "include/linux/mm_inline.h: fold __update_lru_size() into its sole caller""
60f9c51c88 Revert "FROMLIST: mm: multi-gen LRU: groundwork"
6e620d5117 Revert "FROMLIST: mm: multi-gen LRU: minimal implementation"
4bce99229a Revert "FROMLIST: mm: multi-gen LRU: exploit locality in rmap"
16e5220b3d Revert "FROMLIST: mm: multi-gen LRU: support page table walks"
4124cf4b02 Revert "FROMLIST: mm: multi-gen LRU: optimize multiple memcgs"
3a3733721b Revert "FROMLIST: mm: multi-gen LRU: kill switch"
a62a81e770 Revert "FROMLIST: mm: multi-gen LRU: thrashing prevention"
f4b12ac3bc Revert "FROMLIST: mm: multi-gen LRU: debugfs interface"
81c19190ff Revert "FROMLIST: mm: multi-gen LRU: admin guide"
b49c49542f Revert "FROMLIST: mm: multi-gen LRU: design doc"
d8c59190ad Revert "ANDROID: GKI: build multi-gen LRU"
4931d96eb3 ANDROID: mm: Use intended order-adjusted batch size
1bb821dcab ANDROID: ABI: Update allowed list for QCOM
e47b11059b ANDROID: GKI: Add exynos_wear symbol list
23fb3111f6 ANDROID: page_pinner: prevent pp_buffer access before initialization
2bd8e6670e ANDROID: KVM: arm64: Use 32-bit function ID for PSCI MEM_PROTECT call
050466c42e ANDROID: ABI: Update allowed list for QCOM
9449b4f1af ANDROID: mm: preserve vma->anon_vma after MREMAP_DONTUNMAP for SPF
cf5cad44fd ANDROID: mm: disable speculative page faults for CONFIG_NUMA
5fcb50b055 ANDROID: mm: fix speculative walk which is unsafe under RCU
749aa64ba8 ANDROID: mm: avoid using vmacache in lockless vma search
3e7526c672 ANDROID: disable page table moves when speculative page faults are enabled
3b43f23348 ANDROID: mm: skip pte_alloc during speculative page fault
d9d7f843da ANDROID: mm: introduce vma refcounting to protect vma during SPF
d7c52b0cd0 UPSTREAM: crypto: arm/xor - make vectorized C code Clang-friendly
f759aa5f65 UPSTREAM: efi: capsule-loader: Fix use-after-free in efi_capsule_write
564233e471 ANDROID: mm: add a vendor hook to rmqueue_bulk()
979df868f5 FROMGIT: mm/madvise: fix madvise_pageout for private file mappings
99e3951ea4 ANDROID: vendor_hooks: Allow shared pages reclaim via MADV_PAGEOUT
ec736ca13a ANDROID: abi_gki_aarch64_qcom: Update symbol list
710fd74d1d FROMGIT: tty: serial: qcom-geni-serial: Add support for Hibernation feature
6196aa68f6 ANDROID: GKI: Update symbol list for Amlogic
0be362f248 UPSTREAM: KVM: x86: do not report a vCPU as preempted outside instruction boundaries
50358d6729 ANDROID: mm/slab: Use EXPORT_SYMBOL for android_kmalloc_64_create
e161b0c43c ANDROID: GKI: update symbol list for ExynosAuto SoC
1da102d4e3 ANDROID: KVM: arm64: s2mpu: Fix SYNC latency regression
ce39549d92 ANDROID: KVM: arm64: iommu: Add host_stage2_idmap_complete
f0c53a5637 ANDROID: KVM: arm64: Issue CMOs when tearing down shadow pages
aec224bb9e ANDROID: GKI: Update symbol list for xiaomi
4bc79ed42f ANDROID: Add ashmem ioctl to return a unique file identifier
3a049b038e ANDROID: KVM: arm64: Fix repainting of PSCI SYSTEM_RESET2 calls
c2162eca3f ANDROID: reimplement vm_file protection during speculative page fault
a07770525e Revert "ANDROID: add vma->file_ref_count to synchronize vma->vm_file destruction"
578745e43f Revert "ANDROID: arm64/mm: protect vm_file during speculative page fault handling"
24894a547e Revert "ANDROID: x86/mm: protect vm_file during speculative page fault handling"
e9a7e9f2ff Revert "ANDROID: powerpc/mm: protect vm_file during speculative page fault handling"
4288911d5e FROMGIT: usb: core: stop USB enumeration if too many retries
b8b0948987 FROMGIT: f2fs: allow to read node block after shutdown
e796ee5695 ANDROID: KVM: arm64: Adjust PSCI MEM_PROTECT refcount across share/unshare
5e82339f4b UPSTREAM: ext4,f2fs: fix readahead of verity data
3605981d8a FROMLIST: f2fs: fix the msg data type
f9965bb807 BACKPORT: FROMLIST: f2fs: fix the assign logic of iocb
c95f78db38 ANDROID: Update the GKI symbol list and ABI XML
8a7073c106 ANDROID: mm/slab: Create 64-byte slab caches if the hardware supports it
34e03c38fd ANDROID: dma-buf: Add vendor hook for deferred dmabuf sysfs stats release
e4923174ba FROMLIST: cfi: free old cfi shadow asynchronously
9b7bf9c529 FROMLIST: cfi: enable sanitize for cfi.c
432cf292eb ANDROID: GKI: Update abi_gki_aarch64_qcom
a382999851 ANDROID: ABI: Add usb_pipe_type_check symbol
f2f619baa5 ANDROID: GKI: Update symbols to symbol list
69ec48c6a0 ANDROID: GKI: Update symbol list for Amlogic
6707ada5f7 ANDROID: dm-user: Remove bio recount in I/O path
654e0ed6fc UPSTREAM: drm/meson: Fix overflow implicit truncation warnings
aaa6cd7d0d UPSTREAM: irqchip/tegra: Fix overflow implicit truncation warnings
d75ef462c3 UPSTREAM: video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
777857c7a1 UPSTREAM: i2c: ismt: prevent memory corruption in ismt_access()
b006f3a809 ANDROID: GKI: Update symbol list for mtk STB projects
7266895825 FROMLIST: KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from EL1
b72960ae91 ANDROID: ABI: Add teace_android_rvh_rto_next_cpu to unisoc whitelist
02ac822b3d BACKPORT: rcu: Remove __read_mostly annotations from rcu_scheduler_active externs
4baff5cba1 ANDROID: ABI: Export vendor_hook to be used by memcgv2 optimization mechanism
5993940dd7 FROMLIST: xfrm: Fix oops in __xfrm_state_delete()
aaf18200c3 BACKPORT: KVM: arm64: Fix bad dereference on MTE-enabled systems
201d5f4a3e FROMLIST: binder: fix UAF of alloc->vma in race with munmap()
20af947ec9 Revert "Revert "BACKPORT: FROMLIST: ext4: implement speculative fault handling""
365ffc56b4 ANDROID: fix a race between speculative page walk and unmap operations
68f9882b75 ANDROID: GKI: update .xml file after cfg80211 changes
f6fa00feb4 UPSTREAM: wifi: cfg80211: add hardware timestamps to frame RX info
2a2c366c47 UPSTREAM: wifi: cfg80211: add a function for reporting TX status with hardware timestamps
1148c260a1 BACKPORT: wifi: nl80211: add RX and TX timestamp attributes
9c20617add BACKPORT: wifi: nl80211: add EML/MLD capabilities to per-iftype capabilities
23c1ff4ec5 FROMGIT: wifi: cfg80211: support reporting failed links
5bdebe9301 FROMGIT: wifi: cfg80211: Fix bitrates overflow issue
41f5642f15 UPSTREAM: wifi: cfg80211: fix MCS divisor value
3658e1b900 BACKPORT: wifi: nl80211: add MLD address to assoc BSS entries
20d705c31e UPSTREAM: wifi: nl80211: remove redundant err variable
acf72eda07 BACKPORT: wifi: nl80211: Add POWERED_ADDR_CHANGE feature
4743d0ad6c BACKPORT: wifi: cfg80211/mac80211: check EHT capability size correctly
89abd0e78b UPSTREAM: wifi: cfg80211: Update RNR parsing to align with Draft P802.11be_D2.0
d4ecf4c3c4 UPSTREAM: wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
da9a72662d FROMGIT: wifi: nl80211: use link ID in NL80211_CMD_SET_BSS
94afbcfb15 UPSTREAM: wifi: cfg80211: add link id to txq params
8e9375450e BACKPORT: wifi: mac80211: Align with Draft P802.11be_D2.0
fadbf9a2ca BACKPORT: wifi: mac80211: Align with Draft P802.11be_D1.5
3ae950a584 UPSTREAM: wifi: nl80211: add MLO link ID to the NL80211_CMD_FRAME TX API
483086ceca UPSTREAM: wifi: cfg80211: report link ID in NL80211_CMD_FRAME
46c8675945 UPSTREAM: wifi: cfg80211/nl80211: move rx management data into a struct
6d81ebd631 BACKPORT: wifi: nl80211/mac80211: clarify link ID in control port TX
dfdfc3041e UPSTREAM: wifi: nl80211: require MLD address on link STA add/modify
5697efd6e4 UPSTREAM: wifi: cfg80211: add cfg80211_get_iftype_ext_capa()
2c60081d52 UPSTREAM: wifi: nl80211: fix some attribute policy entries
9e73ea479d UPSTREAM: wifi: nl80211: reject fragmented and non-inheritance elements
c74a4e8436 UPSTREAM: wifi: nl80211: reject link specific elements on assoc link
3594b5cb98 UPSTREAM: wifi: cfg80211: set country_elem to NULL
2d971fdf0a UPSTREAM: wifi: nl80211: advertise MLO support
8f37e21b18 UPSTREAM: wifi: nl80211: allow link ID in set_wiphy with frequency
eed91854a5 BACKPORT: wifi: cfg80211/mac80211: Support control port TX from specific link
3120619c1b UPSTREAM: wifi: nl80211: Support MLD parameters in nl80211_set_station()
eab9f6c4ab UPSTREAM: wifi: nl80211: check MLO support in authenticate
85f1514d21 UPSTREAM: wifi: nl80211: set BSS to NULL if IS_ERR()
d9847463ac ANDROID: abi_gki_aarch64_qcom: Add drm_plane_from_index
c6432173e0 ANDROID: GKI: Update symbols to symbol list
0051c6ca25 ANDROID: add func in mm/memcontrol.c
671ba4d337 UPSTREAM: af_key: Do not call xfrm_probe_algs in parallel
4431f52671 UPSTREAM: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
c0a7deb29d ANDROID: KVM: arm64: Donate memory per vcpu for each vcpu shadow state
76094a9979 ANDROID: KVM: arm64: Initialize shadow vcpus with separate hypercalls
31d3b09cb7 ANDROID: KVM: arm64: Refactor unpinning host vcpu
bf48426928 ANDROID: KVM: arm64: Separate functions for shadow vm and vcpu init
bf94ae1300 ANDROID: KVM: arm64: Refactor code for reclaiming guest memory into a function
2c4a77c9b4 UPSTREAM: mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
e8e8278ea7 ANDROID: sched: check on_rq in freezer_should_skip()
15a4d4c54f BACKPORT: mm: don't be stuck to rmap lock on reclaim path
2ac3611cdf UPSTREAM: crypto: x86/polyval - Fix crashes when keys are not 16-byte aligned
379be12c0f ANDROID: KVM: arm64: Only unpin a vCPU SVE state if set
d6b5e9db8c ANDROID: GKI: Update symbol list for xiaomi
9527695a56 FROMGIT: f2fs: let's avoid to get cp_rwsem twice by f2fs_evict_inode by d_invalidate
d9b344dc29 ANDROID: ABI: Update symbols to unisoc whitelist for the scheduler 6st
2f4a562ed8 UPSTREAM: virtio_mmio: add support to set IRQ of a virtio device as wakeup source
56a0806bcb UPSTREAM: dt-bindings: virtio: mmio: add optional wakeup-source property
c4ef0b793d BACKPORT: mm: re-allow pinning of zero pfns
45cda0a886 BACKPORT: mm: fix is_pinnable_page against a cma page
7d53a26b25 ANDROID: Update symbol list for mtk
1f44f2214d UPSTREAM: thermal: sysfs: Fix cooling_device_stats_setup() error code path
161b98aa4c FROMGIT: usb: dwc3: gadget: Don't set IMI for no_interrupt
7947f2f48a FROMGIT: usb: dwc3: gadget: Stop processing more requests on IMI
3bdd7e23e2 FROMGIT: usb: gadget: uvc: fix sg handling during video encode
55249e0b76 FROMGIT: usb: gadget: uvc: fix sg handling in error case
45238b84d8 FROMGIT: usb: gadget: uvc: fix dropped frame after missed isoc
2d2cd1af72 UPSTREAM: usb: gadget: uvc: improve sg exit condition
3248ae0d9d UPSTREAM: usb: gadget: uvc: giveback vb2 buffer on req complete
23616a2948 UPSTREAM: usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer
a50df26246 UPSTREAM: usb: gadget: uvc: use on returned header len in video_encode_isoc_sg
c91c6e0a3f UPSTREAM: usb: gadget: uvc: consistently use define for headerlen
2616a2072c FROMGIT: arm64: io: Use asm-generic high level MMIO accessors
15fbf32b75 ANDROID: GKI: Update abi_gki_aarch64_qcom for trace_mmio
93602bed42 UPSTREAM: usb: dwc3: gadget: fix high speed multiplier setting
14bd2d1473 UPSTREAM: usb: dwc3: gadget: refactor dwc3_repare_one_trb
68d8dea7fe ANDROID: GKI: Update abi_gki_aarch64_qcom for timespec64_to_jiffies
fdf67142f3 ANDROID: vendor_hook: skip trace_android_vh_page_trylock_set when ignore_references is true
a9092347ad ANDROID: ABI: Export psi_system symbol to be used by memcgv2 optimization mechanism
6d81bca908 ANDROID: ABI: export psi_system for memcgv2's vh function optimization
ecb0dcb24a UPSTREAM: mm/damon/dbgfs: fix memory leak when using debugfs_lookup()
52808991c0 UPSTREAM: wifi: mac80211: fix MBSSID parsing use-after-free
ec4ab62846 UPSTREAM: mac80211: fix memory leaks with element parsing
4ae50d8935 UPSTREAM: mac80211: always allocate struct ieee802_11_elems
33c9746293 UPSTREAM: mac80211: mlme: find auth challenge directly
d3f1cd61da UPSTREAM: mac80211: move CRC into struct ieee802_11_elems
397e82f22b UPSTREAM: mac80211: mesh: clean up rx_bcn_presp API
1b7036d9ee UPSTREAM: wifi: cfg80211: update hidden BSSes to avoid WARN_ON
db5865ed3c UPSTREAM: wifi: mac80211: fix crash in beacon protection for P2P-device
b2126d0131 UPSTREAM: wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
64265011ea UPSTREAM: wifi: cfg80211: avoid nontransmitted BSS list corruption
56203e0ecb UPSTREAM: wifi: cfg80211: fix BSS refcounting bugs
3ebea46325 UPSTREAM: wifi: cfg80211: ensure length byte is present before access
0abe9e97c8 UPSTREAM: wifi: cfg80211/mac80211: reject bad MBSSID elements
50802a459b UPSTREAM: wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans()
0a4e0e56b6 UPSTREAM: usb: gadget: f_serial: Ensure gserial disconnected during unbind
a42bb7b44d UPSTREAM: wifi: nl80211: better validate link ID for stations
3ce62ab9f9 UPSTREAM: wifi: cfg80211: clean up links appropriately
6b5b4300ba UPSTREAM: wifi: cfg80211: add ieee80211_chanwidth_rate_flags()
dda95a93f4 UPSTREAM: wifi: cfg80211: extend cfg80211_rx_assoc_resp() for MLO
a4670eb422 BACKPORT: wifi: cfg80211: put cfg80211_rx_assoc_resp() arguments into a struct
c1bcc88a92 BACKPORT: wifi: cfg80211: adjust assoc comeback for MLO
db5bcd0cd8 BACKPORT: wifi: cfg80211: prepare association failure APIs for MLO
4c026e7989 BACKPORT: wifi: cfg80211: remove BSS pointer from cfg80211_disassoc_request
54c7401e6f UPSTREAM: wifi: nl80211: acquire wdev mutex for dump_survey
cedf0a45f1 UPSTREAM: wifi: cfg80211: drop BSS elements from assoc trace for now
85139f4bfc UPSTREAM: wifi: cfg80211: make cfg80211_auth_request::key_idx signed
e75dfe1943 UPSTREAM: wifi: nl80211: enable setting the link address at new station
d104fc76c4 UPSTREAM: wifi: nl80211: hold wdev mutex for station APIs
80f8155cfc UPSTREAM: wifi: nl80211: hold wdev mutex for channel switch APIs
7f076a74a7 UPSTREAM: wifi: nl80211: hold wdev mutex in add/mod/del link station
b1bdeb8543 UPSTREAM: wifi: cfg80211: Allow MLO TX with link source address
6f2a6c919a ANDROID: ABI: add debugfs_lookup_and_remove to whitelist
cabd649d1b UPSTREAM: sched/debug: fix dentry leak in update_sched_domain_debugfs
e681f878fc UPSTREAM: debugfs: add debugfs_lookup_and_remove()
08ef164027 ANDROID: sched: Move scratch_mask to a percpu variable
c61797f241 ANDROID: sched: Keep sched_class::set_cpus_allowed stable
448eb7ef25 FROMGIT: sched: Always clear user_cpus_ptr in do_set_cpus_allowed()
ec8cf94166 BACKPORT: FROMGIT: sched: Enforce user requested affinity
50a3a47c14 BACKPORT: FROMGIT: sched: Always preserve the user requested cpumask
54aeb5c372 BACKPORT: FROMGIT: sched: Introduce affinity_context
5001781910 FROMGIT: sched: Add __releases annotations to affine_move_task()
b3bb41cebd ANDROID: GKI: Update abi_gki_aarch64_qcom for DMA
dba7a32ef7 ANDROID: GKI: Update symbols to symbol list
ba5d7b443e ANDROID: GKI: Update symbol list for Exynos SoC
2eb7ccbee2 BACKPORT: FROMGIT: mmc: core: SD: Add BROKEN-SD-DISCARD quirk
3ade531891 BACKPORT: wifi: cfg80211: Fix validating BSS pointers in __cfg80211_connect_result
0436dc8907 UPSTREAM: mmc: sdhci: Fix host->cmd is null
e91ba0b70e ANDROID: ABI: Update symbols to unisoc whitelist for the wlan
ea095dd932 ANDROID: ABI: Update symbols to unisoc whitelist
545bb8eb6b FROMGIT: seccomp: Move copy_seccomp() to no failure path.
41300cf104 BACKPORT: FROMLIST: tracing: Add register read/write tracing support
e8a2596dec UPSTREAM: fbcon: Prevent that screen size is smaller than font size
b54f2a0d7b UPSTREAM: fbcon: Disallow setting font bigger than screen size
52833e8faf UPSTREAM: fbmem: Check virtual screen sizes in fb_set_var()
ea2a1b81e8 ANDROID: GKI: Update symbol list for VIVO
e0a18fbf05 ANDROID: GKI: Update symbol list for sunxi
3d7ba02e51 ANDROID: ABI: update allowed list for galaxy
ed0b913a4b ANDROID: ABI: Update symbols to unisoc whitelist for UFS the 1st
16aecf0f68 UPSTREAM: usb: gadget: f_fs: change ep->ep safe in ffs_epfile_io()
9dec42d377 UPSTREAM: usb: gadget: f_fs: change ep->status safe in ffs_epfile_io()
6f90f3b9c9 ANDROID: KVM: arm64: Fix MMIO guard map error handling
8324bb0aed ANDROID: GKI: Update symbols to symbol list
95af22de88 UPSTREAM: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
546f62e71b FROMLIST: locking/rwsem: Limit # of null owner retries for handoff writer
4ece302f35 FROMLIST: locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
b5e4b8916f ANDROID: abi_gki_aarch64_sony: Export block driver symbols to collect device info
ca65be56ed ANDROID: GKI: block: export block_rq_complete
316e668d5f ANDROID: ABI: update allowed list for galaxy
6d4b5281a6 ANDROID: KVM: arm64: s2mpu: Add SysMMU_SYNC timeout
c0a46be9dc ANDROID: KVM: arm64: Force CMOs with FWB when reclaiming guest pages
24d27dff64 BACKPORT: locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter
48b7cad9b0 ANDROID: Update mtktv symbol list
38e30fccb8 ANDROID: arm64: Reclaim some cpucaps to aid in backporting
e76686ed1d ANDROID: GKI: Update symbol list for mtk STB projects
7639b80540 ANDROID: debug_symbols: Add put_task_stack
807d95c66b ANDROID: abi_gki_aarch64_qcom: Add hibernation APIs
fae48a3639 ANDROID: fix kernelci build-break for !CONFIG_ANDROID_VENDOR_OEM_DATA
6232eecfa7 ANDROID: mm/filemap: Fix missing put_page() for speculative page fault
0555154508 ANDROID: abi_gki_aarch64_qcom: Add clk_restore_context and clk_save_context
fa951e233f BACKPORT: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
1554564451 ANDROID: abi_gki_aarch64_qcom: Add drm driver APIs
16a71479cb ANDROID: sched: Export sched_domains_mutex for lockdep
d2cb755a43 ANDROID: vendor hooks: Add hooks to support bootloader based hibernation
c297152a18 ANDROID: GKI: Update Amlogic symbol list
2455f6610a ANDROID: fix ABI breakage in struct psi_group
9ed7219990 FROMLIST: psi: stop relying on timer_pending for poll_work rescheduling
9040c2052e ANDROID: ABI: Update symbols to unisoc whitelist
646452113d ANDROID: ABI: Update oplus symbol list
b55a937270 ANDROID: GKI: Update symbol list for sunxi
1eedea5f8d ANDROID: abi_gki_aarch64_qcom: Export update_readahead_gfp_mask VH
041ffcd941 ANDROID: mm: add a vendor_hook to change the gfp flags
ee928517b9 ANDROID: GKI: Update vendor symbol list for vivo
4c1cf366ac ANDROID: vendor_hooks: add new parameter to android_vh_blk_alloc_rqs()
5923781e8c ANDROID: KVM: arm64: Do not advertise SVE capability in protected mode
f803a7997d ANDROID: ABI: Update symbols to unisoc whitelist for the drm
ebf773d748 ANDROID: ABI: Update symbols to unisoc whitelist for clock
372abe5b53 ANDROID: KVM: arm64: Fix MMIO guard unmap
809ec777ea ANDROID: GKI: Add RTK TV KMI symbol list
85eea22b5e ANDROID: Update QCOM symbol list for __tracepoint_android_vh_mmc_sd_update_cmdline_timing
b84c40ff60 UPSTREAM: crypto: jitter - add oversampling of noise source
4b6af87d6e BACKPORT: writeback avoid use-after-free after removing device
75b1bf99a9 ANDROID: GKI: Update abi_gki_aarch64_qcom
3ee1075693 FROMGIT: f2fs: support recording stop_checkpoint reason into super_block
e82a19427e FROMLIST: mm: fix use-after free of page_ext after race with memory-offline
898cfbf094 ANDROID: mm: introduce page_pinner
8dea6e5e50 ANDROID: ABI: Add extcon_get_property_capability symbol
8409443201 ANDROID: gki_config: enable F2FS_UNFAIR_RWSEM
285d4132a6 ANDROID: scsi: ufs: add complete init vendor hook
5756b89437 ANDROID: ABI: update allowed list for galaxy
4ec2c6e2d1 ANDROID: GKI: Update symbol list for mtk AI-vision projects
d6b20ddcd9 ANDROID: GKI: Enable HCTR2
2496e06b21 UPSTREAM: fscrypt: Add HCTR2 support for filename encryption
731238ab38 UPSTREAM: crypto: arm64/polyval - Add PMULL accelerated implementation of POLYVAL
6606d9507e UPSTREAM: crypto: x86/polyval - Add PCLMULQDQ accelerated implementation of POLYVAL
e3431e9f2b UPSTREAM: crypto: arm64/aes-xctr - Improve readability of XCTR and CTR modes
8a794a25ae UPSTREAM: crypto: arm64/aes-xctr - Add accelerated implementation of XCTR
9a11762fde UPSTREAM: crypto: x86/aesni-xctr - Add accelerated implementation of XCTR
927d58494f UPSTREAM: crypto: hctr2 - Add HCTR2 support
b07dcba017 UPSTREAM: crypto: polyval - Add POLYVAL support
24a19f56b4 UPSTREAM: crypto: xctr - Add XCTR support
96c87ab88b UPSTREAM: arm64: Add macro version of the BTI instruction
1fd5d6489a UPSTREAM: crypto: arm64/aes-neon-ctr - improve handling of single tail block
b760d25fca ANDROID: GKI: Update symbols to symbol list
8b49e4bee6 ANDROID: KVM: arm64: Initialize ptr auth in protected mode
5405862223 FROMGIT: KVM: arm64: Ignore kvm-arm.mode if !is_hyp_mode_available()
c101b51fb6 UPSTREAM: wifi: mac80211_hwsim: use 32-bit skb cookie
eb82ad82b1 UPSTREAM: wifi: mac80211_hwsim: add back erroneously removed cast
e154458b37 UPSTREAM: wifi: mac80211_hwsim: fix race condition in pending packet
5e1321eb79 ANDROID: abi_gki_aarch64_qcom: Add protocol related symbols
9122cbfc55 ANDROID: Fix lost track action type in save_track_hash
bcb5f0547e UPSTREAM: usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
c2ab21a729 ANDROID: GKI: Update symbols to symbol list
ac82d34706 ANDROID: vendor_hook: rename the the name of hooks
4a9e3b2ca6 ANDROID: vendor_hooks: Add hook in kmalloc_slab()
fcacd896ec BACKPORT: wifi: cfg80211/mac80211: separate link params from station params
5b0ceee1bd UPSTREAM: wifi: cfg80211: add API to add/modify/remove a link station
54f780d093 ANDROID: signal: Add vendor hook for memory reaping
5edc332cee ANDROID: GKI: Update abi_gki_aarch64_pixel
b80df8c286 Revert "ANDROID: vendor_hooks: Add hooks to tcp/udp send/recv msg functions."
8c09081fc0 Revert "ANDROID: sched: Add vendor hook for util-update related functions"
587cfd8e66 ANDROID: fix alignment of struct shash_desc member
e15184fefe BACKPORT: mm: make minimum slab alignment a runtime property
273bbfc4d7 BACKPORT: printk: stop including cache.h from printk.h
088ce42ab0 UPSTREAM: kasan: fix a missing header include of static_keys.h
17e4c2a950 BACKPORT: kasan: split kasan_*enabled() functions into a separate header
afa76a1c3a ANDROID: scsi: ufs: Improve MCQ error handling
9dcd74deff ANDROID: GKI: Add Sony KMI symbol list
b9707158ac ANDROID: ABI: update allowed list for galaxy
daac36f215 ANDROID: GKI: Update symbols to symbol list
effc9c940a ANDROID: GKI: Update abi_gki_aarch64_qcom symbols.
3561c27eeb UPSTREAM: Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
a89fbc0de0 ANDROID: fix add vendor hooks for unusual abort cases
0fd0345839 ANDROID: regmap: Unhide REGMAP_SPMI
314e242119 ANDROID: ABI: update allowed list for galaxy
6b1ae1157f ANDROID: Enable BUILD_GKI_CERTIFICATION_TOOLS for x86_64 GKI
cbc497caa2 ANDROID: irqchip: Fix vendor hook arguments
898941454f UPSTREAM: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
7bdc155a70 Revert "FROMLIST: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop"
94c8c2f858 ANDROID: add symbol file for type visibility symbols
0e0c25fffd ANDROID: selftests: incfs: Increase timeout in concurrent_reads_and_writes_test
bba227bfd0 ANDROID: abi_gki_aarch64_qcom: Add iio symbol list for qcom
0c3d2d04cc ANDROID: make sure all types for hooks are defined in KMI
1aeba1eea1 ANDROID: mm: cma: proper ret type for tasks interrupted by fatal signal
c2b91dc63c BACKPORT: erofs: fix use-after-free of on-stack io[]
a75431c61b ANDROID: kleaf: Explicit list of ABI files.
41a23cd26e FROMGIT: kasan: call kasan_malloc() from __kmalloc_*track_caller()
e1c0ed46cf FROMLIST: f2fs: let FI_OPU_WRITE override FADVISE_COLD_BIT
d7735e03b7 ANDROID: GKI: update the ABI xml and pixel symbol list
f8c9fae007 ANDROID: incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr
66e0726ca5 ANDROID: GKI: update vendor hook for sd
010f93525d UPSTREAM: kbuild: rename cmd_{bzip2,lzma,lzo,lz4,xzkern,zstd22}
8833039066 ANDROID: ABI: Update symbols to unisoc whitelist
a3525f6e75 ANDROID: ABI: Update symbols to unisoc whitelist for sync from local code
7c0b04f044 ANDROID: ABI: Update symbols to unisoc whitelist
e6c55bbd43 ANDROID: GKI: Update symbol list for sunxi
a3e20edea9 ANDROID: GKI: Update symbol list
ef9a35b2e6 ANDROID: ABI: Update symbols for unisoc whitelist Android13-k5.15
70a5111957 ANDROID: net: export symbol for tracepoint_consume_skb
13bedfc2f2 ANDROID: gki_defconfig: Enable CONFIG_HIBERNATION flag
32e1ff60db ANDROID: ABI: Update symbols to unisoc whitelist for sync from local code
42f39fcf09 ANDROID: GKI: update xiaomi symbol list
ca319dfc39 ANDROID: Add headers to vendor_hooks.c for type visibility
e85a386df9 BACKPORT: KVM: x86: avoid calling x86 emulator without a decoded instruction
6b2fb25eac ANDROID: ABI: Update symbols to unisoc whitelist
678d7a0952 BACKPORT: dm verity: set DM_TARGET_IMMUTABLE feature flag
a2c2b6c914 BACKPORT: pipe: Fix missing lock in pipe_resize_ring()
3c2cc4561f FROMLIST: locking/rwsem: Disable preemption while trying for rwsem lock
c82312f9b0 BACKPORT: rpmsg: virtio: Fix possible double free in rpmsg_probe()
e0440af8b2 BACKPORT: rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
cff4cc7a64 Revert "ANDROID: arm64: smp: fix Lockdep warning: RCU used illegally from idle CPU."
6a2905d352 FROMLIST: arm64: mte: move register initialization to C
7a67b48b62 Revert "BACKPORT: FROMLIST: ext4: implement speculative fault handling"
9f7ac5d820 Revert "FROMLIST: arm64: mte: move register initialization to C"
b9f272d887 ANDROID: vendor_hooks:vendor hook for mmput
c96092a914 ANDROID: GKI: Upate sunxi symbol list
5dc0a0bd6b ANDROID: remove CONFIG_TRACEPOINTS from hook definition headers
ecb7d6b106 ANDROID: remove inclusions from hook definition headers
ea45eaaaae BACKPORT: scsi: ufs: core: Increase fDeviceInit poll frequency
c17b8c3da8 FROMGIT: f2fs: increase the limit for reserve_root
35666bb866 FROMGIT: f2fs: complete checkpoints during remount
9e14ab97fe FROMGIT: f2fs: flush pending checkpoints when freezing super
b52dcd4e22 FROMGIT: f2fs: remove gc_urgent_high_limited for cleanup
e4c3ce6f7d FROMGIT: f2fs: fix wrong continue condition in GC
619b99d2d4 BACKPORT: f2fs: handle decompress only post processing in softirq
c119114518 BACKPORT: f2fs: introduce memory mode
3ec6819bff ANDROID: kleaf: Do not include GKI modules in default output of //common:kernel_aarch64.
fe1e4c55de ANDROID: GKI: Update symbols to symbol list
08b9a0b8aa ANDROID: GKI: Update symbol list for Exynos SoC
ca7f18ea25 ANDROID: ABI: Update oplus symbol list
fb2bb8f3ad ANDROID: mm: Add vendor hook in rmqueue()
193dcfee4d ANDROID: abi_gki_aarch64_qcom: Update symbol list.
1cf95b1e07 ANDROID: GKI: Update symbols to symbol list
e1b8ef44fd ANDROID: Revert "psi: allow unprivileged users with CAP_SYS_RESOURCE to write psi files"
c9ee361850 ANDROID: abi_gki_aarch64_qcom: Add hook for set_cpus_allowed_by_task
2508098b95 ANDROID: GKI: Update symbol list
06a2fffcf3 ANDROID: GKI: Update symbol list for mtk AI-vision projects
1f0f167b62 FROMGIT: wifi: cfg80211: Add link_id to cfg80211_ch_switch_started_notify()
c9375148db FROMGIT: wifi: nl80211: send MLO links channel info in GET_INTERFACE
df92dc5573 FROMGIT: wifi: cfg80211: Prevent cfg80211_wext_siwencodeext() on MLD
460e2bc5da FROMGIT: wifi: cfg80211: reject connect response with MLO params for WEP
cad63b2cf1 FROMGIT: wifi: cfg80211: get correct AP link chandef
e6c826aa9b ANDROID: reduce number of opaque structs in KMI
0226fc2e18 ANDROID: vendor_hooks: tune reclaim inactive ratio
8de5430cb7 BACKPORT: FROMGIT: PCI: dwc: Add support for 64-bit MSI target address
8181ea8d96 BACKPORT: FROMGIT: PCI: dwc: Drop dependency on ZONE_DMA32
a8dfddb2b9 Revert "BACKPORT: FROMLIST: PCI: dwc: Drop dependency on ZONE_DMA32"
c5e662db60 Revert "BACKPORT: FROMLIST: PCI: dwc: Add support for 64-bit MSI target address"
ff81c8d3f5 ANDROID: GKI: create initial PASA symbol list
55f112e068 ANDROID: vendor_hooks: Add hooks for cpufreq_acct_update_power
76be364a84 BACKPORT: irq_work: use kasan_record_aux_stack_noalloc() record callstack
cc724041ce ANDROID: vendor_hooks: Add hooks for oem futex optimization
eb6c8ea051 BACKPORT: fuse: send security context of inode on file
05e1c47bbc UPSTREAM: security: Return xattr name from security_dentry_init_security()
e8ac12a811 BACKPORT: fuse: extend init flags
a43215959d BACKPORT: scsi: ufs: core: Fix missing clk change notification on host reset
773f36077b ANDROID: ABI: Dedup the repeated symbols for Unisoc
c4ebf71500 FROMLIST: arm64: mte: move register initialization to C
f42e2933f0 FROMLIST: ufs: allow host driver to disable wb toggling during clock scaling
8d76ae003b ANDROID: GKI: update xiaomi symbol list
be69ad8227 ANDROID: Expand user_struct size.
776d084118 UPSTREAM: usb: gadget: uvc: calculate the number of request depending on framesize
26e36e62c9 UPSTREAM: usb: dwc3: gadget: increase tx fifo size for ss isoc endpoints
928bb2bbe1 UPSTREAM: usb: gadget: uvc: remove pause flag use
85791a9e63 UPSTREAM: usb: gadget: uvc: allow changing interface name via configfs
499ea1f89b UPSTREAM: usb: gadget: uvc: fix list double add in uvcg_video_pump
0db028444c ANDROID: abi_gki_aarch64_qcom: Add blk_mq_free_request
b58af507bf ANDROID: GKI: Update symbols to symbol list
0312e9cd22 ANDROID: vendor_hooks:vendor hook for __alloc_pages_slowpath.
22c312bbde ANDROID: nl80211: enable reserved attributes with upstream assignments
17e63e8b13 ANDROID: fix declaration mismatch for ns_to_kernel_old_timeval
13e5af1463 ANDROID: avoid huge-page not to clear trylock-bit after shrink_page_list.
b337f6e1a9 ANDROID: mm/memory_hotplug: Fix error path handling
695e36b60e ANDROID: GKI: Update symbol list for imx
4d91f7dff5 ANDROID: GKI: update xiaomi symbol list
39088bd0f1 UPSTREAM: usb: gadget: uvc: test if ep->desc is valid on ep_queue
48ffd4d42d UPSTREAM: usb: gadget: uvc: only pump video data if necessary
1b5de9bdc4 UPSTREAM: usb: gadget: uvc: only schedule stream in streaming state
75b799c801 UPSTREAM: usb: dwc3: gadget: Give some time to schedule isoc
8398037818 UPSTREAM: usb: gadget: composite: Show warning if function driver's descriptors are incomplete.
77672b2424 ANDROID: GKI: Add symbol list file for sunxi
555400c6f7 ANDROID: ABI: Update symbols to unisoc whitelist
73b352b9bc ANDROID: GKI: Update Symbol List for Vendor
175fa88bc2 ANDROID: kernel/sched: rebuild_sched_domains export
5dc0125847 ANDROID: vendor_hooks: Add hooks for page_cache_sync_ra
5a3e902fed FROMLIST: cgroup: Fix race condition at rebind_subsystems()
6aafd4a7e6 ANDROID: GKI: Update symbols to symbol list
7e1756dacc ANDROID: GKI: Add initial symbol list for amlogic
885f16fab6 ANDROID: gki_defconfig: enable CONFIG_USB_CONFIGFS_F_UVC
b2a6221a18 ANDROID: GKI: Update symbols to symbol list
7fa896f92d ANDROID: GKI: Update symbols to symbol list
212c9a7426 ANDROID: ABI: Update symbols to unisoc whitelist for mmc 3st
fb9c12a0f6 ANDROID: ABI: Update oplus symbol list
a54b0cc492 ANDROID: Update mtktv symbol list
bc2b2529f6 BACKPORT: cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
a30c0961dd UPSTREAM: cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
b38034b5d5 BACKPORT: FROMLIST: PCI: dwc: Add support for 64-bit MSI target address
6c9828727f BACKPORT: FROMLIST: PCI: dwc: Drop dependency on ZONE_DMA32
cfaccedb79 BACKPORT: f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
70d1b9fe5f BACKPORT: f2fs: do not set compression bit if kernel doesn't support
66a0472aac BACKPORT: f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time
b57cdff123 BACKPORT: f2fs: do not skip updating inode when retrying to flush node page
db198f61d0 BACKPORT: f2fs: do not count ENOENT for error case
39886a23bb BACKPORT: f2fs: attach inline_data after setting compression
d85467fdca BACKPORT: f2fs: allow compression for mmap files in compress_mode=user
0e65382de3 BACKPORT: f2fs: fix fallocate to use file_modified to update permissions consistently
0d0b29daf8 BACKPORT: f2fs: don't need inode lock for system hidden quota
089aeb07ab BACKPORT: f2fs: fix to clear dirty inode in f2fs_evict_inode()
05a794d93a BACKPORT: f2fs: avoid infinite loop to flush node pages
9449d07f3f BACKPORT: f2fs: fix to do sanity check on inline_dots inode
820c876e42 BACKPORT: f2fs: introduce data read/write showing path info
8637bc7602 BACKPORT: f2fs: fix wrong condition check when failing metapage read
ffb7e4633b BACKPORT: f2fs: replace congestion_wait() calls with io_schedule_timeout()
a60c2d4f12 ANDROID: vendor_hooks: Add hooks for ipa
e956d16bc2 ANDROID: GKI: add restricted vendor hook for mmc
fc9630b3cb ANDROID: vendor_hooks: add vendor hook for dma_heap_buffer_alloc
47351f748e ANDROID: GKI: Update symbol list for Exynos SoC
f729494767 ANDROID: vendor_hook: add hooks to protect locking-tsk in cpu scheduler
e5e38b46e5 ANDROID: GKI: Update symbols to symbol list
1f925159e2 ANDROID: fix kernelci issue: visibility of struct cgroup_subsys
aea5730216 ANDROID: ABI: Update symbols to unisoc whitelist for sync from local code
4899ed313f ANDROID: GKI: update the ABI xml and pixel symbol list
e7cbfabf82 ANDROID: export reclaim_pages
309a6bf81a ANDROID: vendor_hook: Add hook to not be stuck ro rmap lock in kswapd or direct_reclaim
4f5025129f FROMLIST: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
d4d10fb574 Revert "FROMLIST: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop"
2487db8d59 ANDROID: freezer: Add vendor hook to freezer for GKI purpose.
9ac0923ef5 ANDROID: user: Add vendor hook to user for GKI purpose
8b885a54ba ANDROID: GKI: Update symbol list for imx
d1bc61dd85 ANDROID: android: Export symbols for invoking cpufreq_update_util()
b109cefd6f FROMGIT: usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion
6349c3bbd5 ANDROID: GKI: add vendor hook to support emmc FFU
64ae41d79b ANDROID: GKI: Update symbols to symbol list
58c2de6dd0 ANDROID: Update symbol list of mediatek
c3677a966d ANDROID: ABI: update allowed list for galaxy
6581a0bfa7 FROMLIST: usb: gadget: f_uac2: fix superspeed transfer
e2c216a2af UPSTREAM: usb: gadget: f_uac2: clean up some inconsistent indenting
2b0d64ba20 UPSTREAM: wifi: cfg80211: Allow P2P client interface to indicate port authorization
5fad12ed63 UPSTREAM: bcache: move uapi header bcache.h to bcache code directory
99b2e4c942 UPSTREAM: arm64: perf: Support new DT compatibles
08f07e3d42 UPSTREAM: arm64: perf: Simplify registration boilerplate
48af748d03 UPSTREAM: arm64: perf: Support Denver and Carmel PMUs
952fbc560f ANDROID: Add symbols required for NVMe in abi_gki_aarch64_qcom
ce8b55bb08 ANDROID: vendor_hooks: protect multi-mapcount pages in kernel
09ebd2be6e ANDROID: add func:do_traversal_all_lruvec in mm/memcontrol.c
efbe140e82 ANDROID: vendor_hooks: account page-mapcount
bf19ba7dd0 ANDROID: GKI: allow mm vendor hooks header inclusion from header files
e99fffe1d4 ANDROID: Update symbol list for mtk
42f3a7e05f UPSTREAM: dma-buf: remove restriction of IOCTL:DMA_BUF_SET_NAME
dbe7eb9794 ANDROID: abi_gki_aarch64_qcom: Update symbol list
1d7ab182b7 ANDROID: ABI update for virtual device virtio_gpu changes
e0bf6839e7 ANDROID: mm: always destroy mmu_notifier percpu_rwsem asynchronously
3c5af3f431 UPSTREAM: kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
a379c27044 ANDROID: ABI: Update symbols to unisoc whitelist for mmc 2st
7b610b2916 ANDROID: Update symbol list of mediatek
5b6fcb2222 UPSTREAM: kbuild: Ignore __this_module in gen_autoksyms.sh
d78c536fe7 UPSTREAM: binder: fix redefinition of seq_file attributes
b52b0debf7 ANDROID: Add a script to collect information about a device's dependencies
af6d390801 BACKPORT: FROMLIST: wifi: cfg80211: Add link_id parameter to various key operations for MLO
359b4ecb6b ANDROID: Update symbol list for mtk
6360c456ed ANDROID: update symbol list for pixel
60714690fe ANDROID: scsi: ufs: add vendor hook to override key reprogramming
cacbff013b BACKPORT: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
c4fbc06424 BACKPORT: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
6bb5d6b3f7 ANDROID: GKI: update symbol list
a2f552f49c ANDROID: GKI: vendor code needs __balance_callbacks access
Change-Id: Ibee4a43f0ecbddf17851d4db250e95e83800a5a2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This is the merge of the upstream LTS release of 5.15.78 into the
android13-5.15 branch.
It contains the following commits:
c73b4619ad ANDROID: abi preservation for fscrypt change in 5.15.78
1960b1e610 Merge 5.15.78 into android13-5.15-lts
7048384c98 Revert "net: macb: Specify PHY PM management done by MAC"
845a2cc2e8 Revert "perf: Fix missing SIGTRAPs"
6f88ababa4 Merge 5.15.77 into android13-5.15-lts
92f701cae0 Revert "net: phylink: add mac_managed_pm in phylink_config structure"
8d9f3b2315 Revert "arm64: errata: Remove AES hwcap for COMPAT tasks"
eaa46dd972 Merge 5.15.76 into android13-5.15-lts
d9d889009b ANDROID: properly copy the scm_io_uring field in struct sk_buff
16d4484281 ANDROID: fix up struct sk_buf ABI breakage
2d19e77e73 Revert "bpf: Fix reference state management for synchronous callbacks"
c18696c060 Revert "tracing: Wake up ring buffer waiters on closing of the file"
d122aaf804 Revert "tracing: Add ioctl() to force ring buffer waiters to wake up"
dfd3aa1729 ANDROID: rename struct tcm_sock.cwnd_usage_seq to fix ABI
c51f6b79ce ANDROID: rename struct task_struct.in_eventfd to fix ABI
85725fbe42 Revert "ALSA: usb-audio: Register card at the last interface"
8f38fb79b5 Revert "ALSA: usb-audio: Fix last interface check for registration"
3ebc180a96 Revert "serial: 8250: Let drivers request full 16550A feature probing"
f6d7d7caaa Revert "serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices"
d1096112e5 Revert "usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug"
3447743ef1 Revert "serial: 8250: Toggle IER bits on only after irq has been set up"
b049ff121c Merge 5.15.75 into android13-5.15-lts
4ec71a9ec7 ANDROID: cpu/hotplug: call perf event through function pointer
509a32764e Linux 5.15.78
7038af4ce9 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
b66617cc3c drm/i915/sdvo: Setup DDC fully before output init
73d52322c4 drm/i915/sdvo: Filter out invalid outputs more sensibly
2219b6aad3 drm/rockchip: dsi: Force synchronous probe
dd955eb4e6 drm/rockchip: dsi: Clean up 'usage_mode' when failing to attach
cfa8a89af9 cifs: fix regression in very old smb1 mounts
3189de0ac3 ext4,f2fs: fix readahead of verity data
a663e6ab17 tee: Fix tee_shm_register() for kernel TEE drivers
d46db722a0 KVM: x86: emulator: update the emulation mode after CR0 write
942aec252b KVM: x86: emulator: update the emulation mode after rsm
9df4bb7b38 KVM: x86: emulator: introduce emulator_recalc_and_set_mode
311f1e51a2 KVM: x86: emulator: em_sysexit should update ctxt->mode
37a03de2d0 KVM: arm64: Fix bad dereference on MTE-enabled systems
167dca5e21 KVM: VMX: fully disable SGX if SECONDARY_EXEC_ENCLS_EXITING unavailable
19c2b2ffbe KVM: x86: Mask off reserved bits in CPUID.8000001FH
553fd40d3b KVM: x86: Mask off reserved bits in CPUID.80000001H
006366b96c KVM: x86: Mask off reserved bits in CPUID.80000008H
fc796fd861 KVM: x86: Mask off reserved bits in CPUID.8000001AH
ef7716398a KVM: x86: Mask off reserved bits in CPUID.80000006H
a88998446b x86/syscall: Include asm/ptrace.h in syscall_wrapper header
999cff2b6c ext4: fix BUG_ON() when directory entry has invalid rec_len
0a43c015e9 ext4: fix warning in 'ext4_da_release_space'
ada82803a7 parisc: Avoid printing the hardware path twice
081ff43a77 parisc: Export iosapic_serial_irq() symbol for serial port driver
5daf985dd0 parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
425fe99771 perf/x86/intel: Fix pebs event constraints for SPR
4613a45017 perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
7de3fe6a13 perf/x86/intel: Fix pebs event constraints for ICL
71d6c33fe2 arm64: entry: avoid kprobe recursion
52be536155 efi: random: Use 'ACPI reclaim' memory for random seed
83b5ec7ee8 efi: random: reduce seed size to 32 bytes
0417f70b85 fuse: add file_modified() to fallocate
2de8eec8af capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
bd07f8067b tracing/histogram: Update document for KEYS_MAX size
27b4406f9c tools/nolibc/string: Fix memcmp() implementation
b5074df412 ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
85f3caa955 kprobe: reverse kp->flags when arm_kprobe failed
d1b6a8e341 tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
828577e0ba tcp/udp: Make early_demux back namespacified.
88561a6677 ftrace: Fix use-after-free for dynamic ftrace_ops
450d748070 btrfs: fix type of parameter generation in btrfs_get_dentry
007058eb82 btrfs: fix tree mod log mishandling of reallocated nodes
336fdd295c btrfs: fix lost file sync on direct IO write with nowait and dsync iocb
cff805b151 fscrypt: fix keyring memory leak on mount failure
e6f4fd85ef fscrypt: stop using keyrings subsystem for fscrypt_master_key
3975affcf5 af_unix: Fix memory leaks of the whole sk due to OOB skb.
4302806dbf block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
3e4697ffdf Bluetooth: L2CAP: Fix attempting to access uninitialized memory
81035e1201 Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
d78ccdce66 i2c: piix4: Fix adapter not be removed in piix4_remove()
c76ff8ae11 arm64: dts: juno: Add thermal critical trip points
7398435e61 firmware: arm_scmi: Fix devres allocation device in virtio transport
3653cdc21b firmware: arm_scmi: Make Rx chan_setup fail on memory errors
e514d67b23 firmware: arm_scmi: Suppress the driver's bind attributes
4e68c5da60 block: Fix possible memory leak for rq_wb on add_disk failure
bf822b6980 arm64: dts: ls208xa: specify clock frequencies for the MDIO controllers
f2329886e5 arm64: dts: ls1088a: specify clock frequencies for the MDIO controllers
33fcc55dbc arm64: dts: lx2160a: specify clock frequencies for the MDIO controllers
f3429a1e49 arm64: dts: imx8: correct clock order
de2a83186a ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset
cb9ce8910a clk: qcom: Update the force mem core bit for GPU clocks
bdc1182496 efi/tpm: Pass correct address to memblock_reserve
3a4d6f165e i2c: xiic: Add platform module alias
62eea4014a drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case
7a2547cac2 HID: saitek: add madcatz variant of MMO7 mouse device ID
931c97a54c scsi: core: Restrict legal sdev_state transitions via sysfs
c50ec15725 ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
8ecd1db58b media: v4l: subdev: Fail graciously when getting try data for NULL state
f96ad391d0 media: meson: vdec: fix possible refcount leak in vdec_probe()
8b785cdcd3 media: dvb-frontends/drxk: initialize err to 0
73dfb64213 media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
cbfa26936f media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
647c12c47e media: rkisp1: Zero v4l2_subdev_format fields in when validating links
abbeb8f727 media: rkisp1: Use correct macro for gradient registers
03b30e5a36 media: rkisp1: Initialize color space on resizer sink and source pads
d58b6b665c media: rkisp1: Don't pass the quantization to rkisp1_csm_config()
0e501fd0f3 s390/cio: fix out-of-bounds access on cio_ignore free
c65cc56937 s390/cio: derive cdev information only for IO-subchannels
c64be93f1e s390/boot: add secure boot trailer
1cdaca8f00 s390/uaccess: add missing EX_TABLE entries to __clear_user()
509cbbdec9 mtd: parsers: bcm47xxpart: Fix halfblock reads
5b8797e9db mtd: parsers: bcm47xxpart: print correct offset on read error
2f07635876 fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
154934c74f video/fbdev/stifb: Implement the stifb_fillrect() function
b524b41806 drm/msm/hdmi: fix IRQ lifetime
c55dd62001 drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag
d153d468c4 vsock: fix possible infinite sleep in vsock_connectible_wait_data()
0ed71af4d0 ipv6: fix WARNING in ip6_route_net_exit_late()
2b45d6d0c4 net, neigh: Fix null-ptr-deref in neigh_table_clear()
61defd6450 net/smc: Fix possible leaked pernet namespace in smc_init()
de88977427 stmmac: dwmac-loongson: fix invalid mdio_node
535b78739a ibmvnic: Free rwi on reset success
985a88bf0b net: mdio: fix undefined behavior in bit shift for __mdiobus_register
aa16cac06b Bluetooth: L2CAP: Fix memory leak in vhci_write
a3a7b2ac64 Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
cf2719a21f Bluetooth: virtio_bt: Use skb_put to set length
8278a87bb1 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
42d20d5e24 netfilter: ipset: enforce documented limit to prevent allocating huge memory
f46ea5fa33 btrfs: fix ulist leaks in error paths of qgroup self tests
222a3d5330 btrfs: fix inode list leak during backref walking at find_parent_nodes()
6ba3479f9e btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
a80634f392 isdn: mISDN: netjet: fix wrong check of device registration
029d5b7688 mISDN: fix possible memory leak in mISDN_register_device()
3e2129c67d rose: Fix NULL pointer dereference in rose_send_frame()
06d7596d18 ipvs: fix WARNING in ip_vs_app_net_cleanup()
5ee2d6b726 ipvs: fix WARNING in __ip_vs_cleanup_batch()
33e7783bc0 ipvs: use explicitly signed chars
6044791b7b netfilter: nf_tables: release flow rule object from commit path
1ffe710041 netfilter: nf_tables: netlink notifier might race to release objects
dcc79cf735 net: tun: fix bugs for oversize packet when napi frags enabled
fc4b50adb4 net: sched: Fix use after free in red_enqueue()
ab80025ea7 ata: pata_legacy: fix pdc20230_set_piomode()
dede9ba027 net: fec: fix improper use of NETDEV_TX_BUSY
5dfdac5e3f nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
7486f5c900 nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
3cba1f061b nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
44bc1868a4 nfc: fdp: Fix potential memory leak in fdp_nci_send()
4bef9a89f2 net: dsa: fall back to default tagger if we can't load the one from DT
06f9e0b37f RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
6b3d5dcb12 RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
9f555b1584 net: dsa: Fix possible memory leaks in dsa_loop_init()
24641993a7 nfs4: Fix kmemleak when allocate slot failed
0797c85433 NFSv4.2: Fixup CLONE dest file size for zero-length count
d59722d088 SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed
dea7ef05de NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
7b1c2458de NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
4ec017e300 NFSv4: Fix a potential state reclaim deadlock
e3e53c5af5 RDMA/hns: Disable local invalidate operation
85ab79ac94 RDMA/hns: Use hr_reg_xxx() instead of remaining roce_set_xxx()
be16cc7abd RDMA/hns: Remove magic number
ba95409d6b IB/hfi1: Correctly move list in sc_disable()
484d969037 RDMA/cma: Use output interface for net_dev check
f7d9de8a0d KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER
b7b66f13ac KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter()
0c60fa7f55 KVM: x86: Protect the unused bits in MSR exiting flags
ad8e4868dd HID: playstation: add initial DualSense Edge controller support
3a44ae4afa mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
8576d7edea drm/amd/display: explicitly disable psr_feature_enable appropriately
058b3a11f7 KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1)
9ee32892c7 KVM: x86: Trace re-injected exceptions
0c9c1306d6 serial: ar933x: Deassert Transmit Enable on ->rs485_config()
21d65b3516 scsi: lpfc: Rework MIB Rx Monitor debug info logic
d70705e131 scsi: lpfc: Adjust CMF total bytes and rxmonitor
9ebc6e8ad1 scsi: lpfc: Adjust bytes received vales during cmf timer interval
793d8378b7 Linux 5.15.77
1401e9336b tcp/udp: Fix memory leak in ipv6_renew_options().
b079d37752 serial: Deassert Transmit Enable on probe in driver-specific way
63f75fea3a serial: core: move RS485 configuration tasks from drivers into core
0753069d44 can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
17ff99e224 can: rcar_canfd: fix channel specific IRQ handling for RZ/G2L
aad798a0b3 scsi: sd: Revert "scsi: sd: Remove a local variable"
52c2329147 arm64: Add AMPERE1 to the Spectre-BHB affected list
5397ea6a08 net: enetc: survive memory pressure without crashing
885a454e97 kcm: do not sense pfmemalloc status in kcm_sendpage()
92b4c5c3fa net: do not sense pfmemalloc status in skb_append_pagefrags()
ae1b08592e net/mlx5: Fix crash during sync firmware reset
37ada47d01 net/mlx5: Update fw fatal reporter state on PCI handlers successful recover
9e6523d06a net/mlx5: Print more info on pci error handlers
ab3de780c1 net/mlx5: Fix possible use-after-free in async command interface
8bbff203e3 net/mlx5e: Extend SKB room check to include PTP-SQ
ee1c0ca1af net/mlx5e: Do not increment ESN when updating IPsec ESN state
eefa97a7a0 netdevsim: remove dir in nsim_dev_debugfs_init() when creating ports dir failed
c9589e18a6 net: broadcom: bcm4908_enet: update TX stats after actual transmission
9711616a49 net: broadcom: bcm4908enet: remove redundant variable bytes
b317d53680 nh: fix scope used to find saddr when adding non gw nh
2ad284ac88 net: bcmsysport: Indicate MAC is in charge of PHY PM
d1cfa71d5b net: ehea: fix possible memory leak in ehea_register_port()
588bdd7ee4 openvswitch: switch from WARN to pr_warn
9a1c1df925 ALSA: aoa: Fix I2S device accounting
e81d7826b8 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
77a754fcfe net: ethernet: ave: Fix MAC to be in charge of PHY PM
bc2518ec71 net: fec: limit register access on i.MX6UL
f710deeea7 perf vendor events arm64: Fix incorrect Hisi hip08 L3 metrics
eb59cb2fab PM: domains: Fix handling of unavailable/disabled idle states
bde7c2acef net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
8927d90d56 i40e: Fix flow-type by setting GL_HASH_INSET registers
c39de3ae50 i40e: Fix VF hang when reset is triggered on another VF
250bf8ab78 i40e: Fix ethtool rx-flow-hash setting for X722
ad3f1d9bf1 ipv6: ensure sane device mtu in tunnels
e2ec5bb78c perf vendor events power10: Fix hv-24x7 metric events
f9df388ed6 media: vivid: set num_in/outputs to 0 if not supported
4cc7d8d420 media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
491c0959f0 media: v4l2-dv-timings: add sanity checks for blanking values
0f83edbe4f media: vivid: dev->bitmap_cap wasn't freed in all cases
5b1fb2a28d media: vivid: s_fbuf: add more sanity checks
3436e56337 PM: hibernate: Allow hybrid sleep to work with s2idle
3cc8c4088f can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path
a3e09eff32 can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
304a101616 drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()
2fe6b24ce2 net-memcg: avoid stalls when under memory pressure
9b171fdcbf tcp: fix indefinite deferral of RTO with SACK reneging
a85d39f14a tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
2437f3c5c6 tcp: minor optimization in tcp_add_backlog()
ef27df7591 net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
a1e18acb02 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
62086d1c46 kcm: annotate data-races around kcm->rx_wait
342d918cf9 kcm: annotate data-races around kcm->rx_psock
6bb23225bb atlantic: fix deadlock at aq_nic_stop
4e2cbc1f0e drm/i915/dp: Reset frl trained flag before restarting FRL training
3d92ab0865 amd-xgbe: add the bit rate quirk for Molex cables
75a6d1ebf8 amd-xgbe: fix the SFP compliance codes check for DAC cables
98bada8fa0 x86/unwind/orc: Fix unreliable stack dump with gcov
88e879c9f5 nfc: virtual_ncidev: Fix memory leak in virtual_nci_send()
18c60b383d net: macb: Specify PHY PM management done by MAC
95c22fc1e8 net: hinic: fix the issue of double release MBOX callback of VF
6016d96a6a net: hinic: fix the issue of CMDQ memory leaks
e6765fe8de net: hinic: fix memory leak when reading function table
62aa78a0c3 net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg()
1e0bee973e net: netsec: fix error handling in netsec_register_mdio()
7a939503fc tipc: fix a null-ptr-deref in tipc_topsrv_accept
c638b520ba perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap()
4fdf6f978c ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
b688736903 ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile
eca851572d mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe()
08c246c7df arc: iounmap() arg is volatile
739eac37ff sched/core: Fix comparison in sched_group_cookie_match()
ca7b0a1028 perf: Fix missing SIGTRAPs
eb77474a2a ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile
9b6841ab70 KVM: selftests: Fix number of pages for memory slot in memslot_modification_stress_test
59de8738ed drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
a560aeac2f media: atomisp: prevent integer overflow in sh_css_set_black_frame()
32f93e4608 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
5a93a8288c net: ieee802154: fix error return code in dgram_bind()
138a13d8f5 ethtool: eeprom: fix null-deref on genl_info in dump
1c2b1d3bba mmc: block: Remove error check of hw_reset on reset
0b0d169723 Revert "scsi: lpfc: SLI path split: Refactor lpfc_iocbq"
7a0fce24de Revert "scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4"
7a36c9de43 Revert "scsi: lpfc: SLI path split: Refactor SCSI paths"
eb8be2dbfb Revert "scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup()"
065bf71a8a Revert "scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()"
97dc9076ea Revert "scsi: lpfc: Resolve some cleanup issues following SLI path refactoring"
b32b766be4 s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
1ad7213fcf s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
ae9398e837 perf auxtrace: Fix address filter symbol name match for modules
14009ada57 ARC: mm: fix leakage of memory allocated for PTE
eb9ed3343c pinctrl: Ingenic: JZ4755 bug fixes
94d2643df1 kernfs: fix use-after-free in __kernfs_remove
f1204dfc4c counter: microchip-tcb-capture: Handle Signal1 read and Synapse
6fb0106c64 mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus
73e3901e70 mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake
1e8cd93ae5 mmc: core: Fix kernel panic when remove non-standard SDIO card
02e51e7cd1 mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO
4c365a0c21 coresight: cti: Fix hang in cti_disable_hw()
b32775e039 drm/msm/dp: fix IRQ lifetime
b48949ab45 drm/msm/hdmi: fix memory corruption with too many bridges
9f035d1fb3 drm/msm/dsi: fix memory corruption with too many bridges
986a89b371 drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume
a2f0934e6b scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
2b1a3172ee mac802154: Fix LQI recording
46b4b1e11e exec: Copy oldsighand->action under spin-lock
265b6fb780 fs/binfmt_elf: Fix memory leak in load_elf_binary()
24030742a7 cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores
3423a3417f cpufreq: intel_pstate: Read all MSRs on the target CPU
cc6a724984 fbdev: smscufx: Fix several use-after-free bugs
1a8b22e3f3 iio: adxl372: Fix unsafe buffer attributes
2f08cad213 iio: temperature: ltc2983: allocate iio channels once
1bfe97f497 iio: light: tsl2583: Fix module unloading
569709540e tools: iio: iio_utils: fix digit calculation
c892a81c74 xhci: Remove device endpoints from bandwidth list when freeing the device
dfacb5c7f0 xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices
64058af657 xhci: Add quirk to reset host back to default state at shutdown
022f21e850 mtd: rawnand: marvell: Use correct logic for nand-keep-config
f90897c0f6 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
a0c54d5152 usb: bdc: change state when port disconnected
e0fd70ab48 usb: dwc3: gadget: Don't set IMI for no_interrupt
ad538aea64 usb: dwc3: gadget: Stop processing more requests on IMI
f2f53be617 usb: gadget: uvc: fix sg handling during video encode
80ff4ef777 usb: gadget: uvc: fix sg handling in error case
555011f6b2 USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
311428871b ALSA: rme9652: use explicitly signed char
fa8b39c7ed ALSA: au88x0: use explicitly signed char
8af82d330d ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600
259cb4dee1 ALSA: Use del_timer_sync() before freeing timer
33ddee2b95 can: kvaser_usb: Fix possible completions during init_completion
86da269c75 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
ead0495627 NFSv4: Add an fattr allocation to _nfs4_discover_trunking()
eb1fe9600b NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
4f5365f770 Linux 5.15.76
33fc9e26b7 mm: /proc/pid/smaps_rollup: fix no vma's null-deref
b9d8cbe90a mmc: core: Add SD card quirk for broken discard
0ee2f0567a Makefile.debug: re-enable debug info for .S files
117825e9bb x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB
0983205085 ACPI: video: Force backlight native for more TongFang devices
289b56715b perf: Skip and warn on unknown format 'configN' attrs
9d912a3853 mmc: sdhci-tegra: Use actual clock rate for SW tuning correction
7aeda81191 tracing: Do not free snapshot if tracer is on cmdline
57252e7bd4 tracing: Simplify conditional compilation code in tracing_set_tracer()
20bc6d23f7 ksmbd: fix incorrect handling of iterate_dir
3c8cfcaa2d ksmbd: handle smb2 query dir request for OutputBufferLength that is too small
8754fa5dbc arm64: mte: move register initialization to C
ea7be82fd7 fs: dlm: fix invalid derefence of sb_lvbptr
0365d6af75 iommu/vt-d: Clean up si_domain in the init_dmars() error path
5c95d0c9d0 iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check()
209740fd13 net: phy: dp83822: disable MDI crossover status change interrupt
ce1234573d net: sched: fix race condition in qdisc_graft()
91f8f5342b net: hns: fix possible memory leak in hnae_ae_register()
50c31fa952 wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new()
d2fc83a6b5 sfc: include vport_id in filter spec hash and equal()
c2e1e59d59 net: sched: sfb: fix null pointer access issue when sfb_init() fails
34f2a4eedc net: sched: delete duplicate cleanup of backlog and qlen
154f4c06d9 net: sched: cake: fix null pointer access issue when cake_init() fails
5efed7578d nvmet: fix workqueue MEM_RECLAIM flushing dependency
2f2b84b020 nvme-hwmon: kmalloc the NVME SMART log buffer
66c56b2328 nvme-hwmon: consistently ignore errors from nvme_hwmon_init
d77f6908f9 netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements
efa9dd7e67 ionic: catch NULL pointer issue on reconfig
35ece85866 net: hsr: avoid possible NULL deref in skb_clone()
e326df21da dm: remove unnecessary assignment statement in alloc_dev()
847301f0ee cifs: Fix xid leak in cifs_ses_add_channel()
8905d13b9e cifs: Fix xid leak in cifs_flock()
27cfd3afaa cifs: Fix xid leak in cifs_copy_file_range()
593d877c39 cifs: Fix xid leak in cifs_create()
a8df9d0428 udp: Update reuse->has_conns under reuseport_lock.
9749595feb scsi: lpfc: Fix memory leak in lpfc_create_port()
b9122e0e0e net: phylink: add mac_managed_pm in phylink_config structure
412db9b06d net: phy: dp83867: Extend RX strap quirk for SGMII mode
5ce6130519 net/atm: fix proc_mpc_write incorrect return value
0eb17faedc sfc: Change VF mac via PF as first preference if available.
0f58940ca3 HID: magicmouse: Do not set BTN_MOUSE on double report
94a171c982 i40e: Fix DMA mappings leak
dbc01c0a4e tipc: fix an information leak in tipc_topsrv_kern_subscr
b294cad6f0 tipc: Fix recognition of trial period
6161c364e3 ACPI: extlog: Handle multiple records
40e5fceddf drm/vc4: Add module dependency on hdmi-codec
6c5041a103 btrfs: fix processing of delayed tree block refs during backref walking
af67578d56 btrfs: fix processing of delayed data refs during backref walking
c439cafce8 x86/topology: Fix duplicated core ID within a package
d31f4bc225 x86/topology: Fix multiple packages shown on a single-package system
fcc96e89b3 media: venus: dec: Handle the case where find_format fails
b22b4823a0 media: mceusb: set timeout to at least timeout provided
5265cc1202 media: ipu3-imgu: Fix NULL pointer dereference in active selection access
1e4e71f9e1 KVM: arm64: vgic: Fix exit condition in scan_its_table()
5bf2fda26a kvm: Add support for arch compat vm ioctls
112a005d1d mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
2d508b4e65 drm/amdgpu: fix sdma doorbell init ordering on APUs
b5606e3ab1 cpufreq: qcom: fix memory leak in error path
d866f5982c x86/resctrl: Fix min_cbm_bits for AMD
8fbe13de1c ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
5d6a037b3a ata: ahci-imx: Fix MODULE_ALIAS
30cf0dee37 hwmon/coretemp: Handle large core ID value
2f7171465f x86/microcode/AMD: Apply the patch early on every logical thread
93d7e2b47a i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter
14d260f94f cpufreq: qcom: fix writes in read-only memory region
3006766d24 selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
1b31cb0065 ocfs2: fix BUG when iput after ocfs2_mknod fails
e469db818e ocfs2: clear dinode links count in case of error
ded9d535be btrfs: enhance unsupported compat RO flags handling
537412c547 perf/x86/intel/pt: Relax address filter validation
8ddc58e0e3 arm64: errata: Remove AES hwcap for COMPAT tasks
738515cf8b usb: gadget: uvc: improve sg exit condition
db11d8c72a usb: gadget: uvc: giveback vb2 buffer on req complete
aee340dccf usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer
2f54ce7392 usb: gadget: uvc: use on returned header len in video_encode_isoc_sg
d80db2f145 usb: gadget: uvc: consistently use define for headerlen
f9681a6750 arm64/mm: Consolidate TCR_EL1 fields
5b20aacff7 r8152: add PID for the Lenovo OneLink+ Dock
bd8a595958 Linux 5.15.75
b6e2c54be3 io-wq: Fix memory leak in worker creation
7c359e2849 gcov: support GCC 12.1 and newer compilers
8418c1672c thermal: intel_powerclamp: Use first online CPU as control_cpu
55c824b620 ext4: continue to expand file system when the target size doesn't reach
0e63de6d7e lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5
84cd0b20fa Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
371aaf6b48 Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5
e1591557e3 drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n
34f31a2b66 net/ieee802154: don't warn zero-sized raw_sendmsg()
de904d0fe1 Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
9c65eef9d6 net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses
d7eadffce0 blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
28787ff9fb ALSA: usb-audio: Fix last interface check for registration
b8989e95d7 net: ieee802154: return -EINVAL for unknown addr type
0db2efb3bf mm: hugetlb: fix UAF in hugetlb_handle_userfault
98aada6e22 io_uring/rw: fix unexpected link breakage
d6b7efc722 io_uring/rw: fix error'ed retry return values
e857457c6f io_uring/rw: fix short rw error handling
cd148d4e31 io_uring: correct pinned_vm accounting
813d8fe5d3 io_uring/af_unix: defer registered files gc to io_uring release
c69a2324fc perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
e81bf40b28 clk: bcm2835: Round UART input clock up
da17cbb229 clk: bcm2835: Make peripheral PLLC critical
20b8c456df usb: idmouse: fix an uninit-value in idmouse_open
ec8adf767e nvmet-tcp: add bounds check on Transfer Tag
1c64328840 nvme: copy firmware_rev on each init
b9b5560b34 ext2: Use kvmalloc() for group descriptor array
8c067a3051 scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled
39bef9c6a9 staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
b4573a2bad staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
eb24d93e3e Revert "usb: storage: Add quirk for Samsung Fit flash"
3a38985d8b usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
9d4f84a15f arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
3c84c7f592 usb: musb: Fix musb_gadget.c rxstate overflow bug
fcd594da0b usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
9e86dffd0b md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
f8e80792c1 eventfd: guard wake_up in eventfd fs calls as well
c61786dc72 HID: roccat: Fix use-after-free in roccat_read()
f7f425d61d soundwire: intel: fix error handling on dai registration issues
093a5463ae soundwire: cadence: Don't overwrite msg->buf during write commands
1b4ed920b2 bcache: fix set_at_max_writeback_rate() for multiple attached devices
eecb5ccc84 ata: libahci_platform: Sanity check the DT child nodes number
70b2adb1d6 blk-throttle: prevent overflow while calculating wait time
ff8551d411 staging: vt6655: fix potential memory leak
7c8bc37465 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
3d69461807 iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity
c0d73be0af nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
9d54de8660 scsi: 3w-9xxx: Avoid disabling device if failing to enable it
d68da10b0c dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
518a2a1cc3 usb: host: xhci-plat: suspend/resume clks for brcm
f002aa7c0a usb: host: xhci-plat: suspend and resume clocks
6bcd745c87 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
5c32cbf6cc media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc
6f21976095 media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
0a07b13af0 clk: zynqmp: Fix stack-out-of-bounds in strncpy`
3680442cba ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
4a89c0befc btrfs: don't print information about space cache or tree every remount
39a07058c7 btrfs: scrub: try to fix super block errors
f3857dd7c0 btrfs: dump extra info if one free space cache has more bitmaps than it should
d3c6d5be46 arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
82046b6a84 kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
3536541733 ARM: dts: imx6sx: add missing properties for sram
602813650c ARM: dts: imx6sll: add missing properties for sram
6a12e1e23c ARM: dts: imx6sl: add missing properties for sram
8c24dc621b ARM: dts: imx6qp: add missing properties for sram
47666b9a11 ARM: dts: imx6dl: add missing properties for sram
19fe40c518 ARM: dts: imx6q: add missing properties for sram
9361ba7791 ARM: dts: imx7d-sdb: config the max pressure for tsc2046
0f90671ff9 drm/amd/display: Remove interface for periodic interrupt 1
88fd067406 drm/dp: Don't rewrite link config when setting phy test pattern
668806a826 mmc: sdhci-msm: add compatible string check for sdm670
587c7da877 drm/meson: explicitly remove aggregate driver at module unload time
d76ff04a72 drm/meson: reorder driver deinit sequence to fix use-after-free bug
d894db3561 drm/amdgpu: fix initial connector audio value
e3675f688d ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
f16e1b7b39 platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
39da49ffa2 platform/chrome: cros_ec: Notify the PM of wake events during resume
7463604784 drm: panel-orientation-quirks: Add quirk for Anbernic Win600
2810061452 drm/vc4: vec: Fix timings for VEC modes
0506c4eae9 ALSA: usb-audio: Register card at the last interface
39d7a81bbb drm: bridge: dw_hdmi: only trigger hotplug event on link change
dfbed8c92e udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
a47d92c74b drm/amd/display: fix overflow on MIN_I64 definition
a29f742704 gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
5ff7bec678 drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
ca163e389f drm: Prevent drm_copy_field() to attempt copying a NULL pointer
df5ac93926 drm: Use size_t type for len variable in drm_copy_field()
5ab84b1596 drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
b3179865cf r8152: Rate limit overflow messages
d1e894f950 Bluetooth: L2CAP: Fix user-after-free
124b7c7732 net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
5b94d48898 hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
a269c3e390 wifi: rt2x00: correctly set BBP register 86 for MT7620
b5e6ada5a5 wifi: rt2x00: set SoC wmac clock register
357c89074a wifi: rt2x00: set VGC gain for both chains of MT7620
92e2e04da5 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
4304b8e075 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
4a5eab200e can: bcm: check the result of can_send() in bcm_can_tx()
3423a50fa0 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
3ac837cef1 Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
af46b2b9b0 wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
e33da263e9 regulator: core: Prevent integer underflow
d58c8781c0 Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk
232d59eca0 wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
37f15edba2 iavf: Fix race between iavf_close and iavf_reset_task
0315568019 xfrm: Update ipcomp_scratches with NULL when freed
716c526d66 thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround
b1b4144508 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
839f563c5d x86/mce: Retrieve poison range from hardware
1663629bc3 tcp: annotate data-race around tcp_md5sig_pool_populated
7b03296b4f openvswitch: Fix overreporting of drops in dropwatch
ffd7a1dcae openvswitch: Fix double reporting of drops in dropwatch
d449d00a8d net: ethernet: ti: davinci_mdio: Add workaround for errata i2329
624f03a027 ice: set tx_tstamps when creating new Tx rings via ethtool
2e52d858de bpftool: Clear errno after libcap's checks
75995ce1c9 wifi: brcmfmac: fix invalid address access when enabling SCAN log level
83b9496975 NFSD: fix use-after-free on source server when doing inter-server copy
118dc74b2b NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
066b1302f2 x86/entry: Work around Clang __bdos() bug
06c56c9d5d ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
6733222f2c ARM: decompressor: Include .data.rel.ro.local
5614908434 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
139bbbd011 powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
a1387ae83e MIPS: BCM47XX: Cast memcmp() of function to (void *)
c2790fede9 cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode
30eca146c8 ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address
5374638222 ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
7ed95b0803 rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
cf38a05eb1 rcu: Back off upon fill_page_cache_func() allocation failure
3e2d8b89f0 rcu: Avoid triggering strict-GP irq-work when RCU is idle
27d3e646dd fs: dlm: fix race in lowcomms
b6b87460f4 selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
497d736784 f2fs: fix to account FS_CP_DATA_IO correctly
fb1dcc2a9e f2fs: fix race condition on setting FI_NO_EXTENT flag
6ddbd411a0 ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
21f1ba52b8 thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
172c8a24fc crypto: cavium - prevent integer overflow loading firmware
12acfa1059 crypto: marvell/octeontx - prevent integer overflows
c963ce2fa0 kbuild: rpm-pkg: fix breakage when V=1 is used
059ce6b68b kbuild: remove the target in signal traps when interrupted
1e9c23db31 tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads
84795de93e tracing: kprobe: Make gen test module work in arm and riscv
867fce09aa tracing: kprobe: Fix kprobe event gen test module on exit
a9990f24ad iommu/iova: Fix module config properly
f0cac6cc02 cifs: return correct error in ->calc_signature()
1f1ab76e25 crypto: qat - fix DMA transfer direction
393307b99a crypto: inside-secure - Change swab to swab32
93538944ab crypto: ccp - Release dma channels before dmaengine unrgister
779a9930f3 crypto: akcipher - default implementation for setting a private key
0c7043a5b5 iommu/omap: Fix buffer overflow in debugfs
046803b74d cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
771d8aa02d crypto: hisilicon/qm - fix missing put dfx access
9bf3ec61a2 crypto: qat - fix default value of WDT timer
3bfc220e5c hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
507128a0e3 cgroup: Honor caller's cgroup NS when resolving path
8ffe511b7d hwrng: arm-smccc-trng - fix NO_ENTROPY handling
2720934713 crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
e0b4ebf598 crypto: sahara - don't sleep when in softirq
8484023b57 powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL
7f536a8cb6 powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
1f98f8f435 powerpc: Fix SPE Power ISA properties for e500v1 platforms
72c5b7110f powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
399afe92f6 x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
592b302d8b powerpc: Fix fallocate and fadvise64_64 compat parameter combination
61af84b3db powerpc/powernv: add missing of_node_put() in opal_export_attrs()
5be9cb6c06 powerpc/pci_dn: Add missing of_node_put()
5a13d3f1af powerpc/sysdev/fsl_msi: Add missing of_node_put()
b0c0490b3c powerpc/math_emu/efp: Include module.h
93379dc92d powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig
25a4fb0e1a mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
b8fcd9ab0f mailbox: mpfs: account for mbox offsets while sending
ba22643595 mailbox: mpfs: fix handling of the reg property
fad007a315 clk: ast2600: BCLK comes from EPLL
3441076f83 clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
9209e6bab7 clk: imx: scu: fix memleak on platform_device_add() fails
bdf72f2d64 clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
e338131e98 clk: baikal-t1: Add SATA internal ref clock buffer
35b7660275 clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
b2db8b2c53 clk: baikal-t1: Fix invalid xGMAC PTP clock divider
435a8a39c6 clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
b0bc75fe67 spmi: pmic-arb: correct duplicate APID to PPID mapping logic
faabbb103d usb: mtu3: fix failed runtime suspend in host only mode
57f66534a4 dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
8aa96c5bc3 clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
2dafc5afd9 mfd: sm501: Add check for platform_driver_register()
d43d93dbd8 mfd: fsl-imx25: Fix check for platform_get_irq() errors
b940bb3c81 mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
0715005c48 mfd: lp8788: Fix an error handling path in lp8788_probe()
aec1f073f9 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
53bfc1c3c7 mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
2f921d62c2 fsi: core: Check error number after calling ida_simple_get
041c79f6ae RDMA/rxe: Fix resize_finish() in rxe_queue.c
959d4ee095 clk: qcom: gcc-sm6115: Override default Alpha PLL regs
8e556f5573 clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
a26b065875 scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
e87fb1fcf8 scsi: iscsi: Run recv path from workqueue
c2af03a7c1 scsi: iscsi: Add recv workqueue helpers
d6aafc21be scsi: iscsi: Rename iscsi_conn_queue_work()
e45a1516d2 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
6a54f76974 serial: 8250: Fix restoring termios speed after suspend
a5dba09338 firmware: google: Test spinlock on panic path to avoid lockups
60d14575d0 slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON
f19e5b7df5 staging: vt6655: fix some erroneous memory clean-up loops
433c33c554 phy: qualcomm: call clk_disable_unprepare in the error handling
c4293def88 tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
a91a3c2d8d serial: 8250: Toggle IER bits on only after irq has been set up
6be8e565a4 drivers: serial: jsm: fix some leaks in probe
1d05df7757 usb: gadget: function: fix dangling pnp_string in f_printer.c
ed2c66b752 xhci: Don't show warning for reinit on known broken suspend
4d7d8f5cb2 IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
e221b4f16e RDMA/cm: Use SLID in the work completion as the DLID in responder side
7a37c58ee7 md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
b467d9460e md/raid5: Ensure stripe_fill happens on non-read IO with journal
5d8259c9d1 md: Replace snprintf with scnprintf
9e92d5ca54 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
058833dbeb ata: fix ata_id_has_dipm()
dad910a6d4 ata: fix ata_id_has_ncq_autosense()
21faddeff7 ata: fix ata_id_has_devslp()
204cc767dc ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
5c75d608fa RDMA/siw: Fix QP destroy to wait for all references dropped.
308cd50f17 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
e58a0b9100 RDMA/srp: Fix srp_abort()
dc9e4ef6b0 RDMA/irdma: Align AE id codes to correct flush code and event
84ce1a8e36 mtd: rawnand: fsl_elbc: Fix none ECC mode
be424a7d53 mtd: rawnand: intel: Remove undocumented compatible string
445395900b mtd: rawnand: intel: Read the chip-select line from the correct OF node
cbbf9cca47 phy: phy-mtk-tphy: fix the phy type setting issue
e4be7c9495 phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent()
88263152ff mtd: devices: docg3: check the return value of devm_ioremap() in the probe
a0e4ac6988 clk: qcom: sm6115: Select QCOM_GDSC
aecb632674 dyndbg: drop EXPORTed dynamic_debug_exec_queries
0d4421f2cb dyndbg: let query-modname override actual module name
0c0d9f38b0 dyndbg: fix module.dyndbg handling
49d85932f7 dyndbg: fix static_branch manipulation
7cb9b20941 dmaengine: hisilicon: Add multi-thread support for a DMA channel
b88630d9aa dmaengine: hisilicon: Fix CQ head update
e84aeeafe8 dmaengine: hisilicon: Disable channels when unregister hisi_dma
b94605f5cb fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
11bd8bbdf8 misc: ocxl: fix possible refcount leak in afu_ioctl()
c23c5e1845 RDMA/rxe: Fix the error caused by qp->sk
f2f405af70 RDMA/rxe: Fix "kernel NULL pointer dereference" error
2ea7caa968 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
23624abbc9 media: uvcvideo: Use entity get_cur in uvc_ctrl_set
6c5da92103 media: uvcvideo: Fix memory leak in uvc_gpio_parse
4e2042f1ad media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
aeffca4344 tty: xilinx_uartps: Fix the ignore_status
a8d772c7b8 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
6225501072 HSI: omap_ssi_port: Fix dma_map_sg error check
691f23a847 HSI: omap_ssi: Fix refcount leak in ssi_probe
d6e750535b clk: tegra20: Fix refcount leak in tegra20_clock_init
e7a57fb92a clk: tegra: Fix refcount leak in tegra114_clock_init
417ed4432b clk: tegra: Fix refcount leak in tegra210_clock_init
ca5f338ef1 clk: sprd: Hold reference returned by of_get_parent()
49343bdf95 clk: berlin: Add of_node_put() for of_get_parent()
857b719bed clk: qoriq: Hold reference returned by of_get_parent()
a8cbce0305 clk: oxnas: Hold reference returned by of_get_parent()
e0001a565c clk: meson: Hold reference returned by of_get_parent()
e900ec4c4f usb: common: debug: Check non-standard control requests
c11f48764c RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey
cd35ad9a7d iio: magnetometer: yas530: Change data type of hard_offsets to signed
23fafc2e2c iio: ABI: Fix wrong format of differential capacitance channel ABI.
8169da520e iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
504e8807fe iio: inkern: only release the device node when done with it
b0d4fcc3ec iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
5db9b840ac iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
c5c63736d2 iio: adc: at91-sama5d2_adc: check return status for pressure and touch
5f1654a0e5 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
017cf3b0a6 ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
6c93b683ce arm64: ftrace: fix module PLTs with mcount
bbf64eb102 ext4: don't run ext4lazyinit for read-only filesystems
7a00a23207 ARM: Drop CMDLINE_* dependency on ATAGS
2af04fe87e ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
2134214bc4 arm64: dts: ti: k3-j7200: fix main pinmux range
7247a1d7a4 soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
4f7892f242 ia64: export memory_add_physaddr_to_nid to fix cxl build error
2ef01657b2 ARM: dts: kirkwood: lsxl: remove first ethernet port
bf7caa3c5c ARM: dts: kirkwood: lsxl: fix serial line
42ce4c73a4 ARM: dts: turris-omnia: Fix mpp26 pin name and comment
96d8f2b43e ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
08ada28d1d soc: qcom: smem_state: Add refcounting for the 'state->of_node'
96e0028deb soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
a29b6eb959 locks: fix TOCTOU race when granting write lease
7e053784c4 memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
2680690f9c memory: of: Fix refcount leak bug in of_get_ddr_timings()
566b143aa5 memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
10df962300 ALSA: hda/hdmi: Don't skip notification handling during PM operation
cc756b79a5 ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
f9cb3bd557 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
b7dda65fa8 ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
b2bc9fc56a ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
3c3ef19a88 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
b14dc26227 ALSA: dmaengine: increment buffer pointer atomically
f5f1f5ee50 ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
f910aca076 ASoC: codecs: tx-macro: fix kcontrol put
b47a37ad4a drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
bdf54d4b00 drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
635e7700c5 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
4f85988467 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
64545b8a96 mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
3ba3814c00 drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
a5ce83e85d drm/omap: dss: Fix refcount leak bugs
f5f599daa0 drm/bochs: fix blanking
928ac9fc1a ALSA: hda: beep: Simplify keep-power-at-enable behavior
fbb88a7c84 ASoC: rsnd: Add check for rsnd_mod_power_on
4610e7a411 drm/bridge: megachips: Fix a null pointer dereference bug
079c550c57 drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume()
c12daccc90 platform/chrome: cros_ec_typec: Correct alt mode index
c317d2b8a4 platform/x86: msi-laptop: Fix resource cleanup
0e21d41bc7 platform/x86: msi-laptop: Fix old-ec check for backlight registering
6bc81c1b63 ASoC: tas2764: Fix mute/unmute
e644497c53 ASoC: tas2764: Drop conflicting set_bias_level power setting
35bd912ed6 ASoC: tas2764: Allow mono streams
fd1d3b2657 platform/chrome: fix memory corruption in ioctl
27bb672c04 platform/chrome: fix double-free in chromeos_laptop_prepare()
57dfb855bc ASoC: mt6359: fix tests for platform_get_irq() failure
8a475a7732 drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
56d2233cf5 drm/dp_mst: fix drm_dp_dpcd_read return value checks
fe6eb3d0c8 drm/bridge: parade-ps8640: Fix regulator supply order
60630834fa drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
26c1b4cfe5 drm/mipi-dsi: Detach devices when removing the host
652042135e drm/bridge: Avoid uninitialized variable warning
f369fb4dee drm: bridge: adv7511: unregister cec i2c device after cec adapter
20609125b8 drm: bridge: adv7511: fix CEC power down control register offset
a624161ebe net: mvpp2: fix mvpp2 debugfs leak
7aef5082c5 once: add DO_ONCE_SLOW() for sleepable contexts
77bfd26cbb net/ieee802154: reject zero-sized raw_sendmsg()
dc4e9cd6d6 net: wwan: iosm: Call mutex_init before locking it
0b6516a4e3 bnx2x: fix potential memory leak in bnx2x_tpa_stop()
30bfa5aa72 net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
f828333ca9 hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller
c91b922b41 spi: Ensure that sg_table won't be used after being freed
49d429760d tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
19d636b663 sctp: handle the error returned from sctp_auth_asoc_init_active_key
7bfa18b05f mISDN: fix use-after-free bugs in l1oip timer handlers
6f1991a940 eth: alx: take rtnl_lock on resume
e28a4e7f02 vhost/vsock: Use kvmalloc/kvfree for larger packets.
5dbdd690ed wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
432eecffcf spi: s3c64xx: Fix large transfers with DMA
1454a26cb1 netfilter: nft_fib: Fix for rpath check with VRF devices
7d98b26684 xfrm: Reinject transport-mode packets through workqueue
397e880acf Bluetooth: hci_core: Fix not handling link timeouts propertly
1331d3e1f9 i2c: mlxbf: support lock mechanism
9233ab8198 skmsg: Schedule psock work if the cached skb exists on the psock
44f1dc2e82 spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
daa5239ea4 spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
6b94115186 x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
3c27a13807 x86/microcode/AMD: Track patch allocation size explicitly
3e2b805a68 wifi: ath11k: fix number of VHT beamformee spatial streams
5a6827cdc2 netfilter: conntrack: revisit the gc initial rescheduling bias
9c39ca418b netfilter: conntrack: fix the gc rescheduling delay
b8917dce21 Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
c087c35292 bpf: Ensure correct locking around vulnerable function find_vpid()
a0f15af17b net: fs_enet: Fix wrong check in do_pd_setup
ee7c5e814f Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release
57d4f2f8a6 wifi: mt76: mt7915: do not check state before configuring implicit beamform
dea9093f24 wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload
817e8b75ae wifi: mt76: sdio: fix transmitting packet hangs
5dc095a37f wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
9973f78c19 wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
5d9222c680 bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
4ce47c5545 spi: meson-spicc: do not rely on busy flag in pow2 clk ops
36c484bac9 wifi: rtl8xxxu: Fix skb misuse in TX queue selection
fefd2269e6 spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
e22f649918 spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
37005a9486 selftests/xsk: Avoid use-after-free on ctx
69995c64e5 wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init()
6f9484e969 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
d091771f51 Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
f91e25cfa5 bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy
0e13425104 bpf: Propagate error from htab_lock_bucket() to userspace
0b00c6130c bpf: Disable preemption when increasing per-cpu map_locked
68ab769033 xsk: Fix backpressure mechanism on Tx
0559a6d96a x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
e962e458bf spi: mt7621: Fix an error message in mt7621_spi_probe()
0a16bbc8b0 bpftool: Fix a wrong type cast in btf_dumper_int
6e8eadfa9b wifi: mac80211: allow bw change during channel switch in mesh
4ed5155043 bpf: Fix reference state management for synchronous callbacks
3d0a101e71 leds: lm3601x: Don't use mutex after it was destroyed
54a3201f3c wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
714536ff6f wifi: rtlwifi: 8192de: correct checking of IQK reload
80a474502e NFSD: Fix handling of oversized NFSv4 COMPOUND requests
dc7f225090 NFSD: Protect against send buffer overflow in NFSv2 READDIR
cedaf73c8b SUNRPC: Fix svcxdr_init_encode's buflen calculation
6b55707ff8 SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
aed8816305 nfsd: Fix a memory leak in an error handling path
5c4b234c44 objtool: Preserve special st_shndx indexes in elf_update_symbol
425a2a9469 ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
2647b20e04 ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
93296e7ab7 MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
993b13abde MIPS: SGI-IP27: Free some unused memory
959855093f sh: machvec: Use char[] for section boundaries
91fafd22f8 thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register()
81fb3ee298 ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
33d478eee2 userfaultfd: open userfaultfds with O_RDONLY
10918ebecd ima: fix blocking of security.ima xattrs of unsupported algorithms
b7af9b8be8 selinux: use "grep -E" instead of "egrep"
73b8218ef4 smb3: must initialize two ACL struct fields to zero
adf428ae46 drm/amd/display: Fix vblank refcount in vrr transition
60a5174525 drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
01bd3eaa53 drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
20018a252f drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
861f085f81 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
446d40e2a8 drm/nouveau/kms/nv140-: Disable interlacing
4dab0d27a4 staging: greybus: audio_helper: remove unused and wrong debugfs usage
28eb4bdb23 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
4f7b1e7d0f KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02
be1a6a61f1 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
379de01906 KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
e3e5baa368 blk-wbt: call rq_qos_add() after wb_normal is initialized
e8e0a6f4b8 media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
b76fac61c3 media: cedrus: Set the platform driver data earlier
b19254eada efi: libstub: drop pointless get_memory_map() call
5cda4a11b4 thunderbolt: Explicitly enable lane adapter hotplug events at startup
d9c79fbcbd tracing: Fix reading strings from synthetic events
b9ab154d22 tracing: Add "(fault)" name injection to kernel probes
8ae88c4842 tracing: Move duplicate code of trace_kprobe/eprobe.c into header
84f4be2093 tracing: Add ioctl() to force ring buffer waiters to wake up
32eb54a986 tracing: Wake up waiters when tracing is disabled
2475de2bc0 tracing: Wake up ring buffer waiters on closing of the file
48272aa48d tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
d4ab9bc5f5 ring-buffer: Fix race between reset page and reading page
be60f698c2 ring-buffer: Add ring_buffer_wake_waiters()
5201dd81ae ring-buffer: Check pending waiters when doing wake ups as well
bc6d4e9d64 ring-buffer: Have the shortest_full queue be the shortest not longest
e8d1167385 ring-buffer: Allow splice to read previous partially read pages
fb96b7489f ftrace: Properly unset FTRACE_HASH_FL_MOD
31dc1727c1 livepatch: fix race between fork and KLP transition
36997b75bb ext4: update 'state->fc_regions_size' after successful memory allocation
417b0455a0 ext4: fix potential memory leak in ext4_fc_record_regions()
9b5eb368a8 ext4: fix potential memory leak in ext4_fc_record_modified_inode()
ef1607c991 ext4: fix miss release buffer head in ext4_fc_write_inode
d29fa1ab4e ext4: fix dir corruption when ext4_dx_add_entry() fails
d12471b416 ext4: place buffer head allocation before handle start
46e5f470a1 ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
1f5e643b38 ext4: don't increase iversion counter for ea_inodes
dd366295d1 ext4: fix check for block being out of directory size
4a967fe8b0 ext4: make ext4_lazyinit_thread freezable
533c60a0b9 ext4: fix null-ptr-deref in ext4_write_info
d8e4af8314 ext4: avoid crash when inline data creation follows DIO write
56fcd0788f jbd2: add miss release buffer head in fc_do_one_pass()
d11d2ded29 jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
e7385c868e jbd2: fix potential buffer head reference count leak
d87fe290a5 jbd2: wake up journal waiters in FIFO order, not LIFO
7434626c5e hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
095493833b hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
73687c5391 f2fs: fix to do sanity check on summary info
ed854f10e6 f2fs: fix to do sanity check on destination blkaddr during recovery
7f10357c90 f2fs: increase the limit for reserve_root
0035b84223 f2fs: flush pending checkpoints when freezing super
ab49589754 f2fs: complete checkpoints during remount
0a408c6212 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
4b996a3014 btrfs: fix race between quota enable and quota rescan ioctl
0d94230343 fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
95a520b591 ksmbd: Fix user namespace mapping
a19f316406 ksmbd: Fix wrong return value and message length check in smb2_ioctl()
39b6855628 ksmbd: fix endless loop when encryption for response fails
2b0897e336 fbdev: smscufx: Fix use-after-free in ufx_ops_open()
aa7b2c927e pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
5d97378b36 gpio: rockchip: request GPIO mux to pinctrl when setting direction
e0b1c16fda scsi: qedf: Populate sysfs attributes for vport
1d567179f2 slimbus: qcom-ngd: cleanup in probe error path
fa0aab2e45 slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure
ba2159df18 powerpc/boot: Explicitly disable usage of SPE instructions
9df2a9cdad powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
75d9de25a6 NFSD: Protect against send buffer overflow in NFSv3 READ
2be9331ca6 NFSD: Protect against send buffer overflow in NFSv2 READ
071a076fd1 NFSD: Protect against send buffer overflow in NFSv3 READDIR
209a94c519 serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
63a3d75cf1 serial: 8250: Let drivers request full 16550A feature probing
26e5c79e67 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
7c16d0a4e6 xen/gntdev: Accommodate VMA splitting
1cb73704cb xen/gntdev: Prevent leaking grants
43bed0a13a mm/mmap: undo ->mmap() when arch_validate_flags() fails
2b0072d33e mm/damon: validate if the pmd entry is present before accessing
91c4eb16e8 arm64: errata: Add Cortex-A55 to the repeat tlbi list
fc0f921b7e drm/udl: Restore display mode on resume
0640934725 drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
fb3910436b drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
f122bcb34f drm/virtio: Check whether transferred 2D BO is shmem
a95fb5d55a dmaengine: mxs: use platform_driver_register
e7a3334e83 Revert "drm/amdgpu: use dirty framebuffer helper"
4bdedc3b53 nvme-pci: set min_align_mask before calculating max_hw_sectors
32aa0b3f0c nvme-multipath: fix possible hang in live ns resize with ANA access
9391cc3a78 nvmem: core: Fix memleak in nvmem_register()
7efe61dc6a UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
81ab826a28 riscv: Pass -mno-relax only on lld < 15.0.0
7780bb02a0 riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
c657b70e80 riscv: Make VM_WRITE imply VM_READ
3c3c4fa118 riscv: Allow PROT_WRITE-only mmap()
af3aaee08d parisc: fbdev/stifb: Align graphics memory size to 4MB
dc235db7b7 RISC-V: Make port I/O string accessors actually work
8c487db000 riscv: topology: fix default topology reporting
d46c24f307 arm64: topology: move store_cpu_topology() to shared code
fcf0f6cbb6 regulator: qcom_rpm: Fix circular deferral regression
78d81a8a8c net: thunderbolt: Enable DMA paths only after rings are enabled
3281e81ce9 hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
e1ab98ec2b ASoC: wcd934x: fix order of Slimbus unprepare/disable
a2140a9922 ASoC: wcd9335: fix order of Slimbus unprepare/disable
d0507b36da platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
fcfeecca15 quota: Check next/prev free block number after reading from quota file
17214cfab7 HID: multitouch: Add memory barriers
219e4a0f9d fs: dlm: handle -EBUSY first in lock arg validation
34ed22dd28 fs: dlm: fix race between test_bit() and queue_work()
7fa5304c4b i2c: designware: Fix handling of real but unexpected device interrupts
f9effcefa8 mmc: sdhci-sprd: Fix minimum clock limit
a4df91a88c can: kvaser_usb_leaf: Fix CAN state after restart
0c28c2c0cf can: kvaser_usb_leaf: Fix TX queue out of sync after restart
b8c4f6345e can: kvaser_usb_leaf: Fix overread with an invalid command
de4434d682 can: kvaser_usb: Fix use of uninitialized completion
354d768e31 usb: add quirks for Lenovo OneLink+ Dock
103b459590 xhci: dbc: Fix memory leak in xhci_alloc_dbc()
39f4c90b99 iio: pressure: dps310: Reset chip after timeout
bc493cd754 iio: pressure: dps310: Refactor startup procedure
5f6bfc1926 iio: adc: ad7923: fix channel readings for some variants
1be580ed84 iio: ltc2497: Fix reading conversion results
ef4018707d iio: dac: ad5593r: Fix i2c read protocol requirements
60480291c1 cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
0d814a2199 cifs: destage dirty pages before re-reading them for cache=none
15993e9a9b hv_netvsc: Fix race between VF offering and VF association message from host
f9dc33f231 io_uring/net: don't update msg_name if not provided
a1bd289c10 mtd: rawnand: atmel: Unmap streaming DMA mappings
3e4d2375d1 ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
41e83faf03 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
c01f385c70 ALSA: hda/realtek: Correct pin configs for ASUS G533Z
0d50e05ecc ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ec439b97d9 ALSA: usb-audio: Fix NULL dererence at error path
0672215994 ALSA: usb-audio: Fix potential memory leaks
550ca3082e ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
45899fae65 ALSA: oss: Fix potential deadlock at unregistration
5ca155aa79 Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
And update the .xml file to handle some private pointer changes and an
abi preservation change:
type 'struct sk_buff' changed
member 'union { struct { __u8 scm_io_uring; __u8 android_kabi_reserved1_padding1; __u16 android_kabi_reserved1_padding2; __u32 android_kabi_reserved1_padding3; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
member 'u64 android_kabi_reserved1' was removed
type 'struct super_block' changed
member changed from 'struct key * s_master_keys' to 'struct fscrypt_keyring * s_master_keys'
type changed from 'struct key *' to 'struct fscrypt_keyring *'
pointed-to type changed from 'struct key' to 'struct fscrypt_keyring'
type 'struct fscrypt_info' changed
member changed from 'struct key * ci_master_key' to 'struct fscrypt_master_key * ci_master_key'
type changed from 'struct key *' to 'struct fscrypt_master_key *'
pointed-to type changed from 'struct key' to 'struct fscrypt_master_key'
Change-Id: Id0a60a4e0d8a036fffd52dad04135cf57d98f09f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 3d57f36c89d8ba32b2c312f397a37fd1a2dc7cfc ]
I no longer work for Plantronics (aka Poly, aka HP) and do not have
access to the headsets in order to test. However, as noted by Maxim,
the other 32xx models that share the same base code set as the 3220
would need the same quirk. This patch adds the PIDs for the rest of
the Blackwire 32XX product family that require the quirk.
Plantronics Blackwire 3210 Series (047f:c055)
Plantronics Blackwire 3215 Series (047f:c057)
Plantronics Blackwire 3225 Series (047f:c058)
Quote from previous patch by Maxim Mikityanskiy
Plantronics Blackwire 3220 Series (047f:c056) sends HID reports twice
for each volume key press. This patch adds a quirk to hid-plantronics
for this product ID, which will ignore the second volume key press if
it happens within 5 ms from the last one that was handled.
The patch was tested on the mentioned model only, it shouldn't affect
other models, however, this quirk might be needed for them too.
Auto-repeat (when a key is held pressed) is not affected, because the
rate is about 3 times per second, which is far less frequent than once
in 5 ms.
End quote
Signed-off-by: Terry Junge <linuxhid@cosmicgizmosystems.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4eab1c2fe06c98a4dff258dd64800b6986c101e9 ]
The HID descriptor of this device contains two mouse collections, one
for mouse emulation and the other for the trackpoint.
Both collections get merged and, because the first one defines X and Y,
the movemenent events reported by the trackpoint collection are
ignored.
Set the MT_CLS_WIN_8_FORCE_MULTI_INPUT class for this device to be able
to receive its reports.
This fix is similar to/based on commit 40d5bb8737 ("HID: multitouch:
enable multi-input as a quirk for some devices").
Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/825
Reported-by: Akito <the@akito.ooo>
Tested-by: Akito <the@akito.ooo>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 1db1f392591aff13fd643f0ec7c1d5e27391d700 upstream.
Some Wacom devices have a special "bootloader" mode that is used for
firmware flashing. When operating in this mode, the device cannot be
used for input, and the HID descriptor is not able to be processed by
the driver. The driver generates an "Unknown device_type" warning and
then returns an error code from wacom_probe(). This is a problem because
userspace still needs to be able to interact with the device via hidraw
to perform the firmware flash.
This commit adds a non-generic device definition for 056a:0094 which
is used when devices are in "bootloader" mode. It marks the devices
with a special BOOTLOADER type that is recognized by wacom_probe() and
wacom_raw_event(). When we see this type we ensure a hidraw device is
created and otherwise keep our hands off so that userspace is in full
control.
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Tested-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 9d013910df22de91333a0acc81d1dbb115bd76f6 ]
This is no bugfix (so no Fixes: tag is necessary) as it is
taken care of in hid_sensor_custom_add_attributes().
The motivation for this patch is that:
hid_sensor_custom_field.attr_name and
hid_sensor_custom_field.attrs
has the size of HID_CUSTOM_TOTAL_ATTRS and used in same context.
We compare against HID_CUSTOM_TOTAL_ATTRS when
looping through hid_custom_attrs.
We will silent the smatch error:
hid_sensor_custom_add_attributes() error: buffer overflow
'hid_custom_attrs' 8 <= 10
Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 3405a4beaaa852f3ed2a5eb3b5149932d5c3779b ]
Commit f7d8e387d9ae ("HID: uclogic: Switch to Digitizer usage for
styluses") changed the usage used in UCLogic from "Pen" to "Digitizer".
However, the IS_INPUT_APPLICATION() macro evaluates to false for
HID_DG_DIGITIZER causing issues with the XP-Pen Star G640 tablet.
Add the HID_QUIRK_HIDINPUT_FORCE quirk to bypass the
IS_INPUT_APPLICATION() check.
Reported-by: Torge Matthies <openglfreak@googlemail.com>
Reported-by: Alexander Zhang <alex@alexyzhang.dev>
Tested-by: Alexander Zhang <alex@alexyzhang.dev>
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Newer DualSense firmware supports a revised classic rumble mode,
which feels more similar to rumble as supported on previous PlayStation
controllers. It has been made the default on PlayStation and non-PlayStation
devices now (e.g. iOS and Windows). Default to this new mode when
supported.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20221010212313.78275-4-roderick.colenbrander@sony.com
Bug: 260685629
(cherry picked from commit 9fecab247ed15e6145c126fc56ee1e89860741a7)
Change-Id: Icd330111a4d1b1e76a04cd11c623d0982ce3d66f
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
brightness_set_blocking() callback expects function returning int. This fixes
the follwoing build failure:
drivers/hid/hid-playstation.c: In function ‘dualsense_player_led_set_brightness’:
drivers/hid/hid-playstation.c:885:1: error: no return statement in function returning non-void [-Werror=return-type]
}
^
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit 3c92cb4cb60c71b574e47108ead8b6f0470850db)
Change-Id: Id16b960826a26ac22c1a14572444f9af29689ed6
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
The DualSense player LEDs were so far not adjustable from user-space.
This patch exposes each LED individually through the LED class. Each
LED uses the new 'player' function resulting in a name like:
'inputX:white:player-1' for the first LED.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit 8c0ab553b072025530308f74b2c0223ec50dffe5)
Change-Id: I49c699a99b0b8a7bb7980560e3ea7a12faf646aa
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
The DualSense lightbar has so far been supported, but it was not yet
adjustable from user space. This patch exposes it through a multi-color
LED.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit fc97b4d6a1a6d418fd4053fd7716eca746fdd163)
Change-Id: I48204113da804b13ad5bed2f651a5826ab5a86f7
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Changes in 5.15.79
thunderbolt: Tear down existing tunnels when resuming from hibernate
thunderbolt: Add DP OUT resource when DP tunnel is discovered
fuse: fix readdir cache race
drm/amdkfd: avoid recursive lock in migrations back to RAM
drm/amdkfd: handle CPU fault on COW mapping
drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
hwspinlock: qcom: correct MMIO max register for newer SoCs
phy: stm32: fix an error code in probe
wifi: cfg80211: silence a sparse RCU warning
wifi: cfg80211: fix memory leak in query_regdb_file()
soundwire: qcom: reinit broadcast completion
soundwire: qcom: check for outanding writes before doing a read
bpf, verifier: Fix memory leak in array reallocation for stack state
bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
wifi: mac80211: Set TWT Information Frame Disabled bit as 1
bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
HID: hyperv: fix possible memory leak in mousevsc_probe()
bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues
bpf: Fix sockmap calling sleepable function in teardown path
bpf, sock_map: Move cancel_work_sync() out of sock lock
bpf: Add helper macro bpf_for_each_reg_in_vstate
bpf: Fix wrong reg type conversion in release_reference()
net: gso: fix panic on frag_list with mixed head alloc types
macsec: delete new rxsc when offload fails
macsec: fix secy->n_rx_sc accounting
macsec: fix detection of RXSCs when toggling offloading
macsec: clear encryption keys from the stack after setting up offload
octeontx2-pf: Use hardware register for CQE count
octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT]
net: tun: Fix memory leaks of napi_get_frags
bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
net: fman: Unregister ethernet device on removal
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
phy: ralink: mt7621-pci: add sentinel to quirks table
KVM: s390: pv: don't allow userspace to set the clock under PV
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: wwan: iosm: fix memory leak in ipc_wwan_dellink
net: wwan: mhi: fix memory leak in mhi_mbim_dellink
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
can: af_can: fix NULL pointer dereference in can_rx_register()
net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable()
net: broadcom: Fix BCMGENET Kconfig
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
dmaengine: pxa_dma: use platform_get_irq_optional
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
dmaengine: ti: k3-udma-glue: fix memory leak when register device fail
net: lapbether: fix issue of invalid opcode in lapbeth_open()
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
perf stat: Fix printing os->prefix in CSV metrics output
perf tools: Add the include/perf/ directory to .gitignore
netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg()
netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init()
net: nixge: disable napi when enable interrupts failed in nixge_open()
net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg
net/mlx5: Bridge, verify LAG state when adding bond to bridge
net/mlx5: Allow async trigger completion execution on single CPU systems
net/mlx5e: E-Switch, Fix comparing termination table instance
net: cpsw: disable napi in cpsw_ndo_open()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
stmmac: intel: Enable 2.5Gbps for Intel AlderLake-S
stmmac: intel: Update PCH PTP clock rate from 200MHz to 204.8MHz
mctp: Fix an error handling path in mctp_init()
cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
stmmac: dwmac-loongson: fix missing pci_disable_msi() while module exiting
stmmac: dwmac-loongson: fix missing pci_disable_device() in loongson_dwmac_probe()
stmmac: dwmac-loongson: fix missing of_node_put() while module exiting
net: phy: mscc: macsec: clear encryption keys when freeing a flow
net: atlantic: macsec: clear encryption keys from the stack
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: tundra: free irq when alloc ring failed in tsi108_open()
net: macvlan: fix memory leaks of macvlan_common_newlink
riscv: process: fix kernel info leakage
riscv: vdso: fix build with llvm
riscv: fix reserved memory setup
arm64: efi: Fix handling of misaligned runtime regions and drop warning
MIPS: jump_label: Fix compat branch range check
mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA
ALSA: hda/hdmi - enable runtime pm for more AMD display audio
ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
ALSA: hda: fix potential memleak in 'add_widget_node'
ALSA: hda/realtek: Add Positivo C6300 model quirk
ALSA: usb-audio: Yet more regression for for the delayed card registration
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: usb-audio: Add DSD support for Accuphase DAC-60
vmlinux.lds.h: Fix placement of '.data..decrypted' section
ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure
nilfs2: fix deadlock in nilfs_count_free_blocks()
nilfs2: fix use-after-free bug of ns_writer on remount
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
drm/amdgpu: disable BACO on special BEIGE_GOBY card
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
wifi: ath11k: avoid deadlock during regulatory update in ath11k_regd_update()
btrfs: fix match incorrectly in dev_args_match_device
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
btrfs: zoned: initialize device's zone info for seeding
mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
mm/damon/dbgfs: check if rm_contexts input is for a real context
mm/memremap.c: map FS_DAX device memory as decrypted
mm/shmem: use page_mapping() to detect page cache for uffd continue
can: j1939: j1939_send_one(): fix missing CAN header initialization
cert host tools: Stop complaining about deprecated OpenSSL functions
dmaengine: at_hdmac: Fix at_lli struct definition
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending
dmaengine: at_hdmac: Fix premature completion of desc in issue_pending
dmaengine: at_hdmac: Do not call the complete callback on device_terminate_all
dmaengine: at_hdmac: Protect atchan->status with the channel lock
dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all()
dmaengine: at_hdmac: Fix concurrency over descriptor
dmaengine: at_hdmac: Free the memset buf without holding the chan lock
dmaengine: at_hdmac: Fix concurrency over the active list
dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Check return code of dma_async_device_register
marvell: octeontx2: build error: unknown type name 'u64'
drm/amdkfd: Migrate in CPU page fault use current mm
net: tun: call napi_schedule_prep() to ensure we own a napi
x86/cpu: Restore AMD's DE_CFG MSR after resume
Linux 5.15.79
Change-Id: I6f77aa724b7aa43abcef3444af951c7c62d46303
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 9ad6645a9dce4d0e42daca6ebf32a154401c59d3 upstream.
The Acer Aspire Switch V 10 (SW5-017)'s keyboard-dock uses the same
ITE controller setup as other Acer Switch 2-in-1's.
This needs special handling for the wifi on/off toggle hotkey as well as
to properly report touchpad on/off keypresses.
Add the USB-ids for the SW5-017's keyboard-dock with a quirk setting of
QUIRK_TOUCHPAD_ON_OFF_REPORT to fix both issues.
Cc: Rudolf Polzer <rpolzer@google.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ec61b41918587be530398b0d1c9a0d16619397e5 upstream.
Syzbot reported shift-out-of-bounds in hid_report_raw_event.
microsoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) >
32! (swapper/0)
======================================================================
UBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20
shift exponent 127 is too large for 32-bit type 'int'
CPU: 0 PID: 0 Comm: swapper/0 Not tainted
6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0
Hardware name: Google Compute Engine/Google Compute Engine, BIOS
Google 10/26/2022
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322
snto32 drivers/hid/hid-core.c:1323 [inline]
hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline]
hid_process_report drivers/hid/hid-core.c:1665 [inline]
hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998
hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066
hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284
__usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671
dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988
call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x76a/0x980 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x277/0x75b kernel/softirq.c:571
__irq_exit_rcu+0xec/0x170 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107
======================================================================
If the size of the integer (unsigned n) is bigger than 32 in snto32(),
shift exponent will be too large for 32-bit type 'int', resulting in a
shift-out-of-bounds bug.
Fix this by adding a check on the size of the integer (unsigned n) in
snto32(). To add support for n greater than 32 bits, set n to 32, if n
is greater than 32.
Reported-by: syzbot+8b1641d2f14732407e23@syzkaller.appspotmail.com
Fixes: dde5845a52 ("[PATCH] Generic HID layer - code split")
Signed-off-by: ZhangPeng <zhangpeng362@huawei.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d180b6496143cd360c5d5f58ae4b9a8229c1f344 upstream.
If an empty buf is received, lbuf is also empty. So lbuf is
accessed by index -1.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: f31a2de3fe ("HID: hid-lg4ff: Allow switching of Logitech gaming wheels between compatibility modes")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f6d910a89a2391e5ce1f275d205023880a33d3f8 upstream.
Some additional USB mouse devices are needing ALWAYS_POLL quirk without
which they disconnect and reconnect every 60s.
Add below devices to the known quirk list.
CHERRY VID 0x046a, PID 0x000c
MICROSOFT VID 0x045e, PID 0x0783
PRIMAX VID 0x0461, PID 0x4e2a
Signed-off-by: Ankit Patel <anpatel@nvidia.com>
Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Changes in 5.15.78
scsi: lpfc: Adjust bytes received vales during cmf timer interval
scsi: lpfc: Adjust CMF total bytes and rxmonitor
scsi: lpfc: Rework MIB Rx Monitor debug info logic
serial: ar933x: Deassert Transmit Enable on ->rs485_config()
KVM: x86: Trace re-injected exceptions
KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1)
drm/amd/display: explicitly disable psr_feature_enable appropriately
mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
HID: playstation: add initial DualSense Edge controller support
KVM: x86: Protect the unused bits in MSR exiting flags
KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter()
KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER
RDMA/cma: Use output interface for net_dev check
IB/hfi1: Correctly move list in sc_disable()
RDMA/hns: Remove magic number
RDMA/hns: Use hr_reg_xxx() instead of remaining roce_set_xxx()
RDMA/hns: Disable local invalidate operation
NFSv4: Fix a potential state reclaim deadlock
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed
NFSv4.2: Fixup CLONE dest file size for zero-length count
nfs4: Fix kmemleak when allocate slot failed
net: dsa: Fix possible memory leaks in dsa_loop_init()
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
net: dsa: fall back to default tagger if we can't load the one from DT
nfc: fdp: Fix potential memory leak in fdp_nci_send()
nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
net: fec: fix improper use of NETDEV_TX_BUSY
ata: pata_legacy: fix pdc20230_set_piomode()
net: sched: Fix use after free in red_enqueue()
net: tun: fix bugs for oversize packet when napi frags enabled
netfilter: nf_tables: netlink notifier might race to release objects
netfilter: nf_tables: release flow rule object from commit path
ipvs: use explicitly signed chars
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
rose: Fix NULL pointer dereference in rose_send_frame()
mISDN: fix possible memory leak in mISDN_register_device()
isdn: mISDN: netjet: fix wrong check of device registration
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
btrfs: fix inode list leak during backref walking at find_parent_nodes()
btrfs: fix ulist leaks in error paths of qgroup self tests
netfilter: ipset: enforce documented limit to prevent allocating huge memory
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
Bluetooth: virtio_bt: Use skb_put to set length
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: L2CAP: Fix memory leak in vhci_write
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
ibmvnic: Free rwi on reset success
stmmac: dwmac-loongson: fix invalid mdio_node
net/smc: Fix possible leaked pernet namespace in smc_init()
net, neigh: Fix null-ptr-deref in neigh_table_clear()
ipv6: fix WARNING in ip6_route_net_exit_late()
vsock: fix possible infinite sleep in vsock_connectible_wait_data()
drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag
drm/msm/hdmi: fix IRQ lifetime
video/fbdev/stifb: Implement the stifb_fillrect() function
fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
mtd: parsers: bcm47xxpart: print correct offset on read error
mtd: parsers: bcm47xxpart: Fix halfblock reads
s390/uaccess: add missing EX_TABLE entries to __clear_user()
s390/boot: add secure boot trailer
s390/cio: derive cdev information only for IO-subchannels
s390/cio: fix out-of-bounds access on cio_ignore free
media: rkisp1: Don't pass the quantization to rkisp1_csm_config()
media: rkisp1: Initialize color space on resizer sink and source pads
media: rkisp1: Use correct macro for gradient registers
media: rkisp1: Zero v4l2_subdev_format fields in when validating links
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
media: dvb-frontends/drxk: initialize err to 0
media: meson: vdec: fix possible refcount leak in vdec_probe()
media: v4l: subdev: Fail graciously when getting try data for NULL state
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
scsi: core: Restrict legal sdev_state transitions via sysfs
HID: saitek: add madcatz variant of MMO7 mouse device ID
drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case
i2c: xiic: Add platform module alias
efi/tpm: Pass correct address to memblock_reserve
clk: qcom: Update the force mem core bit for GPU clocks
ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset
arm64: dts: imx8: correct clock order
arm64: dts: lx2160a: specify clock frequencies for the MDIO controllers
arm64: dts: ls1088a: specify clock frequencies for the MDIO controllers
arm64: dts: ls208xa: specify clock frequencies for the MDIO controllers
block: Fix possible memory leak for rq_wb on add_disk failure
firmware: arm_scmi: Suppress the driver's bind attributes
firmware: arm_scmi: Make Rx chan_setup fail on memory errors
firmware: arm_scmi: Fix devres allocation device in virtio transport
arm64: dts: juno: Add thermal critical trip points
i2c: piix4: Fix adapter not be removed in piix4_remove()
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
af_unix: Fix memory leaks of the whole sk due to OOB skb.
fscrypt: stop using keyrings subsystem for fscrypt_master_key
fscrypt: fix keyring memory leak on mount failure
btrfs: fix lost file sync on direct IO write with nowait and dsync iocb
btrfs: fix tree mod log mishandling of reallocated nodes
btrfs: fix type of parameter generation in btrfs_get_dentry
ftrace: Fix use-after-free for dynamic ftrace_ops
tcp/udp: Make early_demux back namespacified.
tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd()
kprobe: reverse kp->flags when arm_kprobe failed
ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters()
tools/nolibc/string: Fix memcmp() implementation
tracing/histogram: Update document for KEYS_MAX size
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
fuse: add file_modified() to fallocate
efi: random: reduce seed size to 32 bytes
efi: random: Use 'ACPI reclaim' memory for random seed
arm64: entry: avoid kprobe recursion
perf/x86/intel: Fix pebs event constraints for ICL
perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
perf/x86/intel: Fix pebs event constraints for SPR
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Avoid printing the hardware path twice
ext4: fix warning in 'ext4_da_release_space'
ext4: fix BUG_ON() when directory entry has invalid rec_len
x86/syscall: Include asm/ptrace.h in syscall_wrapper header
KVM: x86: Mask off reserved bits in CPUID.80000006H
KVM: x86: Mask off reserved bits in CPUID.8000001AH
KVM: x86: Mask off reserved bits in CPUID.80000008H
KVM: x86: Mask off reserved bits in CPUID.80000001H
KVM: x86: Mask off reserved bits in CPUID.8000001FH
KVM: VMX: fully disable SGX if SECONDARY_EXEC_ENCLS_EXITING unavailable
KVM: arm64: Fix bad dereference on MTE-enabled systems
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: update the emulation mode after rsm
KVM: x86: emulator: update the emulation mode after CR0 write
tee: Fix tee_shm_register() for kernel TEE drivers
ext4,f2fs: fix readahead of verity data
cifs: fix regression in very old smb1 mounts
drm/rockchip: dsi: Clean up 'usage_mode' when failing to attach
drm/rockchip: dsi: Force synchronous probe
drm/i915/sdvo: Filter out invalid outputs more sensibly
drm/i915/sdvo: Setup DDC fully before output init
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
Linux 5.15.78
Change-Id: Ifb9e17307dea0f99d68043f96e48b8c81c2e692d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ]
roccat_report_event() is responsible for registering
roccat-related reports in struct roccat_device.
int roccat_report_event(int minor, u8 const *data)
{
struct roccat_device *device;
struct roccat_reader *reader;
struct roccat_report *report;
uint8_t *new_value;
device = devices[minor];
new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
if (!new_value)
return -ENOMEM;
report = &device->cbuf[device->cbuf_end];
/* passing NULL is safe */
kfree(report->value);
...
The registered report is stored in the struct roccat_device member
"struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value,
kfree() the saved report from cbuf[0] and allocates a new reprot.
Since there is no lock when this kfree() is performed,
kfree() can be performed even while reading the saved report.
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
struct roccat_reader *reader = file->private_data;
struct roccat_device *device = reader->device;
struct roccat_report *report;
ssize_t retval = 0, len;
DECLARE_WAITQUEUE(wait, current);
mutex_lock(&device->cbuf_lock);
...
report = &device->cbuf[reader->cbuf_start];
/*
* If report is larger than requested amount of data, rest of report
* is lost!
*/
len = device->report_size > count ? count : device->report_size;
if (copy_to_user(buffer, report->value, len)) {
retval = -EFAULT;
goto exit_unlock;
}
...
The roccat_read() function receives the device->cbuf report and
delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of
the Nth report->value is in progress, the pointer that copy_to_user()
is working on is kfree()ed and UAF read may occur. (race condition)
Since the device node of this driver does not set separate permissions,
this is not a security vulnerability, but because it is used for
requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or
There is a possibility to use it by giving.
Bug: 251067658
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I90b24df9216ab87a4fec0ab06fa52e7b1eb97fd1
Changes in 5.15.76
r8152: add PID for the Lenovo OneLink+ Dock
arm64/mm: Consolidate TCR_EL1 fields
usb: gadget: uvc: consistently use define for headerlen
usb: gadget: uvc: use on returned header len in video_encode_isoc_sg
usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer
usb: gadget: uvc: giveback vb2 buffer on req complete
usb: gadget: uvc: improve sg exit condition
arm64: errata: Remove AES hwcap for COMPAT tasks
perf/x86/intel/pt: Relax address filter validation
btrfs: enhance unsupported compat RO flags handling
ocfs2: clear dinode links count in case of error
ocfs2: fix BUG when iput after ocfs2_mknod fails
selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
cpufreq: qcom: fix writes in read-only memory region
i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter
x86/microcode/AMD: Apply the patch early on every logical thread
hwmon/coretemp: Handle large core ID value
ata: ahci-imx: Fix MODULE_ALIAS
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
x86/resctrl: Fix min_cbm_bits for AMD
cpufreq: qcom: fix memory leak in error path
drm/amdgpu: fix sdma doorbell init ordering on APUs
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
kvm: Add support for arch compat vm ioctls
KVM: arm64: vgic: Fix exit condition in scan_its_table()
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
media: mceusb: set timeout to at least timeout provided
media: venus: dec: Handle the case where find_format fails
x86/topology: Fix multiple packages shown on a single-package system
x86/topology: Fix duplicated core ID within a package
btrfs: fix processing of delayed data refs during backref walking
btrfs: fix processing of delayed tree block refs during backref walking
drm/vc4: Add module dependency on hdmi-codec
ACPI: extlog: Handle multiple records
tipc: Fix recognition of trial period
tipc: fix an information leak in tipc_topsrv_kern_subscr
i40e: Fix DMA mappings leak
HID: magicmouse: Do not set BTN_MOUSE on double report
sfc: Change VF mac via PF as first preference if available.
net/atm: fix proc_mpc_write incorrect return value
net: phy: dp83867: Extend RX strap quirk for SGMII mode
net: phylink: add mac_managed_pm in phylink_config structure
scsi: lpfc: Fix memory leak in lpfc_create_port()
udp: Update reuse->has_conns under reuseport_lock.
cifs: Fix xid leak in cifs_create()
cifs: Fix xid leak in cifs_copy_file_range()
cifs: Fix xid leak in cifs_flock()
cifs: Fix xid leak in cifs_ses_add_channel()
dm: remove unnecessary assignment statement in alloc_dev()
net: hsr: avoid possible NULL deref in skb_clone()
ionic: catch NULL pointer issue on reconfig
netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements
nvme-hwmon: consistently ignore errors from nvme_hwmon_init
nvme-hwmon: kmalloc the NVME SMART log buffer
nvmet: fix workqueue MEM_RECLAIM flushing dependency
net: sched: cake: fix null pointer access issue when cake_init() fails
net: sched: delete duplicate cleanup of backlog and qlen
net: sched: sfb: fix null pointer access issue when sfb_init() fails
sfc: include vport_id in filter spec hash and equal()
wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new()
net: hns: fix possible memory leak in hnae_ae_register()
net: sched: fix race condition in qdisc_graft()
net: phy: dp83822: disable MDI crossover status change interrupt
iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check()
iommu/vt-d: Clean up si_domain in the init_dmars() error path
fs: dlm: fix invalid derefence of sb_lvbptr
arm64: mte: move register initialization to C
ksmbd: handle smb2 query dir request for OutputBufferLength that is too small
ksmbd: fix incorrect handling of iterate_dir
tracing: Simplify conditional compilation code in tracing_set_tracer()
tracing: Do not free snapshot if tracer is on cmdline
mmc: sdhci-tegra: Use actual clock rate for SW tuning correction
perf: Skip and warn on unknown format 'configN' attrs
ACPI: video: Force backlight native for more TongFang devices
x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB
Makefile.debug: re-enable debug info for .S files
mmc: core: Add SD card quirk for broken discard
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
Linux 5.15.76
Change-Id: I7015bfc94dfd69b9ab2e83d4b20860f13a6c4be6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.15.75
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
ALSA: oss: Fix potential deadlock at unregistration
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: usb-audio: Fix potential memory leaks
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
mtd: rawnand: atmel: Unmap streaming DMA mappings
io_uring/net: don't update msg_name if not provided
hv_netvsc: Fix race between VF offering and VF association message from host
cifs: destage dirty pages before re-reading them for cache=none
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
iio: dac: ad5593r: Fix i2c read protocol requirements
iio: ltc2497: Fix reading conversion results
iio: adc: ad7923: fix channel readings for some variants
iio: pressure: dps310: Refactor startup procedure
iio: pressure: dps310: Reset chip after timeout
xhci: dbc: Fix memory leak in xhci_alloc_dbc()
usb: add quirks for Lenovo OneLink+ Dock
can: kvaser_usb: Fix use of uninitialized completion
can: kvaser_usb_leaf: Fix overread with an invalid command
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
can: kvaser_usb_leaf: Fix CAN state after restart
mmc: sdhci-sprd: Fix minimum clock limit
i2c: designware: Fix handling of real but unexpected device interrupts
fs: dlm: fix race between test_bit() and queue_work()
fs: dlm: handle -EBUSY first in lock arg validation
HID: multitouch: Add memory barriers
quota: Check next/prev free block number after reading from quota file
platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
ASoC: wcd9335: fix order of Slimbus unprepare/disable
ASoC: wcd934x: fix order of Slimbus unprepare/disable
hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
net: thunderbolt: Enable DMA paths only after rings are enabled
regulator: qcom_rpm: Fix circular deferral regression
arm64: topology: move store_cpu_topology() to shared code
riscv: topology: fix default topology reporting
RISC-V: Make port I/O string accessors actually work
parisc: fbdev/stifb: Align graphics memory size to 4MB
riscv: Allow PROT_WRITE-only mmap()
riscv: Make VM_WRITE imply VM_READ
riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
riscv: Pass -mno-relax only on lld < 15.0.0
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
nvmem: core: Fix memleak in nvmem_register()
nvme-multipath: fix possible hang in live ns resize with ANA access
nvme-pci: set min_align_mask before calculating max_hw_sectors
Revert "drm/amdgpu: use dirty framebuffer helper"
dmaengine: mxs: use platform_driver_register
drm/virtio: Check whether transferred 2D BO is shmem
drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
drm/udl: Restore display mode on resume
arm64: errata: Add Cortex-A55 to the repeat tlbi list
mm/damon: validate if the pmd entry is present before accessing
mm/mmap: undo ->mmap() when arch_validate_flags() fails
xen/gntdev: Prevent leaking grants
xen/gntdev: Accommodate VMA splitting
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
serial: 8250: Let drivers request full 16550A feature probing
serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
NFSD: Protect against send buffer overflow in NFSv3 READDIR
NFSD: Protect against send buffer overflow in NFSv2 READ
NFSD: Protect against send buffer overflow in NFSv3 READ
powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
powerpc/boot: Explicitly disable usage of SPE instructions
slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure
slimbus: qcom-ngd: cleanup in probe error path
scsi: qedf: Populate sysfs attributes for vport
gpio: rockchip: request GPIO mux to pinctrl when setting direction
pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
ksmbd: fix endless loop when encryption for response fails
ksmbd: Fix wrong return value and message length check in smb2_ioctl()
ksmbd: Fix user namespace mapping
fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
btrfs: fix race between quota enable and quota rescan ioctl
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
f2fs: complete checkpoints during remount
f2fs: flush pending checkpoints when freezing super
f2fs: increase the limit for reserve_root
f2fs: fix to do sanity check on destination blkaddr during recovery
f2fs: fix to do sanity check on summary info
hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
jbd2: wake up journal waiters in FIFO order, not LIFO
jbd2: fix potential buffer head reference count leak
jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
jbd2: add miss release buffer head in fc_do_one_pass()
ext4: avoid crash when inline data creation follows DIO write
ext4: fix null-ptr-deref in ext4_write_info
ext4: make ext4_lazyinit_thread freezable
ext4: fix check for block being out of directory size
ext4: don't increase iversion counter for ea_inodes
ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
ext4: place buffer head allocation before handle start
ext4: fix dir corruption when ext4_dx_add_entry() fails
ext4: fix miss release buffer head in ext4_fc_write_inode
ext4: fix potential memory leak in ext4_fc_record_modified_inode()
ext4: fix potential memory leak in ext4_fc_record_regions()
ext4: update 'state->fc_regions_size' after successful memory allocation
livepatch: fix race between fork and KLP transition
ftrace: Properly unset FTRACE_HASH_FL_MOD
ring-buffer: Allow splice to read previous partially read pages
ring-buffer: Have the shortest_full queue be the shortest not longest
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Add ring_buffer_wake_waiters()
ring-buffer: Fix race between reset page and reading page
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
tracing: Wake up ring buffer waiters on closing of the file
tracing: Wake up waiters when tracing is disabled
tracing: Add ioctl() to force ring buffer waiters to wake up
tracing: Move duplicate code of trace_kprobe/eprobe.c into header
tracing: Add "(fault)" name injection to kernel probes
tracing: Fix reading strings from synthetic events
thunderbolt: Explicitly enable lane adapter hotplug events at startup
efi: libstub: drop pointless get_memory_map() call
media: cedrus: Set the platform driver data earlier
media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
blk-wbt: call rq_qos_add() after wb_normal is initialized
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
staging: greybus: audio_helper: remove unused and wrong debugfs usage
drm/nouveau/kms/nv140-: Disable interlacing
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
drm/amd/display: Fix vblank refcount in vrr transition
smb3: must initialize two ACL struct fields to zero
selinux: use "grep -E" instead of "egrep"
ima: fix blocking of security.ima xattrs of unsupported algorithms
userfaultfd: open userfaultfds with O_RDONLY
ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register()
sh: machvec: Use char[] for section boundaries
MIPS: SGI-IP27: Free some unused memory
MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
objtool: Preserve special st_shndx indexes in elf_update_symbol
nfsd: Fix a memory leak in an error handling path
SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
SUNRPC: Fix svcxdr_init_encode's buflen calculation
NFSD: Protect against send buffer overflow in NFSv2 READDIR
NFSD: Fix handling of oversized NFSv4 COMPOUND requests
wifi: rtlwifi: 8192de: correct checking of IQK reload
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
leds: lm3601x: Don't use mutex after it was destroyed
bpf: Fix reference state management for synchronous callbacks
wifi: mac80211: allow bw change during channel switch in mesh
bpftool: Fix a wrong type cast in btf_dumper_int
spi: mt7621: Fix an error message in mt7621_spi_probe()
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
xsk: Fix backpressure mechanism on Tx
bpf: Disable preemption when increasing per-cpu map_locked
bpf: Propagate error from htab_lock_bucket() to userspace
bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy
Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init()
selftests/xsk: Avoid use-after-free on ctx
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
spi: meson-spicc: do not rely on busy flag in pow2 clk ops
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
wifi: mt76: sdio: fix transmitting packet hangs
wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload
wifi: mt76: mt7915: do not check state before configuring implicit beamform
Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release
net: fs_enet: Fix wrong check in do_pd_setup
bpf: Ensure correct locking around vulnerable function find_vpid()
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
netfilter: conntrack: fix the gc rescheduling delay
netfilter: conntrack: revisit the gc initial rescheduling bias
wifi: ath11k: fix number of VHT beamformee spatial streams
x86/microcode/AMD: Track patch allocation size explicitly
x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
skmsg: Schedule psock work if the cached skb exists on the psock
i2c: mlxbf: support lock mechanism
Bluetooth: hci_core: Fix not handling link timeouts propertly
xfrm: Reinject transport-mode packets through workqueue
netfilter: nft_fib: Fix for rpath check with VRF devices
spi: s3c64xx: Fix large transfers with DMA
wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
vhost/vsock: Use kvmalloc/kvfree for larger packets.
eth: alx: take rtnl_lock on resume
mISDN: fix use-after-free bugs in l1oip timer handlers
sctp: handle the error returned from sctp_auth_asoc_init_active_key
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
spi: Ensure that sg_table won't be used after being freed
hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net: wwan: iosm: Call mutex_init before locking it
net/ieee802154: reject zero-sized raw_sendmsg()
once: add DO_ONCE_SLOW() for sleepable contexts
net: mvpp2: fix mvpp2 debugfs leak
drm: bridge: adv7511: fix CEC power down control register offset
drm: bridge: adv7511: unregister cec i2c device after cec adapter
drm/bridge: Avoid uninitialized variable warning
drm/mipi-dsi: Detach devices when removing the host
drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
drm/bridge: parade-ps8640: Fix regulator supply order
drm/dp_mst: fix drm_dp_dpcd_read return value checks
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
ASoC: mt6359: fix tests for platform_get_irq() failure
platform/chrome: fix double-free in chromeos_laptop_prepare()
platform/chrome: fix memory corruption in ioctl
ASoC: tas2764: Allow mono streams
ASoC: tas2764: Drop conflicting set_bias_level power setting
ASoC: tas2764: Fix mute/unmute
platform/x86: msi-laptop: Fix old-ec check for backlight registering
platform/x86: msi-laptop: Fix resource cleanup
platform/chrome: cros_ec_typec: Correct alt mode index
drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume()
drm/bridge: megachips: Fix a null pointer dereference bug
ASoC: rsnd: Add check for rsnd_mod_power_on
ALSA: hda: beep: Simplify keep-power-at-enable behavior
drm/bochs: fix blanking
drm/omap: dss: Fix refcount leak bugs
drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
ASoC: codecs: tx-macro: fix kcontrol put
ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
ALSA: dmaengine: increment buffer pointer atomically
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
ALSA: hda/hdmi: Don't skip notification handling during PM operation
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
locks: fix TOCTOU race when granting write lease
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: kirkwood: lsxl: remove first ethernet port
ia64: export memory_add_physaddr_to_nid to fix cxl build error
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
arm64: dts: ti: k3-j7200: fix main pinmux range
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
ARM: Drop CMDLINE_* dependency on ATAGS
ext4: don't run ext4lazyinit for read-only filesystems
arm64: ftrace: fix module PLTs with mcount
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
iio: inkern: only release the device node when done with it
iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
iio: ABI: Fix wrong format of differential capacitance channel ABI.
iio: magnetometer: yas530: Change data type of hard_offsets to signed
RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey
usb: common: debug: Check non-standard control requests
clk: meson: Hold reference returned by of_get_parent()
clk: oxnas: Hold reference returned by of_get_parent()
clk: qoriq: Hold reference returned by of_get_parent()
clk: berlin: Add of_node_put() for of_get_parent()
clk: sprd: Hold reference returned by of_get_parent()
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra20: Fix refcount leak in tegra20_clock_init
HSI: omap_ssi: Fix refcount leak in ssi_probe
HSI: omap_ssi_port: Fix dma_map_sg error check
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
tty: xilinx_uartps: Fix the ignore_status
media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
media: uvcvideo: Fix memory leak in uvc_gpio_parse
media: uvcvideo: Use entity get_cur in uvc_ctrl_set
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
RDMA/rxe: Fix "kernel NULL pointer dereference" error
RDMA/rxe: Fix the error caused by qp->sk
misc: ocxl: fix possible refcount leak in afu_ioctl()
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
dmaengine: hisilicon: Disable channels when unregister hisi_dma
dmaengine: hisilicon: Fix CQ head update
dmaengine: hisilicon: Add multi-thread support for a DMA channel
dyndbg: fix static_branch manipulation
dyndbg: fix module.dyndbg handling
dyndbg: let query-modname override actual module name
dyndbg: drop EXPORTed dynamic_debug_exec_queries
clk: qcom: sm6115: Select QCOM_GDSC
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent()
phy: phy-mtk-tphy: fix the phy type setting issue
mtd: rawnand: intel: Read the chip-select line from the correct OF node
mtd: rawnand: intel: Remove undocumented compatible string
mtd: rawnand: fsl_elbc: Fix none ECC mode
RDMA/irdma: Align AE id codes to correct flush code and event
RDMA/srp: Fix srp_abort()
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
RDMA/siw: Fix QP destroy to wait for all references dropped.
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
ata: fix ata_id_has_devslp()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_dipm()
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
md: Replace snprintf with scnprintf
md/raid5: Ensure stripe_fill happens on non-read IO with journal
md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
RDMA/cm: Use SLID in the work completion as the DLID in responder side
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
xhci: Don't show warning for reinit on known broken suspend
usb: gadget: function: fix dangling pnp_string in f_printer.c
drivers: serial: jsm: fix some leaks in probe
serial: 8250: Toggle IER bits on only after irq has been set up
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
phy: qualcomm: call clk_disable_unprepare in the error handling
staging: vt6655: fix some erroneous memory clean-up loops
slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON
firmware: google: Test spinlock on panic path to avoid lockups
serial: 8250: Fix restoring termios speed after suspend
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
scsi: iscsi: Rename iscsi_conn_queue_work()
scsi: iscsi: Add recv workqueue helpers
scsi: iscsi: Run recv path from workqueue
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
clk: qcom: gcc-sm6115: Override default Alpha PLL regs
RDMA/rxe: Fix resize_finish() in rxe_queue.c
fsi: core: Check error number after calling ida_simple_get
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: fsl-imx25: Fix check for platform_get_irq() errors
mfd: sm501: Add check for platform_driver_register()
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
usb: mtu3: fix failed runtime suspend in host only mode
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
clk: baikal-t1: Fix invalid xGMAC PTP clock divider
clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
clk: baikal-t1: Add SATA internal ref clock buffer
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
clk: imx: scu: fix memleak on platform_device_add() fails
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: ast2600: BCLK comes from EPLL
mailbox: mpfs: fix handling of the reg property
mailbox: mpfs: account for mbox offsets while sending
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig
powerpc/math_emu/efp: Include module.h
powerpc/sysdev/fsl_msi: Add missing of_node_put()
powerpc/pci_dn: Add missing of_node_put()
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
powerpc: Fix fallocate and fadvise64_64 compat parameter combination
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
powerpc: Fix SPE Power ISA properties for e500v1 platforms
powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL
crypto: sahara - don't sleep when in softirq
crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
hwrng: arm-smccc-trng - fix NO_ENTROPY handling
cgroup: Honor caller's cgroup NS when resolving path
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
crypto: qat - fix default value of WDT timer
crypto: hisilicon/qm - fix missing put dfx access
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
iommu/omap: Fix buffer overflow in debugfs
crypto: akcipher - default implementation for setting a private key
crypto: ccp - Release dma channels before dmaengine unrgister
crypto: inside-secure - Change swab to swab32
crypto: qat - fix DMA transfer direction
cifs: return correct error in ->calc_signature()
iommu/iova: Fix module config properly
tracing: kprobe: Fix kprobe event gen test module on exit
tracing: kprobe: Make gen test module work in arm and riscv
tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads
kbuild: remove the target in signal traps when interrupted
kbuild: rpm-pkg: fix breakage when V=1 is used
crypto: marvell/octeontx - prevent integer overflows
crypto: cavium - prevent integer overflow loading firmware
thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
f2fs: fix race condition on setting FI_NO_EXTENT flag
f2fs: fix to account FS_CP_DATA_IO correctly
selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
fs: dlm: fix race in lowcomms
rcu: Avoid triggering strict-GP irq-work when RCU is idle
rcu: Back off upon fill_page_cache_func() allocation failure
rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address
cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode
MIPS: BCM47XX: Cast memcmp() of function to (void *)
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
ARM: decompressor: Include .data.rel.ro.local
ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
x86/entry: Work around Clang __bdos() bug
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
NFSD: fix use-after-free on source server when doing inter-server copy
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
bpftool: Clear errno after libcap's checks
ice: set tx_tstamps when creating new Tx rings via ethtool
net: ethernet: ti: davinci_mdio: Add workaround for errata i2329
openvswitch: Fix double reporting of drops in dropwatch
openvswitch: Fix overreporting of drops in dropwatch
tcp: annotate data-race around tcp_md5sig_pool_populated
x86/mce: Retrieve poison range from hardware
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround
xfrm: Update ipcomp_scratches with NULL when freed
iavf: Fix race between iavf_close and iavf_reset_task
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk
regulator: core: Prevent integer underflow
wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
can: bcm: check the result of can_send() in bcm_can_tx()
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
wifi: rt2x00: set VGC gain for both chains of MT7620
wifi: rt2x00: set SoC wmac clock register
wifi: rt2x00: correctly set BBP register 86 for MT7620
hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Bluetooth: L2CAP: Fix user-after-free
r8152: Rate limit overflow messages
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
drm: Use size_t type for len variable in drm_copy_field()
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
drm/amd/display: fix overflow on MIN_I64 definition
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
drm: bridge: dw_hdmi: only trigger hotplug event on link change
ALSA: usb-audio: Register card at the last interface
drm/vc4: vec: Fix timings for VEC modes
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
platform/chrome: cros_ec: Notify the PM of wake events during resume
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
drm/amdgpu: fix initial connector audio value
drm/meson: reorder driver deinit sequence to fix use-after-free bug
drm/meson: explicitly remove aggregate driver at module unload time
mmc: sdhci-msm: add compatible string check for sdm670
drm/dp: Don't rewrite link config when setting phy test pattern
drm/amd/display: Remove interface for periodic interrupt 1
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6sll: add missing properties for sram
ARM: dts: imx6sx: add missing properties for sram
kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
btrfs: dump extra info if one free space cache has more bitmaps than it should
btrfs: scrub: try to fix super block errors
btrfs: don't print information about space cache or tree every remount
ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
usb: host: xhci-plat: suspend and resume clocks
usb: host: xhci-plat: suspend/resume clks for brcm
dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
staging: vt6655: fix potential memory leak
blk-throttle: prevent overflow while calculating wait time
ata: libahci_platform: Sanity check the DT child nodes number
bcache: fix set_at_max_writeback_rate() for multiple attached devices
soundwire: cadence: Don't overwrite msg->buf during write commands
soundwire: intel: fix error handling on dai registration issues
HID: roccat: Fix use-after-free in roccat_read()
eventfd: guard wake_up in eventfd fs calls as well
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
usb: musb: Fix musb_gadget.c rxstate overflow bug
arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
Revert "usb: storage: Add quirk for Samsung Fit flash"
staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled
ext2: Use kvmalloc() for group descriptor array
nvme: copy firmware_rev on each init
nvmet-tcp: add bounds check on Transfer Tag
usb: idmouse: fix an uninit-value in idmouse_open
clk: bcm2835: Make peripheral PLLC critical
clk: bcm2835: Round UART input clock up
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
io_uring/af_unix: defer registered files gc to io_uring release
io_uring: correct pinned_vm accounting
io_uring/rw: fix short rw error handling
io_uring/rw: fix error'ed retry return values
io_uring/rw: fix unexpected link breakage
mm: hugetlb: fix UAF in hugetlb_handle_userfault
net: ieee802154: return -EINVAL for unknown addr type
ALSA: usb-audio: Fix last interface check for registration
blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
net/ieee802154: don't warn zero-sized raw_sendmsg()
drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n
Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5
Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5
ext4: continue to expand file system when the target size doesn't reach
thermal: intel_powerclamp: Use first online CPU as control_cpu
gcov: support GCC 12.1 and newer compilers
io-wq: Fix memory leak in worker creation
Linux 5.15.75
Change-Id: I5a3ef9688fb31003940d7e1828f863b9d50f1da9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit b5bcb94b0954a026bbd671741fdb00e7141f9c91 ]
If hid_add_device() returns error, it should call hid_destroy_device()
to free hid_dev which is allocated in hid_allocate_device().
Fixes: 74c4fb0580 ("HID: hv_mouse: Properly add the hid device")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ]
The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same
quirks as the Saitek variant.
Signed-off-by: Samuel Bailey <samuel.bailey1@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 ]
roccat_report_event() is responsible for registering
roccat-related reports in struct roccat_device.
int roccat_report_event(int minor, u8 const *data)
{
struct roccat_device *device;
struct roccat_reader *reader;
struct roccat_report *report;
uint8_t *new_value;
device = devices[minor];
new_value = kmemdup(data, device->report_size, GFP_ATOMIC);
if (!new_value)
return -ENOMEM;
report = &device->cbuf[device->cbuf_end];
/* passing NULL is safe */
kfree(report->value);
...
The registered report is stored in the struct roccat_device member
"struct roccat_report cbuf[ROCCAT_CBUF_SIZE];".
If more reports are received than the "ROCCAT_CBUF_SIZE" value,
kfree() the saved report from cbuf[0] and allocates a new reprot.
Since there is no lock when this kfree() is performed,
kfree() can be performed even while reading the saved report.
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
struct roccat_reader *reader = file->private_data;
struct roccat_device *device = reader->device;
struct roccat_report *report;
ssize_t retval = 0, len;
DECLARE_WAITQUEUE(wait, current);
mutex_lock(&device->cbuf_lock);
...
report = &device->cbuf[reader->cbuf_start];
/*
* If report is larger than requested amount of data, rest of report
* is lost!
*/
len = device->report_size > count ? count : device->report_size;
if (copy_to_user(buffer, report->value, len)) {
retval = -EFAULT;
goto exit_unlock;
}
...
The roccat_read() function receives the device->cbuf report and
delivers it to the user through copy_to_user().
If the N+ROCCAT_CBUF_SIZE th report is received while copying of
the Nth report->value is in progress, the pointer that copy_to_user()
is working on is kfree()ed and UAF read may occur. (race condition)
Since the device node of this driver does not set separate permissions,
this is not a security vulnerability, but because it is used for
requesting screen display of profile or dpi settings,
a user using the roccat device can apply udev to this device node or
There is a possibility to use it by giving.
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Changes in 5.15.69
NFS: Fix WARN_ON due to unionization of nfs_inode.nrequests
ACPI: resource: skip IRQ override on AMD Zen platforms
ARM: dts: imx: align SPI NOR node name with dtschema
ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible
ARM: dts: at91: fix low limit for CPU regulator
ARM: dts: at91: sama7g5ek: specify proper regulator output ranges
lockdep: Fix -Wunused-parameter for _THIS_IP_
x86/mm: Force-inline __phys_addr_nodebug()
task_stack, x86/cea: Force-inline stack helpers
tracing: hold caller_addr to hardirq_{enable,disable}_ip
tracefs: Only clobber mode/uid/gid on remount if asked
iommu/vt-d: Fix kdump kernels boot failure with scalable mode
Input: goodix - add support for GT1158
platform/surface: aggregator_registry: Add support for Surface Laptop Go 2
drm/msm/rd: Fix FIFO-full deadlock
dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins
HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
tg3: Disable tg3 device on system reboot to avoid triggering AER
gpio: mockup: remove gpio debugfs when remove device
ieee802154: cc2520: add rc code in cc2520_tx()
Input: iforce - add support for Boeder Force Feedback Wheel
nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
drm/amd/amdgpu: skip ucode loading if ucode_size == 0
net: dsa: hellcreek: Print warning only once
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
soc: fsl: select FSL_GUTS driver for DPIO
usb: gadget: f_uac2: clean up some inconsistent indenting
usb: gadget: f_uac2: fix superspeed transfer
RDMA/irdma: Use s/g array in post send only when its valid
Input: goodix - add compatible string for GT1158
Linux 5.15.69
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8bf545a2cbe110fc6c49e4b41f80fea8736f6f54
Pietro Borrello