2945 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	20ec745823	Merge 5.15.86 into android13-5.15-lts ... Changes in 5.15.86 drm/amd/display: Manually adjust strobe for DCN303 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down soc: qcom: llcc: make irq truly optional arm64: dts: qcom: Correct QMP PHY child node name arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8250: drop bogus DP PHY clock soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: Treat ESR_ELx as a 64-bit register arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: store lower path in ovl_inode ovl: use ovl_copy_{real,upper}attr() wrappers ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/fair: Removed useless update of p->recent_used_cpu sched/core: Introduce sched_asym_cpucap_active() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() SUNRPC: Return true/false (not 1/0) from bool functions NFSD: Finish converting the NFSv2 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: do not use kzalloc too early futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/chrome: cros_ec_typec: Cleanup switch handle return paths platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open platform/mellanox: mlxbf-pmc: Fix event typo wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros ata: add/use ata_taskfile::{error|status} fields ata: libata: fix NCQ autosense logic ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu/powerplay/psm: Fix memory leak in power state init media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: adv748x: afe: Select input port when initializing AFE media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: make use of units.h in assignment of frequency can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: drop unused GPIO support drm/msm/hdmi: use devres helper for runtime PM management bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() libbpf: Fix uninitialized warning in btf_dump_dump_type_data nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes pinctrl: k210: call of_node_put() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails mt76: stop the radar detector after leaving dfs channel wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick: ms_block: Add error handling support for add_disk() memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: hisilicon/qm - fix missing destroy qp_idr crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix normal discard process f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_ PCI: mt7621: Add sentinel to quirks table orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path extcon: usbc-tusb320: Add support for mode setting and reset extcon: usbc-tusb320: Add support for TUSB320L usb: typec: Factor out non-PD fwnode properties extcon: usbc-tusb320: Factor out extcon into dedicated functions extcon: usbc-tusb320: Add USB TYPE-C support extcon: usbc-tusb320: Update state on probe even if no IRQ pending serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences gpiolib: make struct comments into real kernel docs gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info perf stat: Refactor __run_perf_stat() common code perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() overflow: Implement size_t saturating arithmetic helpers fs/ntfs3: Harden against integer overflows iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/rockchip: fix permission bits in page table entries v2 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Remove driver data structure pm8008_data mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Add test for unstable CT lookup API net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() HID: amd_sfh: Add missing check for dma_alloc_coherent rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed drm/amd/display: Use the largest vready_offset in pipe group libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() tools/include: Add _RET_IP_ and math definitions to kernel.h KVM: selftests: Fix build regression by using accessor function hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm8250: fix USB-DP PHY registers usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range scsi: qla2xxx: Fix crash when I/O abort times out net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 5.15.86 Change-Id: I4ec30b690e8dbd554044495e26360a86cc042069 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-30 14:44:15 +00:00
Greg Kroah-Hartman	a60104c6cc	Merge tag 'android13-5.15.78_r00' into android13-5.15 ... This is the merge of the upstream LTS release of 5.15.78 into the android13-5.15 branch. It contains the following commits: c73b4619ad ANDROID: abi preservation for fscrypt change in 5.15.78 1960b1e610 Merge 5.15.78 into android13-5.15-lts 7048384c98 Revert "net: macb: Specify PHY PM management done by MAC" 845a2cc2e8 Revert "perf: Fix missing SIGTRAPs" 6f88ababa4 Merge 5.15.77 into android13-5.15-lts 92f701cae0 Revert "net: phylink: add mac_managed_pm in phylink_config structure" 8d9f3b2315 Revert "arm64: errata: Remove AES hwcap for COMPAT tasks" eaa46dd972 Merge 5.15.76 into android13-5.15-lts d9d889009b ANDROID: properly copy the scm_io_uring field in struct sk_buff 16d4484281 ANDROID: fix up struct sk_buf ABI breakage 2d19e77e73 Revert "bpf: Fix reference state management for synchronous callbacks" c18696c060 Revert "tracing: Wake up ring buffer waiters on closing of the file" d122aaf804 Revert "tracing: Add ioctl() to force ring buffer waiters to wake up" dfd3aa1729 ANDROID: rename struct tcm_sock.cwnd_usage_seq to fix ABI c51f6b79ce ANDROID: rename struct task_struct.in_eventfd to fix ABI 85725fbe42 Revert "ALSA: usb-audio: Register card at the last interface" 8f38fb79b5 Revert "ALSA: usb-audio: Fix last interface check for registration" 3ebc180a96 Revert "serial: 8250: Let drivers request full 16550A feature probing" f6d7d7caaa Revert "serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices" d1096112e5 Revert "usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug" 3447743ef1 Revert "serial: 8250: Toggle IER bits on only after irq has been set up" b049ff121c Merge 5.15.75 into android13-5.15-lts 4ec71a9ec7 ANDROID: cpu/hotplug: call perf event through function pointer 509a32764e Linux 5.15.78 7038af4ce9 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() b66617cc3c drm/i915/sdvo: Setup DDC fully before output init 73d52322c4 drm/i915/sdvo: Filter out invalid outputs more sensibly 2219b6aad3 drm/rockchip: dsi: Force synchronous probe dd955eb4e6 drm/rockchip: dsi: Clean up 'usage_mode' when failing to attach cfa8a89af9 cifs: fix regression in very old smb1 mounts 3189de0ac3 ext4,f2fs: fix readahead of verity data a663e6ab17 tee: Fix tee_shm_register() for kernel TEE drivers d46db722a0 KVM: x86: emulator: update the emulation mode after CR0 write 942aec252b KVM: x86: emulator: update the emulation mode after rsm 9df4bb7b38 KVM: x86: emulator: introduce emulator_recalc_and_set_mode 311f1e51a2 KVM: x86: emulator: em_sysexit should update ctxt->mode 37a03de2d0 KVM: arm64: Fix bad dereference on MTE-enabled systems 167dca5e21 KVM: VMX: fully disable SGX if SECONDARY_EXEC_ENCLS_EXITING unavailable 19c2b2ffbe KVM: x86: Mask off reserved bits in CPUID.8000001FH 553fd40d3b KVM: x86: Mask off reserved bits in CPUID.80000001H 006366b96c KVM: x86: Mask off reserved bits in CPUID.80000008H fc796fd861 KVM: x86: Mask off reserved bits in CPUID.8000001AH ef7716398a KVM: x86: Mask off reserved bits in CPUID.80000006H a88998446b x86/syscall: Include asm/ptrace.h in syscall_wrapper header 999cff2b6c ext4: fix BUG_ON() when directory entry has invalid rec_len 0a43c015e9 ext4: fix warning in 'ext4_da_release_space' ada82803a7 parisc: Avoid printing the hardware path twice 081ff43a77 parisc: Export iosapic_serial_irq() symbol for serial port driver 5daf985dd0 parisc: Make 8250_gsc driver dependend on CONFIG_PARISC 425fe99771 perf/x86/intel: Fix pebs event constraints for SPR 4613a45017 perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] 7de3fe6a13 perf/x86/intel: Fix pebs event constraints for ICL 71d6c33fe2 arm64: entry: avoid kprobe recursion 52be536155 efi: random: Use 'ACPI reclaim' memory for random seed 83b5ec7ee8 efi: random: reduce seed size to 32 bytes 0417f70b85 fuse: add file_modified() to fallocate 2de8eec8af capabilities: fix potential memleak on error path from vfs_getxattr_alloc() bd07f8067b tracing/histogram: Update document for KEYS_MAX size 27b4406f9c tools/nolibc/string: Fix memcmp() implementation b5074df412 ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters() 85f3caa955 kprobe: reverse kp->flags when arm_kprobe failed d1b6a8e341 tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() 828577e0ba tcp/udp: Make early_demux back namespacified. 88561a6677 ftrace: Fix use-after-free for dynamic ftrace_ops 450d748070 btrfs: fix type of parameter generation in btrfs_get_dentry 007058eb82 btrfs: fix tree mod log mishandling of reallocated nodes 336fdd295c btrfs: fix lost file sync on direct IO write with nowait and dsync iocb cff805b151 fscrypt: fix keyring memory leak on mount failure e6f4fd85ef fscrypt: stop using keyrings subsystem for fscrypt_master_key 3975affcf5 af_unix: Fix memory leaks of the whole sk due to OOB skb. 4302806dbf block, bfq: protect 'bfqd->queued' by 'bfqd->lock' 3e4697ffdf Bluetooth: L2CAP: Fix attempting to access uninitialized memory 81035e1201 Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM d78ccdce66 i2c: piix4: Fix adapter not be removed in piix4_remove() c76ff8ae11 arm64: dts: juno: Add thermal critical trip points 7398435e61 firmware: arm_scmi: Fix devres allocation device in virtio transport 3653cdc21b firmware: arm_scmi: Make Rx chan_setup fail on memory errors e514d67b23 firmware: arm_scmi: Suppress the driver's bind attributes 4e68c5da60 block: Fix possible memory leak for rq_wb on add_disk failure bf822b6980 arm64: dts: ls208xa: specify clock frequencies for the MDIO controllers f2329886e5 arm64: dts: ls1088a: specify clock frequencies for the MDIO controllers 33fcc55dbc arm64: dts: lx2160a: specify clock frequencies for the MDIO controllers f3429a1e49 arm64: dts: imx8: correct clock order de2a83186a ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset cb9ce8910a clk: qcom: Update the force mem core bit for GPU clocks bdc1182496 efi/tpm: Pass correct address to memblock_reserve 3a4d6f165e i2c: xiic: Add platform module alias 62eea4014a drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case 7a2547cac2 HID: saitek: add madcatz variant of MMO7 mouse device ID 931c97a54c scsi: core: Restrict legal sdev_state transitions via sysfs c50ec15725 ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() 8ecd1db58b media: v4l: subdev: Fail graciously when getting try data for NULL state f96ad391d0 media: meson: vdec: fix possible refcount leak in vdec_probe() 8b785cdcd3 media: dvb-frontends/drxk: initialize err to 0 73dfb64213 media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE cbfa26936f media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE 647c12c47e media: rkisp1: Zero v4l2_subdev_format fields in when validating links abbeb8f727 media: rkisp1: Use correct macro for gradient registers 03b30e5a36 media: rkisp1: Initialize color space on resizer sink and source pads d58b6b665c media: rkisp1: Don't pass the quantization to rkisp1_csm_config() 0e501fd0f3 s390/cio: fix out-of-bounds access on cio_ignore free c65cc56937 s390/cio: derive cdev information only for IO-subchannels c64be93f1e s390/boot: add secure boot trailer 1cdaca8f00 s390/uaccess: add missing EX_TABLE entries to __clear_user() 509cbbdec9 mtd: parsers: bcm47xxpart: Fix halfblock reads 5b8797e9db mtd: parsers: bcm47xxpart: print correct offset on read error 2f07635876 fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards 154934c74f video/fbdev/stifb: Implement the stifb_fillrect() function b524b41806 drm/msm/hdmi: fix IRQ lifetime c55dd62001 drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag d153d468c4 vsock: fix possible infinite sleep in vsock_connectible_wait_data() 0ed71af4d0 ipv6: fix WARNING in ip6_route_net_exit_late() 2b45d6d0c4 net, neigh: Fix null-ptr-deref in neigh_table_clear() 61defd6450 net/smc: Fix possible leaked pernet namespace in smc_init() de88977427 stmmac: dwmac-loongson: fix invalid mdio_node 535b78739a ibmvnic: Free rwi on reset success 985a88bf0b net: mdio: fix undefined behavior in bit shift for __mdiobus_register aa16cac06b Bluetooth: L2CAP: Fix memory leak in vhci_write a3a7b2ac64 Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() cf2719a21f Bluetooth: virtio_bt: Use skb_put to set length 8278a87bb1 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu 42d20d5e24 netfilter: ipset: enforce documented limit to prevent allocating huge memory f46ea5fa33 btrfs: fix ulist leaks in error paths of qgroup self tests 222a3d5330 btrfs: fix inode list leak during backref walking at find_parent_nodes() 6ba3479f9e btrfs: fix inode list leak during backref walking at resolve_indirect_refs() a80634f392 isdn: mISDN: netjet: fix wrong check of device registration 029d5b7688 mISDN: fix possible memory leak in mISDN_register_device() 3e2129c67d rose: Fix NULL pointer dereference in rose_send_frame() 06d7596d18 ipvs: fix WARNING in ip_vs_app_net_cleanup() 5ee2d6b726 ipvs: fix WARNING in __ip_vs_cleanup_batch() 33e7783bc0 ipvs: use explicitly signed chars 6044791b7b netfilter: nf_tables: release flow rule object from commit path 1ffe710041 netfilter: nf_tables: netlink notifier might race to release objects dcc79cf735 net: tun: fix bugs for oversize packet when napi frags enabled fc4b50adb4 net: sched: Fix use after free in red_enqueue() ab80025ea7 ata: pata_legacy: fix pdc20230_set_piomode() dede9ba027 net: fec: fix improper use of NETDEV_TX_BUSY 5dfdac5e3f nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() 7486f5c900 nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() 3cba1f061b nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() 44bc1868a4 nfc: fdp: Fix potential memory leak in fdp_nci_send() 4bef9a89f2 net: dsa: fall back to default tagger if we can't load the one from DT 06f9e0b37f RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() 6b3d5dcb12 RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 9f555b1584 net: dsa: Fix possible memory leaks in dsa_loop_init() 24641993a7 nfs4: Fix kmemleak when allocate slot failed 0797c85433 NFSv4.2: Fixup CLONE dest file size for zero-length count d59722d088 SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed dea7ef05de NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot 7b1c2458de NFSv4.1: Handle RECLAIM_COMPLETE trunking errors 4ec017e300 NFSv4: Fix a potential state reclaim deadlock e3e53c5af5 RDMA/hns: Disable local invalidate operation 85ab79ac94 RDMA/hns: Use hr_reg_xxx() instead of remaining roce_set_xxx() be16cc7abd RDMA/hns: Remove magic number ba95409d6b IB/hfi1: Correctly move list in sc_disable() 484d969037 RDMA/cma: Use output interface for net_dev check f7d9de8a0d KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER b7b66f13ac KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() 0c60fa7f55 KVM: x86: Protect the unused bits in MSR exiting flags ad8e4868dd HID: playstation: add initial DualSense Edge controller support 3a44ae4afa mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page 8576d7edea drm/amd/display: explicitly disable psr_feature_enable appropriately 058b3a11f7 KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1) 9ee32892c7 KVM: x86: Trace re-injected exceptions 0c9c1306d6 serial: ar933x: Deassert Transmit Enable on ->rs485_config() 21d65b3516 scsi: lpfc: Rework MIB Rx Monitor debug info logic d70705e131 scsi: lpfc: Adjust CMF total bytes and rxmonitor 9ebc6e8ad1 scsi: lpfc: Adjust bytes received vales during cmf timer interval 793d8378b7 Linux 5.15.77 1401e9336b tcp/udp: Fix memory leak in ipv6_renew_options(). b079d37752 serial: Deassert Transmit Enable on probe in driver-specific way 63f75fea3a serial: core: move RS485 configuration tasks from drivers into core 0753069d44 can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive 17ff99e224 can: rcar_canfd: fix channel specific IRQ handling for RZ/G2L aad798a0b3 scsi: sd: Revert "scsi: sd: Remove a local variable" 52c2329147 arm64: Add AMPERE1 to the Spectre-BHB affected list 5397ea6a08 net: enetc: survive memory pressure without crashing 885a454e97 kcm: do not sense pfmemalloc status in kcm_sendpage() 92b4c5c3fa net: do not sense pfmemalloc status in skb_append_pagefrags() ae1b08592e net/mlx5: Fix crash during sync firmware reset 37ada47d01 net/mlx5: Update fw fatal reporter state on PCI handlers successful recover 9e6523d06a net/mlx5: Print more info on pci error handlers ab3de780c1 net/mlx5: Fix possible use-after-free in async command interface 8bbff203e3 net/mlx5e: Extend SKB room check to include PTP-SQ ee1c0ca1af net/mlx5e: Do not increment ESN when updating IPsec ESN state eefa97a7a0 netdevsim: remove dir in nsim_dev_debugfs_init() when creating ports dir failed c9589e18a6 net: broadcom: bcm4908_enet: update TX stats after actual transmission 9711616a49 net: broadcom: bcm4908enet: remove redundant variable bytes b317d53680 nh: fix scope used to find saddr when adding non gw nh 2ad284ac88 net: bcmsysport: Indicate MAC is in charge of PHY PM d1cfa71d5b net: ehea: fix possible memory leak in ehea_register_port() 588bdd7ee4 openvswitch: switch from WARN to pr_warn 9a1c1df925 ALSA: aoa: Fix I2S device accounting e81d7826b8 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() 77a754fcfe net: ethernet: ave: Fix MAC to be in charge of PHY PM bc2518ec71 net: fec: limit register access on i.MX6UL f710deeea7 perf vendor events arm64: Fix incorrect Hisi hip08 L3 metrics eb59cb2fab PM: domains: Fix handling of unavailable/disabled idle states bde7c2acef net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() 8927d90d56 i40e: Fix flow-type by setting GL_HASH_INSET registers c39de3ae50 i40e: Fix VF hang when reset is triggered on another VF 250bf8ab78 i40e: Fix ethtool rx-flow-hash setting for X722 ad3f1d9bf1 ipv6: ensure sane device mtu in tunnels e2ec5bb78c perf vendor events power10: Fix hv-24x7 metric events f9df388ed6 media: vivid: set num_in/outputs to 0 if not supported 4cc7d8d420 media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' 491c0959f0 media: v4l2-dv-timings: add sanity checks for blanking values 0f83edbe4f media: vivid: dev->bitmap_cap wasn't freed in all cases 5b1fb2a28d media: vivid: s_fbuf: add more sanity checks 3436e56337 PM: hibernate: Allow hybrid sleep to work with s2idle 3cc8c4088f can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path a3e09eff32 can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path 304a101616 drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() 2fe6b24ce2 net-memcg: avoid stalls when under memory pressure 9b171fdcbf tcp: fix indefinite deferral of RTO with SACK reneging a85d39f14a tcp: fix a signed-integer-overflow bug in tcp_add_backlog() 2437f3c5c6 tcp: minor optimization in tcp_add_backlog() ef27df7591 net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY a1e18acb02 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed 62086d1c46 kcm: annotate data-races around kcm->rx_wait 342d918cf9 kcm: annotate data-races around kcm->rx_psock 6bb23225bb atlantic: fix deadlock at aq_nic_stop 4e2cbc1f0e drm/i915/dp: Reset frl trained flag before restarting FRL training 3d92ab0865 amd-xgbe: add the bit rate quirk for Molex cables 75a6d1ebf8 amd-xgbe: fix the SFP compliance codes check for DAC cables 98bada8fa0 x86/unwind/orc: Fix unreliable stack dump with gcov 88e879c9f5 nfc: virtual_ncidev: Fix memory leak in virtual_nci_send() 18c60b383d net: macb: Specify PHY PM management done by MAC 95c22fc1e8 net: hinic: fix the issue of double release MBOX callback of VF 6016d96a6a net: hinic: fix the issue of CMDQ memory leaks e6765fe8de net: hinic: fix memory leak when reading function table 62aa78a0c3 net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg() 1e0bee973e net: netsec: fix error handling in netsec_register_mdio() 7a939503fc tipc: fix a null-ptr-deref in tipc_topsrv_accept c638b520ba perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap() 4fdf6f978c ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() b688736903 ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile eca851572d mtd: rawnand: intel: Add missing of_node_put() in ebu_nand_probe() 08c246c7df arc: iounmap() arg is volatile 739eac37ff sched/core: Fix comparison in sched_group_cookie_match() ca7b0a1028 perf: Fix missing SIGTRAPs eb77474a2a ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile 9b6841ab70 KVM: selftests: Fix number of pages for memory slot in memslot_modification_stress_test 59de8738ed drm/msm: Fix return type of mdp4_lvds_connector_mode_valid a560aeac2f media: atomisp: prevent integer overflow in sh_css_set_black_frame() 32f93e4608 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation 5a93a8288c net: ieee802154: fix error return code in dgram_bind() 138a13d8f5 ethtool: eeprom: fix null-deref on genl_info in dump 1c2b1d3bba mmc: block: Remove error check of hw_reset on reset 0b0d169723 Revert "scsi: lpfc: SLI path split: Refactor lpfc_iocbq" 7a0fce24de Revert "scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4" 7a36c9de43 Revert "scsi: lpfc: SLI path split: Refactor SCSI paths" eb8be2dbfb Revert "scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup()" 065bf71a8a Revert "scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4()" 97dc9076ea Revert "scsi: lpfc: Resolve some cleanup issues following SLI path refactoring" b32b766be4 s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() 1ad7213fcf s390/futex: add missing EX_TABLE entry to __futex_atomic_op() ae9398e837 perf auxtrace: Fix address filter symbol name match for modules 14009ada57 ARC: mm: fix leakage of memory allocated for PTE eb9ed3343c pinctrl: Ingenic: JZ4755 bug fixes 94d2643df1 kernfs: fix use-after-free in __kernfs_remove f1204dfc4c counter: microchip-tcb-capture: Handle Signal1 read and Synapse 6fb0106c64 mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus 73e3901e70 mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake 1e8cd93ae5 mmc: core: Fix kernel panic when remove non-standard SDIO card 02e51e7cd1 mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO 4c365a0c21 coresight: cti: Fix hang in cti_disable_hw() b32775e039 drm/msm/dp: fix IRQ lifetime b48949ab45 drm/msm/hdmi: fix memory corruption with too many bridges 9f035d1fb3 drm/msm/dsi: fix memory corruption with too many bridges 986a89b371 drm/amdgpu: disallow gfxoff until GC IP blocks complete s2idle resume a2f0934e6b scsi: qla2xxx: Use transport-defined speed mask for supported_speeds 2b1a3172ee mac802154: Fix LQI recording 46b4b1e11e exec: Copy oldsighand->action under spin-lock 265b6fb780 fs/binfmt_elf: Fix memory leak in load_elf_binary() 24030742a7 cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores 3423a3417f cpufreq: intel_pstate: Read all MSRs on the target CPU cc6a724984 fbdev: smscufx: Fix several use-after-free bugs 1a8b22e3f3 iio: adxl372: Fix unsafe buffer attributes 2f08cad213 iio: temperature: ltc2983: allocate iio channels once 1bfe97f497 iio: light: tsl2583: Fix module unloading 569709540e tools: iio: iio_utils: fix digit calculation c892a81c74 xhci: Remove device endpoints from bandwidth list when freeing the device dfacb5c7f0 xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices 64058af657 xhci: Add quirk to reset host back to default state at shutdown 022f21e850 mtd: rawnand: marvell: Use correct logic for nand-keep-config f90897c0f6 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller a0c54d5152 usb: bdc: change state when port disconnected e0fd70ab48 usb: dwc3: gadget: Don't set IMI for no_interrupt ad538aea64 usb: dwc3: gadget: Stop processing more requests on IMI f2f53be617 usb: gadget: uvc: fix sg handling during video encode 80ff4ef777 usb: gadget: uvc: fix sg handling in error case 555011f6b2 USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM 311428871b ALSA: rme9652: use explicitly signed char fa8b39c7ed ALSA: au88x0: use explicitly signed char 8af82d330d ALSA: usb-audio: Add quirks for M-Audio Fast Track C400/600 259cb4dee1 ALSA: Use del_timer_sync() before freeing timer 33ddee2b95 can: kvaser_usb: Fix possible completions during init_completion 86da269c75 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() ead0495627 NFSv4: Add an fattr allocation to _nfs4_discover_trunking() eb1fe9600b NFSv4: Fix free of uninitialized nfs4_label on referral lookup. 4f5365f770 Linux 5.15.76 33fc9e26b7 mm: /proc/pid/smaps_rollup: fix no vma's null-deref b9d8cbe90a mmc: core: Add SD card quirk for broken discard 0ee2f0567a Makefile.debug: re-enable debug info for .S files 117825e9bb x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB 0983205085 ACPI: video: Force backlight native for more TongFang devices 289b56715b perf: Skip and warn on unknown format 'configN' attrs 9d912a3853 mmc: sdhci-tegra: Use actual clock rate for SW tuning correction 7aeda81191 tracing: Do not free snapshot if tracer is on cmdline 57252e7bd4 tracing: Simplify conditional compilation code in tracing_set_tracer() 20bc6d23f7 ksmbd: fix incorrect handling of iterate_dir 3c8cfcaa2d ksmbd: handle smb2 query dir request for OutputBufferLength that is too small 8754fa5dbc arm64: mte: move register initialization to C ea7be82fd7 fs: dlm: fix invalid derefence of sb_lvbptr 0365d6af75 iommu/vt-d: Clean up si_domain in the init_dmars() error path 5c95d0c9d0 iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() 209740fd13 net: phy: dp83822: disable MDI crossover status change interrupt ce1234573d net: sched: fix race condition in qdisc_graft() 91f8f5342b net: hns: fix possible memory leak in hnae_ae_register() 50c31fa952 wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() d2fc83a6b5 sfc: include vport_id in filter spec hash and equal() c2e1e59d59 net: sched: sfb: fix null pointer access issue when sfb_init() fails 34f2a4eedc net: sched: delete duplicate cleanup of backlog and qlen 154f4c06d9 net: sched: cake: fix null pointer access issue when cake_init() fails 5efed7578d nvmet: fix workqueue MEM_RECLAIM flushing dependency 2f2b84b020 nvme-hwmon: kmalloc the NVME SMART log buffer 66c56b2328 nvme-hwmon: consistently ignore errors from nvme_hwmon_init d77f6908f9 netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements efa9dd7e67 ionic: catch NULL pointer issue on reconfig 35ece85866 net: hsr: avoid possible NULL deref in skb_clone() e326df21da dm: remove unnecessary assignment statement in alloc_dev() 847301f0ee cifs: Fix xid leak in cifs_ses_add_channel() 8905d13b9e cifs: Fix xid leak in cifs_flock() 27cfd3afaa cifs: Fix xid leak in cifs_copy_file_range() 593d877c39 cifs: Fix xid leak in cifs_create() a8df9d0428 udp: Update reuse->has_conns under reuseport_lock. 9749595feb scsi: lpfc: Fix memory leak in lpfc_create_port() b9122e0e0e net: phylink: add mac_managed_pm in phylink_config structure 412db9b06d net: phy: dp83867: Extend RX strap quirk for SGMII mode 5ce6130519 net/atm: fix proc_mpc_write incorrect return value 0eb17faedc sfc: Change VF mac via PF as first preference if available. 0f58940ca3 HID: magicmouse: Do not set BTN_MOUSE on double report 94a171c982 i40e: Fix DMA mappings leak dbc01c0a4e tipc: fix an information leak in tipc_topsrv_kern_subscr b294cad6f0 tipc: Fix recognition of trial period 6161c364e3 ACPI: extlog: Handle multiple records 40e5fceddf drm/vc4: Add module dependency on hdmi-codec 6c5041a103 btrfs: fix processing of delayed tree block refs during backref walking af67578d56 btrfs: fix processing of delayed data refs during backref walking c439cafce8 x86/topology: Fix duplicated core ID within a package d31f4bc225 x86/topology: Fix multiple packages shown on a single-package system fcc96e89b3 media: venus: dec: Handle the case where find_format fails b22b4823a0 media: mceusb: set timeout to at least timeout provided 5265cc1202 media: ipu3-imgu: Fix NULL pointer dereference in active selection access 1e4e71f9e1 KVM: arm64: vgic: Fix exit condition in scan_its_table() 5bf2fda26a kvm: Add support for arch compat vm ioctls 112a005d1d mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages 2d508b4e65 drm/amdgpu: fix sdma doorbell init ordering on APUs b5606e3ab1 cpufreq: qcom: fix memory leak in error path d866f5982c x86/resctrl: Fix min_cbm_bits for AMD 8fbe13de1c ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS 5d6a037b3a ata: ahci-imx: Fix MODULE_ALIAS 30cf0dee37 hwmon/coretemp: Handle large core ID value 2f7171465f x86/microcode/AMD: Apply the patch early on every logical thread 93d7e2b47a i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter 14d260f94f cpufreq: qcom: fix writes in read-only memory region 3006766d24 selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() 1b31cb0065 ocfs2: fix BUG when iput after ocfs2_mknod fails e469db818e ocfs2: clear dinode links count in case of error ded9d535be btrfs: enhance unsupported compat RO flags handling 537412c547 perf/x86/intel/pt: Relax address filter validation 8ddc58e0e3 arm64: errata: Remove AES hwcap for COMPAT tasks 738515cf8b usb: gadget: uvc: improve sg exit condition db11d8c72a usb: gadget: uvc: giveback vb2 buffer on req complete aee340dccf usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer 2f54ce7392 usb: gadget: uvc: use on returned header len in video_encode_isoc_sg d80db2f145 usb: gadget: uvc: consistently use define for headerlen f9681a6750 arm64/mm: Consolidate TCR_EL1 fields 5b20aacff7 r8152: add PID for the Lenovo OneLink+ Dock bd8a595958 Linux 5.15.75 b6e2c54be3 io-wq: Fix memory leak in worker creation 7c359e2849 gcov: support GCC 12.1 and newer compilers 8418c1672c thermal: intel_powerclamp: Use first online CPU as control_cpu 55c824b620 ext4: continue to expand file system when the target size doesn't reach 0e63de6d7e lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5 84cd0b20fa Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT 371aaf6b48 Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5 e1591557e3 drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n 34f31a2b66 net/ieee802154: don't warn zero-sized raw_sendmsg() de904d0fe1 Revert "net/ieee802154: reject zero-sized raw_sendmsg()" 9c65eef9d6 net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses d7eadffce0 blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() 28787ff9fb ALSA: usb-audio: Fix last interface check for registration b8989e95d7 net: ieee802154: return -EINVAL for unknown addr type 0db2efb3bf mm: hugetlb: fix UAF in hugetlb_handle_userfault 98aada6e22 io_uring/rw: fix unexpected link breakage d6b7efc722 io_uring/rw: fix error'ed retry return values e857457c6f io_uring/rw: fix short rw error handling cd148d4e31 io_uring: correct pinned_vm accounting 813d8fe5d3 io_uring/af_unix: defer registered files gc to io_uring release c69a2324fc perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc e81bf40b28 clk: bcm2835: Round UART input clock up da17cbb229 clk: bcm2835: Make peripheral PLLC critical 20b8c456df usb: idmouse: fix an uninit-value in idmouse_open ec8adf767e nvmet-tcp: add bounds check on Transfer Tag 1c64328840 nvme: copy firmware_rev on each init b9b5560b34 ext2: Use kvmalloc() for group descriptor array 8c067a3051 scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled 39bef9c6a9 staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() b4573a2bad staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() eb24d93e3e Revert "usb: storage: Add quirk for Samsung Fit flash" 3a38985d8b usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug 9d4f84a15f arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes 3c84c7f592 usb: musb: Fix musb_gadget.c rxstate overflow bug fcd594da0b usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() 9e86dffd0b md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d f8e80792c1 eventfd: guard wake_up in eventfd fs calls as well c61786dc72 HID: roccat: Fix use-after-free in roccat_read() f7f425d61d soundwire: intel: fix error handling on dai registration issues 093a5463ae soundwire: cadence: Don't overwrite msg->buf during write commands 1b4ed920b2 bcache: fix set_at_max_writeback_rate() for multiple attached devices eecb5ccc84 ata: libahci_platform: Sanity check the DT child nodes number 70b2adb1d6 blk-throttle: prevent overflow while calculating wait time ff8551d411 staging: vt6655: fix potential memory leak 7c8bc37465 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() 3d69461807 iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity c0d73be0af nbd: Fix hung when signal interrupts nbd_start_device_ioctl() 9d54de8660 scsi: 3w-9xxx: Avoid disabling device if failing to enable it d68da10b0c dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow 518a2a1cc3 usb: host: xhci-plat: suspend/resume clks for brcm f002aa7c0a usb: host: xhci-plat: suspend and resume clocks 6bcd745c87 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate 5c32cbf6cc media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc 6f21976095 media: cx88: Fix a null-ptr-deref bug in buffer_prepare() 0a07b13af0 clk: zynqmp: Fix stack-out-of-bounds in strncpy` 3680442cba ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n 4a89c0befc btrfs: don't print information about space cache or tree every remount 39a07058c7 btrfs: scrub: try to fix super block errors f3857dd7c0 btrfs: dump extra info if one free space cache has more bitmaps than it should d3c6d5be46 arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply 82046b6a84 kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT 3536541733 ARM: dts: imx6sx: add missing properties for sram 602813650c ARM: dts: imx6sll: add missing properties for sram 6a12e1e23c ARM: dts: imx6sl: add missing properties for sram 8c24dc621b ARM: dts: imx6qp: add missing properties for sram 47666b9a11 ARM: dts: imx6dl: add missing properties for sram 19fe40c518 ARM: dts: imx6q: add missing properties for sram 9361ba7791 ARM: dts: imx7d-sdb: config the max pressure for tsc2046 0f90671ff9 drm/amd/display: Remove interface for periodic interrupt 1 88fd067406 drm/dp: Don't rewrite link config when setting phy test pattern 668806a826 mmc: sdhci-msm: add compatible string check for sdm670 587c7da877 drm/meson: explicitly remove aggregate driver at module unload time d76ff04a72 drm/meson: reorder driver deinit sequence to fix use-after-free bug d894db3561 drm/amdgpu: fix initial connector audio value e3675f688d ASoC: SOF: pci: Change DMI match info to support all Chrome platforms f16e1b7b39 platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading 39da49ffa2 platform/chrome: cros_ec: Notify the PM of wake events during resume 7463604784 drm: panel-orientation-quirks: Add quirk for Anbernic Win600 2810061452 drm/vc4: vec: Fix timings for VEC modes 0506c4eae9 ALSA: usb-audio: Register card at the last interface 39d7a81bbb drm: bridge: dw_hdmi: only trigger hotplug event on link change dfbed8c92e udmabuf: Set ubuf->sg = NULL if the creation of sg table fails a47d92c74b drm/amd/display: fix overflow on MIN_I64 definition a29f742704 gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() 5ff7bec678 drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook ca163e389f drm: Prevent drm_copy_field() to attempt copying a NULL pointer df5ac93926 drm: Use size_t type for len variable in drm_copy_field() 5ab84b1596 drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() b3179865cf r8152: Rate limit overflow messages d1e894f950 Bluetooth: L2CAP: Fix user-after-free 124b7c7732 net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory 5b94d48898 hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms a269c3e390 wifi: rt2x00: correctly set BBP register 86 for MT7620 b5e6ada5a5 wifi: rt2x00: set SoC wmac clock register 357c89074a wifi: rt2x00: set VGC gain for both chains of MT7620 92e2e04da5 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 4304b8e075 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 4a5eab200e can: bcm: check the result of can_send() in bcm_can_tx() 3423a50fa0 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times 3ac837cef1 Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() af46b2b9b0 wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value e33da263e9 regulator: core: Prevent integer underflow d58c8781c0 Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk 232d59eca0 wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() 37f15edba2 iavf: Fix race between iavf_close and iavf_reset_task 0315568019 xfrm: Update ipcomp_scratches with NULL when freed 716c526d66 thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround b1b4144508 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() 839f563c5d x86/mce: Retrieve poison range from hardware 1663629bc3 tcp: annotate data-race around tcp_md5sig_pool_populated 7b03296b4f openvswitch: Fix overreporting of drops in dropwatch ffd7a1dcae openvswitch: Fix double reporting of drops in dropwatch d449d00a8d net: ethernet: ti: davinci_mdio: Add workaround for errata i2329 624f03a027 ice: set tx_tstamps when creating new Tx rings via ethtool 2e52d858de bpftool: Clear errno after libcap's checks 75995ce1c9 wifi: brcmfmac: fix invalid address access when enabling SCAN log level 83b9496975 NFSD: fix use-after-free on source server when doing inter-server copy 118dc74b2b NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data 066b1302f2 x86/entry: Work around Clang __bdos() bug 06c56c9d5d ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable 6733222f2c ARM: decompressor: Include .data.rel.ro.local 5614908434 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash 139bbbd011 powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue a1387ae83e MIPS: BCM47XX: Cast memcmp() of function to (void *) c2790fede9 cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode 30eca146c8 ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address 5374638222 ACPI: video: Add Toshiba Satellite/Portege Z830 quirk 7ed95b0803 rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() cf38a05eb1 rcu: Back off upon fill_page_cache_func() allocation failure 3e2d8b89f0 rcu: Avoid triggering strict-GP irq-work when RCU is idle 27d3e646dd fs: dlm: fix race in lowcomms b6b87460f4 selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle 497d736784 f2fs: fix to account FS_CP_DATA_IO correctly fb1dcc2a9e f2fs: fix race condition on setting FI_NO_EXTENT flag 6ddbd411a0 ACPI: APEI: do not add task_work to kernel thread to avoid memory leak 21f1ba52b8 thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id 172c8a24fc crypto: cavium - prevent integer overflow loading firmware 12acfa1059 crypto: marvell/octeontx - prevent integer overflows c963ce2fa0 kbuild: rpm-pkg: fix breakage when V=1 is used 059ce6b68b kbuild: remove the target in signal traps when interrupted 1e9c23db31 tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads 84795de93e tracing: kprobe: Make gen test module work in arm and riscv 867fce09aa tracing: kprobe: Fix kprobe event gen test module on exit a9990f24ad iommu/iova: Fix module config properly f0cac6cc02 cifs: return correct error in ->calc_signature() 1f1ab76e25 crypto: qat - fix DMA transfer direction 393307b99a crypto: inside-secure - Change swab to swab32 93538944ab crypto: ccp - Release dma channels before dmaengine unrgister 779a9930f3 crypto: akcipher - default implementation for setting a private key 0c7043a5b5 iommu/omap: Fix buffer overflow in debugfs 046803b74d cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset 771d8aa02d crypto: hisilicon/qm - fix missing put dfx access 9bf3ec61a2 crypto: qat - fix default value of WDT timer 3bfc220e5c hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() 507128a0e3 cgroup: Honor caller's cgroup NS when resolving path 8ffe511b7d hwrng: arm-smccc-trng - fix NO_ENTROPY handling 2720934713 crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr e0b4ebf598 crypto: sahara - don't sleep when in softirq 8484023b57 powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL 7f536a8cb6 powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() 1f98f8f435 powerpc: Fix SPE Power ISA properties for e500v1 platforms 72c5b7110f powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 399afe92f6 x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition 592b302d8b powerpc: Fix fallocate and fadvise64_64 compat parameter combination 61af84b3db powerpc/powernv: add missing of_node_put() in opal_export_attrs() 5be9cb6c06 powerpc/pci_dn: Add missing of_node_put() 5a13d3f1af powerpc/sysdev/fsl_msi: Add missing of_node_put() b0c0490b3c powerpc/math_emu/efp: Include module.h 93379dc92d powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig 25a4fb0e1a mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg b8fcd9ab0f mailbox: mpfs: account for mbox offsets while sending ba22643595 mailbox: mpfs: fix handling of the reg property fad007a315 clk: ast2600: BCLK comes from EPLL 3441076f83 clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe 9209e6bab7 clk: imx: scu: fix memleak on platform_device_add() fails bdf72f2d64 clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration e338131e98 clk: baikal-t1: Add SATA internal ref clock buffer 35b7660275 clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent b2db8b2c53 clk: baikal-t1: Fix invalid xGMAC PTP clock divider 435a8a39c6 clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD b0bc75fe67 spmi: pmic-arb: correct duplicate APID to PPID mapping logic faabbb103d usb: mtu3: fix failed runtime suspend in host only mode 57f66534a4 dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() 8aa96c5bc3 clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent 2dafc5afd9 mfd: sm501: Add check for platform_driver_register() d43d93dbd8 mfd: fsl-imx25: Fix check for platform_get_irq() errors b940bb3c81 mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() 0715005c48 mfd: lp8788: Fix an error handling path in lp8788_probe() aec1f073f9 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() 53bfc1c3c7 mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() 2f921d62c2 fsi: core: Check error number after calling ida_simple_get 041c79f6ae RDMA/rxe: Fix resize_finish() in rxe_queue.c 959d4ee095 clk: qcom: gcc-sm6115: Override default Alpha PLL regs 8e556f5573 clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical a26b065875 scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() e87fb1fcf8 scsi: iscsi: Run recv path from workqueue c2af03a7c1 scsi: iscsi: Add recv workqueue helpers d6aafc21be scsi: iscsi: Rename iscsi_conn_queue_work() e45a1516d2 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() 6a54f76974 serial: 8250: Fix restoring termios speed after suspend a5dba09338 firmware: google: Test spinlock on panic path to avoid lockups 60d14575d0 slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON f19e5b7df5 staging: vt6655: fix some erroneous memory clean-up loops 433c33c554 phy: qualcomm: call clk_disable_unprepare in the error handling c4293def88 tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown a91a3c2d8d serial: 8250: Toggle IER bits on only after irq has been set up 6be8e565a4 drivers: serial: jsm: fix some leaks in probe 1d05df7757 usb: gadget: function: fix dangling pnp_string in f_printer.c ed2c66b752 xhci: Don't show warning for reinit on known broken suspend 4d7d8f5cb2 IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers e221b4f16e RDMA/cm: Use SLID in the work completion as the DLID in responder side 7a37c58ee7 md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() b467d9460e md/raid5: Ensure stripe_fill happens on non-read IO with journal 5d8259c9d1 md: Replace snprintf with scnprintf 9e92d5ca54 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() 058833dbeb ata: fix ata_id_has_dipm() dad910a6d4 ata: fix ata_id_has_ncq_autosense() 21faddeff7 ata: fix ata_id_has_devslp() 204cc767dc ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() 5c75d608fa RDMA/siw: Fix QP destroy to wait for all references dropped. 308cd50f17 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. e58a0b9100 RDMA/srp: Fix srp_abort() dc9e4ef6b0 RDMA/irdma: Align AE id codes to correct flush code and event 84ce1a8e36 mtd: rawnand: fsl_elbc: Fix none ECC mode be424a7d53 mtd: rawnand: intel: Remove undocumented compatible string 445395900b mtd: rawnand: intel: Read the chip-select line from the correct OF node cbbf9cca47 phy: phy-mtk-tphy: fix the phy type setting issue e4be7c9495 phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent() 88263152ff mtd: devices: docg3: check the return value of devm_ioremap() in the probe a0e4ac6988 clk: qcom: sm6115: Select QCOM_GDSC aecb632674 dyndbg: drop EXPORTed dynamic_debug_exec_queries 0d4421f2cb dyndbg: let query-modname override actual module name 0c0d9f38b0 dyndbg: fix module.dyndbg handling 49d85932f7 dyndbg: fix static_branch manipulation 7cb9b20941 dmaengine: hisilicon: Add multi-thread support for a DMA channel b88630d9aa dmaengine: hisilicon: Fix CQ head update e84aeeafe8 dmaengine: hisilicon: Disable channels when unregister hisi_dma b94605f5cb fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() 11bd8bbdf8 misc: ocxl: fix possible refcount leak in afu_ioctl() c23c5e1845 RDMA/rxe: Fix the error caused by qp->sk f2f405af70 RDMA/rxe: Fix "kernel NULL pointer dereference" error 2ea7caa968 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init 23624abbc9 media: uvcvideo: Use entity get_cur in uvc_ctrl_set 6c5da92103 media: uvcvideo: Fix memory leak in uvc_gpio_parse 4e2042f1ad media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() aeffca4344 tty: xilinx_uartps: Fix the ignore_status a8d772c7b8 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop 6225501072 HSI: omap_ssi_port: Fix dma_map_sg error check 691f23a847 HSI: omap_ssi: Fix refcount leak in ssi_probe d6e750535b clk: tegra20: Fix refcount leak in tegra20_clock_init e7a57fb92a clk: tegra: Fix refcount leak in tegra114_clock_init 417ed4432b clk: tegra: Fix refcount leak in tegra210_clock_init ca5f338ef1 clk: sprd: Hold reference returned by of_get_parent() 49343bdf95 clk: berlin: Add of_node_put() for of_get_parent() 857b719bed clk: qoriq: Hold reference returned by of_get_parent() a8cbce0305 clk: oxnas: Hold reference returned by of_get_parent() e0001a565c clk: meson: Hold reference returned by of_get_parent() e900ec4c4f usb: common: debug: Check non-standard control requests c11f48764c RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey cd35ad9a7d iio: magnetometer: yas530: Change data type of hard_offsets to signed 23fafc2e2c iio: ABI: Fix wrong format of differential capacitance channel ABI. 8169da520e iio: inkern: fix return value in devm_of_iio_channel_get_by_name() 504e8807fe iio: inkern: only release the device node when done with it b0d4fcc3ec iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume 5db9b840ac iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq c5c63736d2 iio: adc: at91-sama5d2_adc: check return status for pressure and touch 5f1654a0e5 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX 017cf3b0a6 ARM: dts: exynos: fix polarity of VBUS GPIO of Origen 6c93b683ce arm64: ftrace: fix module PLTs with mcount bbf64eb102 ext4: don't run ext4lazyinit for read-only filesystems 7a00a23207 ARM: Drop CMDLINE_* dependency on ATAGS 2af04fe87e ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family 2134214bc4 arm64: dts: ti: k3-j7200: fix main pinmux range 7247a1d7a4 soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA 4f7892f242 ia64: export memory_add_physaddr_to_nid to fix cxl build error 2ef01657b2 ARM: dts: kirkwood: lsxl: remove first ethernet port bf7caa3c5c ARM: dts: kirkwood: lsxl: fix serial line 42ce4c73a4 ARM: dts: turris-omnia: Fix mpp26 pin name and comment 96d8f2b43e ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus 08ada28d1d soc: qcom: smem_state: Add refcounting for the 'state->of_node' 96e0028deb soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() a29b6eb959 locks: fix TOCTOU race when granting write lease 7e053784c4 memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() 2680690f9c memory: of: Fix refcount leak bug in of_get_ddr_timings() 566b143aa5 memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() 10df962300 ALSA: hda/hdmi: Don't skip notification handling during PM operation cc756b79a5 ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe f9cb3bd557 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe b7dda65fa8 ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe b2bc9fc56a ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe 3c3ef19a88 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() b14dc26227 ALSA: dmaengine: increment buffer pointer atomically f5f1f5ee50 ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() f910aca076 ASoC: codecs: tx-macro: fix kcontrol put b47a37ad4a drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() bdf54d4b00 drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() 635e7700c5 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx 4f85988467 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API 64545b8a96 mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() 3ba3814c00 drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue() a5ce83e85d drm/omap: dss: Fix refcount leak bugs f5f599daa0 drm/bochs: fix blanking 928ac9fc1a ALSA: hda: beep: Simplify keep-power-at-enable behavior fbb88a7c84 ASoC: rsnd: Add check for rsnd_mod_power_on 4610e7a411 drm/bridge: megachips: Fix a null pointer dereference bug 079c550c57 drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume() c12daccc90 platform/chrome: cros_ec_typec: Correct alt mode index c317d2b8a4 platform/x86: msi-laptop: Fix resource cleanup 0e21d41bc7 platform/x86: msi-laptop: Fix old-ec check for backlight registering 6bc81c1b63 ASoC: tas2764: Fix mute/unmute e644497c53 ASoC: tas2764: Drop conflicting set_bias_level power setting 35bd912ed6 ASoC: tas2764: Allow mono streams fd1d3b2657 platform/chrome: fix memory corruption in ioctl 27bb672c04 platform/chrome: fix double-free in chromeos_laptop_prepare() 57dfb855bc ASoC: mt6359: fix tests for platform_get_irq() failure 8a475a7732 drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() 56d2233cf5 drm/dp_mst: fix drm_dp_dpcd_read return value checks fe6eb3d0c8 drm/bridge: parade-ps8640: Fix regulator supply order 60630834fa drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling 26c1b4cfe5 drm/mipi-dsi: Detach devices when removing the host 652042135e drm/bridge: Avoid uninitialized variable warning f369fb4dee drm: bridge: adv7511: unregister cec i2c device after cec adapter 20609125b8 drm: bridge: adv7511: fix CEC power down control register offset a624161ebe net: mvpp2: fix mvpp2 debugfs leak 7aef5082c5 once: add DO_ONCE_SLOW() for sleepable contexts 77bfd26cbb net/ieee802154: reject zero-sized raw_sendmsg() dc4e9cd6d6 net: wwan: iosm: Call mutex_init before locking it 0b6516a4e3 bnx2x: fix potential memory leak in bnx2x_tpa_stop() 30bfa5aa72 net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() f828333ca9 hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller c91b922b41 spi: Ensure that sg_table won't be used after being freed 49d429760d tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited 19d636b663 sctp: handle the error returned from sctp_auth_asoc_init_active_key 7bfa18b05f mISDN: fix use-after-free bugs in l1oip timer handlers 6f1991a940 eth: alx: take rtnl_lock on resume e28a4e7f02 vhost/vsock: Use kvmalloc/kvfree for larger packets. 5dbdd690ed wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM 432eecffcf spi: s3c64xx: Fix large transfers with DMA 1454a26cb1 netfilter: nft_fib: Fix for rpath check with VRF devices 7d98b26684 xfrm: Reinject transport-mode packets through workqueue 397e880acf Bluetooth: hci_core: Fix not handling link timeouts propertly 1331d3e1f9 i2c: mlxbf: support lock mechanism 9233ab8198 skmsg: Schedule psock work if the cached skb exists on the psock 44f1dc2e82 spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe daa5239ea4 spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe 6b94115186 x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype 3c27a13807 x86/microcode/AMD: Track patch allocation size explicitly 3e2b805a68 wifi: ath11k: fix number of VHT beamformee spatial streams 5a6827cdc2 netfilter: conntrack: revisit the gc initial rescheduling bias 9c39ca418b netfilter: conntrack: fix the gc rescheduling delay b8917dce21 Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure c087c35292 bpf: Ensure correct locking around vulnerable function find_vpid() a0f15af17b net: fs_enet: Fix wrong check in do_pd_setup ee7c5e814f Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release 57d4f2f8a6 wifi: mt76: mt7915: do not check state before configuring implicit beamform dea9093f24 wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload 817e8b75ae wifi: mt76: sdio: fix transmitting packet hangs 5dc095a37f wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask 9973f78c19 wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration 5d9222c680 bpf: btf: fix truncated last_member_type_id in btf_struct_resolve 4ce47c5545 spi: meson-spicc: do not rely on busy flag in pow2 clk ops 36c484bac9 wifi: rtl8xxxu: Fix skb misuse in TX queue selection fefd2269e6 spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() e22f649918 spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() 37005a9486 selftests/xsk: Avoid use-after-free on ctx 69995c64e5 wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init() 6f9484e969 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() d091771f51 Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend f91e25cfa5 bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy 0e13425104 bpf: Propagate error from htab_lock_bucket() to userspace 0b00c6130c bpf: Disable preemption when increasing per-cpu map_locked 68ab769033 xsk: Fix backpressure mechanism on Tx 0559a6d96a x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register e962e458bf spi: mt7621: Fix an error message in mt7621_spi_probe() 0a16bbc8b0 bpftool: Fix a wrong type cast in btf_dumper_int 6e8eadfa9b wifi: mac80211: allow bw change during channel switch in mesh 4ed5155043 bpf: Fix reference state management for synchronous callbacks 3d0a101e71 leds: lm3601x: Don't use mutex after it was destroyed 54a3201f3c wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() 714536ff6f wifi: rtlwifi: 8192de: correct checking of IQK reload 80a474502e NFSD: Fix handling of oversized NFSv4 COMPOUND requests dc7f225090 NFSD: Protect against send buffer overflow in NFSv2 READDIR cedaf73c8b SUNRPC: Fix svcxdr_init_encode's buflen calculation 6b55707ff8 SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation aed8816305 nfsd: Fix a memory leak in an error handling path 5c4b234c44 objtool: Preserve special st_shndx indexes in elf_update_symbol 425a2a9469 ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE 2647b20e04 ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() 93296e7ab7 MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() 993b13abde MIPS: SGI-IP27: Free some unused memory 959855093f sh: machvec: Use char[] for section boundaries 91fafd22f8 thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register() 81fb3ee298 ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers 33d478eee2 userfaultfd: open userfaultfds with O_RDONLY 10918ebecd ima: fix blocking of security.ima xattrs of unsupported algorithms b7af9b8be8 selinux: use "grep -E" instead of "egrep" 73b8218ef4 smb3: must initialize two ACL struct fields to zero adf428ae46 drm/amd/display: Fix vblank refcount in vrr transition 60a5174525 drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier 01bd3eaa53 drm/i915: Fix watermark calculations for gen12+ MC CCS modifier 20018a252f drm/i915: Fix watermark calculations for gen12+ RC CCS modifier 861f085f81 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() 446d40e2a8 drm/nouveau/kms/nv140-: Disable interlacing 4dab0d27a4 staging: greybus: audio_helper: remove unused and wrong debugfs usage 28eb4bdb23 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS 4f7b1e7d0f KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 be1a6a61f1 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" 379de01906 KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility e3e5baa368 blk-wbt: call rq_qos_add() after wb_normal is initialized e8e0a6f4b8 media: cedrus: Fix endless loop in cedrus_h265_skip_bits() b76fac61c3 media: cedrus: Set the platform driver data earlier b19254eada efi: libstub: drop pointless get_memory_map() call 5cda4a11b4 thunderbolt: Explicitly enable lane adapter hotplug events at startup d9c79fbcbd tracing: Fix reading strings from synthetic events b9ab154d22 tracing: Add "(fault)" name injection to kernel probes 8ae88c4842 tracing: Move duplicate code of trace_kprobe/eprobe.c into header 84f4be2093 tracing: Add ioctl() to force ring buffer waiters to wake up 32eb54a986 tracing: Wake up waiters when tracing is disabled 2475de2bc0 tracing: Wake up ring buffer waiters on closing of the file 48272aa48d tracing: Disable interrupt or preemption before acquiring arch_spinlock_t d4ab9bc5f5 ring-buffer: Fix race between reset page and reading page be60f698c2 ring-buffer: Add ring_buffer_wake_waiters() 5201dd81ae ring-buffer: Check pending waiters when doing wake ups as well bc6d4e9d64 ring-buffer: Have the shortest_full queue be the shortest not longest e8d1167385 ring-buffer: Allow splice to read previous partially read pages fb96b7489f ftrace: Properly unset FTRACE_HASH_FL_MOD 31dc1727c1 livepatch: fix race between fork and KLP transition 36997b75bb ext4: update 'state->fc_regions_size' after successful memory allocation 417b0455a0 ext4: fix potential memory leak in ext4_fc_record_regions() 9b5eb368a8 ext4: fix potential memory leak in ext4_fc_record_modified_inode() ef1607c991 ext4: fix miss release buffer head in ext4_fc_write_inode d29fa1ab4e ext4: fix dir corruption when ext4_dx_add_entry() fails d12471b416 ext4: place buffer head allocation before handle start 46e5f470a1 ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate 1f5e643b38 ext4: don't increase iversion counter for ea_inodes dd366295d1 ext4: fix check for block being out of directory size 4a967fe8b0 ext4: make ext4_lazyinit_thread freezable 533c60a0b9 ext4: fix null-ptr-deref in ext4_write_info d8e4af8314 ext4: avoid crash when inline data creation follows DIO write 56fcd0788f jbd2: add miss release buffer head in fc_do_one_pass() d11d2ded29 jbd2: fix potential use-after-free in jbd2_fc_wait_bufs e7385c868e jbd2: fix potential buffer head reference count leak d87fe290a5 jbd2: wake up journal waiters in FIFO order, not LIFO 7434626c5e hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero 095493833b hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO 73687c5391 f2fs: fix to do sanity check on summary info ed854f10e6 f2fs: fix to do sanity check on destination blkaddr during recovery 7f10357c90 f2fs: increase the limit for reserve_root 0035b84223 f2fs: flush pending checkpoints when freezing super ab49589754 f2fs: complete checkpoints during remount 0a408c6212 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer 4b996a3014 btrfs: fix race between quota enable and quota rescan ioctl 0d94230343 fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE 95a520b591 ksmbd: Fix user namespace mapping a19f316406 ksmbd: Fix wrong return value and message length check in smb2_ioctl() 39b6855628 ksmbd: fix endless loop when encryption for response fails 2b0897e336 fbdev: smscufx: Fix use-after-free in ufx_ops_open() aa7b2c927e pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback 5d97378b36 gpio: rockchip: request GPIO mux to pinctrl when setting direction e0b1c16fda scsi: qedf: Populate sysfs attributes for vport 1d567179f2 slimbus: qcom-ngd: cleanup in probe error path fa0aab2e45 slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure ba2159df18 powerpc/boot: Explicitly disable usage of SPE instructions 9df2a9cdad powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain 75d9de25a6 NFSD: Protect against send buffer overflow in NFSv3 READ 2be9331ca6 NFSD: Protect against send buffer overflow in NFSv2 READ 071a076fd1 NFSD: Protect against send buffer overflow in NFSv3 READDIR 209a94c519 serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices 63a3d75cf1 serial: 8250: Let drivers request full 16550A feature probing 26e5c79e67 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge 7c16d0a4e6 xen/gntdev: Accommodate VMA splitting 1cb73704cb xen/gntdev: Prevent leaking grants 43bed0a13a mm/mmap: undo ->mmap() when arch_validate_flags() fails 2b0072d33e mm/damon: validate if the pmd entry is present before accessing 91c4eb16e8 arm64: errata: Add Cortex-A55 to the repeat tlbi list fc0f921b7e drm/udl: Restore display mode on resume 0640934725 drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() fb3910436b drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error f122bcb34f drm/virtio: Check whether transferred 2D BO is shmem a95fb5d55a dmaengine: mxs: use platform_driver_register e7a3334e83 Revert "drm/amdgpu: use dirty framebuffer helper" 4bdedc3b53 nvme-pci: set min_align_mask before calculating max_hw_sectors 32aa0b3f0c nvme-multipath: fix possible hang in live ns resize with ANA access 9391cc3a78 nvmem: core: Fix memleak in nvmem_register() 7efe61dc6a UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK 81ab826a28 riscv: Pass -mno-relax only on lld < 15.0.0 7780bb02a0 riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb c657b70e80 riscv: Make VM_WRITE imply VM_READ 3c3c4fa118 riscv: Allow PROT_WRITE-only mmap() af3aaee08d parisc: fbdev/stifb: Align graphics memory size to 4MB dc235db7b7 RISC-V: Make port I/O string accessors actually work 8c487db000 riscv: topology: fix default topology reporting d46c24f307 arm64: topology: move store_cpu_topology() to shared code fcf0f6cbb6 regulator: qcom_rpm: Fix circular deferral regression 78d81a8a8c net: thunderbolt: Enable DMA paths only after rings are enabled 3281e81ce9 hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API e1ab98ec2b ASoC: wcd934x: fix order of Slimbus unprepare/disable a2140a9922 ASoC: wcd9335: fix order of Slimbus unprepare/disable d0507b36da platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure fcfeecca15 quota: Check next/prev free block number after reading from quota file 17214cfab7 HID: multitouch: Add memory barriers 219e4a0f9d fs: dlm: handle -EBUSY first in lock arg validation 34ed22dd28 fs: dlm: fix race between test_bit() and queue_work() 7fa5304c4b i2c: designware: Fix handling of real but unexpected device interrupts f9effcefa8 mmc: sdhci-sprd: Fix minimum clock limit a4df91a88c can: kvaser_usb_leaf: Fix CAN state after restart 0c28c2c0cf can: kvaser_usb_leaf: Fix TX queue out of sync after restart b8c4f6345e can: kvaser_usb_leaf: Fix overread with an invalid command de4434d682 can: kvaser_usb: Fix use of uninitialized completion 354d768e31 usb: add quirks for Lenovo OneLink+ Dock 103b459590 xhci: dbc: Fix memory leak in xhci_alloc_dbc() 39f4c90b99 iio: pressure: dps310: Reset chip after timeout bc493cd754 iio: pressure: dps310: Refactor startup procedure 5f6bfc1926 iio: adc: ad7923: fix channel readings for some variants 1be580ed84 iio: ltc2497: Fix reading conversion results ef4018707d iio: dac: ad5593r: Fix i2c read protocol requirements 60480291c1 cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message 0d814a2199 cifs: destage dirty pages before re-reading them for cache=none 15993e9a9b hv_netvsc: Fix race between VF offering and VF association message from host f9dc33f231 io_uring/net: don't update msg_name if not provided a1bd289c10 mtd: rawnand: atmel: Unmap streaming DMA mappings 3e4d2375d1 ALSA: hda/realtek: Add Intel Reference SSID to support headset keys 41e83faf03 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop c01f385c70 ALSA: hda/realtek: Correct pin configs for ASUS G533Z 0d50e05ecc ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 ec439b97d9 ALSA: usb-audio: Fix NULL dererence at error path 0672215994 ALSA: usb-audio: Fix potential memory leaks 550ca3082e ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() 45899fae65 ALSA: oss: Fix potential deadlock at unregistration 5ca155aa79 Revert "fs: check FMODE_LSEEK to control internal pipe splicing" And update the .xml file to handle some private pointer changes and an abi preservation change: type 'struct sk_buff' changed member 'union { struct { __u8 scm_io_uring; __u8 android_kabi_reserved1_padding1; __u16 android_kabi_reserved1_padding2; __u32 android_kabi_reserved1_padding3; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added member 'u64 android_kabi_reserved1' was removed type 'struct super_block' changed member changed from 'struct key * s_master_keys' to 'struct fscrypt_keyring * s_master_keys' type changed from 'struct key *' to 'struct fscrypt_keyring *' pointed-to type changed from 'struct key' to 'struct fscrypt_keyring' type 'struct fscrypt_info' changed member changed from 'struct key * ci_master_key' to 'struct fscrypt_master_key * ci_master_key' type changed from 'struct key *' to 'struct fscrypt_master_key *' pointed-to type changed from 'struct key' to 'struct fscrypt_master_key' Change-Id: Id0a60a4e0d8a036fffd52dad04135cf57d98f09f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-21 15:48:02 +00:00
Michael Grzeschik	4aa53ed66b	BACKPORT: media: uvcvideo: move uvc_format_desc to common header ... The uvc_format_desc, GUID defines and the uvc_format_by_guid helper is also useful for the uvc gadget stack. This patch moves them to a common header. Tested-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-3-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6b028df7d466a5f7c0263a46256c9bdc42debd9f) arakesh: resolved minor conflicts in drivers/media/usb/uvc/uvc_driver.c and drivers/media/usb/uvc/uvcvideo.h Bug: 259171206 Change-Id: I37b839850896fff279159fca93a50f4788184354 Signed-off-by: Avichal Rakesh <arakesh@google.com> (cherry picked from commit 73879990ebc86148bef3a4aaa48770abb1afa00c)	2023-01-20 21:27:41 +00:00
Michael Grzeschik	fc7969e41e	BACKPORT: media: v4l: move helper functions for fractions from uvc to v4l2-common ... The functions uvc_simplify_fraction and uvc_fraction_to_interval are generic helpers which are also useful for other v4l2 drivers. This patch moves them to v4l2-common. Tested-by: Daniel Scally <dan.scally@ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Link: https://lore.kernel.org/r/20220909221335.15033-2-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6ba8b8d45335180523df8f1b6cd1c995a3dbf560) arakesh: resolved minor conflicts in include/media/v4l2-common.h and drivers/media/v4l2-core/v4l2-common.c Bug: 259171206 Change-Id: I17eea1ef6788ba98599b1d8a12499147ebef7d60 Signed-off-by: Avichal Rakesh <arakesh@google.com> (cherry picked from commit 38131c2b2feb8611d27a07aefa97b6948f086a4f)	2023-01-20 21:27:41 +00:00
Mazin Al Haddad	d0af6220bb	media: dvb-usb: fix memory leak in dvb_usb_adapter_init() ... [ Upstream commit 94d90fb06b94a90c176270d38861bcba34ce377d ] Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:43 +01:00
Baisong Zhong	210fcf64be	media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() ... [ Upstream commit 0ed554fd769a19ea8464bb83e9ac201002ef74ad ] Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820c8 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by: Wei Chen <harperchen1110@gmail.com> Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:12 +01:00
Greg Kroah-Hartman	b049ff121c	Merge 5.15.75 into android13-5.15-lts ... Changes in 5.15.75 Revert "fs: check FMODE_LSEEK to control internal pipe splicing" ALSA: oss: Fix potential deadlock at unregistration ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() ALSA: usb-audio: Fix potential memory leaks ALSA: usb-audio: Fix NULL dererence at error path ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 ALSA: hda/realtek: Correct pin configs for ASUS G533Z ALSA: hda/realtek: Add quirk for ASUS GV601R laptop ALSA: hda/realtek: Add Intel Reference SSID to support headset keys mtd: rawnand: atmel: Unmap streaming DMA mappings io_uring/net: don't update msg_name if not provided hv_netvsc: Fix race between VF offering and VF association message from host cifs: destage dirty pages before re-reading them for cache=none cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message iio: dac: ad5593r: Fix i2c read protocol requirements iio: ltc2497: Fix reading conversion results iio: adc: ad7923: fix channel readings for some variants iio: pressure: dps310: Refactor startup procedure iio: pressure: dps310: Reset chip after timeout xhci: dbc: Fix memory leak in xhci_alloc_dbc() usb: add quirks for Lenovo OneLink+ Dock can: kvaser_usb: Fix use of uninitialized completion can: kvaser_usb_leaf: Fix overread with an invalid command can: kvaser_usb_leaf: Fix TX queue out of sync after restart can: kvaser_usb_leaf: Fix CAN state after restart mmc: sdhci-sprd: Fix minimum clock limit i2c: designware: Fix handling of real but unexpected device interrupts fs: dlm: fix race between test_bit() and queue_work() fs: dlm: handle -EBUSY first in lock arg validation HID: multitouch: Add memory barriers quota: Check next/prev free block number after reading from quota file platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure ASoC: wcd9335: fix order of Slimbus unprepare/disable ASoC: wcd934x: fix order of Slimbus unprepare/disable hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API net: thunderbolt: Enable DMA paths only after rings are enabled regulator: qcom_rpm: Fix circular deferral regression arm64: topology: move store_cpu_topology() to shared code riscv: topology: fix default topology reporting RISC-V: Make port I/O string accessors actually work parisc: fbdev/stifb: Align graphics memory size to 4MB riscv: Allow PROT_WRITE-only mmap() riscv: Make VM_WRITE imply VM_READ riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb riscv: Pass -mno-relax only on lld < 15.0.0 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK nvmem: core: Fix memleak in nvmem_register() nvme-multipath: fix possible hang in live ns resize with ANA access nvme-pci: set min_align_mask before calculating max_hw_sectors Revert "drm/amdgpu: use dirty framebuffer helper" dmaengine: mxs: use platform_driver_register drm/virtio: Check whether transferred 2D BO is shmem drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() drm/udl: Restore display mode on resume arm64: errata: Add Cortex-A55 to the repeat tlbi list mm/damon: validate if the pmd entry is present before accessing mm/mmap: undo ->mmap() when arch_validate_flags() fails xen/gntdev: Prevent leaking grants xen/gntdev: Accommodate VMA splitting PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge serial: 8250: Let drivers request full 16550A feature probing serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices NFSD: Protect against send buffer overflow in NFSv3 READDIR NFSD: Protect against send buffer overflow in NFSv2 READ NFSD: Protect against send buffer overflow in NFSv3 READ powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain powerpc/boot: Explicitly disable usage of SPE instructions slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure slimbus: qcom-ngd: cleanup in probe error path scsi: qedf: Populate sysfs attributes for vport gpio: rockchip: request GPIO mux to pinctrl when setting direction pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback fbdev: smscufx: Fix use-after-free in ufx_ops_open() ksmbd: fix endless loop when encryption for response fails ksmbd: Fix wrong return value and message length check in smb2_ioctl() ksmbd: Fix user namespace mapping fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE btrfs: fix race between quota enable and quota rescan ioctl btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer f2fs: complete checkpoints during remount f2fs: flush pending checkpoints when freezing super f2fs: increase the limit for reserve_root f2fs: fix to do sanity check on destination blkaddr during recovery f2fs: fix to do sanity check on summary info hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero jbd2: wake up journal waiters in FIFO order, not LIFO jbd2: fix potential buffer head reference count leak jbd2: fix potential use-after-free in jbd2_fc_wait_bufs jbd2: add miss release buffer head in fc_do_one_pass() ext4: avoid crash when inline data creation follows DIO write ext4: fix null-ptr-deref in ext4_write_info ext4: make ext4_lazyinit_thread freezable ext4: fix check for block being out of directory size ext4: don't increase iversion counter for ea_inodes ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate ext4: place buffer head allocation before handle start ext4: fix dir corruption when ext4_dx_add_entry() fails ext4: fix miss release buffer head in ext4_fc_write_inode ext4: fix potential memory leak in ext4_fc_record_modified_inode() ext4: fix potential memory leak in ext4_fc_record_regions() ext4: update 'state->fc_regions_size' after successful memory allocation livepatch: fix race between fork and KLP transition ftrace: Properly unset FTRACE_HASH_FL_MOD ring-buffer: Allow splice to read previous partially read pages ring-buffer: Have the shortest_full queue be the shortest not longest ring-buffer: Check pending waiters when doing wake ups as well ring-buffer: Add ring_buffer_wake_waiters() ring-buffer: Fix race between reset page and reading page tracing: Disable interrupt or preemption before acquiring arch_spinlock_t tracing: Wake up ring buffer waiters on closing of the file tracing: Wake up waiters when tracing is disabled tracing: Add ioctl() to force ring buffer waiters to wake up tracing: Move duplicate code of trace_kprobe/eprobe.c into header tracing: Add "(fault)" name injection to kernel probes tracing: Fix reading strings from synthetic events thunderbolt: Explicitly enable lane adapter hotplug events at startup efi: libstub: drop pointless get_memory_map() call media: cedrus: Set the platform driver data earlier media: cedrus: Fix endless loop in cedrus_h265_skip_bits() blk-wbt: call rq_qos_add() after wb_normal is initialized KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS staging: greybus: audio_helper: remove unused and wrong debugfs usage drm/nouveau/kms/nv140-: Disable interlacing drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() drm/i915: Fix watermark calculations for gen12+ RC CCS modifier drm/i915: Fix watermark calculations for gen12+ MC CCS modifier drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier drm/amd/display: Fix vblank refcount in vrr transition smb3: must initialize two ACL struct fields to zero selinux: use "grep -E" instead of "egrep" ima: fix blocking of security.ima xattrs of unsupported algorithms userfaultfd: open userfaultfds with O_RDONLY ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register() sh: machvec: Use char[] for section boundaries MIPS: SGI-IP27: Free some unused memory MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE objtool: Preserve special st_shndx indexes in elf_update_symbol nfsd: Fix a memory leak in an error handling path SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation SUNRPC: Fix svcxdr_init_encode's buflen calculation NFSD: Protect against send buffer overflow in NFSv2 READDIR NFSD: Fix handling of oversized NFSv4 COMPOUND requests wifi: rtlwifi: 8192de: correct checking of IQK reload wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() leds: lm3601x: Don't use mutex after it was destroyed bpf: Fix reference state management for synchronous callbacks wifi: mac80211: allow bw change during channel switch in mesh bpftool: Fix a wrong type cast in btf_dumper_int spi: mt7621: Fix an error message in mt7621_spi_probe() x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register xsk: Fix backpressure mechanism on Tx bpf: Disable preemption when increasing per-cpu map_locked bpf: Propagate error from htab_lock_bucket() to userspace bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init() selftests/xsk: Avoid use-after-free on ctx spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() wifi: rtl8xxxu: Fix skb misuse in TX queue selection spi: meson-spicc: do not rely on busy flag in pow2 clk ops bpf: btf: fix truncated last_member_type_id in btf_struct_resolve wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask wifi: mt76: sdio: fix transmitting packet hangs wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload wifi: mt76: mt7915: do not check state before configuring implicit beamform Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release net: fs_enet: Fix wrong check in do_pd_setup bpf: Ensure correct locking around vulnerable function find_vpid() Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure netfilter: conntrack: fix the gc rescheduling delay netfilter: conntrack: revisit the gc initial rescheduling bias wifi: ath11k: fix number of VHT beamformee spatial streams x86/microcode/AMD: Track patch allocation size explicitly x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe skmsg: Schedule psock work if the cached skb exists on the psock i2c: mlxbf: support lock mechanism Bluetooth: hci_core: Fix not handling link timeouts propertly xfrm: Reinject transport-mode packets through workqueue netfilter: nft_fib: Fix for rpath check with VRF devices spi: s3c64xx: Fix large transfers with DMA wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM vhost/vsock: Use kvmalloc/kvfree for larger packets. eth: alx: take rtnl_lock on resume mISDN: fix use-after-free bugs in l1oip timer handlers sctp: handle the error returned from sctp_auth_asoc_init_active_key tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited spi: Ensure that sg_table won't be used after being freed hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() bnx2x: fix potential memory leak in bnx2x_tpa_stop() net: wwan: iosm: Call mutex_init before locking it net/ieee802154: reject zero-sized raw_sendmsg() once: add DO_ONCE_SLOW() for sleepable contexts net: mvpp2: fix mvpp2 debugfs leak drm: bridge: adv7511: fix CEC power down control register offset drm: bridge: adv7511: unregister cec i2c device after cec adapter drm/bridge: Avoid uninitialized variable warning drm/mipi-dsi: Detach devices when removing the host drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling drm/bridge: parade-ps8640: Fix regulator supply order drm/dp_mst: fix drm_dp_dpcd_read return value checks drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() ASoC: mt6359: fix tests for platform_get_irq() failure platform/chrome: fix double-free in chromeos_laptop_prepare() platform/chrome: fix memory corruption in ioctl ASoC: tas2764: Allow mono streams ASoC: tas2764: Drop conflicting set_bias_level power setting ASoC: tas2764: Fix mute/unmute platform/x86: msi-laptop: Fix old-ec check for backlight registering platform/x86: msi-laptop: Fix resource cleanup platform/chrome: cros_ec_typec: Correct alt mode index drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume() drm/bridge: megachips: Fix a null pointer dereference bug ASoC: rsnd: Add check for rsnd_mod_power_on ALSA: hda: beep: Simplify keep-power-at-enable behavior drm/bochs: fix blanking drm/omap: dss: Fix refcount leak bugs drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue() mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() ASoC: codecs: tx-macro: fix kcontrol put ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() ALSA: dmaengine: increment buffer pointer atomically mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe ALSA: hda/hdmi: Don't skip notification handling during PM operation memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() memory: of: Fix refcount leak bug in of_get_ddr_timings() memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() locks: fix TOCTOU race when granting write lease soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() soc: qcom: smem_state: Add refcounting for the 'state->of_node' ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus ARM: dts: turris-omnia: Fix mpp26 pin name and comment ARM: dts: kirkwood: lsxl: fix serial line ARM: dts: kirkwood: lsxl: remove first ethernet port ia64: export memory_add_physaddr_to_nid to fix cxl build error soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA arm64: dts: ti: k3-j7200: fix main pinmux range ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family ARM: Drop CMDLINE_* dependency on ATAGS ext4: don't run ext4lazyinit for read-only filesystems arm64: ftrace: fix module PLTs with mcount ARM: dts: exynos: fix polarity of VBUS GPIO of Origen iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX iio: adc: at91-sama5d2_adc: check return status for pressure and touch iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume iio: inkern: only release the device node when done with it iio: inkern: fix return value in devm_of_iio_channel_get_by_name() iio: ABI: Fix wrong format of differential capacitance channel ABI. iio: magnetometer: yas530: Change data type of hard_offsets to signed RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey usb: common: debug: Check non-standard control requests clk: meson: Hold reference returned by of_get_parent() clk: oxnas: Hold reference returned by of_get_parent() clk: qoriq: Hold reference returned by of_get_parent() clk: berlin: Add of_node_put() for of_get_parent() clk: sprd: Hold reference returned by of_get_parent() clk: tegra: Fix refcount leak in tegra210_clock_init clk: tegra: Fix refcount leak in tegra114_clock_init clk: tegra20: Fix refcount leak in tegra20_clock_init HSI: omap_ssi: Fix refcount leak in ssi_probe HSI: omap_ssi_port: Fix dma_map_sg error check media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop tty: xilinx_uartps: Fix the ignore_status media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() media: uvcvideo: Fix memory leak in uvc_gpio_parse media: uvcvideo: Use entity get_cur in uvc_ctrl_set media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init RDMA/rxe: Fix "kernel NULL pointer dereference" error RDMA/rxe: Fix the error caused by qp->sk misc: ocxl: fix possible refcount leak in afu_ioctl() fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() dmaengine: hisilicon: Disable channels when unregister hisi_dma dmaengine: hisilicon: Fix CQ head update dmaengine: hisilicon: Add multi-thread support for a DMA channel dyndbg: fix static_branch manipulation dyndbg: fix module.dyndbg handling dyndbg: let query-modname override actual module name dyndbg: drop EXPORTed dynamic_debug_exec_queries clk: qcom: sm6115: Select QCOM_GDSC mtd: devices: docg3: check the return value of devm_ioremap() in the probe phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent() phy: phy-mtk-tphy: fix the phy type setting issue mtd: rawnand: intel: Read the chip-select line from the correct OF node mtd: rawnand: intel: Remove undocumented compatible string mtd: rawnand: fsl_elbc: Fix none ECC mode RDMA/irdma: Align AE id codes to correct flush code and event RDMA/srp: Fix srp_abort() RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. RDMA/siw: Fix QP destroy to wait for all references dropped. ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() ata: fix ata_id_has_devslp() ata: fix ata_id_has_ncq_autosense() ata: fix ata_id_has_dipm() mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() md: Replace snprintf with scnprintf md/raid5: Ensure stripe_fill happens on non-read IO with journal md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() RDMA/cm: Use SLID in the work completion as the DLID in responder side IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers xhci: Don't show warning for reinit on known broken suspend usb: gadget: function: fix dangling pnp_string in f_printer.c drivers: serial: jsm: fix some leaks in probe serial: 8250: Toggle IER bits on only after irq has been set up tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown phy: qualcomm: call clk_disable_unprepare in the error handling staging: vt6655: fix some erroneous memory clean-up loops slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON firmware: google: Test spinlock on panic path to avoid lockups serial: 8250: Fix restoring termios speed after suspend scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() scsi: iscsi: Rename iscsi_conn_queue_work() scsi: iscsi: Add recv workqueue helpers scsi: iscsi: Run recv path from workqueue scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical clk: qcom: gcc-sm6115: Override default Alpha PLL regs RDMA/rxe: Fix resize_finish() in rxe_queue.c fsi: core: Check error number after calling ida_simple_get mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() mfd: lp8788: Fix an error handling path in lp8788_probe() mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() mfd: fsl-imx25: Fix check for platform_get_irq() errors mfd: sm501: Add check for platform_driver_register() clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() usb: mtu3: fix failed runtime suspend in host only mode spmi: pmic-arb: correct duplicate APID to PPID mapping logic clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD clk: baikal-t1: Fix invalid xGMAC PTP clock divider clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent clk: baikal-t1: Add SATA internal ref clock buffer clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration clk: imx: scu: fix memleak on platform_device_add() fails clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe clk: ast2600: BCLK comes from EPLL mailbox: mpfs: fix handling of the reg property mailbox: mpfs: account for mbox offsets while sending mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig powerpc/math_emu/efp: Include module.h powerpc/sysdev/fsl_msi: Add missing of_node_put() powerpc/pci_dn: Add missing of_node_put() powerpc/powernv: add missing of_node_put() in opal_export_attrs() powerpc: Fix fallocate and fadvise64_64 compat parameter combination x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 powerpc: Fix SPE Power ISA properties for e500v1 platforms powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL crypto: sahara - don't sleep when in softirq crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr hwrng: arm-smccc-trng - fix NO_ENTROPY handling cgroup: Honor caller's cgroup NS when resolving path hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() crypto: qat - fix default value of WDT timer crypto: hisilicon/qm - fix missing put dfx access cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset iommu/omap: Fix buffer overflow in debugfs crypto: akcipher - default implementation for setting a private key crypto: ccp - Release dma channels before dmaengine unrgister crypto: inside-secure - Change swab to swab32 crypto: qat - fix DMA transfer direction cifs: return correct error in ->calc_signature() iommu/iova: Fix module config properly tracing: kprobe: Fix kprobe event gen test module on exit tracing: kprobe: Make gen test module work in arm and riscv tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads kbuild: remove the target in signal traps when interrupted kbuild: rpm-pkg: fix breakage when V=1 is used crypto: marvell/octeontx - prevent integer overflows crypto: cavium - prevent integer overflow loading firmware thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id ACPI: APEI: do not add task_work to kernel thread to avoid memory leak f2fs: fix race condition on setting FI_NO_EXTENT flag f2fs: fix to account FS_CP_DATA_IO correctly selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle fs: dlm: fix race in lowcomms rcu: Avoid triggering strict-GP irq-work when RCU is idle rcu: Back off upon fill_page_cache_func() allocation failure rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() ACPI: video: Add Toshiba Satellite/Portege Z830 quirk ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode MIPS: BCM47XX: Cast memcmp() of function to (void *) powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash ARM: decompressor: Include .data.rel.ro.local ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable x86/entry: Work around Clang __bdos() bug NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data NFSD: fix use-after-free on source server when doing inter-server copy wifi: brcmfmac: fix invalid address access when enabling SCAN log level bpftool: Clear errno after libcap's checks ice: set tx_tstamps when creating new Tx rings via ethtool net: ethernet: ti: davinci_mdio: Add workaround for errata i2329 openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch tcp: annotate data-race around tcp_md5sig_pool_populated x86/mce: Retrieve poison range from hardware wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround xfrm: Update ipcomp_scratches with NULL when freed iavf: Fix race between iavf_close and iavf_reset_task wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk regulator: core: Prevent integer underflow wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times can: bcm: check the result of can_send() in bcm_can_tx() wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 wifi: rt2x00: set VGC gain for both chains of MT7620 wifi: rt2x00: set SoC wmac clock register wifi: rt2x00: correctly set BBP register 86 for MT7620 hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Bluetooth: L2CAP: Fix user-after-free r8152: Rate limit overflow messages drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() drm: Use size_t type for len variable in drm_copy_field() drm: Prevent drm_copy_field() to attempt copying a NULL pointer drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() drm/amd/display: fix overflow on MIN_I64 definition udmabuf: Set ubuf->sg = NULL if the creation of sg table fails drm: bridge: dw_hdmi: only trigger hotplug event on link change ALSA: usb-audio: Register card at the last interface drm/vc4: vec: Fix timings for VEC modes drm: panel-orientation-quirks: Add quirk for Anbernic Win600 platform/chrome: cros_ec: Notify the PM of wake events during resume platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading ASoC: SOF: pci: Change DMI match info to support all Chrome platforms drm/amdgpu: fix initial connector audio value drm/meson: reorder driver deinit sequence to fix use-after-free bug drm/meson: explicitly remove aggregate driver at module unload time mmc: sdhci-msm: add compatible string check for sdm670 drm/dp: Don't rewrite link config when setting phy test pattern drm/amd/display: Remove interface for periodic interrupt 1 ARM: dts: imx7d-sdb: config the max pressure for tsc2046 ARM: dts: imx6q: add missing properties for sram ARM: dts: imx6dl: add missing properties for sram ARM: dts: imx6qp: add missing properties for sram ARM: dts: imx6sl: add missing properties for sram ARM: dts: imx6sll: add missing properties for sram ARM: dts: imx6sx: add missing properties for sram kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply btrfs: dump extra info if one free space cache has more bitmaps than it should btrfs: scrub: try to fix super block errors btrfs: don't print information about space cache or tree every remount ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n clk: zynqmp: Fix stack-out-of-bounds in strncpy` media: cx88: Fix a null-ptr-deref bug in buffer_prepare() media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate usb: host: xhci-plat: suspend and resume clocks usb: host: xhci-plat: suspend/resume clks for brcm dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow scsi: 3w-9xxx: Avoid disabling device if failing to enable it nbd: Fix hung when signal interrupts nbd_start_device_ioctl() iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() staging: vt6655: fix potential memory leak blk-throttle: prevent overflow while calculating wait time ata: libahci_platform: Sanity check the DT child nodes number bcache: fix set_at_max_writeback_rate() for multiple attached devices soundwire: cadence: Don't overwrite msg->buf during write commands soundwire: intel: fix error handling on dai registration issues HID: roccat: Fix use-after-free in roccat_read() eventfd: guard wake_up in eventfd fs calls as well md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() usb: musb: Fix musb_gadget.c rxstate overflow bug arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug Revert "usb: storage: Add quirk for Samsung Fit flash" staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled ext2: Use kvmalloc() for group descriptor array nvme: copy firmware_rev on each init nvmet-tcp: add bounds check on Transfer Tag usb: idmouse: fix an uninit-value in idmouse_open clk: bcm2835: Make peripheral PLLC critical clk: bcm2835: Round UART input clock up perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc io_uring/af_unix: defer registered files gc to io_uring release io_uring: correct pinned_vm accounting io_uring/rw: fix short rw error handling io_uring/rw: fix error'ed retry return values io_uring/rw: fix unexpected link breakage mm: hugetlb: fix UAF in hugetlb_handle_userfault net: ieee802154: return -EINVAL for unknown addr type ALSA: usb-audio: Fix last interface check for registration blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses Revert "net/ieee802154: reject zero-sized raw_sendmsg()" net/ieee802154: don't warn zero-sized raw_sendmsg() drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5 Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5 ext4: continue to expand file system when the target size doesn't reach thermal: intel_powerclamp: Use first online CPU as control_cpu gcov: support GCC 12.1 and newer compilers io-wq: Fix memory leak in worker creation Linux 5.15.75 Change-Id: I5a3ef9688fb31003940d7e1828f863b9d50f1da9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-16 16:28:57 +00:00
Yunke Cao	23624abbc9	media: uvcvideo: Use entity get_cur in uvc_ctrl_set ... [ Upstream commit 5f36851c36b30f713f588ed2b60aa7b4512e2c76 ] Entity controls should get_cur using an entity-defined function instead of via a query. Fix this in uvc_ctrl_set. Fixes: 65900c581d ("media: uvcvideo: Allow entity-defined get_info and get_cur") Signed-off-by: Yunke Cao <yunkec@google.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-10-26 12:35:06 +02:00
José Expósito	6c5da92103	media: uvcvideo: Fix memory leak in uvc_gpio_parse ... [ Upstream commit f0f078457f18f10696888f8d0e6aba9deb9cde92 ] Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses-Coverity-ID: 1474639 ("Resource leak") Fixes: 2886477ff9 ("media: uvcvideo: Implement UVC_EXT_GPIO_UNIT") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-10-26 12:35:06 +02:00
Greg Kroah-Hartman	4305285a35	Merge 5.15.71 into android13-5.15-lts ... Changes in 5.15.71 drm/amdgpu: Separate vf2pf work item init from virt data exchange drm/amdgpu: make sure to init common IP before gmc staging: r8188eu: Remove support for devices with 8188FU chipset (0bda:f179) staging: r8188eu: Add Rosewill USB-N150 Nano to device tables usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind usb: dwc3: Issue core soft reset before enabling run/stop usb: dwc3: gadget: Prevent repeat pullup() usb: dwc3: gadget: Refactor pullup() usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup() usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop usb: add quirks for Lenovo OneLink+ Dock usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Revert "usb: add quirks for Lenovo OneLink+ Dock" Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio" drivers/base: Fix unsigned comparison to -1 in CPUMAP_FILE_MAX_BYTES USB: core: Fix RST error in hub.c USB: serial: option: add Quectel BG95 0x0203 composition USB: serial: option: add Quectel RM520N Revert "ALSA: usb-audio: Split endpoint setups for hw_params and prepare" ALSA: core: Fix double-free at snd_card_new() ALSA: hda/tegra: set depop delay for tegra ALSA: hda: add Intel 5 Series / 3400 PCI DID ALSA: hda/realtek: Add quirk for Huawei WRT-WX9 ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5570 laptop ALSA: hda/realtek: Re-arrange quirk table entries ALSA: hda/realtek: Add pincfg for ASUS G513 HP jack ALSA: hda/realtek: Add pincfg for ASUS G533Z HP jack ALSA: hda/realtek: Add quirk for ASUS GA503R laptop ALSA: hda/realtek: Enable 4-speaker output Dell Precision 5530 laptop iommu/vt-d: Check correct capability for sagaw determination btrfs: fix hang during unmount when stopping block group reclaim worker btrfs: fix hang during unmount when stopping a space reclaim worker media: flexcop-usb: fix endpoint type check usb: dwc3: core: leave default DMA if the controller does not support 64-bit DMA thunderbolt: Add support for Intel Maple Ridge single port controller efi: x86: Wipe setup_data on pure EFI boot efi: libstub: check Shim mode using MokSBStateRT wifi: mt76: fix reading current per-tid starting sequence number for aggregation gpio: mockup: fix NULL pointer dereference when removing debugfs gpio: mockup: Fix potential resource leakage when register a chip gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully riscv: fix a nasty sigreturn bug... kasan: call kasan_malloc() from __kmalloc_*track_caller() can: flexcan: flexcan_mailbox_read() fix return value for drop = true net: mana: Add rmb after checking owner bits mm/slub: fix to return errno if kmalloc() fails mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. KVM: x86: Inject #UD on emulated XSETBV if XSAVES isn't enabled arm64: topology: fix possible overflow in amu_fie_setup() vmlinux.lds.h: CFI: Reduce alignment of jump-table to function alignment xfs: reorder iunlink remove operation in xfs_ifree xfs: fix xfs_ifree() error handling to not leak perag ref xfs: validate inode fork size against fork format firmware: arm_scmi: Harden accesses to the reset domains firmware: arm_scmi: Fix the asynchronous reset requests arm64: dts: rockchip: Pull up wlan wake# on Gru-Bob arm64: dts: rockchip: Fix typo in lisense text for PX30.Core drm/mediatek: dsi: Add atomic {destroy,duplicate}_state, reset callbacks arm64: dts: rockchip: Set RK3399-Gru PCLK_EDP to 24 MHz dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() arm64: dts: rockchip: Remove 'enable-active-low' from rk3399-puma netfilter: nf_conntrack_sip: fix ct_sip_walk_headers netfilter: nf_conntrack_irc: Tighten matching on DCC message netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() ice: Don't double unplug aux on peer initiated reset iavf: Fix cached head and tail value for iavf_get_tx_pending ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header net: core: fix flow symmetric hash net: phy: aquantia: wait for the suspend/resume operations to finish scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() scsi: mpt3sas: Fix return value check of dma_get_required_mask() net: bonding: Share lacpdu_mcast_addr definition net: bonding: Unsync device addresses on ndo_stop net: team: Unsync device addresses on ndo_stop drm/panel: simple: Fix innolux_g121i1_l01 bus_format MIPS: lantiq: export clk_get_io() for lantiq_wdt.ko MIPS: Loongson32: Fix PHY-mode being left unspecified um: fix default console kernel parameter iavf: Fix bad page state mlxbf_gige: clear MDIO gateway lock after read iavf: Fix set max MTU size with port VLAN and jumbo frames i40e: Fix VF set max MTU size i40e: Fix set max_tx_rate when it is lower than 1 Mbps sfc: fix TX channel offset when using legacy interrupts sfc: fix null pointer dereference in efx_hard_start_xmit drm/hisilicon/hibmc: Allow to be built if COMPILE_TEST is enabled drm/hisilicon: Add depends on MMU of: mdio: Add of_node_put() when breaking out of for_each_xx net: ipa: properly limit modem routing table use wireguard: ratelimiter: disable timings test by default wireguard: netlink: avoid variable-sized memcpy on sockaddr net: enetc: move enetc_set_psfp() out of the common enetc_set_features() net: enetc: deny offload of tc-based TSN features on VF interfaces net/sched: taprio: avoid disabling offload when it was never enabled net/sched: taprio: make qdisc_leaf() see the per-netdev-queue pfifo child qdiscs netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() netfilter: ebtables: fix memory leak when blob is malformed net: ravb: Fix PHY state warning splat during system resume net: sh_eth: Fix PHY state warning splat during system resume can: gs_usb: gs_can_open(): fix race dev->can.state condition perf stat: Fix BPF program section name perf jit: Include program header in ELF files perf kcore_copy: Do not check /proc/modules is unchanged perf tools: Honor namespace when synthesizing build-ids drm/mediatek: dsi: Move mtk_dsi_stop() call back to mtk_dsi_poweroff() net/smc: Stop the CLC flow if no link to map buffers on bonding: fix NULL deref in bond_rr_gen_slave_id net: sunhme: Fix packet reception for len < RX_COPY_THRESHOLD net: sched: fix possible refcount leak in tc_new_tfilter() bnxt: prevent skb UAF after handing over to PTP worker selftests: forwarding: add shebang for sch_red.sh KVM: x86/mmu: Fold rmap_recycle into rmap_add serial: fsl_lpuart: Reset prior to registration serial: Create uart_xmit_advance() serial: tegra: Use uart_xmit_advance(), fixes icount.tx accounting serial: tegra-tcu: Use uart_xmit_advance(), fixes icount.tx accounting s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup drm/amd/amdgpu: fixing read wrong pf2vf data in SRIOV Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region drm/gma500: Fix BUG: sleeping function called from invalid context errors drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards drm/amdgpu: use dirty framebuffer helper drm/amd/display: Limit user regamma to a valid value drm/amd/display: Reduce number of arguments of dml31's CalculateWatermarksAndDRAMSpeedChangeSupport() drm/amd/display: Reduce number of arguments of dml31's CalculateFlipSchedule() drm/amd/display: Mark dml30's UseMinimumDCFCLK() as noinline for stack usage drm/rockchip: Fix return type of cdn_dp_connector_mode_valid fsdax: Fix infinite loop in dax_iomap_rw() workqueue: don't skip lockdep work dependency in cancel_work_sync() i2c: imx: If pm_runtime_get_sync() returned 1 device access is possible i2c: mlxbf: incorrect base address passed during io write i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() i2c: mlxbf: Fix frequency calculation drm/amdgpu: don't register a dirty callback for non-atomic NFSv4: Fixes for nfs4_inode_return_delegation() devdax: Fix soft-reservation memory description ext4: make directory inode spreading reflect flexbg size ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 ext4: limit the number of retries after discarding preallocations blocks ext4: make mballoc try target group first even with mb_optimize_scan ext4: avoid unnecessary spreading of allocations among groups ext4: use locality group preallocation for small closed files Linux 5.15.71 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I51916c0ad287a15f0b132f3a87c5c704de31b632	2022-09-30 15:04:19 +02:00
Johan Hovold	7143f6cf58	media: flexcop-usb: fix endpoint type check ... commit 763679f0eeff0185fc431498849bbc1c24460875 upstream. Commit d725d20e81 ("media: flexcop-usb: sanity checking of endpoint type") tried to add an endpoint type sanity check for the single isochronous endpoint but instead broke the driver by checking the wrong descriptor or random data beyond the last endpoint descriptor. Make sure to check the right endpoint descriptor. Fixes: d725d20e81 ("media: flexcop-usb: sanity checking of endpoint type") Cc: Oliver Neukum <oneukum@suse.com> Cc: stable@vger.kernel.org # 5.9 Reported-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20220822151027.27026-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-28 11:11:42 +02:00
Greg Kroah-Hartman	049f90ecb7	Merge 5.15.65 into android13-5.15-lts ... Changes in 5.15.65 mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() drm/bridge: Add stubs for devm_drm_of_get_bridge when OF is disabled ACPI: thermal: drop an always true check drm/vc4: hdmi: Rework power up drm/vc4: hdmi: Depends on CONFIG_PM firmware: tegra: bpmp: Do only aligned access to IPC memory area crypto: lib - remove unneeded selection of XOR_BLOCKS Drivers: hv: balloon: Support status report for larger page sizes mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte arm64: errata: Add Cortex-A510 to the repeat tlbi list io_uring: correct fill events helpers types io_uring: clean cqe filling functions io_uring: refactor poll update io_uring: move common poll bits io_uring: kill poll linking optimisation io_uring: inline io_poll_complete io_uring: poll rework io_uring: Remove unused function req_ref_put io_uring: remove poll entry from list when canceling all io_uring: bump poll refs to full 31-bits io_uring: fail links when poll fails io_uring: fix wrong arm_poll error handling io_uring: fix UAF due to missing POLLFREE handling kbuild: Fix include path in scripts/Makefile.modpost Bluetooth: L2CAP: Fix build errors in some archs Revert "PCI/portdrv: Don't disable AER reporting in get_port_device_capability()" HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report udmabuf: Set the DMA mask for the udmabuf device (v2) media: pvrusb2: fix memory leak in pvr_probe HID: hidraw: fix memory leak in hidraw_release() net: fix refcount bug in sk_psock_get (2) fbdev: fb_pm2fb: Avoid potential divide by zero error ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead bpf: Don't redirect packets with invalid pkt_len mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5 HID: add Lenovo Yoga C630 battery quirk HID: AMD_SFH: Add a DMI quirk entry for Chromebooks HID: asus: ROG NKey: Ignore portion of 0x5a report HID: thrustmaster: Add sparco wheel and fix array length drm/i915/gt: Skip TLB invalidations once wedged mmc: mtk-sd: Clear interrupts when cqe off/disable mmc: sdhci-of-dwcmshc: add reset call back for rockchip Socs mmc: sdhci-of-dwcmshc: rename rk3568 to rk35xx mmc: sdhci-of-dwcmshc: Re-enable support for the BlueField-3 SoC btrfs: remove root argument from btrfs_unlink_inode() btrfs: remove no longer needed logic for replaying directory deletes btrfs: add and use helper for unlinking inode during log replay btrfs: fix warning during log replay when bumping inode link count fs/ntfs3: Fix work with fragmented xattr ASoC: sh: rz-ssi: Improve error handling in rz_ssi_probe() error path drm/amd/display: Avoid MPC infinite loop drm/amd/display: Fix HDMI VSIF V3 incorrect issue drm/amd/display: For stereo keep "FLIP_ANY_FRAME" drm/amd/display: clear optc underflow before turn off odm clock ksmbd: return STATUS_BAD_NETWORK_NAME error status if share is not configured neigh: fix possible DoS due to net iface start/stop loop s390/hypfs: avoid error message under KVM ksmbd: don't remove dos attribute xattr on O_TRUNC open drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid drm/amd/display: Fix pixel clock programming drm/amdgpu: Increase tlb flush timeout for sriov drm/amd/display: avoid doing vm_init multiple time netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y testing: selftests: nft_flowtable.sh: use random netns names btrfs: move lockdep class helpers to locking.c btrfs: fix lockdep splat with reloc root extent buffers btrfs: tree-checker: check for overlapping extent items kprobes: don't call disarm_kprobe() for disabled kprobes btrfs: fix space cache corruption and potential double allocations android: binder: fix lockdep check on clearing vma net/af_packet: check len when min_header_len equals to 0 net: neigh: don't call kfree_skb() under spin_lock_irqsave() Linux 5.15.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I20608962fa7d031aa14ade6388b826c5b51c1693	2022-09-23 13:30:15 +02:00
Dongliang Mu	f2f6e67522	media: pvrusb2: fix memory leak in pvr_probe ... commit 945a9a8e448b65bec055d37eba58f711b39f66f0 upstream. The error handling code in pvr2_hdw_create forgets to unregister the v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create, it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL, which leads to that pvr2_hdw_destroy directly returns. Fix this by adding v4l2_device_unregister to decrease the refcount of usb interface. Reported-by: syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-05 10:30:07 +02:00
Greg Kroah-Hartman	8fd5b33ea5	Merge 5.15.61 into android13-5.15-lts ... Changes in 5.15.61 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" pNFS/flexfiles: Report RDMA connection errors to the server NFSD: Clean up the show_nf_flags() macro nfsd: eliminate the NFSD_FILE_BREAK_* flags ALSA: usb-audio: Add quirk for Behringer UMC202HD ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate lockd: detect and reject lock arguments that overflow HID: hid-input: add Surface Go battery quirk HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 KVM: x86: Tag kvm_mmu_x86_module_init() with __init KVM: x86: do not report preemption if the steal time cache is stale KVM: x86: revalidate steal time cache if MSR value changes riscv: set default pm_power_off to NULL ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect fix short copy handling in copy_mc_pipe_to_iter() crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Drop pa_swapper_pg_lock spinlock parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode riscv:uprobe fix SR_SPIE set/clear handling dt-bindings: riscv: fix SiFive l2-cache's cache-sets RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context RISC-V: Fixup get incorrect user mode PC for kernel mode regs RISC-V: Fixup schedule out issue in machine_crash_shutdown() RISC-V: Add modules to virtual kernel memory layout dump rtc: rx8025: fix 12/24 hour mode detection on RX-8035 drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/shmem-helper: Add missing vunmap on error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/hyperv-drm: Include framebuffer and EDID headers drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/nouveau/kms: Fix failure path for creating DP connectors drm/amdgpu: Check BO's requested pinning domains against its preferred_domains drm/amdgpu: fix check in fbdev init bpf: Fix KASAN use-after-free Read in compute_effective_progs btrfs: reject log replay if there is unsupported RO compat flag mtd: rawnand: arasan: Fix clock rate in NV-DDR mtd: rawnand: arasan: Update NAND bus clock instead of system clock um: Remove straying parenthesis um: seed rng using host OS rng iio: fix iio_format_avail_range() printing for none IIO_VAL_INT iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers soundwire: qcom: Check device status before reading devid ksmbd: fix memory leak in smb2_handle_negotiate ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ksmbd: fix use-after-free bug in smb2_tree_disconect fuse: limit nsec fuse: ioctl: translate ENOSYS serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" ext2: Add more validity checks for inode counts sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP sched/core: Always flush pending blk_plug irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 ARM: dts: ux500: Fix Codina accelerometer mounting matrix ARM: dts: ux500: Fix Gavini accelerometer mounting matrix spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ARM: OMAP2+: pdata-quirks: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist hwmon: (sht15) Fix wrong assumptions in device remove callback PM: hibernate: defer device probing when resuming from hibernation selinux: fix memleak in security_read_state_kernel() selinux: Add boundary check in put_entry() kasan: test: Silence GCC 12 warnings drm/amdgpu: Remove one duplicated ef removal powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names spi: spi-altera-dfl: Fix an error handling path ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values scsi: hisi_sas: Use managed PCI functions dt-bindings: iio: accel: Add DT binding doc for ADXL355 soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible ARM: dts: ast2600-evb-a1: fix board compatible arm64: dts: mt8192: Fix idle-states nodes naming scheme arm64: dts: mt8192: Fix idle-states entry-method arm64: select TRACE_IRQFLAGS_NMI_SUPPORT arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_*() confusion arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init arm64: dts: qcom: sdm630: disable GPU by default arm64: dts: qcom: sdm630: fix the qusb2phy ref clock arm64: dts: qcom: sdm630: fix gpu's interconnect path arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1 soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() stack: Declare {randomize_,}kstack_offset to fix Sparse warnings arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node ACPI: APEI: explicit init of HEST and GHES in apci_init() drivers/iio: Remove all strcpy() uses ACPI: VIOT: Fix ACS setup arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125 arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fixup SYSRAM references arm64: tegra: Update Tegra234 BPMP channel addresses arm64: tegra: Mark BPMP channels as no-memory-wc arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created spi: Fix simplification of devm_spi_register_controller spi: tegra20-slink: fix UAF in tegra_slink_remove() hwmon: (drivetemp) Add module alias blktrace: Trace remapped requests correctly PM: domains: Ensure genpd_debugfs_dir exists before remove dm writecache: return void from functions dm writecache: count number of blocks read, not number of read bios dm writecache: count number of blocks written, not number of write bios dm writecache: count number of blocks discarded, not number of discard bios regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment irqdomain: Report irq number for NOMAP domains drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() x86/extable: Fix ex_handler_msr() print condition selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Reduce number of devm memory allocations pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data() pwm: lpc18xx: Fix period handling drm/dp: Export symbol / kerneldoc fixes for DP AUX bus drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init drm/bridge: lt9611uxc: Cancel only driver's work i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior i2c: mxs: Silence a clang warning virtio-gpu: fix a missing check to avoid NULL dereference drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle() drm/shmem-helper: Export dedicated wrappers for GEM object functions drm/shmem-helper: Pass GEM shmem object in public interfaces drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: atmel: atmel-sama7g5-isc: fix warning in configs without OF media: tw686x: Register the irq at the end of probe media: imx-jpeg: Correct some definition according specification media: imx-jpeg: Leave a blank space before the configuration data media: imx-jpeg: Add pm-runtime support for imx-jpeg media: imx-jpeg: use NV12M to represent non contiguous NV12 media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos media: imx-jpeg: Refactor function mxc_jpeg_parse media: imx-jpeg: Identify and handle precision correctly media: imx-jpeg: Handle source change in a function media: imx-jpeg: Support dynamic resolution change media: imx-jpeg: Align upwards buffer size media: imx-jpeg: Implement drain using v4l2-mem2mem helpers ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers rcutorture: Warn on individual rcu_torture_init() error conditions rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed rcutorture: Fix ksoftirqd boosting timing and iteration test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register media: imx-jpeg: Disable slot interrupt when frame done drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: driver/nxp/imx-jpeg: fix a unexpected return value problem media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/bridge: Add a function to abstract away panels drm/vc4: dsi: Switch to devm_drm_of_get_bridge drm/vc4: Use of_device_get_match_data() drm/vc4: dsi: Release workaround buffer and DMA drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Fix HPD GPIO detection drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Reset HDMI MISC_CONTROL register drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment drm/msm: Avoid dirtyfb stalls on video mode displays (v2) drm/msm/dpu: Fix for non-visible planes mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mt76: mt7615: do not update pm stats in case of error ieee80211: add EHT 1K aggregation definitions mt76: mt7921: fix aggregation subframes setting to HE max mt76: mt7921: enlarge maximum VHT MPDU length to 11454 mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node() skmsg: Fix invalid last sg check in sk_msg_recvmsg() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing media: cedrus: h265: Fix flag name media: hantro: postproc: Fix motion vector space size media: hantro: Simplify postprocessor media: hevc: Embedded indexes in RPS media: staging: media: hantro: Fix typos wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow libbpf: fix an snprintf() overflow check can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS net/mlx5: Adjust log_max_qp to be 18 at most crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set netdevsim: fib: Fix reference count leak on route deletion failure wifi: rtw88: check the return value of alloc_workqueue() iavf: Fix max_rate limiting iavf: Fix 'tc qdisc show' listing too many queues netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock net: usb: make USB_RTL8153_ECM non user configurable wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow HID: amd_sfh: Don't show client init failed as error when discovery fails clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue of: check previous kernel's ima-kexec-buffer against memory bounds scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing scsi: qla2xxx: edif: Fix potential stuck session in sa update scsi: qla2xxx: edif: Reduce connection thrash scsi: qla2xxx: edif: Fix inconsistent check of db_flags scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application scsi: qla2xxx: edif: Add retry for ELS passthrough scsi: qla2xxx: edif: Fix n2n discovery issue with secure target scsi: qla2xxx: edif: Fix n2n login retry for secure device KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails" KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported phy: samsung: exynosautov9-ufs: correct TSRV register configurations PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back scsi: qla2xxx: edif: Send LOGO for unexpected IKE message scsi: qla2xxx: edif: Reduce disruption due to multiple app start scsi: qla2xxx: edif: Fix no login after app start scsi: qla2xxx: edif: Tear down session if keys have been removed scsi: qla2xxx: edif: Fix session thrash scsi: qla2xxx: edif: Fix no logout on delete for N2N iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset lib/test_hmm: avoid accessing uninitialized pages memremap: remove support for external pgmap refcounts mm/memremap: fix memunmap_pages() race with get_dev_pagemap() KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel scsi: iscsi: Add helper to remove a session from the kernel scsi: iscsi: Fix session removal on shutdown dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics mtd: dataflash: Add SPI ID table clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock usb: host: xhci: use snprintf() in xhci_decode_trb() RDMA/rxe: Fix deadlock in rxe_do_local_ops() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain clk: qcom: camcc-sm8250: Fix topology around titan_top power domain clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled. clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register mm/mempolicy: fix get_nodes out of bound access PCI: dwc: Stop link on host_init errors and de-initialization PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Disable outbound windows only for controllers using iATU PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support soundwire: revisit driver bind/unbind and callbacks KVM: arm64: Don't return from void function dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function scsi: qla2xxx: Check correct variable in qla24xx_async_gffid() intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers binder: fix redefinition of seq_file attributes staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch mmc: mxcmmc: Silence a clang warning mmc: renesas_sdhi: Get the reset handle early in the probe memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() phy: stm32: fix error return in stm32_usbphyc_phy_init interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/irdma: Fix a window for use-after-free RDMA/irdma: Fix VLAN connection with wildcard address RDMA/irdma: Fix setting of QP context err_rq_idx_valid field RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/rtrs: Fix warning when use poll mode on client side. RDMA/rtrs: Replace duplicate check with is_pollqueue helper RDMA/rtrs: Introduce destroy_cq helper RDMA/rtrs: Do not allow sessname to contain special symbols / and . RDMA/rtrs: Rename rtrs_sess to rtrs_path RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event iio: cros: Register FIFO callback after sensor is registered clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() HID: amd_sfh: Add NULL check for hid device dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) scripts/gdb: lx-dmesg: read records individually scripts/gdb: fix 'lx-dmesg' on 32 bits arch RDMA/rxe: Fix mw bind to allow any consumer key portion mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support RDMA/rxe: For invalidate compare according to set keys in mr PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence HID: amd_sfh: Handle condition of "no sensors" USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free android: binder: stop saving a pointer to the VMA mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall of/fdt: declared return type does not match actual return type RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Add memory barriers to kernel queues RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq RDMA/rxe: Fix error unwind in rxe_create_qp() block/rnbd-srv: Set keep_id to true after mutex_trylock null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() nvme: define compat_ioctl again to unbreak 32-bit userspace. nvme: disable namespace access for unsupported metadata nvme: don't return an error from nvme_configure_metadata nvme: catch -ENODEV from nvme_revalidate_zones again block/bio: remove duplicate append pages code block: ensure iov_iter advances for added pages jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: imx-audmux: Silence a clang warning ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250: dma: Allow driver operations before starting DMA transfers serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: char: Add mutex protection for rpmsg_eptdev_open() rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix tty registration before control channel open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix missing timer to handle stalled links tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() tty: n_gsm: fix resource allocation order in gsm_activate_mux() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() ASoC: imx-card: Fix DSD/PDM mclk frequency remoteproc: qcom: wcnss: Fix handling of IRQs vfio/ccw: Do not change FSM state in subchannel event serial: 8250_fsl: Don't report FE, PE and OE twice tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() MIPS: vdso: Utilize __pa() for gic_pfn swiotlb: fail map correctly with failed io_tlb_default_mem ASoC: mt6359: Fix refcount leak bug serial: 8250_bcm7271: Save/restore RTS in suspend/resume iommu/exynos: Handle failed IOMMU device registration properly 9p: fix a bunch of checkpatch warnings 9p: Drop kref usage 9p: Add client parameter to p9_req_put() net: 9p: fix refcount leak in p9_read_work() error handling MIPS: Fixed __debug_virt_addr_valid() rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call proc: fix a dentry lock race between release_task and lookup remoteproc: qcom: pas: Check if coredump is enabled remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/maccess: fix semantics of memcpy_real() and its callers s390/crash: fix incorrect number of bytes to copy to user space s390/zcore: fix race when reading from hardware system area ASoC: fsl_asrc: force cast the asrc_format type ASoC: fsl-asoc-card: force cast the asrc_format type ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: imx-card: use snd_pcm_format_t type for asrc_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping. powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias tty: serial: fsl_lpuart: correct the count of break characters s390/dump: fix os_info virtual vs physical address confusion s390/smp: cleanup target CPU callback starting s390/smp: cleanup control register update routines s390/maccess: rework absolute lowcore accessors s390/smp: enforce lowcore protection on CPU restart f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle sched/core: Do not requeue task on CPU excluded from cpus_mask x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y f2fs: allow compression for mmap files in compress_mode=user f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix imbalance vha->vref_count scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts scsi: qla2xxx: Fix excessive I/O error messages by default scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Wind down adapter after PCIe error scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing target when it reappears during delete scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/kprobes: Update kcb status flag after singlestepping x86/olpc: fix 'logical not is only applied to the left hand side' SMB3: fix lease break timeout when multiple deferred close handles for the same file. posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer crypto: blake2s - remove shash module drm/dp/mst: Read the extended DPCD capabilities during system resume drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling usbnet: smsc95xx: Fix deadlock on runtime resume firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails scsi: lpfc: Fix EEH support for NVMe I/O scsi: lpfc: SLI path split: Refactor lpfc_iocbq scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4 scsi: lpfc: SLI path split: Refactor SCSI paths scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Iterate over error counters instead of error strings PCI: qcom: Power on PHY before IPQ8074 DBI register accesses serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_*() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code serial: 8250: Add proper clock handling for OxSemi PCIe devices tty: 8250: Add support for Brainboxes PX cards. dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback net/9p: Initialize the iounit field during fid creation ARM: remove some dead code timekeeping: contribute wall clock to rng on time change locking/csd_lock: Change csdlock_debug from early_param to __setup block: remove the struct blk_queue_ctx forward declaration block: don't allow the same type rq_qos add more than once btrfs: ensure pages are unlocked on cow_file_range() failure btrfs: reset block group chunk force if we have to wait btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA ACPI: CPPC: Do not prevent CPPC from working in the future powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists dm raid: fix address sanitizer warning in raid_status dm raid: fix address sanitizer warning in raid_resume tracing: Add '__rel_loc' using trace event macros tracing: Avoid -Warray-bounds warning for __rel_loc macro ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix use-after-free in ext4_xattr_set_entry ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: check if directory block is within i_size ext4: make sure ext4_append() always allocates new block ext4: remove EA inode entry from mbcache on inode eviction ext4: use kmemdup() to replace kmalloc + memcpy ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect powerpc: Fix eh field when calling lwarx on PPC32 tracing: Use a struct alignof to determine trace event field alignment net_sched: cls_route: remove from list when handle is 0 mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() crypto: lib/blake2s - reduce stack frame usage in self test Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" Revert "s390/smp: enforce lowcore protection on CPU restart" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode drm/vc4: change vc4_dma_range_matches from a global to static tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro drm/msm: Fix dirtyfb refcounting drm/meson: Fix refcount leak in meson_encoder_hdmi_init io_uring: mem-account pbuf buckets Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup() scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4() scsi: lpfc: Resolve some cleanup issues following SLI path refactoring Linux 5.15.61 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0849e49fb265651bf6277e4ead9c440d50ed7536	2022-08-22 14:29:30 +02:00
Niels Dossche	7ca91b2d87	media: hdpvr: fix error value returns in hdpvr_read ... [ Upstream commit 359c27c6ddbde404f44a9c0d3ec88ccd1e2042f2 ] Error return values are supposed to be negative in hdpvr_read. Most error returns are currently handled via an unsigned integer "ret". When setting a negative error value to "ret", the value actually becomes a large positive value, because "ret" is unsigned. Later on, the "ret" value is returned. But as ssize_t is a 64-bit signed number, the error return value stays a large positive integer instead of a negative integer. This can cause an error value to be interpreted as the read size, which can cause a buffer overread for applications relying on the returned size. Fixes: 9aba42efe8 ("V4L/DVB (11096): V4L2 Driver for the Hauppauge HD PVR usb capture device") Signed-off-by: Niels Dossche <dossche.niels@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-17 14:23:23 +02:00
Greg Kroah-Hartman	a9422ed2f1	Merge 5.15.46 into android13-5.15-lts ... Changes in 5.15.46 binfmt_flat: do not stop relocating GOT entries prematurely on riscv parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY riscv: Initialize thread pointer before calling C functions riscv: Fix irq_work when SMP is disabled riscv: Wire up memfd_secret in UAPI header riscv: Move alternative length validation into subsection ALSA: hda/realtek - Add new type for ALC245 ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS ALSA: usb-audio: Cancel pending work at closing a MIDI substream USB: serial: pl2303: fix type detection for odd device USB: serial: option: add Quectel BG95 modem USB: new quirk for Dell Gen 2 devices usb: isp1760: Fix out-of-bounds array access usb: dwc3: gadget: Move null pinter check to proper place usb: core: hcd: Add support for deferring roothub registration fs/ntfs3: Update valid size if -EIOCBQUEUED fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space) fs/ntfs3: Keep preallocated only if option prealloc enabled fs/ntfs3: Check new size for limits fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if called from function ntfs_init_acl fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' fs/ntfs3: Update i_ctime when xattr is added fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions cifs: fix potential double free during failed mount cifs: when extending a file with falloc we should make files not-sparse xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI platform/x86: intel-hid: fix _DSM function index handling x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails perf/x86/intel: Fix event constraints for ICL x86/kexec: fix memory leak of elf header buffer x86/sgx: Set active memcg prior to shmem allocation ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL btrfs: add "0x" prefix for unsupported optional features btrfs: return correct error number for __extent_writepage_io() btrfs: repair super block num_devices automatically btrfs: fix the error handling for submit_extent_page() for btrfs_do_readpage() iommu/vt-d: Add RPLS to quirk list to skip TE disabling drm/vmwgfx: validate the screen formats drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes selftests/bpf: Fix vfs_link kprobe definition selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() ipv6: fix locking issues with loops over idev->addr_list fbcon: Consistently protect deferred_takeover with console_lock() x86/platform/uv: Update TSC sync state for UV5 ACPICA: Avoid cache flush inside virtual machines mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output) drm/komeda: return early if drm_universal_plane_init() fails. drm/amd/display: Disabling Z10 on DCN31 rcu-tasks: Fix race in schedule and flush work rcu: Make TASKS_RUDE_RCU select IRQ_WORK sfc: ef10: Fix assigning negative value to unsigned variable ALSA: jack: Access input_dev under mutex rtw88: 8821c: fix debugfs rssi value spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction tools/power turbostat: fix ICX DRAM power numbers scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock scsi: lpfc: Fix call trace observed during I/O with CMF enabled cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode drm/amd/pm: fix double free in si_parse_power_table() ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() ASoC: rsnd: care return value from rsnd_node_fixed_index() ath9k: fix QCA9561 PA bias level media: venus: hfi: avoid null dereference in deinit media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module md/bitmap: don't set sb values if can't pass sanity check mmc: jz4740: Apply DMA engine limits to maximum segment size drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit scsi: megaraid: Fix error check return value of register_chrdev() drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the doorbells scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() ath11k: disable spectral scan during spectral deinit ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 drm/plane: Move range check for format_count earlier drm/amd/pm: fix the compile warning ath10k: skip ath10k_halt during suspend for driver state RESTARTING arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall drm: msm: fix error check return value of irq_of_parse_and_map() scsi: target: tcmu: Fix possible data corruption ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL net/mlx5: fs, delete the FTE when there are no rules attached to it ASoC: dapm: Don't fold register value changes into notifications mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo regulator: mt6315: Enforce regulator-compatible, not name HID: bigben: fix slab-out-of-bounds Write in bigben_probe of: Support more than one crash kernel regions for kexec -s ASoC: tscs454: Add endianness flag in snd_soc_component_driver scsi: lpfc: Alter FPIN stat accounting logic net: remove two BUG() from skb_checksum_help() s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES perf/amd/ibs: Cascade pmu init functions' return value sched/core: Avoid obvious double update_rq_clock warning spi: stm32-qspi: Fix wait_cmd timeout in APM mode dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues rtlwifi: Use pr_warn instead of WARN_ONCE mt76: mt7921: accept rx frames with non-standard VHT MCS10-11 mt76: fix encap offload ethernet type check media: rga: fix possible memory leak in rga_probe media: coda: limit frame interval enumeration to supported encoder frame sizes media: hantro: HEVC: unconditionnaly set pps_{cb/cr}_qp_offset values media: ccs-core.c: fix failure to call clk_disable_unprepare media: imon: reorganize serialization media: cec-adap.c: fix is_configuring state usbnet: Run unregister_netdev() before unbind() again openrisc: start CPU timer early in boot nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags ASoC: rt5645: Fix errorenous cleanup order nbd: Fix hung on disconnect request if socket is closed before drm/amd/pm: update smartshift powerboost calc for smu12 drm/amd/pm: update smartshift powerboost calc for smu13 net: phy: micrel: Allow probing without .driver_data media: exynos4-is: Fix compile warning media: hantro: Stop using H.264 parameter pic_num ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB ACPI: CPPC: Assume no transition latency if no PCCT nvme: set non-mdts limits in nvme_scan_work can: mcp251xfd: silence clang's -Wunaligned-access warning x86/microcode: Add explicit CPU vendor dependency net: ipa: ignore endianness if there is no header m68k: atari: Make Atari ROM port I/O write macros return void rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes afs: Adjust ACK interpretation to try and cope with NAT eth: tg3: silence the GCC 12 array-bounds warning char: tpm: cr50_i2c: Suppress duplicated error message in .remove() selftests/bpf: fix btf_dump/btf_dump due to recent clang change gfs2: use i_lock spin_lock for inode qadata scsi: target: tcmu: Avoid holding XArray lock when calling lock_page IB/rdmavt: add missing locks in rvt_ruc_loopback ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: socfpga: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema arm64: dts: qcom: msm8994: Fix the cont_splash_mem address arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count PM / devfreq: rk3399_dmc: Disable edev on remove() crypto: ccree - use fine grained DMA mapping dir soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc fs: jfs: fix possible NULL pointer dereference in dbFree() arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's vddio-supply property ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c ARM: OMAP1: clock: Fix UART rate reporting algorithm powerpc/fadump: Fix fadump to work with a different endian capture kernel fat: add ratelimit to fat*_ent_bread() pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() ARM: versatile: Add missing of_node_put in dcscb_init ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM ARM: hisi: Add missing of_node_put after of_find_compatible_node cpufreq: Avoid unnecessary frequency updates due to mismatch powerpc/rtas: Keep MSR[RI] set when calling RTAS PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting alpha: fix alloc_zeroed_user_highpage_movable() tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled powerpc/iommu: Add missing of_node_put in iommu_init_early_dart smb3: check for null tcon RDMA/hfi1: Prevent panic when SDMA is disabled Input: gpio-keys - cancel delayed work only in case of GPIO drm: fix EDID struct for old ARM OABI format drm/bridge_connector: enable HPD by default if supported dt-bindings: display: sitronix, st7735r: Fix backlight in example drm/vmwgfx: Fix an invalid read ath11k: acquire ab->base_lock in unassign when finding the peer by addr drm: bridge: it66121: Fix the register page length ath9k: fix ar9003_get_eepmisc drm/edid: fix invalid EDID extension block filtering drm/bridge: adv7511: clean up CEC adapter when probe fails drm: bridge: icn6211: Fix register layout drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG spi: qcom-qspi: Add minItems to interconnect-names ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe x86/delay: Fix the wrong asm constraint in delay_loop() drm/vc4: hvs: Fix frame count register readout drm/mediatek: Fix mtk_cec_mask() drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled libbpf: Don't error out on CO-RE relos for overriden weak subprogs x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation mptcp: reset the packet scheduler on PRIO change nl80211: show SSID for P2P_GO interfaces drm/komeda: Fix an undefined behavior bug in komeda_plane_add() drm: mali-dp: potential dereference of null pointer spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout scftorture: Fix distribution of short handler delays net: dsa: mt7530: 1G can also support 1000BASE-X link mode ixp4xx_eth: fix error check return value of platform_get_irq() NFC: NULL out the dev->rfkill to prevent UAF efi: Add missing prototype for efi_capsule_setup_info device property: Check fwnode->secondary when finding properties device property: Allow error pointer to be passed to fwnode APIs target: remove an incorrect unmap zeroes data deduction drbd: fix duplicate array initializer EDAC/dmc520: Don't print an error for each unconfigured interrupt line mtd: rawnand: denali: Use managed device resources HID: hid-led: fix maximum brightness for Dream Cheeky HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe regulator: da9121: Fix uninit-value in da9121_assign_chip_model() drm/mediatek: dpi: Use mt8183 output formats for mt8192 signal: Deliver SIGTRAP on perf event asynchronously if blocked sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq sched/psi: report zeroes for CPU full at the system level spi: img-spfi: Fix pm_runtime_get_sync() error checking cpufreq: Fix possible race in cpufreq online error path printk: use atomic updates for klogd work printk: add missing memory barrier to wake_up_klogd() printk: wake waiters for safe and NMI contexts ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix media: i2c: max9286: Use dev_err_probe() helper media: i2c: max9286: Use "maxim,gpio-poc" property media: i2c: max9286: fix kernel oops when removing module media: hantro: Empty encoder capture buffers by default drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it mtdblock: warn if opened on NAND inotify: show inotify mask flags in proc fdinfo fsnotify: fix wrong lockdep annotations spi: rockchip: Stop spi slave dma receiver when cs inactive spi: rockchip: Preset cs-high and clk polarity in setup progress spi: rockchip: fix missing error on unsupported SPI_CS_HIGH of: overlay: do not break notify on NOTIFY_{OK|STOP} selftests/damon: add damon to selftests root Makefile drm/msm/dp: Modify prototype of encoder based API drm/msm/hdmi: switch to drm_bridge_connector drm/msm/dpu: adjust display_v_end for eDP and DP scsi: iscsi: Fix harmless double shift bug scsi: ufs: qcom: Fix ufs_qcom_resume() scsi: ufs: core: Exclude UECxx from SFR dump list drm/v3d: Fix null pointer dereference of pointer perfmon selftests/resctrl: Fix null pointer dereference on open failed libbpf: Fix logic for finding matching program for CO-RE relocation mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() x86/pm: Fix false positive kmemleak report in msr_build_context() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe() x86/speculation: Add missing prototype for unpriv_ebpf_notify() ASoC: rk3328: fix disabling mclk on pclk probe failure perf tools: Add missing headers needed by util/data.h drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/dp: reset DP controller before transmit phy test pattern drm/msm/dp: do not stop transmitting phy test pattern during DP phy compliance test drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() drm/msm: add missing include to msm_drv.c drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H kunit: fix debugfs code to use enum kunit_status, not bool drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA perf tools: Use Python devtools for version autodetection rather than runtime virtio_blk: fix the discard_granularity and discard_alignment queue limits nl80211: don't hold RTNL in color change request x86: Fix return value of __setup handlers irqchip/exiu: Fix acknowledgment of edge triggered interrupts irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value x86/mm: Cleanup the control_va_addr_alignment() __setup handler arm64: fix types in copy_highpage() regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET drm/msm/dsi: fix address for second DSI PHY on SDM660 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected drm/msm: return an error pointer in msm_gem_prime_get_sg_table() media: uvcvideo: Fix missing check to determine if element is found in list arm64: stackleak: fix current_top_of_stack() iomap: iomap_write_failed fix spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() Revert "cpufreq: Fix possible race in cpufreq online error path" regulator: qcom_smd: Fix up PM8950 regulator configuration samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is provided perf/amd/ibs: Use interrupt regs ip for stack unwinding ath11k: Don't check arvif->is_started before sending management frames wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice() HID: amd_sfh: Modify the bus name HID: amd_sfh: Modify the hid name ASoC: fsl: Use dev_err_probe() helper ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages ASoC: samsung: Use dev_err_probe() helper ASoC: samsung: Fix refcount leak in aries_audio_probe block: Fix the bio.bi_opf comment kselftest/cgroup: fix test_stress.sh to use OUTPUT dir scripts/faddr2line: Fix overlapping text section failures media: aspeed: Fix an error handling path in aspeed_video_probe() media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe mt76: mt7921: Fix the error handling path of mt7921_pci_probe() mt76: do not attempt to reorder received 802.3 packets without agg session media: st-delta: Fix PM disable depth imbalance in delta_probe media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe media: i2c: rdacm2x: properly set subdev entity function media: exynos4-is: Change clk_disable to clk_disable_unprepare media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init media: vsp1: Fix offset calculation for plane cropping media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check media: hantro: HEVC: Fix tile info buffer value computation Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring Bluetooth: use hdev lock for accept_list and reject_list in conn req nvme: set dma alignment to dword m68k: math-emu: Fix dependencies of math emulation support sctp: read sk->sk_bound_dev_if once in sctp_rcv() net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* kselftest/arm64: bti: force static linking media: ov7670: remove ov7670_power_off from ov7670_remove media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR() media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() media: rkvdec: h264: Fix dpb_valid implementation media: rkvdec: h264: Fix bit depth wrap in pps packet regulator: scmi: Fix refcount leak in scmi_regulator_probe ext4: reject the 'commit' option on ext2 filesystems drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() x86/sev: Annotate stack change in the #VC handler drm/msm: don't free the IRQ if it was not requested selftests/bpf: Add missed ima_setup.sh in Makefile drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path drm/i915: Fix CFI violation with show_dynamic_id() thermal/drivers/bcm2711: Don't clamp temperature at zero thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe thermal/core: Fix memory leak in __thermal_cooling_device_register() thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe bfq: Relax waker detection for shared queues bfq: Allow current waker to defend against a tentative one ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() PM: domains: Fix initialization of genpd's next_wakeup net: macb: Fix PTP one step sync support NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() net: stmmac: selftests: Use kcalloc() instead of kzalloc() net: stmmac: fix out-of-bounds access in a selftest hv_netvsc: Fix potential dereference of NULL pointer hwmon: (pmbus) Check PEC support before reading other registers rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() hinic: Avoid some over memory allocation net: dsa: restrict SMSC_LAN9303_I2C kconfig net/smc: postpone sk_refcnt increment in connect() dma-direct: factor out dma_set_{de,en}crypted helpers dma-direct: don't call dma_set_decrypted for remapped allocations dma-direct: always leak memory that can't be re-encrypted dma-direct: don't over-decrypt memory arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 arm64: dts: mt8192: Fix nor_flash status disable typo PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 memory: samsung: exynos5422-dmc: Avoid some over memory allocation ARM: dts: BCM5301X: update CRU block description ARM: dts: BCM5301X: Update pin controller node name ARM: dts: suniv: F1C100: fix watchdog compatible soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() PCI: dwc: Fix setting error return on MSI DMA mapping failure ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks soc: qcom: llcc: Add MODULE_DEVICE_TABLE() KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault crypto: qat - set CIPHER capability for QAT GEN2 crypto: qat - set COMPRESSION capability for QAT GEN2 crypto: qat - set CIPHER capability for DH895XCC crypto: qat - set COMPRESSION capability for DH895XCC platform/chrome: cros_ec: fix error handling in cros_ec_register() ARM: dts: imx6dl-colibri: Fix I2C pinmuxing platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls can: xilinx_can: mark bit timing constants as const ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED ARM: dts: bcm2835-rpi-b: Fix GPIO line names misc: ocxl: fix possible double free in ocxl_file_register_afu crypto: marvell/cesa - ECB does not IV gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges arm: mediatek: select arch timer for mt7629 pinctrl/rockchip: support deferring other gpio params pinctrl: mediatek: mt8195: enable driver on mtk platforms arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero powerpc/fadump: fix PT_LOAD segment for boot memory area mfd: ipaq-micro: Fix error check return value of platform_get_irq() scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() soc: bcm: Check for NULL return of devm_kzalloc() arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get() ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname() ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path firmware: arm_scmi: Fix list protocols enumeration in the base protocol nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms pinctrl: mvebu: Fix irq_of_parse_and_map() return value drivers/base/node.c: fix compaction sysfs file leak dax: fix cache flush on PMD-mapped pages drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe firmware: arm_ffa: Remove incorrect assignment of driver_data list: introduce list_is_head() helper and re-use it in list.h list: fix a data-race around ep->rdllist drm/msm/dpu: fix error check return value of irq_of_parse_and_map() powerpc/8xx: export 'cpm_setbrg' for modules pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler RDMA/hns: Add the detection for CMDQ status in the device initialization process arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config arm64: dts: marvell: espressobin-ultra: enable front USB3 port ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component proc: fix dentry/inode overinstantiating under /proc/${pid}/net ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() PCI: imx6: Fix PERST# start-up sequence tty: fix deadlock caused by calling printk() under tty_port->lock crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg crypto: cryptd - Protect per-CPU resource by disabling BH. ARM: dts: at91: sama7g5: remove interrupt-parent from gic node hugetlbfs: fix hugetlbfs_statfs() locking Input: sparcspkr - fix refcount leak in bbc_beep_probe PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits PCI: microchip: Fix potential race in interrupt handling hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() powerpc/64: Only WARN if __pa()/__va() called with bad addresses powerpc/perf: Fix the threshold compare group constraint for power10 powerpc/perf: Fix the threshold compare group constraint for power9 macintosh: via-pmu and via-cuda need RTC_LIB powerpc/xive: Add some error handling code to 'xive_spapr_init()' powerpc/xive: Fix refcount leak in xive_spapr_init powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() nfsd: destroy percpu stats counters after reply cache shutdown mailbox: forward the hrtimer if not queued and under a lock RDMA/hfi1: Prevent use of lock before it is initialized KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer Input: stmfts - do not leave device disabled in stmfts_input_open OPP: call of_node_put() on error path in _bandwidth_supported() f2fs: support fault injection for dquot_initialize() f2fs: fix to do sanity check on inline_dots inode f2fs: fix dereference of stale list iterator after loop body iommu/amd: Enable swiotlb in all cases iommu/mediatek: Fix 2 HW sharing pgtable issue iommu/mediatek: Add list_del in mtk_iommu_remove iommu/mediatek: Remove clk_disable in mtk_iommu_remove iommu/mediatek: Add mutex for m4u_group and m4u_dom in data i2c: at91: use dma safe buffers cpufreq: mediatek: Use module_init and add module_exit cpufreq: mediatek: Unregister platform device on exit iommu/arm-smmu-v3-sva: Fix mm use-after-free MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon iommu/mediatek: Fix NULL pointer dereference when printing dev_name i2c: at91: Initialize dma_buf in at91_twi_xfer() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Don't report ENOSPC write errors twice NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout NFS: Further fixes to the writeback error handling video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() iommu/amd: Increase timeout waiting for GA log enablement i2c: npcm: Fix timeout calculation i2c: npcm: Correct register access width i2c: npcm: Handle spurious interrupts i2c: rcar: fix PM ref counts in probe error paths perf build: Fix btf__load_from_kernel_by_id() feature check perf c2c: Use stdio interface if slang is not supported perf jevents: Fix event syntax error caused by ExtSel video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup NFS: Always initialise fattr->label in nfs_fattr_alloc() NFS: Create a new nfs_alloc_fattr_with_label() function NFS: Convert GFP_NOFS to GFP_KERNEL NFSv4.1 mark qualified async operations as MOVEABLE tasks f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: don't need inode lock for system hidden quota f2fs: fix to do sanity check on total_data_blocks f2fs: don't use casefolded comparison for "." and ".." f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode objtool: Fix objtool regression on x32 systems objtool: Fix symbol creation wifi: mac80211: fix use-after-free in chanctx code iwlwifi: mvm: fix assert 1F04 upon reconfig fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages efi: Do not import certificates from UEFI Secure Boot for T2 Macs bfq: Avoid false marking of bic as stably merged bfq: Avoid merging queues with different parents bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls bfq: Track whether bfq_group is still online bfq: Get rid of __bio_blkcg() usage bfq: Make sure bfqg for which we are queueing requests is online ext4: mark group as trimmed only if it was fully scanned ext4: fix use-after-free in ext4_rename_dir_prepare ext4: fix race condition between ext4_write and ext4_convert_inline_data ext4: fix warning in ext4_handle_inode_extension ext4: fix bug_on in ext4_writepages ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state ext4: fix bug_on in __es_tree_search ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree ACPI: property: Release subnode properties with data nodes tty: goldfish: Introduce gf_ioread32()/gf_iowrite32() tracing: Fix potential double free in create_var_ref() tracing: Initialize integer variable to prevent garbage return value drm/amdgpu: add beige goby PCI ID PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() mm, compaction: fast_find_migrateblock() should return pfn in the target zone s390/perf: obtain sie_block from the right address s390/stp: clock_delta should be signed dlm: fix plock invalid read dlm: uninitialized variable on error in dlm_listen_for_all() dlm: fix missing lkb refcount handling ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock scsi: dc395x: Fix a missing check on list iterator scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled landlock: Add clang-format exceptions landlock: Format with clang-format selftests/landlock: Add clang-format exceptions selftests/landlock: Normalize array assignment selftests/landlock: Format with clang-format samples/landlock: Add clang-format exceptions samples/landlock: Format with clang-format landlock: Fix landlock_add_rule(2) documentation selftests/landlock: Make tests build with old libc selftests/landlock: Extend tests for minimal valid attribute size selftests/landlock: Add tests for unknown access rights selftests/landlock: Extend access right tests to directories selftests/landlock: Fully test file rename with "remove" access selftests/landlock: Add tests for O_PATH landlock: Change landlock_add_rule(2) argument check ordering landlock: Change landlock_restrict_self(2) check ordering selftests/landlock: Test landlock_create_ruleset(2) argument check ordering landlock: Define access_mask_t to enforce a consistent access mask size landlock: Reduce the maximum number of layers to 16 landlock: Create find_rule() from unmask_layers() landlock: Fix same-layer rule unions drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/nouveau/subdev/bus: Ratelimit logging for fault errors drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX drm/i915/dsi: fix VBT send packet port selection for ICL+ md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 ima: remove the IMA_TEMPLATE Kconfig option Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug RDMA/hfi1: Fix potential integer multiplication overflow errors mmc: core: Allows to override the timeout value for ioctl() path csky: patch_text: Fixup last cpu should be master irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip: irq-xtensa-mx: fix initial IRQ affinity thermal: devfreq_cooling: use local ops instead of global ops cfg80211: declare MODULE_FIRMWARE for regulatory.db mac80211: upgrade passive scan to active scan on DFS channels after beacon rx um: Use asm-generic/dma-mapping.h um: chan_user: Fix winch_tramp() return value um: Fix out-of-bounds read in LDT setup kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] ftrace: Clean up hash direct_functions on register failures ksmbd: fix outstanding credits related bugs iommu/msm: Fix an incorrect NULL check on list iterator iommu/dma: Fix iova map result check bug Revert "mm/cma.c: remove redundant cma_mutex lock" mm/page_alloc: always attempt to allocate at least one page during bulk allocation nodemask.h: fix compilation error with GCC12 hugetlb: fix huge_pmd_unshare address update mm/memremap: fix missing call to untrack_pfn() in pagemap_range() xtensa/simdisk: fix proc_read_simdisk() rtl818x: Prevent using not initialized queues ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket serial: pch: don't overwrite xmit->buf[0] by x_char tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator arm64: dts: qcom: ipq8074: fix the sleep clock frequency arm64: tegra: Add missing DFLL reset on Tegra210 clk: tegra: Add missing reset deassertion phy: qcom-qmp: fix struct clk leak on probe errors ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries ARM: pxa: maybe fix gpio lookup tables SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 dt-bindings: gpio: altera: correct interrupt-cells vdpasim: allow to enable a vq repeatedly blk-iolatency: Fix inflight count imbalances and IO hangs on offline coresight: core: Fix coresight device probe failure issue phy: qcom-qmp: fix reset-controller leak on probe errors net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() kseltest/cgroup: Make test_stress.sh work if run interactively list: test: Add a test for list_is_head() Revert "random: use static branch for crng_ready()" staging: r8188eu: delete rtw_wx_read/write32() RDMA/hns: Remove the num_cqc_timer variable RDMA/rxe: Generate a completion for unsupported/invalid opcode MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override ext4: only allow test_dummy_encryption when supported interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate fs: add two trivial lookup helpers exportfs: support idmapped mounts fs/ntfs3: Fix invalid free in log_replay md: Don't set mddev private to NULL in raid0 pers->free md: fix double free of io_acct_set bioset md: bcache: check the return value of kzalloc() in detached_dev_do_request() pinctrl/rockchip: support setting input-enable param block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Linux 5.15.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Id50a95d816e662c0cba3d09dbfd561f386d7a52e	2022-08-04 14:37:04 +02:00
Pavel Skripkin	3309c2c574	media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init ... [ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ] Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com Fixes: d855497edb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:58 +02:00
Xiaomeng Tong	29d441903f	media: uvcvideo: Fix missing check to determine if element is found in list ... [ Upstream commit 261f33388c29f6f3c12a724e6d89172b7f6d5996 ] The list iterator will point to a bogus position containing HEAD if the list is empty or the element is not found in list. This case should be checked before any use of the iterator, otherwise it will lead to a invalid memory access. The missing check here is before "pin = iterm->id;", just add check here to fix the security bug. In addition, the list iterator value will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the element is not found in list, considering the (mis)use here: "if (iterm == NULL". Use a new value 'it' as the list iterator, while use the old value 'iterm' as a dedicated pointer to point to the found element, which 1. can fix this bug, due to 'iterm' is NULL only if it's not found. 2. do not need to change all the uses of 'iterm' after the loop. 3. can also limit the scope of the list iterator 'it' *only inside* the traversal loop by simply declaring 'it' inside the loop in the future, as usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Fixes: d5e90b7a6c ("[media] uvcvideo: Move to video_ioctl2") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:55 +02:00
James_Lin	03b512f716	UPSTREAM: media: uvcvideo: Add UVC_GUID_FORMAT_H265 ... This patch aims to add UVC_GUID_FORMAT_H265 High Efficiency Video Coding (HEVC), also known as H.265 and MPEG-H Part 2. They describe the same video encoding method. So for handling their behavior is the same. However, when external camera device describes this encoding method, some use hevc, some use h265. There is no uniform specification to describe this encoding method. So if an external camera device use h265 to describe this encoding method, driver will not recognize it. Therefore, this patch is to enable driver to read HEVC/H265 and convert it to V4L2_PIX_FMT_HEVC. Signed-off-by: James_Lin <Ping-lei.Lin@mediatek.com> Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Bug: 235045181 (cherry picked from commit be938c70e292731f81226917fc214683e66da577) Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com> Change-Id: Ib9a78c2aa900abdd37b08351d56a3815b55ec7f4	2022-06-06 10:15:13 +00:00
Dongliang Mu	f90db7cca4	media: hdpvr: initialize dev->worker at hdpvr_register_videodev ... [ Upstream commit 07922937e9a580825f9965c46fd15e23ba5754b6 ] hdpvr_register_videodev is responsible to initialize a worker in hdpvr_device. However, the worker is only initialized at hdpvr_start_streaming other than hdpvr_register_videodev. When hdpvr_probe does not initialize its worker, the hdpvr_disconnect will encounter one WARN in flush_work.The stack trace is as follows: hdpvr_disconnect+0xb8/0xf2 drivers/media/usb/hdpvr/hdpvr-core.c:425 usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1206 [inline] device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1237 bus_remove_device+0x108/0x160 drivers/base/bus.c:529 device_del+0x1fe/0x510 drivers/base/core.c:3592 usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419 usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2228 Fix this by moving the initialization of dev->worker to the starting of hdpvr_register_videodev Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:24:02 +02:00
Pavel Skripkin	deb1f04531	media: Revert "media: em28xx: add missing em28xx_close_extension" ... [ Upstream commit fde18c3bac3f964d8333ae53b304d8fee430502b ] This reverts commit 2c98b8a3458df03abdc6945bbef67ef91d181938. Reverted patch causes problems with Hauppauge WinTV dualHD as Maximilian reported [1]. Since quick solution didn't come up let's just revert it to make this device work with upstream kernels. Link: https://lore.kernel.org/all/6a72a37b-e972-187d-0322-16336e12bdc5@elbmurf.de/ [1] Reported-by: Maximilian Böhm <maximilian.boehm@elbmurf.de> Tested-by: Maximilian Böhm <maximilian.boehm@elbmurf.de> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:24:02 +02:00
Dafna Hirschfeld	a09e988280	media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED ... [ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- Fixes: 8ac456495a ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:20 +02:00
Dan Carpenter	895364fa97	media: usb: go7007: s2250-board: fix leak in probe() ... [ Upstream commit 67e4550ecd6164bfbdff54c169e5bbf9ccfaf14d ] Call i2c_unregister_device(audio) on this error path. Fixes: d3b2ccd9e3 ("[media] s2250: convert to the control framework") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:17 +02:00
Dongliang Mu	332d45fe51	media: em28xx: initialize refcount before kref_get ... [ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ] The commit 47677e51e2a4("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") adds kref_get to many init functions (e.g., em28xx_audio_init). However, kref_init is called too late in em28xx_usb_probe, since em28xx_init_dev before will invoke those init functions and call kref_get function. Then refcount bug occurs in my local syzkaller instance. Fix it by moving kref_init before em28xx_init_dev. This issue occurs not only in dev but also dev->dev_next. Fixes: 47677e51e2 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:17 +02:00
Mauro Carvalho Chehab	0c044e39d5	media: m920x: don't use stack on USB reads ... [ Upstream commit a2ab06d7c4d6bfd0b545a768247a70463e977e27 ] Using stack-allocated pointers for USB message data don't work. This driver is almost OK with that, except for the I2C read logic. Fix it by using a temporary read buffer, just like on all other calls to m920x_read(). Link: https://lore.kernel.org/all/ccc99e48-de4f-045e-0fe4-61e3118e3f74@mida.se/ Reported-by: rkardell@mida.se Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 11:04:36 +01:00
James Hilliard	1c9bbda87c	media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. ... [ Upstream commit c8ed7d2f614cd8b315981d116c7a2fb01829500d ] Some uvc devices appear to require the maximum allowed USB timeout for GET_CUR/SET_CUR requests. So lets just bump the UVC control timeout to 5 seconds which is the same as the usb ctrl get/set defaults: USB_CTRL_GET_TIMEOUT 5000 USB_CTRL_SET_TIMEOUT 5000 It fixes the following runtime warnings: Failed to query (GET_CUR) UVC control 11 on unit 2: -110 (exp. 1). Failed to query (SET_CUR) UVC control 3 on unit 2: -110 (exp. 2). Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 11:04:35 +01:00
Anton Vasilyev	4822591943	media: dw2102: Fix use after free ... [ Upstream commit 589a9f0eb799f77de2c09583bf5bad221fa5d685 ] dvb_usb_device_init stores parts of properties at d->props and d->desc and uses it on dvb_usb_device_exit. Free of properties on module probe leads to use after free. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204597 The patch makes properties static instead of allocated on heap to prevent memleak and use after free. Also fixes s421_properties.devices initialization to have 2 element instead of 6 copied from p7500_properties. [mchehab: fix function call alignments] Link: https://lore.kernel.org/linux-media/20190822104147.4420-1-vasilyev@ispras.ru Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> Fixes: 299c7007e9 ("media: dw2102: Fix memleak on sequence of probes") Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 11:03:36 +01:00
Dongliang Mu	85d5345bd8	media: em28xx: fix memory leak in em28xx_init_dev ... [ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ] In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails to deallocate the media_dev allocated in the em28xx_media_device_init. Fix this by adding em28xx_unregister_media_device to free media_dev. BTW, this patch is tested in my local syzkaller instance, and it can prevent the memory leak from occurring again. CC: Pavel Skripkin <paskripkin@gmail.com> Fixes: 37ecc7b127 ("[media] em28xx: add media controller support") Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 11:03:10 +01:00
Johan Hovold	1baebfdf19	media: stk1160: fix control-message timeouts ... commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 9cb2173e6e ("[media] media: Add stk1160 new driver (easycap replacement)") Cc: stable@vger.kernel.org # 3.7 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:56 +01:00
Johan Hovold	b208a38657	media: pvrusb2: fix control-message timeouts ... commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: d855497edb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org # 2.6.18 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:55 +01:00
Michael Kuron	821e5abd21	media: dib0700: fix undefined behavior in tuner shutdown ... commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream. This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16. Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner. The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist. Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers. Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5bdd8201.1632689033.git.mchehab+huawei@kernel.org Cc: stable@vger.kernel.org Fixes: 7757ddda6f ("[media] DiB0700: add function to change I2C-speed") Signed-off-by: Michael Kuron <michael.kuron@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:55 +01:00
Johan Hovold	4e56a23121	media: s2255: fix control-message timeouts ... commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Use the common control-message timeout define for the five-second timeouts. Fixes: 38f993ad8b ("V4L/DVB (8125): This driver adds support for the Sensoray 2255 devices.") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:55 +01:00
Johan Hovold	15955a24fa	media: cpia2: fix control-message timeouts ... commit 10729be03327f53258cb196362015ad5c6eabe02 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: ab33d5071d ("V4L/DVB (3376): Add cpia2 camera support") Cc: stable@vger.kernel.org # 2.6.17 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:55 +01:00
Johan Hovold	198e0c619f	media: em28xx: fix control-message timeouts ... commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: a6c2ba2835 ("[PATCH] v4l: 716: support for em28xx board family") Cc: stable@vger.kernel.org # 2.6.16 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:54 +01:00
Johan Hovold	a16e2eff80	media: flexcop-usb: fix control-message timeouts ... commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Note that the driver was multiplying some of the timeout values with HZ twice resulting in 3000-second timeouts with HZ=1000. Also note that two of the timeout defines are currently unused. Fixes: 2154be651b ("[media] redrat3: new rc-core IR transceiver device driver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 11:02:54 +01:00
Johan Hovold	c671cb0b00	media: uvcvideo: fix division by zero at stream start ... commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream. Add the missing bulk-endpoint max-packet sanity check to uvc_video_start_transfer() to avoid division by zero in uvc_alloc_urb_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4f ("USB: Fix: Don't skip endpoint descriptors with maxpacket=0")). Fixes: c0efd23292 ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org # 2.6.26 Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-20 09:13:15 +01:00
Ricardo Ribalda	46c7ff13df	media: Revert "media: uvcvideo: Set unique vdev name based in type" ... commit f66dcb32af19faf49cc4a9222c3152b10c6ec84a upstream. A lot of userspace depends on a descriptive name for vdev. Without this patch, users have a hard time figuring out which camera shall they use for their video conferencing. This reverts commit e3f60e7e1a2b451f538f9926763432249bcf39c4. Link: https://lore.kernel.org/linux-media/20211207003840.1212374-2-ribalda@chromium.org Cc: <stable@vger.kernel.org> Fixes: e3f60e7e1a2b ("media: uvcvideo: Set unique vdev name based in type") Reported-by: Nicolas Dufresne <nicolas@ndufresne.ca> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-16 09:12:45 +01:00
Pavel Skripkin	8c6fdf62bf	media: mxl111sf: change mutex_init() location ... commit 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f upstream. Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: dvb_usbv2_init() dvb_usbv2_adapter_init() dvb_usbv2_adapter_frontend_init() props->frontend_attach() props->init() Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* devices, which will simply initiaize mutex. Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com Fixes: 8572211842 ("[media] mxl111sf: convert to new DVB USB") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-22 09:32:50 +01:00
Colin Ian King	ff3487b089	media: em28xx: Don't use ops->suspend if it is NULL ... [ Upstream commit 51fa3b70d27342baf1ea8aaab3e96e5f4f26d5b2 ] The call to ops->suspend for the dev->dev_next case can currently trigger a call on a null function pointer if ops->suspend is null. Skip over the use of function ops->suspend if it is null. Addresses-Coverity: ("Dereference after null check") Fixes: be7fd3c3a8 ("media: em28xx: Hauppauge DualHD second tuner functionality") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:29 +01:00
Kees Cook	5a225627ba	media: tm6000: Avoid card name truncation ... [ Upstream commit 42bb98e420d454fef3614b70ea11cc59068395f6 ] The "card" string only holds 31 characters (and the terminating NUL). In order to avoid truncation, use a shorter card description instead of the current result, "Trident TVMaster TM5600/6000/60". Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: e28f49b0b2 ("V4L/DVB: tm6000: fix some info messages") Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:29 +01:00
Pavel Skripkin	d30d3397db	media: dvb-usb: fix ununit-value in az6027_rc_query ... [ Upstream commit afae4ef7d5ad913cab1316137854a36bea6268a5 ] Syzbot reported ununit-value bug in az6027_rc_query(). The problem was in missing state pointer initialization. Since this function does nothing we can simply initialize state to REMOTE_NO_KEY_PRESSED. Reported-and-tested-by: syzbot+2cd8c5db4a85f0a04142@syzkaller.appspotmail.com Fixes: 76f9a820c8 ("V4L/DVB: AZ6027: Initial import of the driver") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:28 +01:00
Evgeny Novikov	98cb3a055b	media: ttusb-dec: avoid release of non-acquired mutex ... [ Upstream commit 36b9d695aa6fb8e9a312db21af41f90824d16ab4 ] ttusb_dec_send_command() invokes mutex_lock_interruptible() that can fail but then it releases the non-acquired mutex. The patch fixes that. Found by Linux Driver Verification project (linuxtesting.org). Fixes: dba328bab4 ("media: ttusb-dec: cleanup an error handling logic") Signed-off-by: Evgeny Novikov <novikov@ispras.ru> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:27 +01:00
Pavel Skripkin	2899243f27	media: em28xx: add missing em28xx_close_extension ... [ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ] If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list node from em28xx_extension_devlist on disconnect to avoid UAF bugs and corrupted list bugs, since driver frees this pointer on disconnect. Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com Fixes: 1a23f81b7d ("V4L/DVB (9979): em28xx: move usb probe code to a proper place") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:27 +01:00
Anant Thazhemadam	74339549c8	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() ... [ Upstream commit 899a61a3305d49e8a712e9ab20d0db94bde5929f ] In dibusb_read_eeprom_byte(), if dibusb_i2c_msg() fails, val gets assigned an value that's not properly initialized. Using kzalloc() in place of kmalloc() for the buffer fixes this issue, as the val can now be set to 0 in the event dibusb_i2c_msg() fails. Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com Tested-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:14 +01:00
Ricardo Ribalda	18c4e5e59f	media: uvcvideo: Set unique vdev name based in type ... [ Upstream commit e3f60e7e1a2b451f538f9926763432249bcf39c4 ] All the entities must have a unique name. We can have a descriptive and unique name by appending the function and the entity->id. This is even resilent to multi chain devices. Fixes v4l2-compliance: Media Controller ioctls: fail: v4l2-test-media.cpp(205): v2_entity_names_set.find(key) != v2_entity_names_set.end() test MEDIA_IOC_G_TOPOLOGY: FAIL fail: v4l2-test-media.cpp(394): num_data_links != num_links test MEDIA_IOC_ENUM_ENTITIES/LINKS: FAIL Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:12 +01:00
Ricardo Ribalda	477f767b94	media: uvcvideo: Return -EIO for control errors ... [ Upstream commit ffccdde5f0e17d2f0d788a9d831a027187890eaa ] The device is doing something unexpected with the control. Either because the protocol is not properly implemented or there has been a HW error. Fixes v4l2-compliance: Control ioctls (Input 0): fail: v4l2-test-controls.cpp(448): s_ctrl returned an error (22) test VIDIOC_G/S_CTRL: FAIL fail: v4l2-test-controls.cpp(698): s_ext_ctrls returned an error (22) test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:12 +01:00
Ricardo Ribalda	7c26956139	media: uvcvideo: Set capability in s_param ... [ Upstream commit 97a2777a96070afb7da5d587834086c0b586c8cc ] Fixes v4l2-compliance: Format ioctls (Input 0): warn: v4l2-test-formats.cpp(1339): S_PARM is supported but doesn't report V4L2_CAP_TIMEPERFRAME fail: v4l2-test-formats.cpp(1241): node->has_frmintervals && !cap->capability Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:16:12 +01:00
Linus Torvalds	835d31d319	Merge tag 'media/v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media ... Pull media updates from Mauro Carvalho Chehab: - new sensor drivers: imx335, imx412, ov9282 - new IR transmitter driver: meson-ir-tx - handro driver gained support for H.264 for Rockchip VDPU2 - imx gained support for i.MX8MQ - ti-vpe has gained support for other SoC variants - lots of cleanups, fixes, board additions and doc improvements * tag 'media/v5.15-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (195 commits) media: venus: venc: add support for V4L2_CID_MPEG_VIDEO_H264_8X8_TRANSFORM control media: venus: venc: Add support for intra-refresh period media: v4l2-ctrls: Add intra-refresh period control media: docs: ext-ctrls-codec: Document cyclic intra-refresh zero control value media: venus: helper: do not set constrained parameters for UBWC media: venus: venc: Fix potential null pointer dereference on pointer fmt media: venus: hfi: fix return value check in sys_get_prop_image_version() media: tegra-cec: Handle errors of clk_prepare_enable() media: cec-pin: rename timer overrun variables media: TDA1997x: report -ENOLINK after disconnecting HDMI source media: TDA1997x: fix tda1997x_query_dv_timings() return value media: Fix cosmetic error in TDA1997x driver media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: imx: add a driver for i.MX8MQ mipi csi rx phy and controller media: dt-bindings: media: document the nxp,imx8mq-mipi-csi2 receiver phy and controller media: imx: imx7_mipi_csis: convert some switch cases to the default media: imx: imx7-media-csi: Fix buffer return upon stream start failure media: imx: imx7-media-csi: Don't set PIXEL_BIT in CSICR1 media: imx: imx7-media-csi: Set TWO_8BIT_SENSOR for >= 10-bit formats media: dt-bindings: media: nxp,imx7-csi: Add i.MX8MM support ...	2021-09-01 10:34:52 -07:00
Dongliang Mu	6fa54bc713	media: em28xx-input: fix refcount bug in em28xx_usb_disconnect ... If em28xx_ir_init fails, it would decrease the refcount of dev. However, in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease the refcount of dev. This will lead to a refcount bug. Fix this bug by removing the kref_put in the error handling code of em28xx_ir_init. refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 Modules linked in: CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3 Workqueue: usb_hub_wq hub_event RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 Call Trace: kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69 em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150 usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1201 [inline] device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232 bus_remove_device+0x108/0x160 drivers/base/bus.c:529 device_del+0x1fe/0x510 drivers/base/core.c:3540 usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419 usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221 hub_port_connect drivers/usb/core/hub.c:5151 [inline] hub_port_connect_change drivers/usb/core/hub.c:5440 [inline] port_event drivers/usb/core/hub.c:5586 [inline] hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668 process_one_work+0x2c9/0x610 kernel/workqueue.c:2276 process_scheduled_works kernel/workqueue.c:2338 [inline] worker_thread+0x333/0x5b0 kernel/workqueue.c:2424 kthread+0x188/0x1d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Reported-by: Dongliang Mu <mudongliangabcd@gmail.com> Fixes: ac56886371 ("media: em28xx: Fix possible memory leak of em28xx struct") Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>	2021-08-04 14:43:49 +02:00
Johan Hovold	76f22c93b2	media: rtl28xxu: fix zero-length control request ... The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation. Control transfers without a data stage are treated as OUT requests by the USB stack and should be using usb_sndctrlpipe(). Failing to do so will now trigger a warning. The driver uses a zero-length i2c-read request for type detection so update the control-request code to use usb_sndctrlpipe() in this case. Note that actually trying to read the i2c register in question does not work as the register might not exist (e.g. depending on the demodulator) as reported by Eero Lehtinen <debiangamer2@gmail.com>. Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com Reported-by: Eero Lehtinen <debiangamer2@gmail.com> Tested-by: Eero Lehtinen <debiangamer2@gmail.com> Fixes: d0f232e823 ("[media] rtl28xxu: add heuristic to detect chip type") Cc: stable@vger.kernel.org # 4.0 Cc: Antti Palosaari <crope@iki.fi> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>	2021-07-30 12:59:18 +02:00