msm-5.15

Author	SHA1	Message	Date
Greg Kroah-Hartman	787413edad	Merge 5.15.93 into android13-5.15-lts Changes in 5.15.93 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() ASoC: Intel: boards: fix spelling in comments ASoC: Intel: bytcht_es8316: move comment to the right place ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Support <8-byte scalar spill and refill bpf: Fix to preserve reg parent/live fields when copying range info bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX drm/vc4: hdmi: make CEC adapter name unique scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" vhost/net: Clear the pending messages when the backend is removed WRITE is "data source", not destination... READ is "data destination", not source... fix iov_iter_bvec() "direction" argument fix "direction" argument of iov_iter_kvec() ice: Prevent set_channel from changing queues while RDMA active qede: execute xdp_do_flush() before napi_complete_done() virtio-net: execute xdp_do_flush() before napi_complete_done() dpaa_eth: execute xdp_do_flush() before napi_complete_done() dpaa2-eth: execute xdp_do_flush() before napi_complete_done() sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" block, bfq: replace 0/1 with false/true in bic apis block, bfq: fix uaf for bfqq in bic_set_bfqq() netrom: Fix use-after-free caused by accept on already connected socket drm/i915/guc: Fix locking when searching for a hung request drm/i915/adlp: Fix typo for reference clock netfilter: br_netfilter: disable sabotage_in hook after first suppression squashfs: harden sanity check in squashfs_read_xattr_id_table net: phy: meson-gxl: Add generic dummy stubs for MMD register access ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address riscv: kprobe: Fixup kernel panic when probing an illegal position igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels perf/x86/intel: Add Emerald Rapids scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF net/x25: Fix to not accept on connected socket drm/amd/display: Fix timing not changning when freesync video is enabled iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Input: i8042 - add Clevo PCX0DX to i8042 quirk table fbcon: Check font dimension limits net: qrtr: free memory on error path in radix_tree_insert() watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 efi: Accept version 2 of memory attributes table iio: hid: fix the retval in accel_3d_capture_sample iio: hid: fix the retval in gyro_3d_capture_sample iio: adc: berlin2-adc: Add missing of_node_put() in error path iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/swapfile: add cond_resched() in get_swap_pages() highmem: round down the address passed to kunmap_flush_on_unmap() Squashfs: fix handling and sanity checking of xattr_ids count drm/i915: Fix potential bit_17 double-free nvmem: core: initialise nvmem->id early nvmem: core: remove nvmem_config wp_gpio nvmem: core: fix cell removal on error serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race phy: qcom-qmp-combo: disable runtime PM on unbind phy: qcom-qmp-combo: fix memleak on probe deferral phy: qcom-qmp-usb: fix memleak on probe deferral phy: qcom-qmp-combo: fix broken power on phy: qcom-qmp-combo: fix runtime suspend bpf: Fix incorrect state pruning for <8B spill/fill bpf: Do not reject when the stack read size is different from the tracked scalar size iio:adc:twl6030: Enable measurement of VAC powerpc/imc-pmu: Revert nest_init_lock to being a mutex fs/ntfs3: Validate attribute data and valid sizes ovl: Use "buf" flexible array for memcpy() destination fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads gfs2: Cosmetic gfs2_dinode_{in,out} cleanup gfs2: Always check inode size of inline inodes bpf: Skip invalid kfunc call in backtrack_insn Linux 5.15.93 Change-Id: I36ae60a781fc72667896bc649af5788cda1ef6c2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-15 15:05:04 +00:00
Samuel Thibault	dccbd062d7	fbcon: Check font dimension limits commit 2b09d5d364986f724f17001ccfe4126b9b43a0be upstream. blit_x and blit_y are u32, so fbcon currently cannot support fonts larger than 32x32. The 32x32 case also needs shifting an unsigned int, to properly set bit 31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font", as reported on: http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com Kernel Branch: 6.2.0-rc5-next-20230124 Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing Reported-by: Sanan Hasanov <sanan.hasanov@Knights.ucf.edu> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Fixes: `2d2699d984` ("fbcon: font setting should check limitation of driver") Cc: stable@vger.kernel.org Tested-by: Miko Larsson <mikoxyzzz@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-09 11:26:41 +01:00
Greg Kroah-Hartman	20ec745823	Merge 5.15.86 into android13-5.15-lts Changes in 5.15.86 drm/amd/display: Manually adjust strobe for DCN303 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down soc: qcom: llcc: make irq truly optional arm64: dts: qcom: Correct QMP PHY child node name arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8250: drop bogus DP PHY clock soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: Treat ESR_ELx as a 64-bit register arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: store lower path in ovl_inode ovl: use ovl_copy_{real,upper}attr() wrappers ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/fair: Removed useless update of p->recent_used_cpu sched/core: Introduce sched_asym_cpucap_active() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() SUNRPC: Return true/false (not 1/0) from bool functions NFSD: Finish converting the NFSv2 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: do not use kzalloc too early futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/chrome: cros_ec_typec: Cleanup switch handle return paths platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds\|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open platform/mellanox: mlxbf-pmc: Fix event typo wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros ata: add/use ata_taskfile::{error\|status} fields ata: libata: fix NCQ autosense logic ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu/powerplay/psm: Fix memory leak in power state init media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: adv748x: afe: Select input port when initializing AFE media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: make use of units.h in assignment of frequency can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: drop unused GPIO support drm/msm/hdmi: use devres helper for runtime PM management bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() libbpf: Fix uninitialized warning in btf_dump_dump_type_data nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes pinctrl: k210: call of_node_put() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails mt76: stop the radar detector after leaving dfs channel wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick: ms_block: Add error handling support for add_disk() memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: hisilicon/qm - fix missing destroy qp_idr crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix normal discard process f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_ PCI: mt7621: Add sentinel to quirks table orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path extcon: usbc-tusb320: Add support for mode setting and reset extcon: usbc-tusb320: Add support for TUSB320L usb: typec: Factor out non-PD fwnode properties extcon: usbc-tusb320: Factor out extcon into dedicated functions extcon: usbc-tusb320: Add USB TYPE-C support extcon: usbc-tusb320: Update state on probe even if no IRQ pending serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu\|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu\|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences gpiolib: make struct comments into real kernel docs gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info perf stat: Refactor __run_perf_stat() common code perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() overflow: Implement size_t saturating arithmetic helpers fs/ntfs3: Harden against integer overflows iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/rockchip: fix permission bits in page table entries v2 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Remove driver data structure pm8008_data mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Add test for unstable CT lookup API net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() HID: amd_sfh: Add missing check for dma_alloc_coherent rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed drm/amd/display: Use the largest vready_offset in pipe group libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() tools/include: Add _RET_IP_ and math definitions to kernel.h KVM: selftests: Fix build regression by using accessor function hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm8250: fix USB-DP PHY registers usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range scsi: qla2xxx: Fix crash when I/O abort times out net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 5.15.86 Change-Id: I4ec30b690e8dbd554044495e26360a86cc042069 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-30 14:44:15 +00:00
Greg Kroah-Hartman	bfbd2237c1	Merge 5.15.83 into android13-5.15-lts Changes in 5.15.83 clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks mmc: mtk-sd: Fix missing clk_disable_unprepare in msdc_of_clock_parse() arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series arm: dts: rockchip: fix node name for hym8563 rtc arm: dts: rockchip: remove clock-frequency from rtc ARM: dts: rockchip: fix ir-receiver node names arm64: dts: rockchip: fix ir-receiver node names ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name fs: use acquire ordering in __fget_light() ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register spi: mediatek: Fix DEVAPC Violation at KO Remove ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 ASoC: rt711-sdca: fix the latency time of clock stop prepare state machine transitions 9p/fd: Use P9_HDRSZ for header size regulator: slg51000: Wait after asserting CS pin ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event selftests/net: Find nettest in current directory btrfs: send: avoid unaligned encoded writes when attempting to clone range ASoC: soc-pcm: Add NULL check in BE reparenting regulator: twl6030: fix get status of twl6032 regulators fbcon: Use kzalloc() in fbcon_prepare_logo() usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer 9p/xen: check logical size for buffer size net: usb: qmi_wwan: add u-blox 0x1342 composition mm/khugepaged: take the right locks for page table retraction mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths rtc: mc146818-lib: extract mc146818_avoid_UIP rtc: cmos: avoid UIP when writing alarm time rtc: cmos: avoid UIP when reading alarm time cifs: fix use-after-free caused by invalid pointer `hostname` drm/bridge: anx7625: Fix edid_read break case in sp_tx_edid_read() xen/netback: Ensure protocol headers don't fall in the non-linear area xen/netback: do some code cleanup xen/netback: don't call kfree_skb() with interrupts disabled media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() soundwire: intel: Initialize clock stop timeout Revert "ARM: dts: imx7: Fix NAND controller size-cells" media: v4l2-dv-timings.c: fix too strict blanking sanity checks memcg: fix possible use-after-free in memcg_write_event_control() mm/gup: fix gup_pud_range() for dax Bluetooth: btusb: Add debug message for CSR controllers Bluetooth: Fix crash when replugging CSR fake controllers net: mana: Fix race on per-CQ variable napi work_done KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field drm/vmwgfx: Don't use screen objects when SEV is active drm/amdgpu/sdma_v4_0: turn off SDMA ring buffer in the s2idle suspend drm/shmem-helper: Remove errant put in error path drm/shmem-helper: Avoid vm_open error paths net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing() HID: usbhid: Add ALWAYS_POLL quirk for some mice HID: hid-lg4ff: Add check for empty lbuf HID: core: fix shift-out-of-bounds in hid_report_raw_event HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 can: af_can: fix NULL pointer dereference in can_rcv_filter clk: Fix pointer casting to prevent oops in devm_clk_release() gpiolib: improve coding style for local variables gpiolib: check the 'ngpios' property in core gpiolib code gpiolib: fix memory leak in gpiochip_setup_dev() netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one drm/vmwgfx: Fix race issue calling pin_user_pages ieee802154: cc2520: Fix error return code in cc2520_hw_init() ca8210: Fix crash by zero initializing data netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark drm/bridge: ti-sn65dsi86: Fix output polarity setting bug gpio: amd8111: Fix PCI device reference count leak e1000e: Fix TX dispatch condition igb: Allocate MSI-X vector when testing net: broadcom: Add PTP_1588_CLOCK_OPTIONAL dependency for BCMGENET under ARCH_BCM2835 drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 af_unix: Get user_ns from in_skb in unix_diag_get_exact(). vmxnet3: correctly report encapsulated LRO packet vmxnet3: use correct intrConf reference when using extended queues Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() Bluetooth: Fix not cleanup led when bt_init fails net: dsa: ksz: Check return value net: dsa: hellcreek: Check return value net: dsa: sja1105: Check return value selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() net: encx24j600: Add parentheses to fix precedence net: encx24j600: Fix invalid logic in reading of MISTAT register net: mdiobus: fwnode_mdiobus_register_phy() rework error handling net: mdiobus: fix double put fwnode in the error path octeontx2-pf: Fix potential memory leak in otx2_init_tc() xen-netfront: Fix NULL sring after live migration net: mvneta: Prevent out of bounds read in mvneta_config_rss() i40e: Fix not setting default xps_cpus after reset i40e: Fix for VF MAC address 0 i40e: Disallow ip4 and ip6 l4_4_bytes NFC: nci: Bounds check struct nfc_target arrays nvme initialize core quirks before calling nvme_init_subsystem gpio/rockchip: fix refcount leak in rockchip_gpiolib_register() net: stmmac: fix "snps,axi-config" node property parsing ip_gre: do not report erspan version on GRE interface net: microchip: sparx5: Fix missing destroy_workqueue of mact_queue net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq net: hisilicon: Fix potential use-after-free in hisi_femac_rx() net: mdio: fix unbalanced fwnode reference count in mdio_device_release() net: hisilicon: Fix potential use-after-free in hix5hd2_rx() tipc: Fix potential OOB in tipc_link_proto_rcv() ipv4: Fix incorrect route flushing when source address is deleted ipv4: Fix incorrect route flushing when table ID 0 is used net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() tipc: call tipc_lxc_xmit without holding node_read_lock ethernet: aeroflex: fix potential skb leak in greth_init_rings() dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove() xen/netback: fix build warning net: phy: mxl-gpy: fix version reporting net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() ipv6: avoid use-after-free in ip6_fragment() net: thunderbolt: fix memory leak in tbnet_open() net: mvneta: Fix an out of bounds check macsec: add missing attribute validation for offload s390/qeth: fix various format strings s390/qeth: fix use-after-free in hsci can: esd_usb: Allow REC and TEC to return to zero block: move CONFIG_BLOCK guard to top Makefile io_uring: move to separate directory io_uring: Fix a null-ptr-deref in io_tctx_exit_cb() Linux 5.15.83 Change-Id: I6fa315bcb552a500c6bfe8331d4f630f75065798 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-27 13:36:39 +00:00
Tetsuo Handa	88ec6d1105	fbdev: fbcon: release buffer when fbcon_do_set_font() failed commit 3c3bfb8586f848317ceba5d777e11204ba3e5758 upstream. syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") missed that the buffer might be newly allocated by fbcon_set_font(). Link: https://syzkaller.appspot.com/bug?extid=25bdb7b1703639abd498 [1] Reported-by: syzbot <syzbot+25bdb7b1703639abd498@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+25bdb7b1703639abd498@syzkaller.appspotmail.com> Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-31 13:14:47 +01:00
Tetsuo Handa	e70a572440	fbcon: Use kzalloc() in fbcon_prepare_logo() [ Upstream commit a6a00d7e8ffd78d1cdb7a43f1278f081038c638f ] A kernel built with syzbot's config file reported that scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2)) causes uninitialized "save" to be copied. ---------- [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0 [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1 Console: switching to colour frame buffer device 128x48 ===================================================== BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0 do_update_region+0x4b8/0xba0 update_region+0x40d/0x840 fbcon_switch+0x3364/0x35e0 redraw_screen+0xae3/0x18a0 do_bind_con_driver+0x1cb3/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) Uninit was stored to memory at: fbcon_prepare_logo+0x143b/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) Uninit was created at: __kmem_cache_alloc_node+0xb69/0x1020 __kmalloc+0x379/0x680 fbcon_prepare_logo+0x704/0x1940 fbcon_init+0x2c1b/0x31c0 visual_init+0x3e7/0x820 do_bind_con_driver+0x14a4/0x1df0 do_take_over_console+0x11cb/0x13f0 fbcon_fb_registered+0xacc/0xfd0 register_framebuffer+0x1179/0x1320 __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 drm_fbdev_client_hotplug+0xbea/0xda0 drm_fbdev_generic_setup+0x65e/0x9d0 vkms_init+0x9f3/0xc76 (...snipped...) CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924 Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 ---------- Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-14 11:37:17 +01:00
Greg Kroah-Hartman	35fc902dbd	Merge 5.15.68 into android13-5.15-lts Changes in 5.15.68 net: wwan: iosm: remove pointless null check efi: libstub: Disable struct randomization efi: capsule-loader: Fix use-after-free in efi_capsule_write wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() fs: only do a memory barrier for the first set_buffer_uptodate() Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX scsi: megaraid_sas: Fix double kfree() drm/gem: Fix GEM handle release errors drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. drm/radeon: add a force flush to delay work when radeon scsi: ufs: core: Reduce the power mode change timeout Revert "parisc: Show error if wrong 32/64-bit compiler is being used" parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level netfilter: conntrack: work around exceeded receive window cpufreq: check only freq_table in __resolve_freq() net/core/skbuff: Check the return value of skb_copy_bits() md: Flush workqueue md_rdev_misc_wq in md_alloc() fbdev: fbcon: Destroy mutex on freeing struct fb_info fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() ALSA: aloop: Fix random zeros in capture data when using jiffies timer ALSA: usb-audio: Split endpoint setups for hw_params and prepare ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() tracing: Fix to check event_mutex is held while accessing trigger list btrfs: zoned: set pseudo max append zone limit in zone emulation mode vfio/type1: Unpin zero pages kprobes: Prohibit probes in gate area debugfs: add debugfs_lookup_and_remove() sched/debug: fix dentry leak in update_sched_domain_debugfs drm/amd/display: fix memory leak when using debugfs_lookup() nvmet: fix a use-after-free drm/i915: Implement WaEdpLinkRateDataReload scsi: mpt3sas: Fix use-after-free warning scsi: lpfc: Add missing destroy_workqueue() in error path NFS: Further optimisations for 'ls -l' NFS: Save some space in the inode NFS: Fix another fsync() issue after a server reboot cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock ASoC: qcom: sm8250: add missing module owner RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node soc: imx: gpcv2: Assert reset before ungating clock regulator: core: Clean up on enable failure tee: fix compiler warning in tee_shm_register() RDMA/cma: Fix arguments order in net device validation soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs RDMA/hns: Fix supported page size RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift wifi: wilc1000: fix DMA on stack objects ARM: at91: pm: fix self-refresh for sama7g5 ARM: at91: pm: fix DDR recalibration when resuming from backup and self-refresh ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time netfilter: br_netfilter: Drop dst references before setting. netfilter: nf_tables: clean up hook list when offload flags check fails netfilter: nf_conntrack_irc: Fix forged IP logic RDMA/srp: Set scmnd->result only when scmnd is not NULL ALSA: usb-audio: Inform the delayed registration more properly ALSA: usb-audio: Register card again for iface over delayed_register option rxrpc: Fix ICMP/ICMP6 error handling rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() afs: Use the operation issue time instead of the reply time for callbacks Revert "net: phy: meson-gxl: improve link-up behavior" sch_sfb: Don't assume the skb is still around after enqueueing to child tipc: fix shift wrapping bug in map_get() net: introduce __skb_fill_page_desc_noacc tcp: TX zerocopy should not sense pfmemalloc status ice: use bitmap_free instead of devm_kfree i40e: Fix kernel crash during module removal iavf: Detach device during reset task xen-netback: only remove 'hotplug-status' when the vif is actually destroyed RDMA/siw: Pass a pointer to virt_to_page() ipv6: sr: fix out-of-bounds read when setting HMAC data. IB/core: Fix a nested dead lock as part of ODP flow RDMA/mlx5: Set local port to one when accessing counters erofs: fix pcluster use-after-free on UP platforms nvme-tcp: fix UAF when detecting digest errors nvme-tcp: fix regression that causes sporadic requests to time out tcp: fix early ETIMEDOUT after spurious non-SACK RTO nvmet: fix mar and mor off-by-one errors RDMA/irdma: Report the correct max cqes from query device RDMA/irdma: Return correct WC error for bind operation failure RDMA/irdma: Report RNR NAK generation in device caps sch_sfb: Also store skb len before calling child enqueue perf script: Fix Cannot print 'iregs' field for hybrid systems hwmon: (tps23861) fix byte order in resistance register ASoC: mchp-spdiftx: remove references to mchp_i2s_caps ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion MIPS: loongson32: ls1c: Fix hang during startup kbuild: disable header exports for UML in a straightforward way i40e: Refactor tc mqprio checks i40e: Fix ADQ rate limiting for PF swiotlb: avoid potential left shift overflow iommu/amd: use full 64-bit value in build_completion_wait() s390/boot: fix absolute zero lowcore corruption on boot hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors hwmon: (mr75203) fix voltage equation for negative source input hwmon: (mr75203) fix multi-channel voltage reading hwmon: (mr75203) enable polling for all VM channels Revert "arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"" arm64/bti: Disable in kernel BTI when cross section thunks are broken iommu/vt-d: Correctly calculate sagaw value of IOMMU arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly drm/bridge: display-connector: implement bus fmts callbacks perf machine: Use path__join() to compose a path instead of snprintf(dir, '/', filename) ARM: at91: ddr: remove CONFIG_SOC_SAMA7 dependency Linux 5.15.68 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie37701b41d9c35632876034bcdd0029594170af9	2022-09-23 14:45:07 +02:00
Shigeru Yoshida	c3abfd6ce2	fbdev: fbcon: Destroy mutex on freeing struct fb_info [ Upstream commit 58559dfc1ebba2ae0c7627dc8f8991ae1984c6e3 ] It's needed to destroy bl_curve_mutex on freeing struct fb_info since the mutex is embedded in the structure and initialized when it's allocated. Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-09-15 11:30:01 +02:00
Greg Kroah-Hartman	889a0c39fe	Merge 5.15.64 into android13-5.15-lts Changes in 5.15.64 wifi: rtlwifi: remove always-true condition pointed out by GCC 12 eth: sun: cassini: remove dead code audit: fix potential double free on error path from fsnotify_add_inode_mark cgroup: Fix race condition at rebind_subsystems() parisc: Make CONFIG_64BIT available for ARCH=parisc64 only parisc: Fix exception handler for fldw and fstw instructions kernel/sys_ni: add compat entry for fadvise64_64 x86/entry: Move CLD to the start of the idtentry macro block: add a bdev_max_zone_append_sectors helper block: add bdev_max_segments() helper btrfs: zoned: revive max_zone_append_bytes btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size btrfs: convert count_max_extents() to use fs_info->max_extent_size Input: i8042 - move __initconst to fix code styling warning Input: i8042 - merge quirk tables Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - add additional TUXEDO devices to i8042 quirk tables drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist scsi: qla2xxx: Fix response queue handler reading stale packets scsi: qla2xxx: edif: Fix dropped IKE message btrfs: put initial index value of a directory in a constant btrfs: pass the dentry to btrfs_log_new_name() instead of the inode btrfs: remove unnecessary parameter delalloc_start for writepage_delalloc() riscv: lib: uaccess: fold fixups into body riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit xfrm: fix refcount leak in __xfrm_policy_check() xfrm: clone missing x->lastused in xfrm_do_migrate af_key: Do not call xfrm_probe_algs in parallel xfrm: policy: fix metadata dst->dev xmit null pointer dereference fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts net: use eth_hw_addr_set() instead of ether_addr_copy() Revert "net: macsec: update SCI upon MAC address change." NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() NFSv4.2 fix problems with __nfs42_ssc_open SUNRPC: RPC level errors should set task->tk_rpc_status mm/smaps: don't access young/dirty bit if pte unpresent ntfs: fix acl handling rose: check NULL rose_loopback_neigh->loopback r8152: fix the units of some registers for RTL8156A r8152: fix the RX FIFO settings when suspending nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id net/mlx5e: Properly disable vlan strip on non-UL reps net/mlx5: Avoid false positive lockdep warning by adding lock_class_key net/mlx5e: Fix wrong application of the LRO state net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off net: ipa: don't assume SMEM is page-aligned net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume() net: moxa: get rid of asymmetry in DMA mapping/unmapping bonding: 802.3ad: fix no transmission of LACPDUs net: ipvtap - add __init/__exit annotations to module init/exit funcs netfilter: ebtables: reject blobs that don't provide all entry points bnxt_en: fix NQ resource accounting during vf creation on 57500 chips netfilter: nf_tables: disallow updates of implicit chain netfilter: nf_tables: make table handle allocation per-netns friendly netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: bitwise: improve error goto labels netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element netfilter: nf_tables: disallow binding to already bound chain netfilter: flowtable: add function to invoke garbage collection immediately netfilter: flowtable: fix stuck flows on cleanup due to pending work net: Fix data-races around sysctl_[rw]mem_(max\|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. tcp: expose the tcp_mark_push() and tcp_skb_entail() helpers mptcp: stop relying on tcp_tx_skb_cache net: Fix data-races around sysctl_max_skb_frags. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter i40e: Fix incorrect address type for IPv6 flow rules rxrpc: Fix locking in rxrpc's sendmsg ionic: widen queue_lock use around lif init and deinit ionic: clear broken state on generation change ionic: fix up issues with handling EAGAIN on FW cmds ionic: VF initial random MAC address if no assigned mac net: stmmac: work around sporadic tx issue on link-up btrfs: fix silent failure when deleting root reference btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target btrfs: check if root is readonly while setting security xattr btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() perf/x86/lbr: Enable the branch type for the Arch LBR by default x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/bugs: Add "unknown" reporting for MMIO Stale Data x86/nospec: Unwreck the RSB stuffing loop: Check for overflow while configuring loop writeback: avoid use-after-free after removing device asm-generic: sections: refactor memory_intersects mm/damon/dbgfs: avoid duplicate context directory creation s390/mm: do not trigger write fault when vma does not allow VM_WRITE bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem s390: fix double free of GS and RI CBs on fork() failure fbdev: fbcon: Properly revert changes when vc_resize() failed Revert "memcg: cleanup racy sum avoidance code" ACPI: processor: Remove freq Qos request for all CPUs nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf smb3: missing inode locks in punch hole xen/privcmd: fix error exit of privcmd_ioctl_dm_op() riscv: traps: add missing prototype io_uring: fix issue with io_write() not always undoing sb_start_write() Revert "usbnet: smsc95xx: Fix deadlock on runtime resume" Revert "usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling" mm/hugetlb: fix hugetlb not supporting softdirty tracking Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 binder_alloc: add missing mmap_lock calls when using the VMA x86/nospec: Fix i386 RSB stuffing Documentation/ABI: Mention retbleed vulnerability info file for sysfs blk-mq: fix io hung due to missing commit_rqs perf python: Fix build when PYTHON_CONFIG is user supplied perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU perf/x86/intel/ds: Fix precise store latency handling perf stat: Clear evsel->reset_group for each stat run scsi: ufs: core: Enable link lost interrupt scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq bpf: Don't use tnum_range on array range checking for poke descriptors Linux 5.15.64 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaba96c173ad668df1c20b3bee08ce0e34f1068e1	2022-08-31 17:29:10 +02:00
Shigeru Yoshida	ebd6f886aa	fbdev: fbcon: Properly revert changes when vc_resize() failed commit a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 upstream. fbcon_do_set_font() calls vc_resize() when font size is changed. However, if if vc_resize() failed, current implementation doesn't revert changes for font size, and this causes inconsistent state. syzbot reported unable to handle page fault due to this issue [1]. syzbot's repro uses fault injection which cause failure for memory allocation, so vc_resize() failed. This patch fixes this issue by properly revert changes for font related date when vc_resize() failed. Link: https://syzkaller.appspot.com/bug?id=3443d3a1fa6d964dd7310a0cb1696d165a3e07c4 [1] Reported-by: syzbot+a168dbeaaa7778273c1b@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Signed-off-by: Helge Deller <deller@gmx.de> CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-08-31 17:16:48 +02:00
Greg Kroah-Hartman	8fd5b33ea5	Merge 5.15.61 into android13-5.15-lts Changes in 5.15.61 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" pNFS/flexfiles: Report RDMA connection errors to the server NFSD: Clean up the show_nf_flags() macro nfsd: eliminate the NFSD_FILE_BREAK_* flags ALSA: usb-audio: Add quirk for Behringer UMC202HD ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate lockd: detect and reject lock arguments that overflow HID: hid-input: add Surface Go battery quirk HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 KVM: x86: Tag kvm_mmu_x86_module_init() with __init KVM: x86: do not report preemption if the steal time cache is stale KVM: x86: revalidate steal time cache if MSR value changes riscv: set default pm_power_off to NULL ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect fix short copy handling in copy_mc_pipe_to_iter() crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Drop pa_swapper_pg_lock spinlock parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode riscv:uprobe fix SR_SPIE set/clear handling dt-bindings: riscv: fix SiFive l2-cache's cache-sets RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context RISC-V: Fixup get incorrect user mode PC for kernel mode regs RISC-V: Fixup schedule out issue in machine_crash_shutdown() RISC-V: Add modules to virtual kernel memory layout dump rtc: rx8025: fix 12/24 hour mode detection on RX-8035 drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/shmem-helper: Add missing vunmap on error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/hyperv-drm: Include framebuffer and EDID headers drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/nouveau/kms: Fix failure path for creating DP connectors drm/amdgpu: Check BO's requested pinning domains against its preferred_domains drm/amdgpu: fix check in fbdev init bpf: Fix KASAN use-after-free Read in compute_effective_progs btrfs: reject log replay if there is unsupported RO compat flag mtd: rawnand: arasan: Fix clock rate in NV-DDR mtd: rawnand: arasan: Update NAND bus clock instead of system clock um: Remove straying parenthesis um: seed rng using host OS rng iio: fix iio_format_avail_range() printing for none IIO_VAL_INT iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers soundwire: qcom: Check device status before reading devid ksmbd: fix memory leak in smb2_handle_negotiate ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ksmbd: fix use-after-free bug in smb2_tree_disconect fuse: limit nsec fuse: ioctl: translate ENOSYS serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" ext2: Add more validity checks for inode counts sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP sched/core: Always flush pending blk_plug irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 ARM: dts: ux500: Fix Codina accelerometer mounting matrix ARM: dts: ux500: Fix Gavini accelerometer mounting matrix spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ARM: OMAP2+: pdata-quirks: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist hwmon: (sht15) Fix wrong assumptions in device remove callback PM: hibernate: defer device probing when resuming from hibernation selinux: fix memleak in security_read_state_kernel() selinux: Add boundary check in put_entry() kasan: test: Silence GCC 12 warnings drm/amdgpu: Remove one duplicated ef removal powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names spi: spi-altera-dfl: Fix an error handling path ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values scsi: hisi_sas: Use managed PCI functions dt-bindings: iio: accel: Add DT binding doc for ADXL355 soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible ARM: dts: ast2600-evb-a1: fix board compatible arm64: dts: mt8192: Fix idle-states nodes naming scheme arm64: dts: mt8192: Fix idle-states entry-method arm64: select TRACE_IRQFLAGS_NMI_SUPPORT arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_() confusion arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init arm64: dts: qcom: sdm630: disable GPU by default arm64: dts: qcom: sdm630: fix the qusb2phy ref clock arm64: dts: qcom: sdm630: fix gpu's interconnect path arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1 soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() stack: Declare {randomize_,}kstack_offset to fix Sparse warnings arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node ACPI: APEI: explicit init of HEST and GHES in apci_init() drivers/iio: Remove all strcpy() uses ACPI: VIOT: Fix ACS setup arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125 arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fixup SYSRAM references arm64: tegra: Update Tegra234 BPMP channel addresses arm64: tegra: Mark BPMP channels as no-memory-wc arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created spi: Fix simplification of devm_spi_register_controller spi: tegra20-slink: fix UAF in tegra_slink_remove() hwmon: (drivetemp) Add module alias blktrace: Trace remapped requests correctly PM: domains: Ensure genpd_debugfs_dir exists before remove dm writecache: return void from functions dm writecache: count number of blocks read, not number of read bios dm writecache: count number of blocks written, not number of write bios dm writecache: count number of blocks discarded, not number of discard bios regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment irqdomain: Report irq number for NOMAP domains drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() x86/extable: Fix ex_handler_msr() print condition selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Reduce number of devm memory allocations pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data() pwm: lpc18xx: Fix period handling drm/dp: Export symbol / kerneldoc fixes for DP AUX bus drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init drm/bridge: lt9611uxc: Cancel only driver's work i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior i2c: mxs: Silence a clang warning virtio-gpu: fix a missing check to avoid NULL dereference drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle() drm/shmem-helper: Export dedicated wrappers for GEM object functions drm/shmem-helper: Pass GEM shmem object in public interfaces drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: atmel: atmel-sama7g5-isc: fix warning in configs without OF media: tw686x: Register the irq at the end of probe media: imx-jpeg: Correct some definition according specification media: imx-jpeg: Leave a blank space before the configuration data media: imx-jpeg: Add pm-runtime support for imx-jpeg media: imx-jpeg: use NV12M to represent non contiguous NV12 media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos media: imx-jpeg: Refactor function mxc_jpeg_parse media: imx-jpeg: Identify and handle precision correctly media: imx-jpeg: Handle source change in a function media: imx-jpeg: Support dynamic resolution change media: imx-jpeg: Align upwards buffer size media: imx-jpeg: Implement drain using v4l2-mem2mem helpers ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers rcutorture: Warn on individual rcu_torture_init() error conditions rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed rcutorture: Fix ksoftirqd boosting timing and iteration test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register media: imx-jpeg: Disable slot interrupt when frame done drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: driver/nxp/imx-jpeg: fix a unexpected return value problem media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/bridge: Add a function to abstract away panels drm/vc4: dsi: Switch to devm_drm_of_get_bridge drm/vc4: Use of_device_get_match_data() drm/vc4: dsi: Release workaround buffer and DMA drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Fix HPD GPIO detection drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Reset HDMI MISC_CONTROL register drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment drm/msm: Avoid dirtyfb stalls on video mode displays (v2) drm/msm/dpu: Fix for non-visible planes mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mt76: mt7615: do not update pm stats in case of error ieee80211: add EHT 1K aggregation definitions mt76: mt7921: fix aggregation subframes setting to HE max mt76: mt7921: enlarge maximum VHT MPDU length to 11454 mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node() skmsg: Fix invalid last sg check in sk_msg_recvmsg() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing media: cedrus: h265: Fix flag name media: hantro: postproc: Fix motion vector space size media: hantro: Simplify postprocessor media: hevc: Embedded indexes in RPS media: staging: media: hantro: Fix typos wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow libbpf: fix an snprintf() overflow check can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS net/mlx5: Adjust log_max_qp to be 18 at most crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set netdevsim: fib: Fix reference count leak on route deletion failure wifi: rtw88: check the return value of alloc_workqueue() iavf: Fix max_rate limiting iavf: Fix 'tc qdisc show' listing too many queues netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock net: usb: make USB_RTL8153_ECM non user configurable wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow HID: amd_sfh: Don't show client init failed as error when discovery fails clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue of: check previous kernel's ima-kexec-buffer against memory bounds scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing scsi: qla2xxx: edif: Fix potential stuck session in sa update scsi: qla2xxx: edif: Reduce connection thrash scsi: qla2xxx: edif: Fix inconsistent check of db_flags scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application scsi: qla2xxx: edif: Add retry for ELS passthrough scsi: qla2xxx: edif: Fix n2n discovery issue with secure target scsi: qla2xxx: edif: Fix n2n login retry for secure device KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails" KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported phy: samsung: exynosautov9-ufs: correct TSRV register configurations PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back scsi: qla2xxx: edif: Send LOGO for unexpected IKE message scsi: qla2xxx: edif: Reduce disruption due to multiple app start scsi: qla2xxx: edif: Fix no login after app start scsi: qla2xxx: edif: Tear down session if keys have been removed scsi: qla2xxx: edif: Fix session thrash scsi: qla2xxx: edif: Fix no logout on delete for N2N iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset lib/test_hmm: avoid accessing uninitialized pages memremap: remove support for external pgmap refcounts mm/memremap: fix memunmap_pages() race with get_dev_pagemap() KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel scsi: iscsi: Add helper to remove a session from the kernel scsi: iscsi: Fix session removal on shutdown dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics mtd: dataflash: Add SPI ID table clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock usb: host: xhci: use snprintf() in xhci_decode_trb() RDMA/rxe: Fix deadlock in rxe_do_local_ops() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain clk: qcom: camcc-sm8250: Fix topology around titan_top power domain clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled. clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register mm/mempolicy: fix get_nodes out of bound access PCI: dwc: Stop link on host_init errors and de-initialization PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Disable outbound windows only for controllers using iATU PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support soundwire: revisit driver bind/unbind and callbacks KVM: arm64: Don't return from void function dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function scsi: qla2xxx: Check correct variable in qla24xx_async_gffid() intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers binder: fix redefinition of seq_file attributes staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch mmc: mxcmmc: Silence a clang warning mmc: renesas_sdhi: Get the reset handle early in the probe memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() phy: stm32: fix error return in stm32_usbphyc_phy_init interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/irdma: Fix a window for use-after-free RDMA/irdma: Fix VLAN connection with wildcard address RDMA/irdma: Fix setting of QP context err_rq_idx_valid field RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/rtrs: Fix warning when use poll mode on client side. RDMA/rtrs: Replace duplicate check with is_pollqueue helper RDMA/rtrs: Introduce destroy_cq helper RDMA/rtrs: Do not allow sessname to contain special symbols / and . RDMA/rtrs: Rename rtrs_sess to rtrs_path RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event iio: cros: Register FIFO callback after sensor is registered clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() HID: amd_sfh: Add NULL check for hid device dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) scripts/gdb: lx-dmesg: read records individually scripts/gdb: fix 'lx-dmesg' on 32 bits arch RDMA/rxe: Fix mw bind to allow any consumer key portion mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support RDMA/rxe: For invalidate compare according to set keys in mr PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence HID: amd_sfh: Handle condition of "no sensors" USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free android: binder: stop saving a pointer to the VMA mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall of/fdt: declared return type does not match actual return type RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Add memory barriers to kernel queues RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq RDMA/rxe: Fix error unwind in rxe_create_qp() block/rnbd-srv: Set keep_id to true after mutex_trylock null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() nvme: define compat_ioctl again to unbreak 32-bit userspace. nvme: disable namespace access for unsupported metadata nvme: don't return an error from nvme_configure_metadata nvme: catch -ENODEV from nvme_revalidate_zones again block/bio: remove duplicate append pages code block: ensure iov_iter advances for added pages jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: imx-audmux: Silence a clang warning ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250: dma: Allow driver operations before starting DMA transfers serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: char: Add mutex protection for rpmsg_eptdev_open() rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix tty registration before control channel open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix missing timer to handle stalled links tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() tty: n_gsm: fix resource allocation order in gsm_activate_mux() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() ASoC: imx-card: Fix DSD/PDM mclk frequency remoteproc: qcom: wcnss: Fix handling of IRQs vfio/ccw: Do not change FSM state in subchannel event serial: 8250_fsl: Don't report FE, PE and OE twice tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() MIPS: vdso: Utilize __pa() for gic_pfn swiotlb: fail map correctly with failed io_tlb_default_mem ASoC: mt6359: Fix refcount leak bug serial: 8250_bcm7271: Save/restore RTS in suspend/resume iommu/exynos: Handle failed IOMMU device registration properly 9p: fix a bunch of checkpatch warnings 9p: Drop kref usage 9p: Add client parameter to p9_req_put() net: 9p: fix refcount leak in p9_read_work() error handling MIPS: Fixed __debug_virt_addr_valid() rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call proc: fix a dentry lock race between release_task and lookup remoteproc: qcom: pas: Check if coredump is enabled remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/maccess: fix semantics of memcpy_real() and its callers s390/crash: fix incorrect number of bytes to copy to user space s390/zcore: fix race when reading from hardware system area ASoC: fsl_asrc: force cast the asrc_format type ASoC: fsl-asoc-card: force cast the asrc_format type ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: imx-card: use snd_pcm_format_t type for asrc_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping. powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias tty: serial: fsl_lpuart: correct the count of break characters s390/dump: fix os_info virtual vs physical address confusion s390/smp: cleanup target CPU callback starting s390/smp: cleanup control register update routines s390/maccess: rework absolute lowcore accessors s390/smp: enforce lowcore protection on CPU restart f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle sched/core: Do not requeue task on CPU excluded from cpus_mask x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y f2fs: allow compression for mmap files in compress_mode=user f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix imbalance vha->vref_count scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts scsi: qla2xxx: Fix excessive I/O error messages by default scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Wind down adapter after PCIe error scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing target when it reappears during delete scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/kprobes: Update kcb status flag after singlestepping x86/olpc: fix 'logical not is only applied to the left hand side' SMB3: fix lease break timeout when multiple deferred close handles for the same file. posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer crypto: blake2s - remove shash module drm/dp/mst: Read the extended DPCD capabilities during system resume drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling usbnet: smsc95xx: Fix deadlock on runtime resume firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails scsi: lpfc: Fix EEH support for NVMe I/O scsi: lpfc: SLI path split: Refactor lpfc_iocbq scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4 scsi: lpfc: SLI path split: Refactor SCSI paths scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Iterate over error counters instead of error strings PCI: qcom: Power on PHY before IPQ8074 DBI register accesses serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code serial: 8250: Add proper clock handling for OxSemi PCIe devices tty: 8250: Add support for Brainboxes PX cards. dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback net/9p: Initialize the iounit field during fid creation ARM: remove some dead code timekeeping: contribute wall clock to rng on time change locking/csd_lock: Change csdlock_debug from early_param to __setup block: remove the struct blk_queue_ctx forward declaration block: don't allow the same type rq_qos add more than once btrfs: ensure pages are unlocked on cow_file_range() failure btrfs: reset block group chunk force if we have to wait btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA ACPI: CPPC: Do not prevent CPPC from working in the future powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists dm raid: fix address sanitizer warning in raid_status dm raid: fix address sanitizer warning in raid_resume tracing: Add '__rel_loc' using trace event macros tracing: Avoid -Warray-bounds warning for __rel_loc macro ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix use-after-free in ext4_xattr_set_entry ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: check if directory block is within i_size ext4: make sure ext4_append() always allocates new block ext4: remove EA inode entry from mbcache on inode eviction ext4: use kmemdup() to replace kmalloc + memcpy ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect powerpc: Fix eh field when calling lwarx on PPC32 tracing: Use a struct alignof to determine trace event field alignment net_sched: cls_route: remove from list when handle is 0 mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() crypto: lib/blake2s - reduce stack frame usage in self test Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" Revert "s390/smp: enforce lowcore protection on CPU restart" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode drm/vc4: change vc4_dma_range_matches from a global to static tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro drm/msm: Fix dirtyfb refcounting drm/meson: Fix refcount leak in meson_encoder_hdmi_init io_uring: mem-account pbuf buckets Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup() scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4() scsi: lpfc: Resolve some cleanup issues following SLI path refactoring Linux 5.15.61 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0849e49fb265651bf6277e4ead9c440d50ed7536	2022-08-22 14:29:30 +02:00
Helge Deller	d0d6186eae	fbcon: Fix accelerated fbdev scrolling while logo is still shown commit 3866cba87dcd0162fb41e9b3b653d0af68fad5ec upstream. There is no need to directly skip over to the SCROLL_REDRAW case while the logo is still shown. When using DRM, this change has no effect because the code will reach the SCROLL_REDRAW case immediately anyway. But if you run an accelerated fbdev driver and have FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION enabled, console scrolling is slowed down by factors so that it feels as if you use a 9600 baud terminal. So, drop those unnecessary checks and speed up fbdev console acceleration during bootup. Cc: stable@vger.kernel.org # v5.10+ Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Helge Deller <deller@gmx.de> Link: https://patchwork.freedesktop.org/patch/msgid/YpkYxk7wsBPx3po+@p100 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-08-17 14:22:51 +02:00
Helge Deller	c1e09ee98f	fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters commit cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69 upstream. The user may use the fbcon=vc:<n1>-<n2> option to tell fbcon to take over the given range (n1...n2) of consoles. The value for n1 and n2 needs to be a positive number and up to (MAX_NR_CONSOLES - 1). The given values were not fully checked against those boundaries yet. To fix the issue, convert first_fb_vc and last_fb_vc to unsigned integers and check them against the upper boundary, and make sure that first_fb_vc is smaller than last_fb_vc. Cc: stable@vger.kernel.org # v4.19+ Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Helge Deller <deller@gmx.de> Link: https://patchwork.freedesktop.org/patch/msgid/YpkYRMojilrtZIgM@p100 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-08-17 14:22:50 +02:00
Greg Kroah-Hartman	817780c598	Merge 5.15.56 into android13-5.15-lts Changes in 5.15.56 ALSA: hda - Add fixup for Dell Latitidue E5430 ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model ALSA: hda/realtek: Fix headset mic for Acer SF313-51 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: fix mute/micmute LEDs for HP machines ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue fix race between exit_itimers() and /proc/pid/timers mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages mm: split huge PUD on wp_huge_pud fallback tracing/histograms: Fix memory leak problem net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer ip: fix dflt addr selection for connected nexthop ARM: 9213/1: Print message about disabled Spectre workarounds only once ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction wifi: mac80211: fix queue selection for mesh/OCB interfaces cgroup: Use separate src/dst nodes when preloading css_sets for migration btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error drm/panfrost: Fix shrinker list corruption by madvise IOCTL fs/remap: constrain dedupe of EOF blocks nilfs2: fix incorrect masking of permission flags for symlinks sh: convert nommu io{re,un}map() to static inline functions Revert "evm: Fix memleak in init_desc" xfs: only run COW extent recovery when there are no live extents xfs: don't include bnobt blocks when reserving free block pool xfs: run callbacks before waking waiters in xlog_state_shutdown_callbacks xfs: drop async cache flushes from CIL commits. reset: Fix devm bulk optional exclusive control getter ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count spi: amd: Limit max transfer and message size ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle ARM: 9210/1: Mark the FDT_FIXED sections as shareable net/mlx5e: kTLS, Fix build time constant test in TX net/mlx5e: kTLS, Fix build time constant test in RX net/mlx5e: Fix enabling sriov while tc nic rules are offloaded net/mlx5e: Fix capability check for updating vnic env counters net/mlx5e: Ring the TX doorbell on DMA errors drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() ima: Fix a potential integer overflow in ima_appraise_measurement ASoC: sgtl5000: Fix noise on shutdown/remove ASoC: tas2764: Add post reset delays ASoC: tas2764: Fix and extend FSYNC polarity handling ASoC: tas2764: Correct playback volume range ASoC: tas2764: Fix amp gain register offset & default ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array net: stmmac: dwc-qos: Disable split header for Tegra194 net: ethernet: ti: am65-cpsw: Fix devlink port register sequence sysctl: Fix data races in proc_dointvec(). sysctl: Fix data races in proc_douintvec(). sysctl: Fix data races in proc_dointvec_minmax(). sysctl: Fix data races in proc_douintvec_minmax(). sysctl: Fix data races in proc_doulongvec_minmax(). sysctl: Fix data races in proc_dointvec_jiffies(). tcp: Fix a data-race around sysctl_tcp_max_orphans. inetpeer: Fix data-races around sysctl. net: Fix data-races around sysctl_mem. cipso: Fix data-races around sysctl. icmp: Fix data-races around sysctl. ipv4: Fix a data-race around sysctl_fib_sync_mem. ARM: dts: at91: sama5d2: Fix typo in i2s1 node ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot netfilter: nf_log: incorrect offset to network header netfilter: nf_tables: replace BUG_ON by element length check drm/i915/gvt: IS_ERR() vs NULL bug in intel_gvt_update_reg_whitelist() xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE lockd: set fl_owner when unlocking files lockd: fix nlm_close_files tracing: Fix sleeping while atomic in kdb ftdump drm/i915/selftests: fix a couple IS_ERR() vs NULL tests drm/i915/dg2: Add Wa_22011100796 drm/i915/gt: Serialize GRDOM access between multiple engine resets drm/i915/gt: Serialize TLB invalidates with GT resets drm/i915/uc: correctly track uc_fw init failure drm/i915: Require the vm mutex for i915_vma_bind() bnxt_en: Fix bnxt_reinit_after_abort() code path bnxt_en: Fix bnxt_refclk_read() sysctl: Fix data-races in proc_dou8vec_minmax(). sysctl: Fix data-races in proc_dointvec_ms_jiffies(). icmp: Fix data-races around sysctl_icmp_echo_enable_probe. icmp: Fix a data-race around sysctl_icmp_ignore_bogus_error_responses. icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. icmp: Fix a data-race around sysctl_icmp_ratelimit. icmp: Fix a data-race around sysctl_icmp_ratemask. raw: Fix a data-race around sysctl_raw_l3mdev_accept. tcp: Fix a data-race around sysctl_tcp_ecn_fallback. ipv4: Fix data-races around sysctl_ip_dynaddr. nexthop: Fix data-races around nexthop_compat_mode. net: ftgmac100: Hold reference returned by of_get_child_by_name() net: stmmac: fix leaks in probe ima: force signature verification when CONFIG_KEXEC_SIG is configured ima: Fix potential memory leak in ima_init_crypto() drm/amd/display: Only use depth 36 bpp linebuffers on DCN display engines. drm/amd/pm: Prevent divide by zero sfc: fix use after free when disabling sriov ceph: switch netfs read ops to use rreq->inode instead of rreq->mapping->host seg6: fix skb checksum evaluation in SRH encapsulation/insertion seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors seg6: bpf: fix skb checksum in bpf_push_seg6_encap() sfc: fix kernel panic when creating VF net: atlantic: remove deep parameter on suspend/resume functions net: atlantic: remove aq_nic_deinit() when resume KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() net/tls: Check for errors in tls_device_init ACPI: video: Fix acpi_video_handles_brightness_key_presses() mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE btrfs: rename btrfs_bio to btrfs_io_context btrfs: zoned: fix a leaked bioc in read_zone_info ksmbd: use SOCK_NONBLOCK type for kernel_accept() powerpc/xive/spapr: correct bitmap allocation size vdpa/mlx5: Initialize CVQ vringh only once vduse: Tie vduse mgmtdev and its device virtio_mmio: Add missing PM calls to freeze/restore virtio_mmio: Restore guest page size on resume netfilter: br_netfilter: do not skip all hooks with 0 priority scsi: hisi_sas: Limit max hw sectors for v3 HW cpufreq: pmac32-cpufreq: Fix refcount leak bug platform/x86: hp-wmi: Ignore Sanitization Mode event firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer firmware: sysfb: Add sysfb_disable() helper function fbdev: Disable sysfb device registration when removing conflicting FBs net: tipc: fix possible refcount leak in tipc_sk_create() NFC: nxp-nci: don't print header length mismatch on i2c error nvme-tcp: always fail a request when sending it failed nvme: fix regression when disconnect a recovering ctrl net: sfp: fix memory leak in sfp_probe() ASoC: ops: Fix off by one in range control validation pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove ASoC: rt711-sdca-sdw: fix calibrate mutex initialization ASoC: Intel: sof_sdw: handle errors on card registration ASoC: rt711: fix calibrate mutex initialization ASoC: rt7*-sdw: harden jack_detect_handler ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow ASoC: wcd938x: Fix event generation for some controls ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem ASoC: wm5110: Fix DRE control ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error ASoC: dapm: Initialise kcontrol data for mux/demux controls ASoC: cs47l15: Fix event generation for low power mux control ASoC: madera: Fix event generation for OUT1 demux ASoC: madera: Fix event generation for rate controls irqchip: or1k-pic: Undefine mask_ack for level triggered hardware x86: Clear .brk area at early boot soc: ixp4xx/npe: Fix unused match warning ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 Revert "can: xilinx_can: Limit CANFD brp to 2" ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices ALSA: usb-audio: Add quirk for Fiero SC-01 ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) nvme-pci: phison e16 has bogus namespace ids signal handling: don't use BUG_ON() for debugging USB: serial: ftdi_sio: add Belimo device ids usb: typec: add missing uevent when partner support PD usb: dwc3: gadget: Fix event pending check tty: serial: samsung_tty: set dma burst_size to 1 vt: fix memory overlapping when deleting chars in the buffer serial: 8250: fix return error code in serial8250_request_std_resource() serial: stm32: Clear prev values before setting RTS delays serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle serial: 8250: Fix PM usage_count for console handover x86/pat: Fix x86_has_pat_wp() drm/aperture: Run fbdev removal before internal helpers Linux 5.15.56 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib44efbedc8fea205005bd3ec2806ebb8cb19710d	2022-08-10 16:54:10 +02:00
Greg Kroah-Hartman	85e3c21eb8	Merge 5.15.54 into android13-5.15-lts Changes in 5.15.54 mm/slub: add missing TID updates on slab deactivation mm/filemap: fix UAF in find_lock_entries Revert "selftests/bpf: Add test for bpf_timer overwriting crash" ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD ALSA: hda/realtek: Add quirk for Clevo L140PU ALSA: cs46xx: Fix missing snd_card_free() call at probe error can: bcm: use call_rcu() instead of costly synchronize_rcu() can: grcan: grcan_probe(): remove extra of_node_get() can: gs_usb: gs_usb_open/close(): fix memory leak can: m_can: m_can_chip_config(): actually enable internal timestamping can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register bpf: Fix incorrect verifier simulation around jmp32's jeq/jne bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals usbnet: fix memory leak in error case net: rose: fix UAF bug caused by rose_t0timer_expiry netfilter: nft_set_pipapo: release elements in clone from abort path netfilter: nf_tables: stricter validation of element data btrfs: rename btrfs_alloc_chunk to btrfs_create_chunk btrfs: add additional parameters to btrfs_init_tree_ref/btrfs_init_data_ref btrfs: fix invalid delayed ref after subvolume creation failure btrfs: fix warning when freeing leaf after subvolume creation failure Input: cpcap-pwrbutton - handle errors from platform_get_irq() Input: goodix - change goodix_i2c_write() len parameter type to int Input: goodix - add a goodix.h header file Input: goodix - refactor reset handling Input: goodix - try not to touch the reset-pin on x86/ACPI devices dma-buf/poll: Get a file reference for outstanding fence callbacks btrfs: fix deadlock between chunk allocation and chunk btree modifications drm/i915: Disable bonding on gen12+ platforms drm/i915/gt: Register the migrate contexts with their engines drm/i915: Replace the unconditional clflush with drm_clflush_virt_range() PCI/portdrv: Rename pm_iter() to pcie_port_device_iter() PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset media: ir_toy: prevent device from hanging during transmit memory: renesas-rpc-if: Avoid unaligned bus access for HyperFlash ath11k: add hw_param for wakeup_mhi qed: Improve the stack space of filter_config() platform/x86: wmi: introduce helper to convert driver to WMI driver platform/x86: wmi: Replace read_takes_no_args with a flags field platform/x86: wmi: Fix driver->notify() vs ->probe() race mt76: mt7921: get rid of mt7921_mac_set_beacon_filter mt76: mt7921: introduce mt7921_mcu_set_beacon_filter utility routine mt76: mt7921: fix a possible race enabling/disabling runtime-pm bpf: Stop caching subprog index in the bpf_pseudo_func insn bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC riscv: defconfig: enable DRM_NOUVEAU RISC-V: defconfigs: Set CONFIG_FB=y, for FB console net/mlx5e: Check action fwd/drop flag exists also for nic flows net/mlx5e: Split actions_match_supported() into a sub function net/mlx5e: TC, Reject rules with drop and modify hdr action net/mlx5e: TC, Reject rules with forward and drop actions ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend ASoC: rt5682: Re-detect the combo jack after resuming ASoC: rt5682: Fix deadlock on resume netfilter: nf_tables: convert pktinfo->tprot_set to flags field netfilter: nft_payload: support for inner header matching / mangling netfilter: nft_payload: don't allow th access for fragments s390/boot: allocate amode31 section in decompressor s390/setup: use physical pointers for memblock_reserve() s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE ibmvnic: init init_done_rc earlier ibmvnic: clear fop when retrying probe ibmvnic: Allow queueing resets during probe virtio-blk: avoid preallocating big SGL for data io_uring: ensure that fsnotify is always called block: use bdev_get_queue() in bio.c block: only mark bio as tracked if it really is tracked block: fix rq-qos breakage from skipping rq_qos_done_bio() stddef: Introduce struct_group() helper macro media: omap3isp: Use struct_group() for memcpy() region media: davinci: vpif: fix use-after-free on driver unbind mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error mt76: mt7921: do not always disable fw runtime-pm cxl/port: Hold port reference until decoder release clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue scsi: qla2xxx: Fix laggy FC remote port session recovery scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe scsi: qla2xxx: Fix crash during module load unload test gfs2: Fix gfs2_file_buffered_write endless loop workaround vdpa/mlx5: Avoid processing works if workqueue was destroyed btrfs: handle device lookup with btrfs_dev_lookup_args btrfs: add a btrfs_get_dev_args_from_path helper btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls btrfs: remove device item and update super block in the same transaction drbd: add error handling support for add_disk() drbd: Fix double free problem in drbd_create_device drbd: fix an invalid memory access caused by incorrect use of list iterator drm/amd/display: Set min dcfclk if pipe count is 0 drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) NFSD: COMMIT operations must not return NFS?ERR_INVAL riscv/mm: Add XIP_FIXUP for riscv_pfn_base iio: accel: mma8452: use the correct logic to get mma8452_data batman-adv: Use netif_rx(). mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set Compiler Attributes: add __alloc_size() for better bounds checking mm: vmalloc: introduce array allocation functions KVM: use __vcalloc for very large allocations btrfs: don't access possibly stale fs_info data in device_list_add KVM: s390x: fix SCK locking scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test powerpc/32: Don't use lmw/stmw for saving/restoring non volatile regs powerpc: flexible GPR range save/restore macros powerpc/tm: Fix more userspace r13 corruption serial: sc16is7xx: Clear RS485 bits in the shutdown bus: mhi: core: Use correctly sized arguments for bit field bus: mhi: Fix pm_state conversion to string stddef: Introduce DECLARE_FLEX_ARRAY() helper uapi/linux/stddef.h: Add include guards ASoC: rt5682: move clk related code to rt5682_i2c_probe ASoC: rt5682: fix an incorrect NULL check on list iterator drm/amd/vcn: fix an error msg on vcn 3.0 KVM: Don't create VM debugfs files outside of the VM directory tty: n_gsm: Modify CR,PF bit when config requester tty: n_gsm: Save dlci address open status when config requester tty: n_gsm: fix frame reception handling ALSA: usb-audio: add mapping for MSI MPG X570S Carbon Max Wifi. ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. tty: n_gsm: fix missing update of modem controls after DLCI open btrfs: zoned: encapsulate inode locking for zoned relocation btrfs: zoned: use dedicated lock for data relocation KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref mm/hwpoison: mf_mutex for soft offline and unpoison mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler mm/memory-failure.c: fix race with changing page compound again mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb() tty: n_gsm: fix invalid use of MSC in advanced option tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() serial: 8250_mtk: Make sure to select the right FEATURE_SEL tty: n_gsm: fix invalid gsmtty_write_room() result drm/amd: Refactor `amdgpu_aspm` to be evaluated per device drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems drm/i915: Fix a race between vma / object destruction and unbinding drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb drm/mediatek: Remove the pointer of struct cmdq_client drm/mediatek: Detect CMDQ execution timeout drm/mediatek: Add cmdq_handle in mtk_crtc drm/mediatek: Add vblank register/unregister callback functions Bluetooth: protect le accept and resolv lists with hdev->lock Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event io_uring: avoid io-wq -EAGAIN looping for !IOPOLL irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling irqchip/gic-v3: Refactor ISB + EOIR at ack time rxrpc: Fix locking issue dt-bindings: soc: qcom: smd-rpm: Add compatible for MSM8953 SoC dt-bindings: soc: qcom: smd-rpm: Fix missing MSM8936 compatible module: change to print useful messages from elf_validity_check() module: fix [e_shstrndx].sh_size=0 OOB access iommu/vt-d: Fix PCI bus rescan device hot add fbdev: fbmem: Fix logo center image dx issue fbmem: Check virtual screen sizes in fb_set_var() fbcon: Disallow setting font bigger than screen size fbcon: Prevent that screen size is smaller than font size PM: runtime: Redefine pm_runtime_release_supplier() memregion: Fix memregion_free() fallback definition video: of_display_timing.h: include errno.h powerpc/powernv: delay rng platform device creation until later in boot net: dsa: qca8k: reset cpu port on MTU change can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits xfs: remove incorrect ASSERT in xfs_rename Revert "serial: sc16is7xx: Clear RS485 bits in the shutdown" btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2() virtio-blk: modify the value type of num in virtio_queue_rq() btrfs: fix use of uninitialized variable at rm device ioctl tty: n_gsm: fix encoding of command/response bit ARM: meson: Fix refcount leak in meson_smp_prepare_cpus pinctrl: sunxi: a83t: Fix NAND function name for some pins ASoC: rt711: Add endianness flag in snd_soc_component_driver ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect arm64: dts: qcom: msm8994: Fix CPU6/7 reg values arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node ARM: mxs_defconfig: Enable the framebuffer arm64: dts: imx8mp-evk: correct mmc pad settings arm64: dts: imx8mp-evk: correct the uart2 pinctl value arm64: dts: imx8mp-evk: correct gpio-led pad settings arm64: dts: imx8mp-evk: correct vbus pad settings arm64: dts: imx8mp-evk: correct eqos pad settings arm64: dts: imx8mp-evk: correct I2C1 pad settings arm64: dts: imx8mp-evk: correct I2C3 pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings pinctrl: sunxi: sunxi_pconf_set: use correct offset arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo ARM: at91: pm: use proper compatible for sama5d2's rtc ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: dts: at91: sama5d2_icp: fix eeprom compatibles ARM: at91: fix soc detection for SAM9X60 SiPs xsk: Clear page contiguity bit when unmapping pool i2c: piix4: Fix a memory leak in the EFCH MMIO support i40e: Fix dropped jumbo frames statistics i40e: Fix VF's MAC Address change on VM ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151 ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 ibmvnic: Properly dispose of all skbs during a failover. selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT selftests: forwarding: fix error message in learning_test r8169: fix accessing unset transport header i2c: cadence: Unregister the clk notifier in error path dmaengine: imx-sdma: Allow imx8m for imx7 FW revs misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer misc: rtsx_usb: use separate command and response buffers misc: rtsx_usb: set return value in rsp_buf alloc err path Revert "mm/memory-failure.c: fix race with changing page compound again" Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo ida: don't use BUG_ON() for debugging dmaengine: pl330: Fix lockdep warning about non-static key dmaengine: lgm: Fix an error handling path in intel_ldma_probe() dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate dmaengine: qcom: bam_dma: fix runtime PM underflow dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate dmaengine: idxd: force wq context cleanup on device disable path selftests/net: fix section name when using xdp_dummy.o Linux 5.15.54 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5434cb4ec4ac9e6d1f619f47a5139a11352b98e1	2022-08-10 13:23:20 +02:00
Greg Kroah-Hartman	a9422ed2f1	Merge 5.15.46 into android13-5.15-lts Changes in 5.15.46 binfmt_flat: do not stop relocating GOT entries prematurely on riscv parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY riscv: Initialize thread pointer before calling C functions riscv: Fix irq_work when SMP is disabled riscv: Wire up memfd_secret in UAPI header riscv: Move alternative length validation into subsection ALSA: hda/realtek - Add new type for ALC245 ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS ALSA: usb-audio: Cancel pending work at closing a MIDI substream USB: serial: pl2303: fix type detection for odd device USB: serial: option: add Quectel BG95 modem USB: new quirk for Dell Gen 2 devices usb: isp1760: Fix out-of-bounds array access usb: dwc3: gadget: Move null pinter check to proper place usb: core: hcd: Add support for deferring roothub registration fs/ntfs3: Update valid size if -EIOCBQUEUED fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space) fs/ntfs3: Keep preallocated only if option prealloc enabled fs/ntfs3: Check new size for limits fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if called from function ntfs_init_acl fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' fs/ntfs3: Update i_ctime when xattr is added fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions cifs: fix potential double free during failed mount cifs: when extending a file with falloc we should make files not-sparse xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI platform/x86: intel-hid: fix _DSM function index handling x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails perf/x86/intel: Fix event constraints for ICL x86/kexec: fix memory leak of elf header buffer x86/sgx: Set active memcg prior to shmem allocation ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL btrfs: add "0x" prefix for unsupported optional features btrfs: return correct error number for __extent_writepage_io() btrfs: repair super block num_devices automatically btrfs: fix the error handling for submit_extent_page() for btrfs_do_readpage() iommu/vt-d: Add RPLS to quirk list to skip TE disabling drm/vmwgfx: validate the screen formats drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes selftests/bpf: Fix vfs_link kprobe definition selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() ipv6: fix locking issues with loops over idev->addr_list fbcon: Consistently protect deferred_takeover with console_lock() x86/platform/uv: Update TSC sync state for UV5 ACPICA: Avoid cache flush inside virtual machines mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output) drm/komeda: return early if drm_universal_plane_init() fails. drm/amd/display: Disabling Z10 on DCN31 rcu-tasks: Fix race in schedule and flush work rcu: Make TASKS_RUDE_RCU select IRQ_WORK sfc: ef10: Fix assigning negative value to unsigned variable ALSA: jack: Access input_dev under mutex rtw88: 8821c: fix debugfs rssi value spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction tools/power turbostat: fix ICX DRAM power numbers scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock scsi: lpfc: Fix call trace observed during I/O with CMF enabled cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode drm/amd/pm: fix double free in si_parse_power_table() ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() ASoC: rsnd: care return value from rsnd_node_fixed_index() ath9k: fix QCA9561 PA bias level media: venus: hfi: avoid null dereference in deinit media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module md/bitmap: don't set sb values if can't pass sanity check mmc: jz4740: Apply DMA engine limits to maximum segment size drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit scsi: megaraid: Fix error check return value of register_chrdev() drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the doorbells scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() ath11k: disable spectral scan during spectral deinit ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 drm/plane: Move range check for format_count earlier drm/amd/pm: fix the compile warning ath10k: skip ath10k_halt during suspend for driver state RESTARTING arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall drm: msm: fix error check return value of irq_of_parse_and_map() scsi: target: tcmu: Fix possible data corruption ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL net/mlx5: fs, delete the FTE when there are no rules attached to it ASoC: dapm: Don't fold register value changes into notifications mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo regulator: mt6315: Enforce regulator-compatible, not name HID: bigben: fix slab-out-of-bounds Write in bigben_probe of: Support more than one crash kernel regions for kexec -s ASoC: tscs454: Add endianness flag in snd_soc_component_driver scsi: lpfc: Alter FPIN stat accounting logic net: remove two BUG() from skb_checksum_help() s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES perf/amd/ibs: Cascade pmu init functions' return value sched/core: Avoid obvious double update_rq_clock warning spi: stm32-qspi: Fix wait_cmd timeout in APM mode dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues rtlwifi: Use pr_warn instead of WARN_ONCE mt76: mt7921: accept rx frames with non-standard VHT MCS10-11 mt76: fix encap offload ethernet type check media: rga: fix possible memory leak in rga_probe media: coda: limit frame interval enumeration to supported encoder frame sizes media: hantro: HEVC: unconditionnaly set pps_{cb/cr}_qp_offset values media: ccs-core.c: fix failure to call clk_disable_unprepare media: imon: reorganize serialization media: cec-adap.c: fix is_configuring state usbnet: Run unregister_netdev() before unbind() again openrisc: start CPU timer early in boot nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags ASoC: rt5645: Fix errorenous cleanup order nbd: Fix hung on disconnect request if socket is closed before drm/amd/pm: update smartshift powerboost calc for smu12 drm/amd/pm: update smartshift powerboost calc for smu13 net: phy: micrel: Allow probing without .driver_data media: exynos4-is: Fix compile warning media: hantro: Stop using H.264 parameter pic_num ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB ACPI: CPPC: Assume no transition latency if no PCCT nvme: set non-mdts limits in nvme_scan_work can: mcp251xfd: silence clang's -Wunaligned-access warning x86/microcode: Add explicit CPU vendor dependency net: ipa: ignore endianness if there is no header m68k: atari: Make Atari ROM port I/O write macros return void rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes afs: Adjust ACK interpretation to try and cope with NAT eth: tg3: silence the GCC 12 array-bounds warning char: tpm: cr50_i2c: Suppress duplicated error message in .remove() selftests/bpf: fix btf_dump/btf_dump due to recent clang change gfs2: use i_lock spin_lock for inode qadata scsi: target: tcmu: Avoid holding XArray lock when calling lock_page IB/rdmavt: add missing locks in rvt_ruc_loopback ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: socfpga: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema arm64: dts: qcom: msm8994: Fix the cont_splash_mem address arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count PM / devfreq: rk3399_dmc: Disable edev on remove() crypto: ccree - use fine grained DMA mapping dir soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc fs: jfs: fix possible NULL pointer dereference in dbFree() arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's vddio-supply property ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c ARM: OMAP1: clock: Fix UART rate reporting algorithm powerpc/fadump: Fix fadump to work with a different endian capture kernel fat: add ratelimit to fat_ent_bread() pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() ARM: versatile: Add missing of_node_put in dcscb_init ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM ARM: hisi: Add missing of_node_put after of_find_compatible_node cpufreq: Avoid unnecessary frequency updates due to mismatch powerpc/rtas: Keep MSR[RI] set when calling RTAS PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting alpha: fix alloc_zeroed_user_highpage_movable() tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled powerpc/iommu: Add missing of_node_put in iommu_init_early_dart smb3: check for null tcon RDMA/hfi1: Prevent panic when SDMA is disabled Input: gpio-keys - cancel delayed work only in case of GPIO drm: fix EDID struct for old ARM OABI format drm/bridge_connector: enable HPD by default if supported dt-bindings: display: sitronix, st7735r: Fix backlight in example drm/vmwgfx: Fix an invalid read ath11k: acquire ab->base_lock in unassign when finding the peer by addr drm: bridge: it66121: Fix the register page length ath9k: fix ar9003_get_eepmisc drm/edid: fix invalid EDID extension block filtering drm/bridge: adv7511: clean up CEC adapter when probe fails drm: bridge: icn6211: Fix register layout drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG spi: qcom-qspi: Add minItems to interconnect-names ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe x86/delay: Fix the wrong asm constraint in delay_loop() drm/vc4: hvs: Fix frame count register readout drm/mediatek: Fix mtk_cec_mask() drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled libbpf: Don't error out on CO-RE relos for overriden weak subprogs x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation mptcp: reset the packet scheduler on PRIO change nl80211: show SSID for P2P_GO interfaces drm/komeda: Fix an undefined behavior bug in komeda_plane_add() drm: mali-dp: potential dereference of null pointer spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout scftorture: Fix distribution of short handler delays net: dsa: mt7530: 1G can also support 1000BASE-X link mode ixp4xx_eth: fix error check return value of platform_get_irq() NFC: NULL out the dev->rfkill to prevent UAF efi: Add missing prototype for efi_capsule_setup_info device property: Check fwnode->secondary when finding properties device property: Allow error pointer to be passed to fwnode APIs target: remove an incorrect unmap zeroes data deduction drbd: fix duplicate array initializer EDAC/dmc520: Don't print an error for each unconfigured interrupt line mtd: rawnand: denali: Use managed device resources HID: hid-led: fix maximum brightness for Dream Cheeky HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe regulator: da9121: Fix uninit-value in da9121_assign_chip_model() drm/mediatek: dpi: Use mt8183 output formats for mt8192 signal: Deliver SIGTRAP on perf event asynchronously if blocked sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq sched/psi: report zeroes for CPU full at the system level spi: img-spfi: Fix pm_runtime_get_sync() error checking cpufreq: Fix possible race in cpufreq online error path printk: use atomic updates for klogd work printk: add missing memory barrier to wake_up_klogd() printk: wake waiters for safe and NMI contexts ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix media: i2c: max9286: Use dev_err_probe() helper media: i2c: max9286: Use "maxim,gpio-poc" property media: i2c: max9286: fix kernel oops when removing module media: hantro: Empty encoder capture buffers by default drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it mtdblock: warn if opened on NAND inotify: show inotify mask flags in proc fdinfo fsnotify: fix wrong lockdep annotations spi: rockchip: Stop spi slave dma receiver when cs inactive spi: rockchip: Preset cs-high and clk polarity in setup progress spi: rockchip: fix missing error on unsupported SPI_CS_HIGH of: overlay: do not break notify on NOTIFY_{OK\|STOP} selftests/damon: add damon to selftests root Makefile drm/msm/dp: Modify prototype of encoder based API drm/msm/hdmi: switch to drm_bridge_connector drm/msm/dpu: adjust display_v_end for eDP and DP scsi: iscsi: Fix harmless double shift bug scsi: ufs: qcom: Fix ufs_qcom_resume() scsi: ufs: core: Exclude UECxx from SFR dump list drm/v3d: Fix null pointer dereference of pointer perfmon selftests/resctrl: Fix null pointer dereference on open failed libbpf: Fix logic for finding matching program for CO-RE relocation mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() x86/pm: Fix false positive kmemleak report in msr_build_context() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe() x86/speculation: Add missing prototype for unpriv_ebpf_notify() ASoC: rk3328: fix disabling mclk on pclk probe failure perf tools: Add missing headers needed by util/data.h drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/dp: reset DP controller before transmit phy test pattern drm/msm/dp: do not stop transmitting phy test pattern during DP phy compliance test drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() drm/msm: add missing include to msm_drv.c drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H kunit: fix debugfs code to use enum kunit_status, not bool drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA perf tools: Use Python devtools for version autodetection rather than runtime virtio_blk: fix the discard_granularity and discard_alignment queue limits nl80211: don't hold RTNL in color change request x86: Fix return value of __setup handlers irqchip/exiu: Fix acknowledgment of edge triggered interrupts irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value x86/mm: Cleanup the control_va_addr_alignment() __setup handler arm64: fix types in copy_highpage() regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET drm/msm/dsi: fix address for second DSI PHY on SDM660 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected drm/msm: return an error pointer in msm_gem_prime_get_sg_table() media: uvcvideo: Fix missing check to determine if element is found in list arm64: stackleak: fix current_top_of_stack() iomap: iomap_write_failed fix spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() Revert "cpufreq: Fix possible race in cpufreq online error path" regulator: qcom_smd: Fix up PM8950 regulator configuration samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is provided perf/amd/ibs: Use interrupt regs ip for stack unwinding ath11k: Don't check arvif->is_started before sending management frames wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice() HID: amd_sfh: Modify the bus name HID: amd_sfh: Modify the hid name ASoC: fsl: Use dev_err_probe() helper ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages ASoC: samsung: Use dev_err_probe() helper ASoC: samsung: Fix refcount leak in aries_audio_probe block: Fix the bio.bi_opf comment kselftest/cgroup: fix test_stress.sh to use OUTPUT dir scripts/faddr2line: Fix overlapping text section failures media: aspeed: Fix an error handling path in aspeed_video_probe() media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe mt76: mt7921: Fix the error handling path of mt7921_pci_probe() mt76: do not attempt to reorder received 802.3 packets without agg session media: st-delta: Fix PM disable depth imbalance in delta_probe media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe media: i2c: rdacm2x: properly set subdev entity function media: exynos4-is: Change clk_disable to clk_disable_unprepare media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init media: vsp1: Fix offset calculation for plane cropping media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check media: hantro: HEVC: Fix tile info buffer value computation Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring Bluetooth: use hdev lock for accept_list and reject_list in conn req nvme: set dma alignment to dword m68k: math-emu: Fix dependencies of math emulation support sctp: read sk->sk_bound_dev_if once in sctp_rcv() net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_ kselftest/arm64: bti: force static linking media: ov7670: remove ov7670_power_off from ov7670_remove media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR() media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() media: rkvdec: h264: Fix dpb_valid implementation media: rkvdec: h264: Fix bit depth wrap in pps packet regulator: scmi: Fix refcount leak in scmi_regulator_probe ext4: reject the 'commit' option on ext2 filesystems drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() x86/sev: Annotate stack change in the #VC handler drm/msm: don't free the IRQ if it was not requested selftests/bpf: Add missed ima_setup.sh in Makefile drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path drm/i915: Fix CFI violation with show_dynamic_id() thermal/drivers/bcm2711: Don't clamp temperature at zero thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe thermal/core: Fix memory leak in __thermal_cooling_device_register() thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe bfq: Relax waker detection for shared queues bfq: Allow current waker to defend against a tentative one ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() PM: domains: Fix initialization of genpd's next_wakeup net: macb: Fix PTP one step sync support NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() net: stmmac: selftests: Use kcalloc() instead of kzalloc() net: stmmac: fix out-of-bounds access in a selftest hv_netvsc: Fix potential dereference of NULL pointer hwmon: (pmbus) Check PEC support before reading other registers rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() hinic: Avoid some over memory allocation net: dsa: restrict SMSC_LAN9303_I2C kconfig net/smc: postpone sk_refcnt increment in connect() dma-direct: factor out dma_set_{de,en}crypted helpers dma-direct: don't call dma_set_decrypted for remapped allocations dma-direct: always leak memory that can't be re-encrypted dma-direct: don't over-decrypt memory arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 arm64: dts: mt8192: Fix nor_flash status disable typo PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 memory: samsung: exynos5422-dmc: Avoid some over memory allocation ARM: dts: BCM5301X: update CRU block description ARM: dts: BCM5301X: Update pin controller node name ARM: dts: suniv: F1C100: fix watchdog compatible soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() PCI: dwc: Fix setting error return on MSI DMA mapping failure ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks soc: qcom: llcc: Add MODULE_DEVICE_TABLE() KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault crypto: qat - set CIPHER capability for QAT GEN2 crypto: qat - set COMPRESSION capability for QAT GEN2 crypto: qat - set CIPHER capability for DH895XCC crypto: qat - set COMPRESSION capability for DH895XCC platform/chrome: cros_ec: fix error handling in cros_ec_register() ARM: dts: imx6dl-colibri: Fix I2C pinmuxing platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls can: xilinx_can: mark bit timing constants as const ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED ARM: dts: bcm2835-rpi-b: Fix GPIO line names misc: ocxl: fix possible double free in ocxl_file_register_afu crypto: marvell/cesa - ECB does not IV gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges arm: mediatek: select arch timer for mt7629 pinctrl/rockchip: support deferring other gpio params pinctrl: mediatek: mt8195: enable driver on mtk platforms arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero powerpc/fadump: fix PT_LOAD segment for boot memory area mfd: ipaq-micro: Fix error check return value of platform_get_irq() scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() soc: bcm: Check for NULL return of devm_kzalloc() arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get() ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname() ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path firmware: arm_scmi: Fix list protocols enumeration in the base protocol nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms pinctrl: mvebu: Fix irq_of_parse_and_map() return value drivers/base/node.c: fix compaction sysfs file leak dax: fix cache flush on PMD-mapped pages drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe firmware: arm_ffa: Remove incorrect assignment of driver_data list: introduce list_is_head() helper and re-use it in list.h list: fix a data-race around ep->rdllist drm/msm/dpu: fix error check return value of irq_of_parse_and_map() powerpc/8xx: export 'cpm_setbrg' for modules pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler RDMA/hns: Add the detection for CMDQ status in the device initialization process arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config arm64: dts: marvell: espressobin-ultra: enable front USB3 port ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component proc: fix dentry/inode overinstantiating under /proc/${pid}/net ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() PCI: imx6: Fix PERST# start-up sequence tty: fix deadlock caused by calling printk() under tty_port->lock crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg crypto: cryptd - Protect per-CPU resource by disabling BH. ARM: dts: at91: sama7g5: remove interrupt-parent from gic node hugetlbfs: fix hugetlbfs_statfs() locking Input: sparcspkr - fix refcount leak in bbc_beep_probe PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits PCI: microchip: Fix potential race in interrupt handling hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() powerpc/64: Only WARN if __pa()/__va() called with bad addresses powerpc/perf: Fix the threshold compare group constraint for power10 powerpc/perf: Fix the threshold compare group constraint for power9 macintosh: via-pmu and via-cuda need RTC_LIB powerpc/xive: Add some error handling code to 'xive_spapr_init()' powerpc/xive: Fix refcount leak in xive_spapr_init powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() nfsd: destroy percpu stats counters after reply cache shutdown mailbox: forward the hrtimer if not queued and under a lock RDMA/hfi1: Prevent use of lock before it is initialized KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer Input: stmfts - do not leave device disabled in stmfts_input_open OPP: call of_node_put() on error path in _bandwidth_supported() f2fs: support fault injection for dquot_initialize() f2fs: fix to do sanity check on inline_dots inode f2fs: fix dereference of stale list iterator after loop body iommu/amd: Enable swiotlb in all cases iommu/mediatek: Fix 2 HW sharing pgtable issue iommu/mediatek: Add list_del in mtk_iommu_remove iommu/mediatek: Remove clk_disable in mtk_iommu_remove iommu/mediatek: Add mutex for m4u_group and m4u_dom in data i2c: at91: use dma safe buffers cpufreq: mediatek: Use module_init and add module_exit cpufreq: mediatek: Unregister platform device on exit iommu/arm-smmu-v3-sva: Fix mm use-after-free MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon iommu/mediatek: Fix NULL pointer dereference when printing dev_name i2c: at91: Initialize dma_buf in at91_twi_xfer() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Don't report ENOSPC write errors twice NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout NFS: Further fixes to the writeback error handling video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() iommu/amd: Increase timeout waiting for GA log enablement i2c: npcm: Fix timeout calculation i2c: npcm: Correct register access width i2c: npcm: Handle spurious interrupts i2c: rcar: fix PM ref counts in probe error paths perf build: Fix btf__load_from_kernel_by_id() feature check perf c2c: Use stdio interface if slang is not supported perf jevents: Fix event syntax error caused by ExtSel video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup NFS: Always initialise fattr->label in nfs_fattr_alloc() NFS: Create a new nfs_alloc_fattr_with_label() function NFS: Convert GFP_NOFS to GFP_KERNEL NFSv4.1 mark qualified async operations as MOVEABLE tasks f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: don't need inode lock for system hidden quota f2fs: fix to do sanity check on total_data_blocks f2fs: don't use casefolded comparison for "." and ".." f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode objtool: Fix objtool regression on x32 systems objtool: Fix symbol creation wifi: mac80211: fix use-after-free in chanctx code iwlwifi: mvm: fix assert 1F04 upon reconfig fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages efi: Do not import certificates from UEFI Secure Boot for T2 Macs bfq: Avoid false marking of bic as stably merged bfq: Avoid merging queues with different parents bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls bfq: Track whether bfq_group is still online bfq: Get rid of __bio_blkcg() usage bfq: Make sure bfqg for which we are queueing requests is online ext4: mark group as trimmed only if it was fully scanned ext4: fix use-after-free in ext4_rename_dir_prepare ext4: fix race condition between ext4_write and ext4_convert_inline_data ext4: fix warning in ext4_handle_inode_extension ext4: fix bug_on in ext4_writepages ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state ext4: fix bug_on in __es_tree_search ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree ACPI: property: Release subnode properties with data nodes tty: goldfish: Introduce gf_ioread32()/gf_iowrite32() tracing: Fix potential double free in create_var_ref() tracing: Initialize integer variable to prevent garbage return value drm/amdgpu: add beige goby PCI ID PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() mm, compaction: fast_find_migrateblock() should return pfn in the target zone s390/perf: obtain sie_block from the right address s390/stp: clock_delta should be signed dlm: fix plock invalid read dlm: uninitialized variable on error in dlm_listen_for_all() dlm: fix missing lkb refcount handling ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock scsi: dc395x: Fix a missing check on list iterator scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled landlock: Add clang-format exceptions landlock: Format with clang-format selftests/landlock: Add clang-format exceptions selftests/landlock: Normalize array assignment selftests/landlock: Format with clang-format samples/landlock: Add clang-format exceptions samples/landlock: Format with clang-format landlock: Fix landlock_add_rule(2) documentation selftests/landlock: Make tests build with old libc selftests/landlock: Extend tests for minimal valid attribute size selftests/landlock: Add tests for unknown access rights selftests/landlock: Extend access right tests to directories selftests/landlock: Fully test file rename with "remove" access selftests/landlock: Add tests for O_PATH landlock: Change landlock_add_rule(2) argument check ordering landlock: Change landlock_restrict_self(2) check ordering selftests/landlock: Test landlock_create_ruleset(2) argument check ordering landlock: Define access_mask_t to enforce a consistent access mask size landlock: Reduce the maximum number of layers to 16 landlock: Create find_rule() from unmask_layers() landlock: Fix same-layer rule unions drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/nouveau/subdev/bus: Ratelimit logging for fault errors drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX drm/i915/dsi: fix VBT send packet port selection for ICL+ md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 ima: remove the IMA_TEMPLATE Kconfig option Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug RDMA/hfi1: Fix potential integer multiplication overflow errors mmc: core: Allows to override the timeout value for ioctl() path csky: patch_text: Fixup last cpu should be master irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip: irq-xtensa-mx: fix initial IRQ affinity thermal: devfreq_cooling: use local ops instead of global ops cfg80211: declare MODULE_FIRMWARE for regulatory.db mac80211: upgrade passive scan to active scan on DFS channels after beacon rx um: Use asm-generic/dma-mapping.h um: chan_user: Fix winch_tramp() return value um: Fix out-of-bounds read in LDT setup kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] ftrace: Clean up hash direct_functions on register failures ksmbd: fix outstanding credits related bugs iommu/msm: Fix an incorrect NULL check on list iterator iommu/dma: Fix iova map result check bug Revert "mm/cma.c: remove redundant cma_mutex lock" mm/page_alloc: always attempt to allocate at least one page during bulk allocation nodemask.h: fix compilation error with GCC12 hugetlb: fix huge_pmd_unshare address update mm/memremap: fix missing call to untrack_pfn() in pagemap_range() xtensa/simdisk: fix proc_read_simdisk() rtl818x: Prevent using not initialized queues ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket serial: pch: don't overwrite xmit->buf[0] by x_char tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator arm64: dts: qcom: ipq8074: fix the sleep clock frequency arm64: tegra: Add missing DFLL reset on Tegra210 clk: tegra: Add missing reset deassertion phy: qcom-qmp: fix struct clk leak on probe errors ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries ARM: pxa: maybe fix gpio lookup tables SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 dt-bindings: gpio: altera: correct interrupt-cells vdpasim: allow to enable a vq repeatedly blk-iolatency: Fix inflight count imbalances and IO hangs on offline coresight: core: Fix coresight device probe failure issue phy: qcom-qmp: fix reset-controller leak on probe errors net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() kseltest/cgroup: Make test_stress.sh work if run interactively list: test: Add a test for list_is_head() Revert "random: use static branch for crng_ready()" staging: r8188eu: delete rtw_wx_read/write32() RDMA/hns: Remove the num_cqc_timer variable RDMA/rxe: Generate a completion for unsupported/invalid opcode MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override ext4: only allow test_dummy_encryption when supported interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate fs: add two trivial lookup helpers exportfs: support idmapped mounts fs/ntfs3: Fix invalid free in log_replay md: Don't set mddev private to NULL in raid0 pers->free md: fix double free of io_acct_set bioset md: bcache: check the return value of kzalloc() in detached_dev_do_request() pinctrl/rockchip: support setting input-enable param block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Linux 5.15.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Id50a95d816e662c0cba3d09dbfd561f386d7a52e	2022-08-04 14:37:04 +02:00
Javier Martinez Canillas	13d28e0c79	fbdev: Disable sysfb device registration when removing conflicting FBs [ Upstream commit ee7a69aa38d87a3bbced7b8245c732c05ed0c6ec ] The platform devices registered by sysfb match with firmware-based DRM or fbdev drivers, that are used to have early graphics using a framebuffer provided by the system firmware. DRM or fbdev drivers later are probed and remove conflicting framebuffers, leading to these platform devices for generic drivers to be unregistered. But the current solution has a race, since the sysfb_init() function could be called after a DRM or fbdev driver is probed and request to unregister the devices for drivers with conflicting framebuffes. To prevent this, disable any future sysfb platform device registration by calling sysfb_disable(), if a driver requests to remove the conflicting framebuffers. Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20220607182338.344270-4-javierm@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-07-21 21:24:35 +02:00
Helge Deller	9c9e44bb3d	fbcon: Prevent that screen size is smaller than font size commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 upstream. We need to prevent that users configure a screen size which is smaller than the currently selected font size. Otherwise rendering chars on the screen will access memory outside the graphics memory region. This patch adds a new function fbcon_modechange_possible() which implements this check and which later may be extended with other checks if necessary. The new function is called from the FBIOPUT_VSCREENINFO ioctl handler in fbmem.c, which will return -EINVAL if userspace asked for a too small screen size. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-07-12 16:35:09 +02:00
Helge Deller	6886327780	fbcon: Disallow setting font bigger than screen size commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream. Prevent that users set a font size which is bigger than the physical screen. It's unlikely this may happen (because screens are usually much larger than the fonts and each font char is limited to 32x32 pixels), but it may happen on smaller screens/LCD displays. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-07-12 16:35:09 +02:00
Helge Deller	738d06ef99	fbmem: Check virtual screen sizes in fb_set_var() commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream. Verify that the fbdev or drm driver correctly adjusted the virtual screen sizes. On failure report the failing driver and reject the screen size change. Signed-off-by: Helge Deller <deller@gmx.de> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-07-12 16:35:09 +02:00
Guiling Deng	989b2c4032	fbdev: fbmem: Fix logo center image dx issue commit 955f04766d4e6eb94bf3baa539e096808c74ebfb upstream. Image.dx gets wrong value because of missing '()'. If xres == logo->width and n == 1, image.dx = -16. Signed-off-by: Guiling Deng <greens9@163.com> Fixes: `3d8b1933eb` ("fbdev: fbmem: add config option to center the bootup logo") Cc: stable@vger.kernel.org # v5.0+ Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-07-12 16:35:09 +02:00
Daniel Vetter	0781b56404	fbcon: Consistently protect deferred_takeover with console_lock() [ Upstream commit 43553559121ca90965b572cf8a1d6d0fd618b449 ] This shouldn't be a problem in practice since until we've actually taken over the console there's nothing we've registered with the console/vt subsystem, so the exit/unbind path that check this can't do the wrong thing. But it's confusing, so fix it by moving it a tad later. Acked-by: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Du Cheng <ducheng2@gmail.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Claudio Suarez <cssk@net-c.es> Cc: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-14-daniel.vetter@ffwll.ch Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:31 +02:00
Greg Kroah-Hartman	813550e7cc	Merge 5.15.42 into android13-5.15-lts Changes in 5.15.42 usb: gadget: fix race when gadget driver register via ioctl io_uring: arm poll for non-nowait files floppy: use a statically allocated error counter kernel/resource: Introduce request_mem_region_muxed() i2c: piix4: Replace hardcoded memory map size with a #define i2c: piix4: Move port I/O region request/release code into functions i2c: piix4: Move SMBus controller base address detect into function i2c: piix4: Move SMBus port selection into function i2c: piix4: Add EFCH MMIO support to region request and release i2c: piix4: Add EFCH MMIO support to SMBus base address detect i2c: piix4: Add EFCH MMIO support for SMBus port select i2c: piix4: Enable EFCH MMIO for Family 17h+ Watchdog: sp5100_tco: Move timer initialization into function Watchdog: sp5100_tco: Refactor MMIO base address initialization Watchdog: sp5100_tco: Add initialization using EFCH MMIO Watchdog: sp5100_tco: Enable Family 17h+ CPUs mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" rtc: fix use-after-free on device removal rtc: pcf2127: fix bug when reading alarm registers um: Cleanup syscall_handler_t definition/cast, fix warning Input: add bounds checking to input_set_capability() Input: stmfts - fix reference leak in stmfts_input_open nvme-pci: add quirks for Samsung X5 SSDs gfs2: Disable page faults during lockless buffered reads rtc: sun6i: Fix time overflow handling crypto: stm32 - fix reference leak in stm32_crc_remove crypto: x86/chacha20 - Avoid spurious jumps to other functions ALSA: hda/realtek: Enable headset mic on Lenovo P360 s390/traps: improve panic message for translation-specification exception s390/pci: improve zpci_dev reference counting vhost_vdpa: don't setup irq offloading when irq_num < 0 tools/virtio: compile with -pthread nvmet: use a private workqueue instead of the system workqueue nvme-multipath: fix hang when disk goes live over reconnect rtc: mc146818-lib: Fix the AltCentury for AMD platforms fs: fix an infinite loop in iomap_fiemap MIPS: lantiq: check the return value of kzalloc() drbd: remove usage of list iterator variable after loop platform/chrome: cros_ec_debugfs: detach log reader wq from devm ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() nilfs2: fix lockdep warnings in page operations for btree nodes nilfs2: fix lockdep warnings during disk space reclamation ALSA: usb-audio: Restore Rane SL-1 quirk ALSA: wavefront: Proper check of get_user() error ALSA: hda/realtek: Add quirk for TongFang devices with pop noise perf: Fix sys_perf_event_open() race against self selinux: fix bad cleanup on error in hashtab_duplicate() Fix double fget() in vhost_net_set_backend() PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold Revert "can: m_can: pci: use custom bit timings for Elkhart Lake" KVM: x86/mmu: Update number of zapped pages even if page list is stable arm64: paravirt: Use RCU read locks to guard stolen_time arm64: mte: Ensure the cleared tags are visible before setting the PTE crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ libceph: fix potential use-after-free on linger ping and resends drm/amd: Don't reset dGPUs if the system is going to s2idle drm/i915/dmc: Add MMIO range restrictions drm/dp/mst: fix a possible memory leak in fetch_monitor_name() dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace dma-buf: ensure unique directory name for dmabuf stats ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group ARM: dts: aspeed: Add ADC for AST2600 and enable for Rainier and Everest ARM: dts: aspeed: Add secure boot controller node ARM: dts: aspeed: Add video engine to g6 pinctrl: mediatek: mt8365: fix IES control pins ALSA: hda - fix unused Realtek function when PM is not enabled net: ipa: record proper RX transaction count net: macb: Increment rx bd head after allocating skb and buffer xfrm: rework default policy structure xfrm: fix "disable_policy" flag use when arriving from different devices net/sched: act_pedit: sanitize shift argument before usage netfilter: flowtable: fix excessive hw offload attempts after failure netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices net: fix dev_fill_forward_path with pppoe + bridge netfilter: nft_flow_offload: fix offload with pppoe + vlan Revert "PCI: aardvark: Rewrite IRQ code to chained IRQ handler" net: systemport: Fix an error handling path in bcm_sysport_probe() net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() ice: fix crash when writing timestamp on RX rings ice: fix possible under reporting of ethtool Tx and Rx statistics ice: move ice_container_type onto ice_ring_container ice: Fix interrupt moderation settings getting cleared clk: at91: generated: consider range when calculating best rate net/qla3xxx: Fix a test in ql_reset_work() NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc net/mlx5: DR, Fix missing flow_source when creating multi-destination FW table net/mlx5e: Properly block LRO when XDP is enabled net: af_key: add check for pfkey_broadcast in function pfkey_process ARM: 9196/1: spectre-bhb: enable for Cortex-A15 ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 mptcp: change the parameter of __mptcp_make_csum mptcp: reuse __mptcp_make_csum in validate_data_csum mptcp: fix checksum byte order igb: skip phy status check where unavailable netfilter: flowtable: fix TCP flow teardown netfilter: flowtable: pass flowtable to nf_flow_table_iterate() netfilter: flowtable: move dst_check to packet path net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. riscv: dts: sifive: fu540-c000: align dma node name with dtschema scsi: ufs: core: Fix referencing invalid rsp field perf build: Fix check for btf__load_from_kernel_by_id() in libbpf gpio: gpio-vf610: do not touch other bits when set the target bit gpio: mvebu/pwm: Refuse requests with inverted polarity perf regs x86: Fix arch__intr_reg_mask() for the hybrid platform perf bench numa: Address compiler error on s390 scsi: scsi_dh_alua: Properly handle the ALUA transitioning state scsi: qla2xxx: Fix missed DMA unmap for aborted commands mac80211: fix rx reordering with non explicit / psmp ack policy nl80211: validate S1G channel width selftests: add ping test with ping_group_range tuned Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered" fbdev: Prevent possible use-after-free in fb_release() net: fix wrong network header length nl80211: fix locking in nl80211_set_tx_bitrate_mask() ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() net: atlantic: fix "frag[0] not initialized" net: atlantic: reduce scope of is_rsc_complete net: atlantic: add check for MAX_SKB_FRAGS net: atlantic: verify hw_head_ lies within TX buffer ring arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs Input: ili210x - fix reset timing dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group mt76: mt7921e: fix possible probe failure after reboot lockdown: also lock down previous kgdb use i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() afs: Fix afs_getattr() to refetch file status if callback break occurred Linux 5.15.42 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ifad49f172050c7f8d07f9432a48766cfd5ddf2ca	2022-06-06 16:38:53 +02:00
Daniel Vetter	4f631f9f9d	fbdev: Prevent possible use-after-free in fb_release() [ Upstream commit 89bfd4017e58faaf70411555e7f508495114e90b ] Most fbdev drivers have issues with the fb_info lifetime, because call to framebuffer_release() from their driver's .remove callback, rather than doing from fbops.fb_destroy callback. Doing that will destroy the fb_info too early, while references to it may still exist, leading to a use-after-free error. To prevent this, check the fb_info reference counter when attempting to kfree the data structure in framebuffer_release(). That will leak it but at least will prevent the mentioned error. Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220505220413.365977-1-javierm@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-05-25 09:57:35 +02:00
Javier Martinez Canillas	92dc6278de	Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered" [ Upstream commit 135332f34ba2662bc1e32b5c612e06a8cc41a053 ] This reverts commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a. That commit attempted to fix a NULL pointer dereference, caused by the struct fb_info associated with a framebuffer device to not longer be valid when the file descriptor was closed. The issue was exposed by commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal"), which added a new path that goes through the struct device removal instead of directly unregistering the fb. Most fbdev drivers have issues with the fb_info lifetime, because call to framebuffer_release() from their driver's .remove callback, rather than doing from fbops.fb_destroy callback. This meant that due to this switch, the fb_info was now destroyed too early, while references still existed, while before it was simply leaked. The patch we're reverting here reinstated that leak, hence "fixed" the regression. But the proper solution is to fix the drivers to not release the fb_info too soon. Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20220504115917.758787-1-javierm@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-05-25 09:57:35 +02:00
Greg Kroah-Hartman	2bde857bee	Merge 5.15.39 into android13-5.15 Changes in 5.15.39 MIPS: Fix CP0 counter erratum detection for R4k CPUs parisc: Merge model and model name into one line in /proc/cpuinfo ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes mmc: sdhci-msm: Reset GCC_SDCC_BCR register for SDHC mmc: sunxi-mmc: Fix DMA descriptors allocated above 32 bits mmc: core: Set HS clock speed before sending HS CMD13 gpiolib: of: fix bounds check for 'gpio-reserved-ranges' x86/fpu: Prevent FPU state corruption KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id iommu/vt-d: Calculate mask for non-aligned flushes iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range() drm/amd/display: Avoid reading audio pattern past AUDIO_CHANNELS_COUNT drm/amdgpu: do not use passthrough mode in Xen dom0 RISC-V: relocate DTB if it's outside memory region Revert "SUNRPC: attempt AF_LOCAL connect on setup" timekeeping: Mark NMI safe time accessors as notrace firewire: fix potential uaf in outbound_phy_packet_callback() firewire: remove check of list iterator against head past the loop body firewire: core: extend card->lock in fw_core_handle_bus_reset net: stmmac: disable Split Header (SPH) for Intel platforms genirq: Synchronize interrupt thread startup ASoC: da7219: Fix change notifications for tone generator frequency ASoC: wm8958: Fix change notifications for DSP controls ASoC: meson: Fix event generation for AUI ACODEC mux ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux s390/dasd: fix data corruption for ESE devices s390/dasd: prevent double format of tracks for ESE devices s390/dasd: Fix read for ESE with blksize < 4k s390/dasd: Fix read inconsistency for ESE DASD devices can: grcan: grcan_close(): fix deadlock can: isotp: remove re-binding of bound socket can: grcan: use ofdev->dev when allocating DMA memory can: grcan: grcan_probe(): fix broken system id check for errata workaround needs can: grcan: only use the NAPI poll budget for RX nfc: replace improper check device_is_registered() in netlink related functions nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs NFC: netlink: fix sleep in atomic bug when firmware download timeout gpio: visconti: Fix fwnode of GPIO IRQ gpio: pca953x: fix irq_stat not updated when irq is disabled (irq_mask not set) hwmon: (adt7470) Fix warning on module removal hwmon: (pmbus) disable PEC if not enabled ASoC: dmaengine: Restore NULL prepare_slave_config() callback ASoC: soc-ops: fix error handling iommu/vt-d: Drop stop marker messages iommu/dart: check return value after calling platform_get_resource() net/mlx5e: Fix trust state reset in reload net/mlx5e: Don't match double-vlan packets if cvlan is not set net/mlx5e: CT: Fix queued up restore put() executing after relevant ft release net/mlx5e: Fix the calling of update_buffer_lossy() API net/mlx5: Avoid double clear or set of sync reset requested net/mlx5: Fix deadlock in sync reset flow selftests/seccomp: Don't call read() on TTY from background pgrp SUNRPC release the transport of a relocated task with an assigned transport RDMA/siw: Fix a condition race issue in MPA request processing RDMA/irdma: Flush iWARP QP if modified to ERR from RTR state RDMA/irdma: Reduce iWARP QP destroy time RDMA/irdma: Fix possible crash due to NULL netdev in notifier NFSv4: Don't invalidate inode attributes on delegation return net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init() net: dsa: mt7530: add missing of_node_put() in mt7530_setup() net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux() net: mdio: Fix ENOMEM return value in BCM6368 mux bus controller net: cpsw: add missing of_node_put() in cpsw_probe_dt() net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() net: emaclite: Add error handling for of_address_to_resource() selftests/net: so_txtime: fix parsing of start time stamp on 32 bit systems selftests/net: so_txtime: usage(): fix documentation of default clock drm/msm/dp: remove fail safe mode related code btrfs: do not BUG_ON() on failure to update inode when setting xattr hinic: fix bug of wq out of bound access mld: respect RCU rules in ip6_mc_source() and ip6_mc_msfilter() rxrpc: Enable IPv6 checksums on transport socket selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag bnxt_en: Fix unnecessary dropping of RX packets selftests: ocelot: tc_flower_chains: specify conform-exceed action for policer smsc911x: allow using IRQ0 btrfs: force v2 space cache usage for subpage mount btrfs: always log symlinks in full mode drm/amdgpu: unify BO evicting method in amdgpu_ttm drm/amdgpu: explicitly check for s0ix when evicting resources drm/amdgpu: don't set s3 and s0ix at the same time drm/amdgpu: Ensure HDA function is suspended before ASIC reset gpio: mvebu: drop pwm base assignment kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU fbdev: Make fb_release() return -ENODEV if fbdev was unregistered net/mlx5: Fix slab-out-of-bounds while reading resource dump menu net/mlx5e: Lag, Fix use-after-free in fib event handler net/mlx5e: Lag, Fix fib_info pointer assignment net/mlx5e: Lag, Don't skip fib events on current dst iommu/dart: Add missing module owner to ops structure kvm: selftests: do not use bitfields larger than 32-bits for PTEs KVM: selftests: Silence compiler warning in the kvm_page_table_test x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume KVM: x86: Do not change ICR on write to APIC_SELF_IPI KVM: x86/mmu: avoid NULL-pointer dereference on page freeing bugs KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised selftest/vm: verify mmap addr in mremap_test selftest/vm: verify remap destination address in mremap_test mmc: rtsx: add 74 Clocks in power on flow Revert "parisc: Mark sched_clock unstable only if clocks are not syncronized" rcu: Fix callbacks processing time limit retaining cond_resched() rcu: Apply callbacks processing time limit only on softirq PCI: pci-bridge-emul: Add description for class_revision field PCI: pci-bridge-emul: Add definitions for missing capabilities registers PCI: aardvark: Add support for DEVCAP2, DEVCTL2, LNKCAP2 and LNKCTL2 registers on emulated bridge PCI: aardvark: Clear all MSIs at setup PCI: aardvark: Comment actions in driver remove method PCI: aardvark: Disable bus mastering when unbinding driver PCI: aardvark: Mask all interrupts when unbinding driver PCI: aardvark: Fix memory leak in driver unbind PCI: aardvark: Assert PERST# when unbinding driver PCI: aardvark: Disable link training when unbinding driver PCI: aardvark: Disable common PHY when unbinding driver PCI: aardvark: Replace custom PCIE_CORE_INT_* macros with PCI_INTERRUPT_* PCI: aardvark: Rewrite IRQ code to chained IRQ handler PCI: aardvark: Check return value of generic_handle_domain_irq() when processing INTx IRQ PCI: aardvark: Make MSI irq_chip structures static driver structures PCI: aardvark: Make msi_domain_info structure a static driver structure PCI: aardvark: Use dev_fwnode() instead of of_node_to_fwnode(dev->of_node) PCI: aardvark: Refactor unmasking summary MSI interrupt PCI: aardvark: Add support for masking MSI interrupts PCI: aardvark: Fix setting MSI address PCI: aardvark: Enable MSI-X support PCI: aardvark: Add support for ERR interrupt on emulated bridge PCI: aardvark: Optimize writing PCI_EXP_RTCTL_PMEIE and PCI_EXP_RTSTA_PME on emulated bridge PCI: aardvark: Add support for PME interrupts PCI: aardvark: Fix support for PME requester on emulated bridge PCI: aardvark: Use separate INTA interrupt for emulated root bridge PCI: aardvark: Remove irq_mask_ack() callback for INTx interrupts PCI: aardvark: Don't mask irq when mapping PCI: aardvark: Drop __maybe_unused from advk_pcie_disable_phy() PCI: aardvark: Update comment about link going down after link-up Linux 5.15.39 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic51d6d05a0d99156c6fd844786e984aff8e7386a	2022-05-18 09:38:58 +02:00
Javier Martinez Canillas	161568b749	fbdev: Make fb_release() return -ENODEV if fbdev was unregistered [ Upstream commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a ] A reference to the framebuffer device struct fb_info is stored in the file private data, but this reference could no longer be valid and must not be accessed directly. Instead, the file_fb_info() accessor function must be used since it does sanity checking to make sure that the fb_info is valid. This can happen for example if the registered framebuffer device is for a driver that just uses a framebuffer provided by the system firmware. In that case, the fbdev core would unregister the framebuffer device when a real video driver is probed and ask to remove conflicting framebuffers. The bug has been present for a long time but commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") unmasked it since the fbdev core started unregistering the framebuffers' devices associated. Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") Reported-by: Maxime Ripard <maxime@cerno.tech> Reported-by: Junxiao Chang <junxiao.chang@intel.com> Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20220502135014.377945-1-javierm@redhat.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-05-12 12:30:22 +02:00
Greg Kroah-Hartman	7c41694559	Revert "Revert "fbdev: Hot-unplug firmware fb devices on forced removal"" This reverts commit `5cc70dfa47`. It is no longer needed as we are able to update the abi at this point in time. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8727d672ee887e1598d1661bbcd99061dcdae4d2	2022-05-04 13:39:11 -07:00
Greg Kroah-Hartman	5cc70dfa47	Revert "fbdev: Hot-unplug firmware fb devices on forced removal" This reverts commit `c894ac4478`. It breaks the kernel abi so revert it for now. We will add it back later at the next kabi update. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3ea6942053c06dac9e05d6a05081e404e10324eb	2022-04-20 08:19:54 +02:00
Thomas Zimmermann	2388f826cd	fbdev: Fix unregistering of framebuffers without device commit 0f525289ff0ddeb380813bd81e0f9bdaaa1c9078 upstream. OF framebuffers do not have an underlying device in the Linux device hierarchy. Do a regular unregister call instead of hot unplugging such a non-existing device. Fixes a NULL dereference. An example error message on ppc64le is shown below. BUG: Kernel NULL pointer dereference on read at 0x00000060 Faulting instruction address: 0xc00000000080dfa4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [...] CPU: 2 PID: 139 Comm: systemd-udevd Not tainted 5.17.0-ae085d7f9365 #1 NIP: c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430 REGS: c000000004132fe0 TRAP: 0300 Not tainted (5.17.0-ae085d7f9365) MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28228282 XER: 20000000 CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0 GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029 GPR04: 00000000ffffefff c000000004132f90 c000000004132f88 0000000000000000 GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283 GPR12: 0000000000000000 c00000003fffe300 0000000020000000 0000000000000000 GPR16: 0000000000000000 0000000113fc4a40 0000000000000005 0000000113fcfb80 GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0 GPR24: 0000000000000001 00000000000a0000 c008000000db0168 c0000000021f6ec0 GPR28: c0000000016d65a8 c000000004b36460 0000000000000000 c0000000016d64b0 NIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0 [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (unreliable) [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150 [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0 [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm] [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs] [...] [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0 [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250 The bug [1] was introduced by commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal"). Most firmware framebuffers have an underlying platform device, which can be hot-unplugged before loading the native graphics driver. OF framebuffers do not (yet) have that device. Fix the code by unregistering the framebuffer as before without a hot unplug. Tested with 5.17 on qemu ppc64le emulation. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") Reported-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Cc: Zack Rusin <zackr@vmware.com> Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Hans de Goede <hdegoede@redhat.com> Cc: stable@vger.kernel.org # v5.11+ Cc: Helge Deller <deller@gmx.de> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Sam Ravnborg <sam@ravnborg.org> Cc: Zheyu Ma <zheyuma97@gmail.com> Cc: Xiyu Yang <xiyuyang19@fudan.edu.cn> Cc: Zhen Lei <thunder.leizhen@huawei.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Cc: Guenter Roeck <linux@roeck-us.net> Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Link: https://lore.kernel.org/all/YkHXO6LGHAN0p1pq@debian/ # [1] Link: https://patchwork.freedesktop.org/patch/msgid/20220404194402.29974-1-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-13 20:59:24 +02:00
Dan Carpenter	c3364cbc37	video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() [ Upstream commit 78482af095abd9f4f29f1aa3fe575d25c6ae3028 ] This code has two bugs: 1) "cnt" is 255 but the size of the buffer is 256 so the last byte is not used. 2) If we try to print more than 255 characters then "cnt" will be negative and that will trigger a WARN() in snprintf(). The fix for this is to use scnprintf() instead of snprintf(). We can re-write this code to be cleaner: 1) Rename "offset" to "off" because that's shorter. 2) Get rid of the "cnt" variable and just use "size - off" directly. 3) Get rid of the "read" variable and just increment "off" directly. Fixes: `96fe6a2109` ("fbdev: Add VESA Coordinated Video Timings (CVT) support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:15 +02:00
Thomas Zimmermann	c894ac4478	fbdev: Hot-unplug firmware fb devices on forced removal commit 27599aacbaefcbf2af7b06b0029459bbf682000d upstream. Hot-unplug all firmware-framebuffer devices as part of removing them via remove_conflicting_framebuffers() et al. Releases all memory regions to be acquired by native drivers. Firmware, such as EFI, install a framebuffer while posting the computer. After removing the firmware-framebuffer device from fbdev, a native driver takes over the hardware and the firmware framebuffer becomes invalid. Firmware-framebuffer drivers, specifically simplefb, don't release their device from Linux' device hierarchy. It still owns the firmware framebuffer and blocks the native drivers from loading. This has been observed in the vmwgfx driver. [1] Initiating a device removal (i.e., hot unplug) as part of remove_conflicting_framebuffers() removes the underlying device and returns the memory range to the system. [1] https://lore.kernel.org/dri-devel/20220117180359.18114-1-zack@kde.org/ v2: * rename variable 'dev' to 'device' (Javier) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reported-by: Zack Rusin <zackr@vmware.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Zack Rusin <zackr@vmware.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> CC: stable@vger.kernel.org # v5.11+ Link: https://patchwork.freedesktop.org/patch/msgid/20220125091222.21457-2-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:22:59 +02:00
Helge Deller	3523167d66	fbcon: Avoid 'cap' set but not used warning [ Upstream commit 50b10528aad568c95f772039d4b3093b4aea7439 ] Fix this kernel test robot warning: drivers/video/fbdev/core/fbcon.c: In function 'fbcon_init': drivers/video/fbdev/core/fbcon.c:1028:6: warning: variable 'cap' set but not used [-Wunused-but-set-variable] The cap variable is only used when CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is enabled. Drop the temporary variable and use info->flags instead. Fixes: 87ab9f6b7417 ("Revert "fbcon: Disable accelerated scrolling") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/YgFB4xqI+As196FR@p100 Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-02-16 12:56:27 +01:00
Helge Deller	778283dc28	fbcon: Add option to enable legacy hardware acceleration commit a3f781a9d6114c1d1e01defb7aa234dec45d2a5f upstream. Add a config option CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION to enable bitblt and fillrect hardware acceleration in the framebuffer console. If disabled, such acceleration will not be used, even if it is supported by the graphics hardware driver. If you plan to use DRM as your main graphics output system, you should disable this option since it will prevent compiling in code which isn't used later on when DRM takes over. For all other configurations, e.g. if none of your graphic cards support DRM (yet), DRM isn't available for your architecture, or you can't be sure that the graphic card in the target system will support DRM, you most likely want to enable this option. In the non-accelerated case (e.g. when DRM is used), the inlined fb_scrollmode() function is hardcoded to return SCROLL_REDRAW and as such the compiler is able to optimize much unneccesary code away. In this v3 patch version I additionally changed the GETVYRES() and GETVXRES() macros to take a pointer to the fbcon_display struct. This fixes the build when console rotation is enabled and helps the compiler again to optimize out code. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20220202135531.92183-4-deller@gmx.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-08 18:34:06 +01:00
Helge Deller	2a2629db42	Revert "fbcon: Disable accelerated scrolling" commit 87ab9f6b7417349aa197a6c7098d4fdd4beebb74 upstream. This reverts commit `39aead8373`. Revert the first (of 2) commits which disabled scrolling acceleration in fbcon/fbdev. It introduced a regression for fbdev-supported graphic cards because of the performance penalty by doing screen scrolling by software instead of using the existing graphic card 2D hardware acceleration. Console scrolling acceleration was disabled by dropping code which checked at runtime the driver hardware capabilities for the BINFO_HWACCEL_COPYAREA or FBINFO_HWACCEL_FILLRECT flags and if set, it enabled scrollmode SCROLL_MOVE which uses hardware acceleration to move screen contents. After dropping those checks scrollmode was hard-wired to SCROLL_REDRAW instead, which forces all graphic cards to redraw every character at the new screen position when scrolling. This change effectively disabled all hardware-based scrolling acceleration for ALL drivers, because now all kind of 2D hardware acceleration (bitblt, fillrect) in the drivers isn't used any longer. The original commit message mentions that only 3 DRM drivers (nouveau, omapdrm and gma500) used hardware acceleration in the past and thus code for checking and using scrolling acceleration is obsolete. This statement is NOT TRUE, because beside the DRM drivers there are around 35 other fbdev drivers which depend on fbdev/fbcon and still provide hardware acceleration for fbdev/fbcon. The original commit message also states that syzbot found lots of bugs in fbcon and thus it's "often the solution to just delete code and remove features". This is true, and the bugs - which actually affected all users of fbcon, including DRM - were fixed, or code was dropped like e.g. the support for software scrollback in vgacon (commit `973c096f6a`). So to further analyze which bugs were found by syzbot, I've looked through all patches in drivers/video which were tagged with syzbot or syzkaller back to year 2005. The vast majority fixed the reported issues on a higher level, e.g. when screen is to be resized, or when font size is to be changed. The few ones which touched driver code fixed a real driver bug, e.g. by adding a check. But NONE of those patches touched code of either the SCROLL_MOVE or the SCROLL_REDRAW case. That means, there was no real reason why SCROLL_MOVE had to be ripped-out and just SCROLL_REDRAW had to be used instead. The only reason I can imagine so far was that SCROLL_MOVE wasn't used by DRM and as such it was assumed that it could go away. That argument completely missed the fact that SCROLL_MOVE is still heavily used by fbdev (non-DRM) drivers. Some people mention that using memcpy() instead of the hardware acceleration is pretty much the same speed. But that's not true, at least not for older graphic cards and machines where we see speed decreases by factor 10 and more and thus this change leads to console responsiveness way worse than before. That's why the original commit is to be reverted. By reverting we reintroduce hardware-based scrolling acceleration and fix the performance regression for fbdev drivers. There isn't any impact on DRM when reverting those patches. Signed-off-by: Helge Deller <deller@gmx.de> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Sven Schnelle <svens@stackframe.org> Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20220202135531.92183-3-deller@gmx.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-08 18:34:06 +01:00
Alex Deucher	fa3d8456f7	fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb commit 9a45ac2320d0a6ae01880a30d4b86025fce4061b upstream. Add a function for drivers to check if the a firmware initialized fb is corresponds to their aperture. This allows drivers to check if the device corresponds to what the firmware set up as the display device. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215203 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-11 15:35:16 +01:00
Tetsuo Handa	8c28051cdc	fbmem: don't allow too huge resolutions syzbot is reporting page fault at vga16fb_fillrect() [1], for vga16fb_check_var() is failing to detect multiplication overflow. if (vxres * vyres > maxmem) { vyres = maxmem / vxres; if (vyres < yres) return -ENOMEM; } Since no module would accept too huge resolutions where multiplication overflow happens, let's reject in the common path. Link: https://syzkaller.appspot.com/bug?extid=04168c8063cfdde1db5e [1] Reported-by: syzbot <syzbot+04168c8063cfdde1db5e@syzkaller.appspotmail.com> Debugged-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/185175d6-227a-7b55-433d-b070929b262c@i-love.sakura.ne.jp	2021-09-08 18:52:04 +02:00
Dave Airlie	8da49a33dd	Merge tag 'drm-misc-next-2021-07-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next for v5.15-rc1: UAPI Changes: - Remove sysfs stats for dma-buf attachments, as it causes a performance regression. Previous merge is not in a rc kernel yet, so no userspace regression possible. Cross-subsystem Changes: - Sanitize user input in kyro's viewport ioctl. - Use refcount_t in fb_info->count - Assorted fixes to dma-buf. - Extend x86 efifb handling to all archs. - Fix neofb divide by 0. - Document corpro,gm7123 bridge dt bindings. Core Changes: - Slightly rework drm master handling. - Cleanup vgaarb handling. - Assorted fixes. Driver Changes: - Add support for ws2401 panel. - Assorted fixes to stm, ast, bochs. - Demidlayer ingenic irq. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/2d0d2fe8-01fc-e216-c3fd-38db9e69944e@linux.intel.com	2021-07-23 11:32:43 +10:00
Xiyu Yang	0189cb57b9	fbmem: Convert from atomic_t to refcount_t on fb_info->count refcount_t type and corresponding API can protect refcounters from accidental underflow and overflow and further use-after-free situations. Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Link: https://patchwork.freedesktop.org/patch/msgid/1626674392-55857-1-git-send-email-xiyuyang19@fudan.edu.cn	2021-07-19 22:16:35 +02:00
Zhen Lei	0af778269a	fbmem: Do not delete the mode that is still in use The execution of fb_delete_videomode() is not based on the result of the previous fbcon_mode_deleted(). As a result, the mode is directly deleted, regardless of whether it is still in use, which may cause UAF. ================================================================== BUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \ drivers/video/fbdev/core/modedb.c:924 Read of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962 CPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x137/0x1be lib/dump_stack.c:118 print_address_description+0x6c/0x640 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x13d/0x1e0 mm/kasan/report.c:562 fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924 fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746 fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 18960: kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x3d/0x70 mm/kasan/common.c:56 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1541 [inline] slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574 slab_free mm/slub.c:3139 [inline] kfree+0xca/0x3d0 mm/slub.c:4121 fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104 fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: `13ff178ccd` ("fbcon: Call fbcon_mode_deleted/new_modelist directly") Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Cc: <stable@vger.kernel.org> # v5.3+ Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210712085544.2828-1-thunder.leizhen@huawei.com	2021-07-13 17:01:38 +02:00
Matthew Wilcox	0b78f8bcf4	Revert "fb_defio: Remove custom address_space_operations" Commit `ccf953d8f3` makes framebuffers which use deferred I/O stop displaying updates after the first one. This is because the pages handled by fb_defio no longer have a page_mapping(). That prevents page_mkclean() from marking the PTEs as clean, and so writes are only noticed the first time. Reported-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/YLZEhv0cpZp8uVE3@casper.infradead.org	2021-06-01 17:38:40 +02:00
Tetsuo Handa	ffb324e6f8	tty: vt: always invoke vc->vc_sw->con_resize callback syzbot is reporting OOB write at vga16fb_imageblit() [1], for resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether requested rows/columns fit the amount of memory reserved for the graphical screen if current mode is KD_GRAPHICS. ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kd.h> #include <linux/vt.h> int main(int argc, char *argv[]) { const int fd = open("/dev/char/4:1", O_RDWR); struct vt_sizes vt = { 0x4100, 2 }; ioctl(fd, KDSETMODE, KD_GRAPHICS); ioctl(fd, VT_RESIZE, &vt); ioctl(fd, KDSETMODE, KD_TEXT); return 0; } ---------- Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode != KD_GRAPHICS check from resize_screen() to fbcon_resize(). Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1] Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2021-05-15 08:12:12 -07:00
Linus Torvalds	6dae40aed4	fbmem: fix horribly incorrect placement of __maybe_unused Commit `b9d79e4ca4` ("fbmem: Mark proc_fb_seq_ops as __maybe_unused") places the '__maybe_unused' in an entirely incorrect location between the "struct" keyword and the structure name. It's a wonder that gcc accepts that silently, but clang quite reasonably warns about it: drivers/video/fbdev/core/fbmem.c:736:21: warning: attribute declaration must precede definition [-Wignored-attributes] static const struct __maybe_unused seq_operations proc_fb_seq_ops = { ^ Fix it. Cc: Guenter Roeck <linux@roeck-us.net> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2021-05-09 14:03:33 -07:00
Linus Torvalds	efc58a96ad	Merge tag 'drm-next-2021-05-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Bit later than usual, I queued them all up on Friday then promptly forgot to write the pull request email. This is mainly amdgpu fixes, with some radeon/msm/fbdev and one i915 gvt fix thrown in. amdgpu: - MPO hang workaround - Fix for concurrent VM flushes on vega/navi - dcefclk is not adjustable on navi1x and newer - MST HPD debugfs fix - Suspend/resumes fixes - Register VGA clients late in case driver fails to load - Fix GEM leak in user framebuffer create - Add support for polaris12 with 32 bit memory interface - Fix duplicate cursor issue when using overlay - Fix corruption with tiled surfaces on VCN3 - Add BO size and stride check to fix BO size verification radeon: - Fix off-by-one in power state parsing - Fix possible memory leak in power state parsing msm: - NULL ptr dereference fix fbdev: - procfs disabled warning fix i915: - gvt: Fix a possible division by zero in vgpu display rate calculation" * tag 'drm-next-2021-05-10' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: Use device specific BO size & stride check. drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode. drm/amd/pm: initialize variable drm/radeon: Avoid power table parsing memory leaks drm/radeon: Fix off-by-one power_state index heap overwrite drm/amd/display: Fix two cursor duplication when using overlay drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC fbmem: Mark proc_fb_seq_ops as __maybe_unused drm/msm/dpu: Delete bonkers code drm/i915/gvt: Prevent divided by zero when calculating refresh rate amdgpu: fix GEM obj leak in amdgpu_display_user_framebuffer_create drm/amdgpu: Register VGA clients after init can no longer fail drm/amdgpu: Handling of amdgpu_device_resume return value for graceful teardown drm/amdgpu: fix r initial values drm/amd/display: fix wrong statement in mst hpd debugfs amdgpu/pm: set pp_dpm_dcefclk to readonly on NAVI10 and newer gpus amdgpu/pm: Prevent force of DCEFCLK on NAVI10 and SIENNA_CICHLID drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 drm/amd/display: Reject non-zero src_y and src_x for video planes	2021-05-09 13:42:39 -07:00
Dave Airlie	59e528c5bc	Merge tag 'drm-misc-next-fixes-2021-05-06' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Two patches, one to fix a null pointer dereference in msm, and one to fix an unused warning for in fbdev when PROCFS is disabled. Signed-off-by: Dave Airlie <airlied@redhat.com> # gpg: Signature made Thu 06 May 2021 22:26:35 AEST # gpg: using ? key E3EF0D6F671851C5 # gpg: Can't check signature: unknown pubkey algorithm From: Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20210506122723.oqadel7oacazywij@gilmour	2021-05-07 12:37:37 +10:00
Guenter Roeck	b9d79e4ca4	fbmem: Mark proc_fb_seq_ops as __maybe_unused With CONFIG_PROC_FS=n and -Werror, 0-day reports: drivers/video/fbdev/core/fbmem.c:736:36: error: 'proc_fb_seq_ops' defined but not used Mark it as __maybe_unused. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210504142910.2084722-1-linux@roeck-us.net	2021-05-04 17:12:37 +02:00
Linus Torvalds	68a32ba141	Merge tag 'drm-next-2021-04-28' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "The usual lots of work all over the place. i915 has gotten some Alderlake work and prelim DG1 code, along with a major locking rework over the GEM code, and brings back the property of timing out long running jobs using a watchdog. amdgpu has some Alderbran support (new GPU), freesync HDMI support along with a lot other fixes. Outside of the drm, there is a new printf specifier added which should have all the correct acks/sobs: - printk fourcc modifier support added %p4cc Summary: core: - drm_crtc_commit_wait - atomic plane state helpers reworked for full state - dma-buf heaps API rework - edid: rework and improvements for displayid dp-mst: - better topology logging bridge: - Chipone ICN6211 - Lontium LT8912B - anx7625 regulator support panel: - fix lt9611 4k panels handling simple-kms: - add plane state helpers ttm: - debugfs support - removal of unused sysfs - ignore signaled moved fences - ioremap buffer according to mem caching i915: - Alderlake S enablement - Conversion to dma_resv_locking - Bring back watchdog timeout support - legacy ioctl cleanups - add GEM TDDO and RFC process - DG1 LMEM preparation work - intel_display.c refactoring - Gen9/TGL PCH combination support - eDP MSO Support - multiple PSR instance support - Link training debug updates - Disable PSR2 support on JSL/EHL - DDR5/LPDDR5 support for bw calcs - LSPCON limited to gen9/10 platforms - HSW/BDW async flip/VTd corruption workaround - SAGV watermark fixes - SNB hard hang on ring resume fix - Limit imported dma-buf size - move to use new tasklet API - refactor KBL/TGL/ADL-S display/gt steppings - refactoring legacy DP/HDMI, FB plane code out amdgpu: - uapi: add ioctl to query video capabilities - Iniital AMD Freesync HDMI support - Initial Adebaran support - 10bpc dithering improvements - DCN secure display support - Drop legacy IO BAR requirements - PCIE/S0ix/RAS/Prime/Reset fixes - Display ASSR support - SMU gfx busy queues for RV/PCO - Initial LTTPR display work amdkfd: - MMU notifier fixes - APU fixes radeon: - debugfs cleanps - fw error handling ifix - Flexible array cleanups msm: - big DSI phy/pll cleanup - sc7280 initial support - commong bandwidth scaling path - shrinker locking contention fixes - unpin/swap support for GEM objcets ast: - cursor plane handling reworked tegra: - don't register DP AUX channels before connectors zynqmp: - fix OOB struct padding memset gma500: - drop ttm and medfield support exynos: - request_irq cleanup function mediatek: - fine tune line time for EOTp - MT8192 dpi support - atomic crtc config updates - don't support HDMI connector creation mxsdb: - imx8mm support panfrost: - MMU IRQ handling rework qxl: - locking fixes - resource deallocation changes sun4i: - add alpha properties to UI/VI layers vc4: - RPi4 CEC support vmwgfx: - doc cleanups arc: - moved to drm/tiny" * tag 'drm-next-2021-04-28' of git://anongit.freedesktop.org/drm/drm: (1390 commits) drm/ttm: Don't count pages in SG BOs against pages_limit drm/ttm: fix return value check drm/bridge: lt8912b: fix incorrect handling of of_* return values drm: bridge: fix LONTIUM use of mipi_dsi_() functions drm: bridge: fix ANX7625 use of mipi_dsi_() functions drm/amdgpu: page retire over debugfs mechanism drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() drm/amd/display: Fix the Wunused-function warning drm/radeon/r600: Fix variables that are not used after assignment drm/amdgpu/smu7: fix CAC setting on TOPAZ drm/amd/display: Update DCN302 SR Exit Latency drm/amdgpu: enable ras eeprom on aldebaran drm/amdgpu: RAS harvest on driver load drm/amdgpu: add ras aldebaran ras eeprom driver drm/amd/pm: increase time out value when sending msg to SMU drm/amdgpu: add DMUB outbox event IRQ source define/complete/debug flag drm/amd/pm: add the callback to get vbios bootup values for vangogh drm/radeon: Fix size overflow drm/amdgpu: Fix size overflow drm/amdgpu: move mmhub ras_func init to ip specific file ...	2021-04-28 10:01:40 -07:00
Daniel Vetter	213cc929cb	Merge drm/drm-fixes into drm-next msm-next pull request has a baseline with stuff from -fixes, roll forward first. Some simple conflicts in amdgpu, ttm and one in i915 where git gets confused and tries to add the same function twice. Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>	2021-04-13 23:15:09 +02:00
Phillip Potter	19ab233989	fbdev: zero-fill colormap in fbcmap.c Use kzalloc() rather than kmalloc() for the dynamically allocated parts of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel data to userspace under certain circumstances. Fixes a KMSAN-found infoleak bug reported by syzbot at: https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e Reported-by: syzbot+47fa9c9c648b765305b9@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/r/20210331220719.1499743-1-phil@philpotter.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-10 11:12:08 +02:00
Du Cheng	01faae5193	drivers: video: fbcon: fix NULL dereference in fbcon_cursor() add null-check on function pointer before dereference on ops->cursor Reported-by: syzbot+b67aaae8d3a927f68d20@syzkaller.appspotmail.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Du Cheng <ducheng2@gmail.com> Link: https://lore.kernel.org/r/20210312081421.452405-1-ducheng2@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-23 15:15:17 +01:00

1 2 3 4 5

246 Commits