msm-5.15

Author	SHA1	Message	Date
Greg Kroah-Hartman	787413edad	Merge 5.15.93 into android13-5.15-lts Changes in 5.15.93 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() ASoC: Intel: boards: fix spelling in comments ASoC: Intel: bytcht_es8316: move comment to the right place ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use bpf: Fix a possible task gone issue with bpf_send_signal[_thread]() helpers ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() bpf: Support <8-byte scalar spill and refill bpf: Fix to preserve reg parent/live fields when copying range info bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX drm/vc4: hdmi: make CEC adapter name unique scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT" vhost/net: Clear the pending messages when the backend is removed WRITE is "data source", not destination... READ is "data destination", not source... fix iov_iter_bvec() "direction" argument fix "direction" argument of iov_iter_kvec() ice: Prevent set_channel from changing queues while RDMA active qede: execute xdp_do_flush() before napi_complete_done() virtio-net: execute xdp_do_flush() before napi_complete_done() dpaa_eth: execute xdp_do_flush() before napi_complete_done() dpaa2-eth: execute xdp_do_flush() before napi_complete_done() sfc: correctly advertise tunneled IPv6 segmentation net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices block/bfq-iosched.c: use "false" rather than "BLK_RW_ASYNC" block, bfq: replace 0/1 with false/true in bic apis block, bfq: fix uaf for bfqq in bic_set_bfqq() netrom: Fix use-after-free caused by accept on already connected socket drm/i915/guc: Fix locking when searching for a hung request drm/i915/adlp: Fix typo for reference clock netfilter: br_netfilter: disable sabotage_in hook after first suppression squashfs: harden sanity check in squashfs_read_xattr_id_table net: phy: meson-gxl: Add generic dummy stubs for MMD register access ip/ip6_gre: Fix changing addr gen mode not generating IPv6 link local address ip/ip6_gre: Fix non-point-to-point tunnel not generating IPv6 link local address riscv: kprobe: Fixup kernel panic when probing an illegal position igc: return an error if the mac type is unknown in igc_ptp_systim_to_hwtstamp() can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate ata: libata: Fix sata_down_spd_limit() when no link speed is reported selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking virtio-net: Keep stop() to follow mirror sequence of open() net: openvswitch: fix flow memory leak in ovs_flow_cmd_new efi: fix potential NULL deref in efi_mem_reserve_persistent i2c: designware-pci: Add new PCI IDs for AMD NAVI GPU i2c: mxs: suppress probe-deferral error message scsi: target: core: Fix warning on RT kernels perf/x86/intel: Add Emerald Rapids scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress i2c: rk3x: fix a bunch of kernel-doc warnings platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010 table platform/x86: gigabyte-wmi: add support for B450M DS3H WIFI-CF net/x25: Fix to not accept on connected socket drm/amd/display: Fix timing not changning when freesync video is enabled iio: adc: stm32-dfsdm: fill module aliases usb: dwc3: qcom: enable vbus override when in OTG dr-mode usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF Input: i8042 - add Clevo PCX0DX to i8042 quirk table fbcon: Check font dimension limits net: qrtr: free memory on error path in radix_tree_insert() watchdog: diag288_wdt: do not use stack buffers for hardware data watchdog: diag288_wdt: fix __diag288() inline assembly ALSA: hda/realtek: Add Acer Predator PH315-54 efi: Accept version 2 of memory attributes table iio: hid: fix the retval in accel_3d_capture_sample iio: hid: fix the retval in gyro_3d_capture_sample iio: adc: berlin2-adc: Add missing of_node_put() in error path iio:adc:twl6030: Enable measurements of VUSB, VBAT and others iio: imu: fxos8700: fix ACCEL measurement range selection iio: imu: fxos8700: fix incomplete ACCEL and MAGN channels readback iio: imu: fxos8700: fix IMU data bits returned to user space iio: imu: fxos8700: fix map label of channel type to MAGN sensor iio: imu: fxos8700: fix swapped ACCEL and MAGN channels readback iio: imu: fxos8700: fix incorrect ODR mode readback iio: imu: fxos8700: fix failed initialization ODR mode assignment iio: imu: fxos8700: remove definition FXOS8700_CTRL_ODR_MIN iio: imu: fxos8700: fix MAGN sensor scale and unit nvmem: qcom-spmi-sdam: fix module autoloading parisc: Fix return code of pdc_iodc_print() parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case riscv: disable generation of unwind tables mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps usb: gadget: f_uac2: Fix incorrect increment of bNumEndpoints kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses fpga: stratix10-soc: Fix return value check in s10_ops_write_init() mm/swapfile: add cond_resched() in get_swap_pages() highmem: round down the address passed to kunmap_flush_on_unmap() Squashfs: fix handling and sanity checking of xattr_ids count drm/i915: Fix potential bit_17 double-free nvmem: core: initialise nvmem->id early nvmem: core: remove nvmem_config wp_gpio nvmem: core: fix cell removal on error serial: 8250_dma: Fix DMA Rx completion race serial: 8250_dma: Fix DMA Rx rearm race phy: qcom-qmp-combo: disable runtime PM on unbind phy: qcom-qmp-combo: fix memleak on probe deferral phy: qcom-qmp-usb: fix memleak on probe deferral phy: qcom-qmp-combo: fix broken power on phy: qcom-qmp-combo: fix runtime suspend bpf: Fix incorrect state pruning for <8B spill/fill bpf: Do not reject when the stack read size is different from the tracked scalar size iio:adc:twl6030: Enable measurement of VAC powerpc/imc-pmu: Revert nest_init_lock to being a mutex fs/ntfs3: Validate attribute data and valid sizes ovl: Use "buf" flexible array for memcpy() destination fbdev: smscufx: fix error handling code in ufx_usb_probe f2fs: fix to do sanity check on i_extra_isize in is_alive() wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads gfs2: Cosmetic gfs2_dinode_{in,out} cleanup gfs2: Always check inode size of inline inodes bpf: Skip invalid kfunc call in backtrack_insn Linux 5.15.93 Change-Id: I36ae60a781fc72667896bc649af5788cda1ef6c2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-15 15:05:04 +00:00
Kees Cook	a77141a063	ovl: Use "buf" flexible array for memcpy() destination commit cf8aa9bf97cadf85745506c6a3e244b22c268d63 upstream. The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21) Reported-by: syzbot+9d14351a171d0d1c7955@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000763a6c05e95a5985@google.com/ Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-09 11:26:47 +01:00
Greg Kroah-Hartman	7622c50ba6	Merge 5.15.91 into android13-5.15-lts Changes in 5.15.91 memory: tegra: Remove clients SID override programming memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' ARM: dts: imx7d-pico: Use 'clock-frequency' ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity soc: imx8m: Fix incorrect check for of_clk_get_by_name() reset: uniphier-glue: Use reset_control_bulk API reset: uniphier-glue: Fix possible null-ptr-deref EDAC/highbank: Fix memory leak in highbank_mc_probe() firmware: arm_scmi: Harden shared memory access in fetch_response firmware: arm_scmi: Harden shared memory access in fetch_notification tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues IB/hfi1: Immediately remove invalid memory from hardware IB/hfi1: Remove user expected buffer invalidate race affs: initialize fsdata in affs_truncate() PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() arm64: dts: qcom: msm8992: Don't use sfpb mutex arm64: dts: qcom: msm8992-libra: Add CPU regulators arm64: dts: qcom: msm8992-libra: Fix the memory map phy: ti: fix Kconfig warning and operator precedence NFSD: fix use-after-free in nfsd4_ssc_setup_dul() ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() sch_htb: Avoid grafting on htb_destroy_class_offload when destroying htb gpio: use raw spinlock for gpio chip shadowed data gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid pinctrl/rockchip: Use temporary variable for struct device pinctrl/rockchip: add error handling for pull/drive register getters pinctrl: rockchip: fix reading pull type on rk3568 net: stmmac: Fix queue statistics reading net/sched: sch_taprio: fix possible use-after-free l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock l2tp: convert l2tp_tunnel_list to idr l2tp: close all race conditions in l2tp_tunnel_register() octeontx2-pf: Avoid use of GFP_KERNEL in atomic context net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() pinctrl: rockchip: fix mux route data for rk3568 HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request Bluetooth: Fix possible deadlock in rfcomm_sk_state_change net: ipa: disable ipa interrupt during suspend net/mlx5: E-switch, Fix setting of reserved fields on MODIFY_SCHEDULING_ELEMENT net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding virtio-net: correctly enable callback during start_xmit l2tp: prevent lockdep issue in l2tp_tunnel_register() HID: betop: check shape of output reports cifs: fix potential deadlock in cache_refresh_path() dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() phy: phy-can-transceiver: Skip warning if no "max-bitrate" drm/amd/display: fix issues with driver unload nvme-pci: fix timeout request state check tcp: avoid the lookup process failing to get sk in ehash table octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt ptdma: pt_core_execute_cmd() should use spinlock device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array selftests/net: toeplitz: fix race on tpacket_v3 block close net: dsa: microchip: ksz9477: port map correction in ALU table entry register thermal/core: Remove duplicate information when an error occurs thermal/core: Rename 'trips' to 'num_trips' thermal: Validate new state in cur_state_store() thermal/core: fix error code in __thermal_cooling_device_register() thermal: core: call put_device() only after device_register() fails net: stmmac: enable all safety features by default tcp: fix rate_app_limited to default to 1 scsi: iscsi: Fix multiple iSCSI session unbind events sent to userspace cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist kcsan: test: don't put the expect array on the stack cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist ASoC: fsl_micfil: Correct the number of steps on SX controls net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard s390: expicitly align _edata and _end symbols on page boundary perf/x86/msr: Add Emerald Rapids perf/x86/intel/uncore: Add Emerald Rapids cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id r8152: add vendor/device ID pair for Microsoft Devkit platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop firmware: coreboot: Check size of table entry and use flex-array drm/i915: Allow switching away via vga-switcheroo if uninitialized Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" drm/i915: Remove unused variable x86: ACPI: cstate: Optimize C3 entry on AMD CPUs fs: reiserfs: remove useless new_opts in reiserfs_remount sysctl: add a new register_sysctl_init() interface kernel/panic: move panic sysctls to its own file panic: unset panic_on_warn inside panic() ubsan: no need to unset panic_on_warn in ubsan_epilogue() kasan: no need to unset panic_on_warn in end_report() exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate panic: Separate sysctl logic from CONFIG_SMP exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads Bluetooth: hci_sync: cancel cmd_timer if hci_open failed drm/amdgpu: complete gfxoff allow signal during suspend without delay scsi: hpsa: Fix allocation size for scsi_host_alloc() KVM: SVM: fix tsc scaling cache logic module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect i2c: mv64xxx: Remove shutdown method from driver i2c: mv64xxx: Add atomic_xfer method to driver ksmbd: add smbd max io size parameter ksmbd: add max connections parameter ksmbd: do not sign response to session request for guest login ksmbd: downgrade ndr version error message to debug ksmbd: limit pdu length size according to connection status ovl: fail on invalid uid/gid mapping at copy up KVM: x86/vmx: Do not skip segment attributes if unusable bit is set KVM: arm64: GICv4.1: Fix race with doorbell on VPE activation/deactivation thermal: intel: int340x: Protect trip temperature from concurrent updates ipv6: fix reachability confirmation with proxy_ndp ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info net: mana: Fix IRQ name - add PCI and queue number scsi: ufs: core: Fix devfreq deadlocks i2c: designware: use casting of u64 in clock multiplication to avoid overflow netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path drm/i915/selftest: fix intel_selftest_modify_policy argument types netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope riscv/kprobe: Fix instruction simulation of JALR nvme: fix passthrough csi check gpio: mxc: Unlock on error path in mxc_flip_edge() ravb: Rename "no_ptp_cfg_active" and "ptp_cfg_active" variables net: ravb: Fix lack of register setting after system resumed for Gen3 net: ravb: Fix possible hang if RIS2_QFF1 happen net: mctp: mark socks as dead on unhash, prevent re-add thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net: mdio-mux-meson-g12a: force internal PHY off on mux switch treewide: fix up files incorrectly marked executable tools: gpio: fix -c option of gpio-event-mon Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data kbuild: Allow kernel installation packaging to override pkg-config block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int Linux 5.15.91 Change-Id: I1a0a227ff3f034e4a07501ebbd97458fb1fec818 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 16:05:31 +00:00
Miklos Szeredi	e91308e637	ovl: fail on invalid uid/gid mapping at copy up commit 4f11ada10d0ad3fd53e2bd67806351de63a4f9c3 upstream. If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then copy-up should fail, just like it would fail if the mounter task was doing the copy using "cp -a". There's a corner case where the "cp -a" would succeed but copy up fail: if there's a mapping of the invalid uid/gid (65534 by default) in the user namespace. This is because stat(2) will return this value if the mapping doesn't exist in the current user_ns and "cp -a" will in turn be able to create a file with this uid/gid. This behavior would be inconsistent with POSIX ACL's, which return -1 for invalid uid/gid which result in a failed copy. For consistency and simplicity fail the copy of the st_uid/st_gid are invalid. Fixes: `459c7c565a` ("ovl: unprivieged mounts") Cc: <stable@vger.kernel.org> # v5.11 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Christian Brauner <brauner@kernel.org> Reviewed-by: Seth Forshee <sforshee@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-01 08:27:24 +01:00
Greg Kroah-Hartman	fc4de343bd	Merge 5.15.87 into android13-5.15-lts Changes in 5.15.87 usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init cifs: fix oops during encryption Revert "selftests/bpf: Add test for unstable CT lookup API" nvme-pci: fix doorbell buffer value endianness nvme-pci: fix mempool alloc size nvme-pci: fix page size checks ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA ACPI: resource: do IRQ override on LENOVO IdeaPad ACPI: resource: do IRQ override on XMG Core 15 ACPI: resource: do IRQ override on Lenovo 14ALC7 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq ata: ahci: Fix PCS quirk application for suspend nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvmet: don't defer passthrough commands with trivial effects to the workqueue fs/ntfs3: Validate BOOT record_size fs/ntfs3: Add overflow check for attribute size fs/ntfs3: Validate data run offset fs/ntfs3: Add null pointer check to attr_load_runs_vcn fs/ntfs3: Fix memory leak on ntfs_fill_super() error path fs/ntfs3: Add null pointer check for inode operations fs/ntfs3: Validate attribute name offset fs/ntfs3: Validate buffer length while parsing index fs/ntfs3: Validate resident attribute name fs/ntfs3: Fix slab-out-of-bounds read in run_unpack soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15 fs/ntfs3: Validate index root when initialize NTFS security fs/ntfs3: Use __GFP_NOWARN allocation at wnd_init() fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_fill_super() fs/ntfs3: Delete duplicate condition in ntfs_read_mft() fs/ntfs3: Fix slab-out-of-bounds in r_page objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk pstore: Properly assign mem_type property pstore/zone: Use GFP_ATOMIC to allocate zone buffer hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount binfmt: Fix error return code in load_elf_fdpic_binary() ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source mfd: mt6360: Add bounds checking in Regmap read/write call-backs md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info f2fs: allow to read node block after shutdown mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: acpi: Call acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails kcsan: Instrument memcpy/memset/memmove with newer Clang ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire rcu-tasks: Simplify trc_read_check_handler() atomic operations net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D perf/x86/intel/uncore: Clear attr_update properly arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops fs: dlm: fix sock release if listen fails fs: dlm: retry accept() until -EAGAIN or error returns mptcp: mark ops structures as ro_after_init mptcp: remove MPTCP 'ifdef' in TCP SYN cookies dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values KVM: VMX: Resume guest immediately when injecting #GP on ECREATE KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK tracing: Fix race where eprobes can be called before the event tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE tracing/hist: Fix wrong return value in parse_action_params() tracing/probes: Handle system names with hyphens tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error staging: media: tegra-video: fix device_node use after free ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options rtc: ds1347: fix value written to century register block: mq-deadline: Do not break sequential write streams to zoned HDDs md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument riscv: mm: notify remote harts about mmu cache updates crypto: n2 - add missing hash statesize crypto: ccp - Add support for TEE for PCI ID 0x14CA driver core: Fix bus_type.match() error handling in __driver_attach() phy: qcom-qmp-combo: fix sc8180x reset iommu/amd: Fix ivrs_acpihid cmdline parsing code remoteproc: core: Do pm_relax when in RPROC_OFFLINE state parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: remove trailing newline from ext4_msg() message fs: ext4: initialize fsdata in pagecache_write() ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: fix leaking uninitialized memory in fast-commit journal ext4: fix uninititialized value in 'ext4_evict_inode' ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) block: mq-deadline: Fix dd_finish_request() for zoned devices tracing: Fix issue of missing one synthetic field ext4: remove unused enum EXT4_FC_COMMIT_FAILED ext4: use ext4_debug() instead of jbd_debug() ext4: introduce EXT4_FC_TAG_BASE_LEN helper ext4: factor out ext4_fc_get_tl() ext4: fix potential out of bound read in ext4_fc_replay_scan() ext4: disable fast-commit of encrypted dir operations ext4: don't set up encryption key during jbd2 transaction ext4: add missing validation of fast-commit record lengths ext4: fix unaligned memory access in ext4_fc_reserve_space() ext4: fix off-by-one errors in fast-commit block filling ARM: renumber bits related to _TIF_WORK_MASK phy: qcom-qmp-combo: fix out-of-bounds clock access btrfs: replace strncpy() with strscpy() btrfs: move missing device handling in a dedicate function btrfs: fix extent map use-after-free when handling missing device in read_one_chunk x86/mce: Get rid of msr_ops x86/MCE/AMD: Clear DFR errors found in THR handler media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data ravb: Fix "failed to switch device to config mode" message during unbind ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption drm/i915/migrate: don't check the scratch page drm/i915/migrate: fix offset calculation drm/i915/migrate: fix length calculation SUNRPC: ensure the matching upcall is in-flight upon downcall btrfs: fix an error handling path in btrfs_defrag_leaves() bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting netfilter: nf_tables: consolidate set description netfilter: nf_tables: add function to create set stateful expressions netfilter: nf_tables: perform type checking for existing sets vmxnet3: correctly report csum_level for encapsulated packet netfilter: nf_tables: honor set timeout and garbage collection updates veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: hns3: refactor hns3_nic_reuse_page() net: hns3: extract macro to simplify ring stats update code net: hns3: fix miss L3E checking for rx packet net: hns3: fix VF promisc mode not update when mac table full net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure net: dsa: mv88e6xxx: depend on PTP conditionally nfc: Fix potential resource leaks vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() vdpa_sim: fix vringh initialization in vdpasim_queue_ready() net/mlx5: E-Switch, properly handle ingress tagged packets on VST net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Avoid recovery in probe flows net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: TC, Refactor mlx5e_tc_add_flow_mod_hdr() to get flow attr net/mlx5e: Always clear dest encap in neigh-update-del net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net: amd-xgbe: add missed tasklet_kill net: ena: Fix toeplitz initial hash value net: ena: Don't register memory info on XDP exchange net: ena: Account for the number of processed bytes in XDP net: ena: Use bitmask to indicate packet redirection net: ena: Fix rx_copybreak value update net: ena: Set default value for RX interrupt moderation net: ena: Update NUMA TPH hint register upon NUMA node update net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device RDMA/mlx5: Fix validation of max_rd_atomic caps for DC drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop net: sparx5: Fix reading of the MAC address netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries perf tools: Fix resources leak in perf_data__open_dir() drm/imx: ipuv3-plane: Fix overlay plane width fs/ntfs3: don't hold ni_lock when calling truncate_setsize() drivers/net/bonding/bond_3ad: return when there's no aggregator octeontx2-pf: Fix lmtst ID used in aura free usb: rndis_host: Secure rndis_query check against int overflow perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet nvme: fix multipath crash caused by flush request when blktrace is enabled io_uring: check for valid register opcode earlier nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: also return I/O command effects from nvme_command_effects btrfs: check superblock to ensure the fs was not modified at thaw time x86/kexec: Fix double-free of elf header buffer x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB block: don't allow splitting of a REQ_NOWAIT bio io_uring: fix CQ waiting timeout handling thermal: int340x: Add missing attribute for data rate base riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling ksmbd: fix infinite loop in ksmbd_conn_handler_loop() ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob Revert "ACPI: PM: Add support for upcoming AMD uPEP HID AMDI007" mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 ext4: don't allow journal inode to have encrypt flag selftests: set the BUILD variable to absolute path btrfs: make thaw time super block check to also verify checksum net: hns3: fix return value check bug of rx copybreak mbcache: Avoid nesting of cache->c_list_lock under bit locks efi: random: combine bootloader provided RNG seed with RNG protocol output io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 Linux 5.15.87 Change-Id: I1df39ccb245b1e224417ee8deb8c7a5f9be2650a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-31 12:22:42 +00:00
Greg Kroah-Hartman	20ec745823	Merge 5.15.86 into android13-5.15-lts Changes in 5.15.86 drm/amd/display: Manually adjust strobe for DCN303 usb: musb: remove extra check in musb_gadget_vbus_draw arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins arm64: dts: qcom: sm8250-sony-xperia-edo: fix touchscreen bias-disable arm64: dts: qcom: msm8996: Add MSM8996 Pro support arm64: dts: qcom: msm8996: fix supported-hw in cpufreq OPP tables arm64: dts: qcom: msm8996: fix GPU OPP table ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm630: fix UART1 pin bias arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias arm64: dts: qcom: msm8916: Drop MSS fallback compatible objtool, kcsan: Add volatile read/write instrumentation to whitelist ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96 ARM: dts: stm32: Fix AV96 WLAN regulator gpio property drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm64: dts: qcom: pm660: Use unique ADC5_VCOIN address in node name arm64: dts: qcom: sm8250: correct LPASS pin pull down soc: qcom: llcc: make irq truly optional arm64: dts: qcom: Correct QMP PHY child node name arm64: dts: qcom: sm8150: fix UFS PHY registers arm64: dts: qcom: sm8250: fix UFS PHY registers arm64: dts: qcom: sm8350: fix UFS PHY registers arm64: dts: qcom: sm8250: drop bogus DP PHY clock soc: qcom: apr: make code more reuseable soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index arm64: dts: qcom: sm6125: fix SDHCI CQE reg names arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe arm64: Treat ESR_ELx as a 64-bit register arm64: mm: kfence: only handle translation faults perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node ARM: dts: nuvoton: Remove bogus unit addresses from fixed-partition nodes arm64: dts: mt6779: Fix devicetree build warnings arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC seccomp: Move copy_seccomp() to no failure path. pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init() tpm/tpm_crb: Fix error message in __crb_relinquish_locality() ovl: store lower path in ovl_inode ovl: use ovl_copy_{real,upper}attr() wrappers ovl: remove privs in ovl_copyfile() ovl: remove privs in ovl_fallocate() sched/fair: Cleanup task_util and capacity type sched/uclamp: Fix relationship between uclamp and migration margin sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/fair: Removed useless update of p->recent_used_cpu sched/core: Introduce sched_asym_cpucap_active() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix TIF_NOTIFY_SIGNAL handling alpha: fix syscall entry in !AUDUT_SYSCALL case x86/sgx: Reduce delay and interference of enclave release PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() lib/debugobjects: fix stat count and optimize debug_objects_mem_init platform/x86: huawei-wmi: fix return value calculation timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() thermal: core: fix some possible name leaks in error paths irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() SUNRPC: Return true/false (not 1/0) from bool functions NFSD: Finish converting the NFSv2 GETACL result encoder nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file debugfs: fix error when writing negative value to atomic_t debugfs file rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Access registers according to spec mips: ralink: mt7621: define MT7621_SYSC_BASE with __iomem mips: ralink: mt7621: soc queries and tests as functions mips: ralink: mt7621: do not use kzalloc too early futex: Move to kernel/futex/ futex: Resend potentially swallowed owner death notification cpu/hotplug: Make target_store() a nop when target == state cpu/hotplug: Do not bail-out in DYING/STARTING sections clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock() ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/chrome: cros_ec_typec: Cleanup switch handle return paths platform/chrome: cros_ec_typec: zero out stale pointers platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds\|mx]() platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used lockd: set other missing fields when unlocking files fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open platform/mellanox: mlxbf-pmc: Fix event typo wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge libbpf: Fix use-after-free in btf_dump_name_dups libbpf: Fix null-pointer dereference in find_prog_by_sec_insn() ata: libata: move ata_{port,link,dev}_dbg to standard pr_XXX() macros ata: add/use ata_taskfile::{error\|status} fields ata: libata: fix NCQ autosense logic ipmi: kcs: Poll OBF briefly to reduce OBE latency drm/amdgpu/powerplay/psm: Fix memory leak in power state init media: v4l2-ctrls: Fix off-by-one error in integer menu control check media: coda: jpeg: Add check for kmalloc media: adv748x: afe: Select input port when initializing AFE media: i2c: ad5820: Fix error path venus: pm_helpers: Fix error check in vcodec_domains_get() soreuseport: Fix socket selection for SO_INCOMING_CPU. media: exynos4-is: don't rely on the v4l2_async_subdev internals libbpf: Btf dedup identical struct test needs check for nested structs/arrays can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb: make use of units.h in assignment of frequency can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming drm/rockchip: lvds: fix PM usage counter unbalance in poweron clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Handle -ESTALE returned by ima_filter_rule_match() drm/msm/hdmi: drop unused GPIO support drm/msm/hdmi: use devres helper for runtime PM management bpf: Fix slot type check in check_stack_write_var_off media: vivid: fix compose size exceed boundary media: platform: exynos4-is: fix return value check in fimc_md_probe() bpf: propagate precision in ALU/ALU64 operations bpf: Check the other end of slot_type for STACK_SPILL bpf: propagate precision across all frames, not just the last one clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs mtd: Fix device name leak when register device failed in add_mtd_device() Input: joystick - fix Kconfig warning for JOYSTICK_ADC wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack bfq: fix waker_bfqq inconsistency crash drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() libbpf: Fix uninitialized warning in btf_dump_dump_type_data nvmet: only allocate a single slab for bvecs regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() nvme: return err on nvme_init_non_mdts_limits fail regulator: qcom-rpmh: Fix PMR735a S3 regulator spec drm/fourcc: Add packed 10bit YUV 4:2:0 format drm/fourcc: Fix vsub/hsub for Q410 and Q401 integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() block: clear ->slave_dir when dropping the main slave_dir reference wifi: ath10k: Fix return value in ath10k_pci_init() drm/msm/a6xx: Fix speed-bin detection vs probe-defer mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict() mtd: spi-nor: hide jedec_id sysfs attribute if not present mtd: spi-nor: Fix the number of bytes for the dummy cycles bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes pinctrl: k210: call of_node_put() ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() drm/amdgpu: fix pci device refcount leak bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe drbd: remove call to memset before free device/resource/connection drbd: destroy workqueue when drbd device was freed ASoC: qcom: Add checks for devm_kcalloc media: vimc: Fix wrong function called when vimc_init() fails media: imon: fix a race condition in send_packet() clk: imx8mn: rename vpu_pll to m7_alt_pll clk: imx: replace osc_hdmi with dummy clk: imx8mn: fix imx8mn_sai2_sels clocks list clk: imx8mn: fix imx8mn_enet_phy_sels clocks list pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a credential leak in _nfs4_discover_trunking() NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn NFS: Fix an Oops in nfs_d_automount() ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Fix debugfs registration for components ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/amd/pm/smu11: BACO is supported when it's in BACO state drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() drm/amdkfd: Fix memory leakage ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED Input: wistron_btns - disable on UML bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: mac80211: fix memory leak in ieee80211_if_add() wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails mt76: stop the radar detector after leaving dfs channel wifi: mt76: mt7921: fix reporting of TX AGGR histogram wifi: mt76: fix coverity overrun-call in mt76_get_txpower() regulator: core: fix module refcount leak in set_supply() clk: qcom: lpass-sc7180: Fix pm_runtime usage clk: qcom: clk-krait: fix wrong div2 functions hsr: Add a rcu-read lock to hsr_forward_skb(). hsr: Avoid double remove of a node. hsr: Disable netpoll. hsr: Synchronize sending frames to have always incremented outgoing seq nr. hsr: Synchronize sequence number updates. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() hwmon: (jc42) Convert register access and caching to regmap/regcache hwmon: (jc42) Restore the min/max/critical temperatures on resume bpf, sockmap: fix race in sock_map_free() ALSA: pcm: Set missing stop_operating flag at undoing trigger start media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run riscv, bpf: Emit fixed-length instructions for BPF_PSEUDO_FUNC mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_pci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() mmc: renesas_sdhi: alway populate SCC pointer memstick: ms_block: Add error handling support for add_disk() memstick/ms_block: Add check for alloc_ordered_workqueue mmc: core: Normalize the error handling branch in sd_read_ext_regs() regulator: qcom-labibb: Fix missing of_node_put() in qcom_labibb_regulator_probe() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: rtl8xxxu: Fix the channel width reporting wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled bpf: Do not zero-extend kfunc return values clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() net: stmmac: fix possible memory leak in stmmac_dvr_probe() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() af_unix: call proto_unregister() in the error path in af_unix_init() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts can: m_can: Call the RAM init directly from m_can_chip_config can: tcan4x5x: Fix use of register error status mask net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context sctp: sysctl: make extra pointers netns aware Bluetooth: MGMT: Fix error report for ADD_EXT_ADV_PARAMS Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 i40e: Fix the inability to attach XDP program on downed interface net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi crypto: hisilicon/qm - fix missing destroy qp_idr crypto: sun8i-ss - use dma_addr instead u32 crypto: nitrox - avoid double free on error path in nitrox_sriov_init() scsi: core: Fix a race between scsi_done() and scsi_timeout() apparmor: Use pointer to struct aa_label for lbs_cred PCI: dwc: Fix n_fts[] array overrun RDMA/core: Fix order of nldev_exit call PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled f2fs: Fix the race condition of resize flag between resizefs crypto: rockchip - do not do custom power management crypto: rockchip - do not store mode globally crypto: rockchip - add fallback for cipher crypto: rockchip - add fallback for ahash crypto: rockchip - better handle cipher key crypto: rockchip - remove non-aligned handling crypto: rockchip - rework by using crypto_engine apparmor: Fix memleak in alloc_ns() f2fs: fix to invalidate dcc->f2fs_issue_discard in error path f2fs: fix normal discard process f2fs: fix to destroy sbi->post_read_wq in error path of f2fs_fill_super() RDMA/irdma: Report the correct link speed scsi: qla2xxx: Fix set-but-not-used variable warnings RDMA/siw: Fix immediate work request flush to completion queue IB/mad: Don't call to function that might sleep while in atomic context PCI: vmd: Disable MSI remapping after suspend RDMA/restrack: Release MR restrack when delete RDMA/core: Make sure "ib_port" is valid when access sysfs node RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - Remove debugfs when platform_driver_register failed crypto: cryptd - Use request context instead of stack for sub-request crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set() RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data() RDMA/hns: Fix ext_sge num error when post send PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/hns: fix memory leak in hns_roce_alloc_mr() RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed dt-bindings: imx6q-pcie: Fix clock names for imx6sx and imx8mq dt-bindings: visconti-pcie: Fix interrupts array max constraints scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak padata: Always leave BHs disabled when running ->parallel() padata: Fix list iterator in padata_do_serial() scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: efct: Fix possible memleak in efct_device_init() scsi: scsi_debug: Fix a warning in resp_verify() scsi: scsi_debug: Fix a warning in resp_report_zones() scsi: fcoe: Fix possible name leak when device_register() fails scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper() scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section RDMA/nldev: Fix failure to send large messages crypto: amlogic - Remove kcalloc without check crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() riscv/mm: add arch hook arch_clear_hugepage_flags RDMA/hfi1: Fix error return code in parse_platform_config() RDMA/srp: Fix error return code in srp_parse_options() PCI: mt7621: Rename mt7621_pci_ to mt7621_pcie_ PCI: mt7621: Add sentinel to quirks table orangefs: Fix sysfs not cleanup when dev init failed RDMA/hns: Fix AH attr queried by query_qp RDMA/hns: Fix PBL page MTR find RDMA/hns: Fix page size cap from firmware RDMA/hns: Fix error code of CMD crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces RISC-V: Align the shadow stack drivers: dio: fix possible memory leak in dio_init() serial: tegra: Read DMA status before terminating serial: 8250_bcm7271: Fix error handling in brcmuart_init() class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() usb: typec: tipd: Cleanup resources if devm_tps6598_psy_register fails usb: typec: tipd: Fix spurious fwnode_handle_put in error path extcon: usbc-tusb320: Add support for mode setting and reset extcon: usbc-tusb320: Add support for TUSB320L usb: typec: Factor out non-PD fwnode properties extcon: usbc-tusb320: Factor out extcon into dedicated functions extcon: usbc-tusb320: Add USB TYPE-C support extcon: usbc-tusb320: Update state on probe even if no IRQ pending serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: stm32: move dma_request_chan() before clk_prepare_enable() serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() ocxl: fix pci device refcount leak when calling get_function_0() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() cxl: fix possible null-ptr-deref in cxl_guest_init_afu\|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu\|adapter() iio: temperature: ltc2983: make bulk write buffer DMA-safe iio: adis: handle devices that cannot unmask the drdy pin iio: adis: stylistic changes iio:imu:adis: Move exports into IIO_ADISLIB namespace iio: adis: add '__adis_enable_irq()' implementation counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update coresight: trbe: remove cpuhp instance node before remove cpuhp state usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() gpiolib: Get rid of redundant 'else' gpiolib: cdev: fix NULL-pointer dereferences gpiolib: make struct comments into real kernel docs gpiolib: protect the GPIO device against being dropped while in use by user-space i2c: mux: reg: check return value after calling platform_get_resource() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log ksmbd: Fix resource leak in ksmbd_session_rpc_open() samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() thermal/drivers/imx8mm_thermal: Validate temperature range thermal/drivers/qcom/temp-alarm: Fix inaccurate warning for gen2 thermal/drivers/qcom/lmh: Fix irq handler return value fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: ep93xx-fb: Add missing clk_disable_unprepare in ep93xxfb_probe() fbdev: geode: don't build on UML fbdev: uvesafb: don't build on UML fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol power: supply: z2_battery: Fix possible memleak in z2_batt_probe() HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: ab8500: Fix error handling in ab8500_charger_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info perf stat: Refactor __run_perf_stat() common code perf stat: Do not delay the workload with --delay RDMA/siw: Fix pointer cast warning fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() overflow: Implement size_t saturating arithmetic helpers fs/ntfs3: Harden against integer overflows iommu/sun50i: Fix reset release iommu/sun50i: Consider all fault sources for reset iommu/sun50i: Fix R/W permission check iommu/sun50i: Fix flush size iommu/rockchip: fix permission bits in page table entries v2 phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices include/uapi/linux/swab: Fix potentially missing __always_inline pwm: tegra: Improve required rate calculation fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs dmaengine: idxd: Fix crc_val field for completion record rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 rtc: cmos: Fix event handler registration ordering issue rtc: cmos: Fix wake alarm breakage rtc: cmos: fix build on non-ACPI platforms rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() rtc: cmos: Eliminate forward declarations of some functions rtc: cmos: Rename ACPI-related functions rtc: cmos: Disable ACPI RTC event on removal rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY pwm: sifive: Call pwm_sifive_update_clock() while mutex is held pwm: mtk-disp: Fix the parameters calculated by the enabled flag of disp_pwm pwm: mediatek: always use bus clock for PWM on MT7622 remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove remoteproc: qcom_q6v5_pas: detach power domains on remove remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() remoteproc: qcom: q6v5: Fix missing clk_disable_unprepare() in q6v5_wcss_qcs404_power_on() powerpc/eeh: Drop redundant spinlock initialization powerpc/pseries/eeh: use correct API for error log size mfd: bd957x: Fix Kconfig dependency on REGMAP_IRQ mfd: qcom_rpm: Fix an error handling path in qcom_rpm_probe() mfd: pm8008: Remove driver data structure pm8008_data mfd: pm8008: Fix return value check in pm8008_probe() netfilter: flowtable: really fix NAT IPv6 offload rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() rtc: pcf85063: fix pcf85063_clkout_control nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure net: macsec: fix net device access prior to holding a lock mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() block, bfq: fix possible uaf for 'bfqq->bic' selftests/bpf: Add test for unstable CT lookup API net: enetc: avoid buffer leaks on xdp_do_redirect() failure nfc: pn533: Clear nfc_target before being used unix: Fix race in SOCK_SEQPACKET's unix_dgram_sendmsg() r6040: Fix kmemleak in probe and remove igc: Enhance Qbv scheduling by using first flag bit igc: Use strict cycles for Qbv scheduling igc: Add checking for basetime less than zero igc: allow BaseTime 0 enrollment for Qbv igc: recalculate Qbv end_time by considering cycle time igc: Lift TAPRIO schedule restriction igc: Set Qbv start_time and end_time to end_time if not being configured in GCL rtc: mxc_v2: Add missing clk_disable_unprepare() selftests: devlink: fix the fd redirect in dummy_reporter_test openvswitch: Fix flow lookup to use unmasked key soc: mediatek: pm-domains: Fix the power glitch issue arm64: dts: mt8183: Fix Mali GPU clock skbuff: Account for tail adjustment during pull operations mailbox: mpfs: read the system controller's status mailbox: arm_mhuv2: Fix return value check in mhuv2_probe() mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() HID: amd_sfh: Add missing check for dma_alloc_coherent rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() arm64: make is_ttbrX_addr() noinstr-safe video: hyperv_fb: Avoid taking busy spinlock on panic path x86/hyperv: Remove unregister syscore call from Hyper-V cleanup binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() jfs: Fix fortify moan in symlink fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() nilfs2: fix shift-out-of-bounds due to too large exponent of block size acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 media: imx-jpeg: Disable useless interrupt to avoid kernel panic brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver drm/amd/display: prevent memory leak Revert "drm/amd/display: Limit max DSC target bpp for specific monitors" qed (gcc13): use u16 for fid to be big enough bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated drm/amdgpu: Fix type of second parameter in trans_msg() callback drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/msm: Use drm_mode_copy() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drm/mediatek: Fix return type of mtk_hdmi_bridge_mode_valid() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed drm/amd/display: fix array index out of bound error in bios parser net: add atomic_long_t to net_device_stats fields ipv6/sit: use DEV_STATS_INC() to avoid data-races mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg ethtool: avoiding integer overflow in ethtool_phys_id() media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed drm/amd/display: Use the largest vready_offset in pipe group libbpf: Avoid enum forward-declarations in public API in C++ mode regulator: core: fix use_count leakage when handling boot-on wifi: mt76: do not run mt76u_status_worker if the device is not running mmc: f-sdh30: Add quirks for broken timeout clock capability mmc: renesas_sdhi: better reset from HS400 mode media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() crypto: hisilicon/hpre - fix resource leak in remove process scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs scsi: ufs: Reduce the START STOP UNIT timeout scsi: elx: libefc: Fix second parameter type in state callbacks hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() tools/include: Add _RET_IP_ and math definitions to kernel.h KVM: selftests: Fix build regression by using accessor function hwmon: (jc42) Fix missing unlock on error in jc42_write() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() drm/i915/display: Don't disable DDI/Transcoder when setting phy test pattern LoadPin: Ignore the "contents" argument of the LSM hooks pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() afs: Fix lost servers_outstanding count pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ima: Simplify ima_lsm_copy_rule ALSA: usb-audio: add the quirk for KT0206 device ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: cdnsp: fix lack of ZLP for ep0 usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq arm64: dts: qcom: sm8250: fix USB-DP PHY registers usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode usb: dwc3: core: defer probe on ulpi_read_id timeout xhci: Prevent infinite loop in transaction errors recovery for streams HID: wacom: Ensure bootloader PID is usable in hidraw mode HID: mcp2221: don't connect hidraw loop: Fix the max_loop commandline argument treatment when it is set to 0 9p: set req refcount to zero to avoid uninitialized usage security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 reiserfs: Add missing calls to reiserfs_security_free() iio: fix memory leak in iio_device_register_eventset() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable floppy: Fix memory leak in do_floppy_init() gcov: add support for checksum field fbdev: fbcon: release buffer when fbcon_do_set_font() failed ovl: fix use inode directly in rcu-walk mode btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range scsi: qla2xxx: Fix crash when I/O abort times out net: stmmac: fix errno when create_singlethread_workqueue() fails media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug extcon: usbc-tusb320: Call the Type-C IRQ handler only if a port is registered mfd: qcom_rpm: Use devm_of_platform_populate() to simplify code pwm: tegra: Fix 32 bit build Linux 5.15.86 Change-Id: I4ec30b690e8dbd554044495e26360a86cc042069 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-30 14:44:15 +00:00
Zhang Tianci	83c44f0ebf	ovl: Use ovl mounter's fsuid and fsgid in ovl_link() commit 5b0db51215e895a361bc63132caa7cca36a53d6a upstream. There is a wrong case of link() on overlay: $ mkdir /lower /fuse /merge $ mount -t fuse /fuse $ mkdir /fuse/upper /fuse/work $ mount -t overlay /merge -o lowerdir=/lower,upperdir=/fuse/upper,\ workdir=work $ touch /merge/file $ chown bin.bin /merge/file // the file's caller becomes "bin" $ ln /merge/file /merge/lnkfile Then we will get an error(EACCES) because fuse daemon checks the link()'s caller is "bin", it denied this request. In the changing history of ovl_link(), there are two key commits: The first is commit `bb0d2b8ad2` ("ovl: fix sgid on directory") which overrides the cred's fsuid/fsgid using the new inode. The new inode's owner is initialized by inode_init_owner(), and inode->fsuid is assigned to the current user. So the override fsuid becomes the current user. We know link() is actually modifying the directory, so the caller must have the MAY_WRITE permission on the directory. The current caller may should have this permission. This is acceptable to use the caller's fsuid. The second is commit `51f7e52dc9` ("ovl: share inode for hard link") which removed the inode creation in ovl_link(). This commit move inode_init_owner() into ovl_create_object(), so the ovl_link() just give the old inode to ovl_create_or_link(). Then the override fsuid becomes the old inode's fsuid, neither the caller nor the overlay's mounter! So this is incorrect. Fix this bug by using ovl mounter's fsuid/fsgid to do underlying fs's link(). Link: https://lore.kernel.org/all/20220817102952.xnvesg3a7rbv576x@wittgenstein/T Link: https://lore.kernel.org/lkml/20220825130552.29587-1-zhangtianci.1997@bytedance.com/t Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com> Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com> Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org> Fixes: `51f7e52dc9` ("ovl: share inode for hard link") Cc: <stable@vger.kernel.org> # v4.8 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-12 11:58:46 +01:00
Chen Zhongjin	1c65d50315	ovl: fix use inode directly in rcu-walk mode commit 672e4268b2863d7e4978dfed29552b31c2f9bd4e upstream. ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care". Check inode here to protect access under rcu-walk mode. Fixes: `bccece1ead` ("ovl: allow remote upper") Reported-and-tested-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Cc: <stable@vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-31 13:14:47 +01:00
Amir Goldstein	26bffaf678	ovl: remove privs in ovl_fallocate() [ Upstream commit 23a8ce16419a3066829ad4a8b7032a75817af65b ] Underlying fs doesn't remove privs because fallocate is called with privileged mounter credentials. This fixes some failure in fstests generic/683..687. Fixes: `aab8848cee` ("ovl: add ovl_fallocate()") Acked-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:00 +01:00
Amir Goldstein	5dc34f9aaa	ovl: remove privs in ovl_copyfile() [ Upstream commit b306e90ffabdaa7e3b3350dbcd19b7663e71ab17 ] Underlying fs doesn't remove privs because copy_range/remap_range are called with privileged mounter credentials. This fixes some failures in fstest generic/673. Fixes: `8ede205541` ("ovl: add reflink/copyfile/dedup support") Acked-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:00 +01:00
Christian Brauner	9636e70ee2	ovl: use ovl_copy_{real,upper}attr() wrappers [ Upstream commit 2878dffc7db0b5a51e308ccb6b571296b57c82e7 ] When copying inode attributes from the upper or lower layer to ovl inodes we need to take the upper or lower layer's mount's idmapping into account. In a lot of places we call ovl_copyattr() only on upper inodes and in some we call it on either upper or lower inodes. Split this into two separate helpers. The first one should only be called on upper inodes and is thus called ovl_copy_upperattr(). The second one can be called on upper or lower inodes. We add ovl_copy_realattr() for this task. The new helper makes use of the previously added ovl_i_path_real() helper. This is needed to support idmapped base layers with overlay. When overlay copies the inode information from an upper or lower layer to the relevant overlay inode it will apply the idmapping of the upper or lower layer when doing so. The ovl inode ownership will thus always correctly reflect the ownership of the idmapped upper or lower layer. All idmapping helpers are nops when no idmapped base layers are used. Cc: <linux-unionfs@vger.kernel.org> Tested-by: Giuseppe Scrivano <gscrivan@redhat.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Stable-dep-of: b306e90ffabd ("ovl: remove privs in ovl_copyfile()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:00 +01:00
Amir Goldstein	a54843833c	ovl: store lower path in ovl_inode [ Upstream commit ffa5723c6d259b3191f851a50a98d0352b345b39 ] Create some ovl_i_* helpers to get real path from ovl inode. Instead of just stashing struct inode for the lower layer we stash struct path for the lower layer. The helpers allow to retrieve a struct path for the relevant upper or lower layer. This will be used when retrieving information based on struct inode when copying up inode attributes from upper or lower inodes to ovl inodes and when checking permissions in ovl_permission() in following patches. This is needed to support idmapped base layers with overlay. Cc: <linux-unionfs@vger.kernel.org> Tested-by: Giuseppe Scrivano <gscrivan@redhat.com> Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Stable-dep-of: b306e90ffabd ("ovl: remove privs in ovl_copyfile()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-31 13:14:00 +01:00
Greg Kroah-Hartman	c4be56dac8	Merge 5.15.63 into android13-5.15-lts Changes in 5.15.63 ALSA: info: Fix llseek return value when using callback ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU KVM: Unconditionally get a ref to /dev/kvm module when creating a VM x86/mm: Use proper mask when setting PUD mapping rds: add missing barrier to release_refill locking/atomic: Make test_and__bit() ordered on failure drm/nouveau: recognise GA103 drm/ttm: Fix dummy res NULL ptr deref bug drm/amd/display: Check correct bounds for stream encoder instances for DCN303 ata: libata-eh: Add missing command name mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() mmc: meson-gx: Fix an error handling path in meson_mmc_probe() btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() btrfs: reset RO counter on block group if we fail to relocate btrfs: fix lost error handling when looking up extended ref on log replay cifs: Fix memory leak on the deferred close x86/kprobes: Fix JNG/JNLE emulation tracing/perf: Fix double put of trace event when init fails tracing/eprobes: Do not allow eprobes to use $stack, or % for regs tracing/eprobes: Do not hardcode $comm as a string tracing/eprobes: Have event probes be consistent with kprobes and uprobes tracing/probes: Have kprobes and uprobes use $COMM too tracing: Have filter accept "common_cpu" to be consistent ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II dt-bindings: usb: mtk-xhci: Allow wakeup interrupt-names to be optional can: ems_usb: fix clang's -Wunaligned-access warning apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix aa_label_asxprint return check apparmor: fix setting unconfined mode on a loaded profile apparmor: fix overlapping attachment computation apparmor: fix reference count leak in aa_pivotroot() apparmor: Fix memleak in aa_simple_write_to_buffer() Documentation: ACPI: EINJ: Fix obsolete example NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4.1: RECLAIM_COMPLETE must handle EACCES NFSv4/pnfs: Fix a use-after-free bug in open BPF: Fix potential bad pointer dereference in bpf_sys_bpf() bpf: Don't reinit map value in prealloc_lru_pop bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator can: mcp251x: Fix race condition on receive interrupt can: j1939: j1939_session_destroy(): fix memory leak of skbs net: atlantic: fix aq_vec index out of range error m68k: coldfire/device.c: protect FLEXCAN blocks sunrpc: fix expiry of auth creds SUNRPC: Fix xdr_encode_bool() SUNRPC: Reinitialise the backchannel request buffers before reuse virtio_net: fix memory leak inside XPD_TX with mergeable devlink: Fix use-after-free after a failed reload net: phy: Warn about incorrect mdio_bus_phy_resume() state net: bcmgenet: Indicate MAC is in charge of PHY PM net: bgmac: Fix a BUG triggered by wrong bytes_compl selftests: forwarding: Fix failing tests with old libnet dt-bindings: arm: qcom: fix Alcatel OneTouch Idol 3 compatibles pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed pinctrl: amd: Don't save/restore interrupt status and wake status bits pinctrl: sunxi: Add I/O bias setting for H6 R-PIO pinctrl: qcom: sm8250: Fix PDC map Input: exc3000 - fix return value check of wait_for_completion_timeout octeontx2-pf: Fix NIX_AF_TL3_TL2X_LINKX_CFG register configuration octeontx2-af: Apply tx nibble fixup always octeontx2-af: suppress external profile loading warning octeontx2-af: Fix mcam entry resource leak octeontx2-af: Fix key checking for source mac ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool geneve: do not use RT_TOS for IPv6 flowlabel mlx5: do not use RT_TOS for IPv6 flowlabel ipv6: do not use RT_TOS for IPv6 flowlabel plip: avoid rcu debug splat vsock: Fix memory leak in vsock_connect() vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() dt-bindings: gpio: zynq: Add missing compatible strings dt-bindings: arm: qcom: fix Longcheer L8150 compatibles dt-bindings: arm: qcom: fix MSM8916 MTP compatibles dt-bindings: arm: qcom: fix MSM8994 boards compatibles dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources spi: dt-bindings: cadence: add missing 'required' spi: dt-bindings: zynqmp-qspi: add missing 'required' ceph: use correct index when encoding client supported features tools/vm/slabinfo: use alphabetic order when two values are equal ceph: don't leak snap_rwsem in handle_cap_grant kbuild: dummy-tools: avoid tmpdir leak in dummy gcc tools build: Switch to new openssl API for test-libcrypto NTB: ntb_tool: uninitialized heap data in tool_fn_write() nfp: ethtool: fix the display error of `ethtool -m DEVNAME` xen/xenbus: fix return type in xenbus_file_read() atm: idt77252: fix use-after-free bugs caused by tst_timer geneve: fix TOS inheriting for ipv4 perf probe: Fix an error handling path in 'parse_perf_probe_command()' perf parse-events: Fix segfault when event parser gets an error perf tests: Fix Track with sched_switch test for hybrid case dpaa2-eth: trace the allocated address instead of page struct fs/ntfs3: Fix using uninitialized value n when calling indx_read fs/ntfs3: Fix NULL deref in ntfs_update_mftmirr fs/ntfs3: Don't clear upper bits accidentally in log_replay() fs/ntfs3: Fix double free on remount fs/ntfs3: Do not change mode if ntfs_set_ea failed fs/ntfs3: Fix missing i_op in ntfs_read_mft nios2: page fault et.al. are not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() iavf: Fix adminq error handling iavf: Fix reset error handling ASoC: SOF: debug: Fix potential buffer overflow by snprintf() ASoC: tas2770: Set correct FSYNC polarity ASoC: tas2770: Allow mono streams ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Fix handling of mute/unmute ASoC: codec: tlv320aic32x4: fix mono playback via I2S netfilter: nf_tables: use READ_ONCE and WRITE_ONCE for shared generation id access fs/ntfs3: uninitialized variable in ntfs_set_acl_ex() netfilter: nf_tables: disallow NFTA_SET_ELEM_KEY_END with NFT_SET_ELEM_INTERVAL_END flag netfilter: nf_tables: possible module reference underflow in error path netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags netfilter: nf_tables: disallow NFT_SET_ELEM_CATCHALL and NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified powerpc/pci: Fix get_phb_number() locking spi: meson-spicc: add local pow2 clock ops to preserve rate between messages net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() net: dsa: mv88e6060: prevent crash on an unused port mlxsw: spectrum: Clear PTP configuration after unregistering the netdevice net: moxa: pass pdev instead of ndev to DMA functions net: fix potential refcount leak in ndisc_router_discovery() net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters net: genl: fix error path memory leak in policy dumping net: dsa: don't warn in dsa_port_set_state_now() when driver doesn't support it net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() ice: Ignore EEXIST when setting promisc mode i2c: imx: Make sure to unregister adapter on remove() regulator: pca9450: Remove restrictions for regulator-name i40e: Fix to stop tx_timeout recovery if GLOBR fails fec: Fix timer capture timing in `fec_ptp_enable_pps()` stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() igb: Add lock to avoid data race kbuild: fix the modules order between drivers and libs gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file tracing/eprobes: Fix reading of string fields drm/imx/dcss: get rid of HPD warning message ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() drm/sun4i: dsi: Prevent underflow when computing packet sizes net: qrtr: start MHI channel after endpoit creation KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems KVM: arm64: Reject 32bit user PSTATE on asymmetric systems HID: multitouch: new device class fix Lenovo X12 trackpad sticky PCI: Add ACS quirk for Broadcom BCM5750x NICs platform/chrome: cros_ec_proto: don't show MKBP version if unsupported usb: cdns3 fix use-after-free at workaround 2 usb: cdns3: fix random warning message when driver load usb: gadget: uvc: calculate the number of request depending on framesize usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info PCI: aardvark: Fix reporting Slot capabilities on emulated bridge irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings clk: ti: Stop using legacy clkctrl names for omap4 and 5 scsi: ufs: ufs-mediatek: Fix the timing of configuring device regulators usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch vboxguest: Do not use devm for irq clk: qcom: ipq8074: dont disable gcc_sleep_clk_src uacce: Handle parent device removal or parent driver module rmmod zram: do not lookup algorithm in backends table clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE gadgetfs: ep_io - wait until IRQ finishes coresight: etm4x: avoid build failure with unrolled loops habanalabs/gaudi: fix shift out of bounds habanalabs/gaudi: mask constant value before cast mmc: tmio: avoid glitches when resetting pinctrl: intel: Check against matching data instead of ACPI companion cxl: Fix a memory leak in an error handling path PCI/ACPI: Guard ARM64-specific mcfg_quirks um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups dmaengine: dw-axi-dmac: do not print NULL LLI during error dmaengine: dw-axi-dmac: ignore interrupt if no descriptor RDMA/rxe: Limit the number of calls to each tasklet csky/kprobe: reclaim insn_slot on kprobe unregistration selftests/kprobe: Do not test for GRP/ without event failures dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed openrisc: io: Define iounmap argument as volatile phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks md: Notify sysfs sync_completed in md_reap_sync_thread() nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown drivers:md:fix a potential use-after-free bug ext4: avoid remove directory when directory is corrupted ext4: avoid resizing to a partial cluster size lib/list_debug.c: Detect uninitialized lists tty: serial: Fix refcount leak bug in ucc_uart.c KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings vfio: Clear the caps->buf to NULL after free mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit modules: Ensure natural alignment for .altinstructions and __bug_table sections ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl() riscv: dts: sifive: Add fu740 topology information riscv: dts: canaan: Add k210 topology information riscv: mmap with PROT_WRITE but no PROT_READ is invalid RISC-V: Add fast call path of crash_kexec() watchdog: export lockup_detector_reconfigure powerpc/32: Set an IBAT covering up to _einittext during init powerpc/32: Don't always pass -mcpu=powerpc to the compiler ovl: warn if trusted xattr creation fails powerpc/ioda/iommu/debugfs: Generate unique debugfs entries ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper ALSA: control: Use deferred fasync helper f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to do sanity check on segment type in build_sit_entries() smb3: check xattr value length earlier powerpc/64: Init jump labels before parse_early_param() venus: pm_helpers: Fix warning in OPP during probe video: fbdev: i740fb: Check the argument of i740_calc_vclk() MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() scsi: ufs: ufs-mediatek: Fix build error and type mismatch xfs: flush inodegc workqueue tasks before cancel xfs: reserve quota for dir expansion when linking/unlinking files xfs: reserve quota for target dir expansion when renaming files xfs: remove infinite loop when reserving free block pool xfs: always succeed at setting the reserve pool size xfs: fix overfilling of reserve pool xfs: fix soft lockup via spinning in filestream ag selection loop xfs: revert "xfs: actually bump warning counts when we send warnings" xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* Linux 5.15.63 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7fda993b776ff638dff390f0ae7e3b26c45ca9e4	2022-08-29 16:32:18 +02:00
Miklos Szeredi	8641e0bbb5	ovl: warn if trusted xattr creation fails [ Upstream commit b10b85fe5149ee8b39fbbf86095b303632dde2cd ] When mounting overlayfs in an unprivileged user namespace, trusted xattr creation will fail. This will lead to failures in some file operations, e.g. in the following situation: mkdir lower upper work merged mkdir lower/directory mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged rmdir merged/directory mkdir merged/directory The last mkdir will fail: mkdir: cannot create directory 'merged/directory': Input/output error The cause for these failures is currently extremely non-obvious and hard to debug. Hence, warn the user and suggest using the userxattr mount option, if it is not already supplied and xattr creation fails during the self-check. Reported-by: Alois Wohlschlager <alois1@gmx-topmail.de> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-25 11:40:43 +02:00
Greg Kroah-Hartman	8fd5b33ea5	Merge 5.15.61 into android13-5.15-lts Changes in 5.15.61 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" pNFS/flexfiles: Report RDMA connection errors to the server NFSD: Clean up the show_nf_flags() macro nfsd: eliminate the NFSD_FILE_BREAK_* flags ALSA: usb-audio: Add quirk for Behringer UMC202HD ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate lockd: detect and reject lock arguments that overflow HID: hid-input: add Surface Go battery quirk HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 KVM: x86: Tag kvm_mmu_x86_module_init() with __init KVM: x86: do not report preemption if the steal time cache is stale KVM: x86: revalidate steal time cache if MSR value changes riscv: set default pm_power_off to NULL ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect fix short copy handling in copy_mc_pipe_to_iter() crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Drop pa_swapper_pg_lock spinlock parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode riscv:uprobe fix SR_SPIE set/clear handling dt-bindings: riscv: fix SiFive l2-cache's cache-sets RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context RISC-V: Fixup get incorrect user mode PC for kernel mode regs RISC-V: Fixup schedule out issue in machine_crash_shutdown() RISC-V: Add modules to virtual kernel memory layout dump rtc: rx8025: fix 12/24 hour mode detection on RX-8035 drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/shmem-helper: Add missing vunmap on error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/hyperv-drm: Include framebuffer and EDID headers drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/nouveau/kms: Fix failure path for creating DP connectors drm/amdgpu: Check BO's requested pinning domains against its preferred_domains drm/amdgpu: fix check in fbdev init bpf: Fix KASAN use-after-free Read in compute_effective_progs btrfs: reject log replay if there is unsupported RO compat flag mtd: rawnand: arasan: Fix clock rate in NV-DDR mtd: rawnand: arasan: Update NAND bus clock instead of system clock um: Remove straying parenthesis um: seed rng using host OS rng iio: fix iio_format_avail_range() printing for none IIO_VAL_INT iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers soundwire: qcom: Check device status before reading devid ksmbd: fix memory leak in smb2_handle_negotiate ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ksmbd: fix use-after-free bug in smb2_tree_disconect fuse: limit nsec fuse: ioctl: translate ENOSYS serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" ext2: Add more validity checks for inode counts sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP sched/core: Always flush pending blk_plug irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 ARM: dts: ux500: Fix Codina accelerometer mounting matrix ARM: dts: ux500: Fix Gavini accelerometer mounting matrix spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ARM: OMAP2+: pdata-quirks: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist hwmon: (sht15) Fix wrong assumptions in device remove callback PM: hibernate: defer device probing when resuming from hibernation selinux: fix memleak in security_read_state_kernel() selinux: Add boundary check in put_entry() kasan: test: Silence GCC 12 warnings drm/amdgpu: Remove one duplicated ef removal powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names spi: spi-altera-dfl: Fix an error handling path ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values scsi: hisi_sas: Use managed PCI functions dt-bindings: iio: accel: Add DT binding doc for ADXL355 soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible ARM: dts: ast2600-evb-a1: fix board compatible arm64: dts: mt8192: Fix idle-states nodes naming scheme arm64: dts: mt8192: Fix idle-states entry-method arm64: select TRACE_IRQFLAGS_NMI_SUPPORT arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_() confusion arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init arm64: dts: qcom: sdm630: disable GPU by default arm64: dts: qcom: sdm630: fix the qusb2phy ref clock arm64: dts: qcom: sdm630: fix gpu's interconnect path arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1 soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() stack: Declare {randomize_,}kstack_offset to fix Sparse warnings arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node ACPI: APEI: explicit init of HEST and GHES in apci_init() drivers/iio: Remove all strcpy() uses ACPI: VIOT: Fix ACS setup arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125 arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fixup SYSRAM references arm64: tegra: Update Tegra234 BPMP channel addresses arm64: tegra: Mark BPMP channels as no-memory-wc arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created spi: Fix simplification of devm_spi_register_controller spi: tegra20-slink: fix UAF in tegra_slink_remove() hwmon: (drivetemp) Add module alias blktrace: Trace remapped requests correctly PM: domains: Ensure genpd_debugfs_dir exists before remove dm writecache: return void from functions dm writecache: count number of blocks read, not number of read bios dm writecache: count number of blocks written, not number of write bios dm writecache: count number of blocks discarded, not number of discard bios regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment irqdomain: Report irq number for NOMAP domains drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() x86/extable: Fix ex_handler_msr() print condition selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Reduce number of devm memory allocations pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data() pwm: lpc18xx: Fix period handling drm/dp: Export symbol / kerneldoc fixes for DP AUX bus drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init drm/bridge: lt9611uxc: Cancel only driver's work i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior i2c: mxs: Silence a clang warning virtio-gpu: fix a missing check to avoid NULL dereference drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle() drm/shmem-helper: Export dedicated wrappers for GEM object functions drm/shmem-helper: Pass GEM shmem object in public interfaces drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: atmel: atmel-sama7g5-isc: fix warning in configs without OF media: tw686x: Register the irq at the end of probe media: imx-jpeg: Correct some definition according specification media: imx-jpeg: Leave a blank space before the configuration data media: imx-jpeg: Add pm-runtime support for imx-jpeg media: imx-jpeg: use NV12M to represent non contiguous NV12 media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos media: imx-jpeg: Refactor function mxc_jpeg_parse media: imx-jpeg: Identify and handle precision correctly media: imx-jpeg: Handle source change in a function media: imx-jpeg: Support dynamic resolution change media: imx-jpeg: Align upwards buffer size media: imx-jpeg: Implement drain using v4l2-mem2mem helpers ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers rcutorture: Warn on individual rcu_torture_init() error conditions rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed rcutorture: Fix ksoftirqd boosting timing and iteration test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register media: imx-jpeg: Disable slot interrupt when frame done drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: driver/nxp/imx-jpeg: fix a unexpected return value problem media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/bridge: Add a function to abstract away panels drm/vc4: dsi: Switch to devm_drm_of_get_bridge drm/vc4: Use of_device_get_match_data() drm/vc4: dsi: Release workaround buffer and DMA drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Fix HPD GPIO detection drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Reset HDMI MISC_CONTROL register drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment drm/msm: Avoid dirtyfb stalls on video mode displays (v2) drm/msm/dpu: Fix for non-visible planes mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mt76: mt7615: do not update pm stats in case of error ieee80211: add EHT 1K aggregation definitions mt76: mt7921: fix aggregation subframes setting to HE max mt76: mt7921: enlarge maximum VHT MPDU length to 11454 mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node() skmsg: Fix invalid last sg check in sk_msg_recvmsg() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing media: cedrus: h265: Fix flag name media: hantro: postproc: Fix motion vector space size media: hantro: Simplify postprocessor media: hevc: Embedded indexes in RPS media: staging: media: hantro: Fix typos wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow libbpf: fix an snprintf() overflow check can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS net/mlx5: Adjust log_max_qp to be 18 at most crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set netdevsim: fib: Fix reference count leak on route deletion failure wifi: rtw88: check the return value of alloc_workqueue() iavf: Fix max_rate limiting iavf: Fix 'tc qdisc show' listing too many queues netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock net: usb: make USB_RTL8153_ECM non user configurable wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow HID: amd_sfh: Don't show client init failed as error when discovery fails clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue of: check previous kernel's ima-kexec-buffer against memory bounds scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing scsi: qla2xxx: edif: Fix potential stuck session in sa update scsi: qla2xxx: edif: Reduce connection thrash scsi: qla2xxx: edif: Fix inconsistent check of db_flags scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application scsi: qla2xxx: edif: Add retry for ELS passthrough scsi: qla2xxx: edif: Fix n2n discovery issue with secure target scsi: qla2xxx: edif: Fix n2n login retry for secure device KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails" KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported phy: samsung: exynosautov9-ufs: correct TSRV register configurations PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back scsi: qla2xxx: edif: Send LOGO for unexpected IKE message scsi: qla2xxx: edif: Reduce disruption due to multiple app start scsi: qla2xxx: edif: Fix no login after app start scsi: qla2xxx: edif: Tear down session if keys have been removed scsi: qla2xxx: edif: Fix session thrash scsi: qla2xxx: edif: Fix no logout on delete for N2N iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset lib/test_hmm: avoid accessing uninitialized pages memremap: remove support for external pgmap refcounts mm/memremap: fix memunmap_pages() race with get_dev_pagemap() KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel scsi: iscsi: Add helper to remove a session from the kernel scsi: iscsi: Fix session removal on shutdown dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics mtd: dataflash: Add SPI ID table clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock usb: host: xhci: use snprintf() in xhci_decode_trb() RDMA/rxe: Fix deadlock in rxe_do_local_ops() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain clk: qcom: camcc-sm8250: Fix topology around titan_top power domain clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled. clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register mm/mempolicy: fix get_nodes out of bound access PCI: dwc: Stop link on host_init errors and de-initialization PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Disable outbound windows only for controllers using iATU PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support soundwire: revisit driver bind/unbind and callbacks KVM: arm64: Don't return from void function dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function scsi: qla2xxx: Check correct variable in qla24xx_async_gffid() intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers binder: fix redefinition of seq_file attributes staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch mmc: mxcmmc: Silence a clang warning mmc: renesas_sdhi: Get the reset handle early in the probe memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() phy: stm32: fix error return in stm32_usbphyc_phy_init interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/irdma: Fix a window for use-after-free RDMA/irdma: Fix VLAN connection with wildcard address RDMA/irdma: Fix setting of QP context err_rq_idx_valid field RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/rtrs: Fix warning when use poll mode on client side. RDMA/rtrs: Replace duplicate check with is_pollqueue helper RDMA/rtrs: Introduce destroy_cq helper RDMA/rtrs: Do not allow sessname to contain special symbols / and . RDMA/rtrs: Rename rtrs_sess to rtrs_path RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event iio: cros: Register FIFO callback after sensor is registered clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() HID: amd_sfh: Add NULL check for hid device dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) scripts/gdb: lx-dmesg: read records individually scripts/gdb: fix 'lx-dmesg' on 32 bits arch RDMA/rxe: Fix mw bind to allow any consumer key portion mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support RDMA/rxe: For invalidate compare according to set keys in mr PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence HID: amd_sfh: Handle condition of "no sensors" USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free android: binder: stop saving a pointer to the VMA mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall of/fdt: declared return type does not match actual return type RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Add memory barriers to kernel queues RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq RDMA/rxe: Fix error unwind in rxe_create_qp() block/rnbd-srv: Set keep_id to true after mutex_trylock null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() nvme: define compat_ioctl again to unbreak 32-bit userspace. nvme: disable namespace access for unsupported metadata nvme: don't return an error from nvme_configure_metadata nvme: catch -ENODEV from nvme_revalidate_zones again block/bio: remove duplicate append pages code block: ensure iov_iter advances for added pages jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: imx-audmux: Silence a clang warning ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250: dma: Allow driver operations before starting DMA transfers serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: char: Add mutex protection for rpmsg_eptdev_open() rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix tty registration before control channel open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix missing timer to handle stalled links tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() tty: n_gsm: fix resource allocation order in gsm_activate_mux() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() ASoC: imx-card: Fix DSD/PDM mclk frequency remoteproc: qcom: wcnss: Fix handling of IRQs vfio/ccw: Do not change FSM state in subchannel event serial: 8250_fsl: Don't report FE, PE and OE twice tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() MIPS: vdso: Utilize __pa() for gic_pfn swiotlb: fail map correctly with failed io_tlb_default_mem ASoC: mt6359: Fix refcount leak bug serial: 8250_bcm7271: Save/restore RTS in suspend/resume iommu/exynos: Handle failed IOMMU device registration properly 9p: fix a bunch of checkpatch warnings 9p: Drop kref usage 9p: Add client parameter to p9_req_put() net: 9p: fix refcount leak in p9_read_work() error handling MIPS: Fixed __debug_virt_addr_valid() rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call proc: fix a dentry lock race between release_task and lookup remoteproc: qcom: pas: Check if coredump is enabled remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/maccess: fix semantics of memcpy_real() and its callers s390/crash: fix incorrect number of bytes to copy to user space s390/zcore: fix race when reading from hardware system area ASoC: fsl_asrc: force cast the asrc_format type ASoC: fsl-asoc-card: force cast the asrc_format type ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: imx-card: use snd_pcm_format_t type for asrc_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping. powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias tty: serial: fsl_lpuart: correct the count of break characters s390/dump: fix os_info virtual vs physical address confusion s390/smp: cleanup target CPU callback starting s390/smp: cleanup control register update routines s390/maccess: rework absolute lowcore accessors s390/smp: enforce lowcore protection on CPU restart f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle sched/core: Do not requeue task on CPU excluded from cpus_mask x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y f2fs: allow compression for mmap files in compress_mode=user f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix imbalance vha->vref_count scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts scsi: qla2xxx: Fix excessive I/O error messages by default scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Wind down adapter after PCIe error scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing target when it reappears during delete scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/kprobes: Update kcb status flag after singlestepping x86/olpc: fix 'logical not is only applied to the left hand side' SMB3: fix lease break timeout when multiple deferred close handles for the same file. posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer crypto: blake2s - remove shash module drm/dp/mst: Read the extended DPCD capabilities during system resume drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling usbnet: smsc95xx: Fix deadlock on runtime resume firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails scsi: lpfc: Fix EEH support for NVMe I/O scsi: lpfc: SLI path split: Refactor lpfc_iocbq scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4 scsi: lpfc: SLI path split: Refactor SCSI paths scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Iterate over error counters instead of error strings PCI: qcom: Power on PHY before IPQ8074 DBI register accesses serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code serial: 8250: Add proper clock handling for OxSemi PCIe devices tty: 8250: Add support for Brainboxes PX cards. dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback net/9p: Initialize the iounit field during fid creation ARM: remove some dead code timekeeping: contribute wall clock to rng on time change locking/csd_lock: Change csdlock_debug from early_param to __setup block: remove the struct blk_queue_ctx forward declaration block: don't allow the same type rq_qos add more than once btrfs: ensure pages are unlocked on cow_file_range() failure btrfs: reset block group chunk force if we have to wait btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA ACPI: CPPC: Do not prevent CPPC from working in the future powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists dm raid: fix address sanitizer warning in raid_status dm raid: fix address sanitizer warning in raid_resume tracing: Add '__rel_loc' using trace event macros tracing: Avoid -Warray-bounds warning for __rel_loc macro ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix use-after-free in ext4_xattr_set_entry ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: check if directory block is within i_size ext4: make sure ext4_append() always allocates new block ext4: remove EA inode entry from mbcache on inode eviction ext4: use kmemdup() to replace kmalloc + memcpy ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect powerpc: Fix eh field when calling lwarx on PPC32 tracing: Use a struct alignof to determine trace event field alignment net_sched: cls_route: remove from list when handle is 0 mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() crypto: lib/blake2s - reduce stack frame usage in self test Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" Revert "s390/smp: enforce lowcore protection on CPU restart" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode drm/vc4: change vc4_dma_range_matches from a global to static tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro drm/msm: Fix dirtyfb refcounting drm/meson: Fix refcount leak in meson_encoder_hdmi_init io_uring: mem-account pbuf buckets Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup() scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4() scsi: lpfc: Resolve some cleanup issues following SLI path refactoring Linux 5.15.61 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0849e49fb265651bf6277e4ead9c440d50ed7536	2022-08-22 14:29:30 +02:00
Jiachen Zhang	35ef2ee74d	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() commit dd524b7f317de8d31d638cbfdc7be4cf9b770e42 upstream. Some code paths cannot guarantee the inode have any dentry alias. So WARN_ON() all !dentry may flood the kernel logs. For example, when an overlayfs inode is watched by inotifywait (1), and someone is trying to read the /proc/$(pidof inotifywait)/fdinfo/INOTIFY_FD, at that time if the dentry has been reclaimed by kernel (such as echo 2 > /proc/sys/vm/drop_caches), there will be a WARN_ON(). The printed call stack would be like: ? show_mark_fhandle+0xf0/0xf0 show_mark_fhandle+0x4a/0xf0 ? show_mark_fhandle+0xf0/0xf0 ? seq_vprintf+0x30/0x50 ? seq_printf+0x53/0x70 ? show_mark_fhandle+0xf0/0xf0 inotify_fdinfo+0x70/0x90 show_fdinfo.isra.4+0x53/0x70 seq_show+0x130/0x170 seq_read+0x153/0x440 vfs_read+0x94/0x150 ksys_read+0x5f/0xe0 do_syscall_64+0x59/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 So let's drop WARN_ON() to avoid kernel log flooding. Reported-by: Hongbo Yin <yinhongbo@bytedance.com> Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com> Signed-off-by: Tianci Zhang <zhangtianci.1997@bytedance.com> Fixes: `8ed5eec9d6` ("ovl: encode pure upper file handles") Cc: <stable@vger.kernel.org> # v4.16 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-08-17 14:22:51 +02:00
Greg Kroah-Hartman	bab324e8a8	Merge 5.15.52 into android13-5.15-lts Changes in 5.15.52 tick/nohz: unexport __init-annotated tick_nohz_full_setup() x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() xfs: use kmem_cache_free() for kmem_cache objects xfs: punch out data fork delalloc blocks on COW writeback failure xfs: Fix the free logic of state in xfs_attr_node_hasname xfs: remove all COW fork extents when remounting readonly xfs: check sb_meta_uuid for dabuf buffer recovery xfs: prevent UAF in xfs_log_item_in_current_chkpt xfs: only bother with sync_filesystem during readonly remount powerpc/ftrace: Remove ftrace init tramp once kernel init is complete fs: add is_idmapped_mnt() helper fs: move mapping helpers fs: tweak fsuidgid_has_mapping() fs: account for filesystem mappings docs: update mapping documentation fs: use low-level mapping helpers fs: remove unused low-level mapping helpers fs: port higher-level mapping helpers fs: add i_user_ns() helper fs: support mapped mounts of mapped filesystems fs: fix acl translation fs: account for group membership rtw88: 8821c: support RFE type4 wifi NIC rtw88: rtw8821c: enable rfe 6 devices net: mscc: ocelot: allow unregistered IP multicast flooding to CPU io_uring: fix not locked access to fixed buf table Linux 5.15.52 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2e16e1b5f0367946199f0a0a3b371b54f2377267	2022-08-08 16:18:44 +02:00
Christian Brauner	b3679e8b59	fs: add is_idmapped_mnt() helper commit bb49e9e730c2906a958eee273a7819f401543d6c upstream. Multiple places open-code the same check to determine whether a given mount is idmapped. Introduce a simple helper function that can be used instead. This allows us to get rid of the fragile open-coding. We will later change the check that is used to determine whether a given mount is idmapped. Introducing a helper allows us to do this in a single place instead of doing it for multiple places. Link: https://lore.kernel.org/r/20211123114227.3124056-2-brauner@kernel.org (v1) Link: https://lore.kernel.org/r/20211130121032.3753852-2-brauner@kernel.org (v2) Link: https://lore.kernel.org/r/20211203111707.3901969-2-brauner@kernel.org Cc: Seth Forshee <sforshee@digitalocean.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Al Viro <viro@zeniv.linux.org.uk> CC: linux-fsdevel@vger.kernel.org Reviewed-by: Amir Goldstein <amir73il@gmail.com> Reviewed-by: Seth Forshee <sforshee@digitalocean.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-07-02 16:41:14 +02:00
Greg Kroah-Hartman	0a77fca3aa	ANDROID: GKI: set vfs-only exports into their own namespace We have namespaces, so use them for all vfs-exported namespaces so that filesystems can use them, but not anything else. Some in-kernel drivers that do direct filesystem accesses (because they serve up files) are also allowed access to these symbols to keep 'make allmodconfig' builds working properly, but it is not needed for Android kernel images. Bug: 157965270 Bug: 210074446 Cc: Matthias Maennich <maennich@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaf6140baf3a18a516ab2d5c3966235c42f3f70de	2022-04-07 15:14:24 +02:00
Greg Kroah-Hartman	344a3ff87c	Merge 5.15.20 into android13-5.15 Changes in 5.15.20 PCI: pciehp: Fix infinite loop in IRQ handler upon power fault selftests: mptcp: fix ipv6 routing setup net: ipa: use a bitmap for endpoint replenish_enabled net: ipa: prevent concurrent replenish drm/vc4: hdmi: Make sure the device is powered with CEC cgroup-v1: Require capabilities to set release_agent Revert "mm/gup: small refactoring: simplify try_grab_page()" ovl: don't fail copy up if no fileattr support on upper lockd: fix server crash on reboot of client holding lock lockd: fix failure to cleanup client locks net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic net/mlx5: Bridge, take rtnl lock in init error handler net/mlx5: Bridge, ensure dev_name is null-terminated net/mlx5e: Fix handling of wrong devices during bond netevent net/mlx5: Use del_timer_sync in fw reset flow of halting poll net/mlx5e: Fix module EEPROM query net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE net/mlx5e: Don't treat small ceil values as unlimited in HTB offload net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion net/mlx5: E-Switch, Fix uninitialized variable modact ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback i40e: Fix reset bw limit when DCB enabled with 1 TC i40e: Fix reset path while removing the driver net: amd-xgbe: ensure to reset the tx_timer_active flag net: amd-xgbe: Fix skb data length underflow fanotify: Fix stale file descriptor in copy_event_to_user() net: sched: fix use-after-free in tc_new_tfilter() rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() e1000e: Handshake with CSME starts from ADL platforms af_packet: fix data-race in packet_setsockopt / packet_setsockopt tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() ovl: fix NULL pointer dereference in copy up warning Linux 5.15.20 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia50333eff81881fac62eb52455b502e6c46ff3d9	2022-02-05 13:22:13 +01:00
Christoph Fritz	e6b678c1a3	ovl: fix NULL pointer dereference in copy up warning commit 4ee7e4a6c9b298da44029ed9ec8ed23ae49cc209 upstream. This patch is fixing a NULL pointer dereference to get a recently introduced warning message working. Fixes: 5b0a414d06c3 ("ovl: fix filattr copy-up failure") Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com> Cc: <stable@vger.kernel.org> # v5.15 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-05 12:38:59 +01:00
Miklos Szeredi	559bc6ec87	ovl: don't fail copy up if no fileattr support on upper commit 94fd19752b28aa66c98e7991734af91dfc529f8f upstream. Christoph Fritz is reporting that failure to copy up fileattr when upper doesn't support fileattr or xattr results in a regression. Return success in these failure cases; this reverts overlayfs to the old behavior. Add a pr_warn_once() in these cases to still let the user know about the copy up failures. Reported-by: Christoph Fritz <chf.fritz@googlemail.com> Fixes: `72db82115d` ("ovl: copy up sync/noatime fileattr flags") Cc: <stable@vger.kernel.org> # v5.15 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-05 12:38:57 +01:00
Greg Kroah-Hartman	bbc1b6a8a4	Merge 5.15.11 into android13-5.15 Changes in 5.15.11 reset: tegra-bpmp: Revert Handle errors in BPMP response KVM: VMX: clear vmx_x86_ops.sync_pir_to_irr if APICv is disabled KVM: selftests: Make sure kvm_create_max_vcpus test won't hit RLIMIT_NOFILE KVM: downgrade two BUG_ONs to WARN_ON_ONCE x86/kvm: remove unused ack_notifier callbacks KVM: X86: Fix tlb flush for tdp in kvm_invalidate_pcid() mac80211: fix rate control for retransmitted frames mac80211: fix regression in SSN handling of addba tx mac80211: mark TX-during-stop for TX in in_reconfig mac80211: send ADDBA requests using the tid/queue of the aggregation session mac80211: validate extended element ID is present firmware: arm_scpi: Fix string overflow in SCPI genpd driver bpf: Fix kernel address leakage in atomic fetch bpf, selftests: Add test case for atomic fetch on spilled pointer bpf: Fix signed bounds propagation after mov32 bpf: Make 32->64 bounds propagation slightly more robust bpf, selftests: Add test case trying to taint map value pointer bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg bpf, selftests: Update test case for atomic cmpxchg on r0 with pointer vduse: fix memory corruption in vduse_dev_ioctl() vduse: check that offset is within bounds in get_config() virtio_ring: Fix querying of maximum DMA mapping size for virtio device vdpa: check that offsets are within bounds s390/entry: fix duplicate tracking of irq nesting level recordmcount.pl: look for jgnop instruction as well as bcrl on s390 arm64: dts: ten64: remove redundant interrupt declaration for gpio-keys ceph: fix up non-directory creation in SGID directories dm btree remove: fix use after free in rebalance_children() audit: improve robustness of the audit queue handling btrfs: convert latest_bdev type to btrfs_device and rename btrfs: use latest_dev in btrfs_show_devname btrfs: update latest_dev when we create a sprout device btrfs: remove stale comment about the btrfs_show_devname scsi: ufs: core: Retry START_STOP on UNIT_ATTENTION drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915 drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown() pinctrl: amd: Fix wakeups when IRQ is shared with SCI arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from rk3399-khadas-edge arm64: dts: rockchip: fix rk3308-roc-cc vcc-sd supply arm64: dts: rockchip: fix rk3399-leez-p710 vcc3v3-lan supply arm64: dts: rockchip: fix audio-supply for Rock Pi 4 arm64: dts: rockchip: fix poweroff on helios64 dmaengine: idxd: add halt interrupt support dmaengine: idxd: fix calling wq quiesce inside spinlock mac80211: track only QoS data frames for admission control tee: amdtee: fix an IS_ERR() vs NULL bug ceph: fix duplicate increment of opened_inodes metric ceph: initialize pathlen variable in reconnect_caps_cb ARM: socfpga: dts: fix qspi node compatible arm64: dts: imx8mq: remove interconnect property from lcdif clk: Don't parent clks until the parent is fully registered soc: imx: Register SoC device only on i.MX boards iwlwifi: mvm: don't crash on invalid rate w/o STA virtio: always enter drivers/virtio/ virtio/vsock: fix the transport to work with VMADDR_CID_ANY vdpa: Consider device id larger than 31 Revert "drm/fb-helper: improve DRM fbdev emulation device names" selftests: net: Correct ping6 expected rc from 2 to 1 s390/kexec_file: fix error handling when applying relocations sch_cake: do not call cake_destroy() from cake_init() inet_diag: fix kernel-infoleak for UDP sockets netdevsim: don't overwrite read only ethtool parms selftests: icmp_redirect: pass xfail=0 to log_test() net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg net: hns3: fix race condition in debugfs selftests: Add duplicate config only for MD5 VRF tests selftests: Fix raw socket bind tests with VRF selftests: Fix IPv6 address bind tests dmaengine: idxd: fix missed completion on abort path dmaengine: st_fdma: fix MODULE_ALIAS drm: simpledrm: fix wrong unit with pixel clock net/sched: sch_ets: don't remove idle classes from the round-robin list selftests/net: toeplitz: fix udp option net: dsa: mv88e6xxx: Unforce speed & duplex in mac_link_down() selftest/net/forwarding: declare NETIFS p9 p10 mptcp: never allow the PM to close a listener subflow drm/ast: potential dereference of null pointer drm/i915/display: Fix an unsigned subtraction which can never be negative. mac80211: agg-tx: don't schedule_and_wake_txq() under sta->lock cfg80211: Acquire wiphy mutex on regulatory work mac80211: fix lookup when adding AddBA extension element net: stmmac: fix tc flower deletion for VLAN priority Rx steering flow_offload: return EOPNOTSUPP for the unsupported mpls action type rds: memory leak in __rds_conn_create() ice: Use div64_u64 instead of div_u64 in adjfine ice: Don't put stale timestamps in the skb drm/amd/display: Set exit_optimized_pwr_state for DCN31 drm/amd/pm: fix a potential gpu_metrics_table memory leak mptcp: remove tcp ulp setsockopt support mptcp: clear 'kern' flag from fallback sockets mptcp: fix deadlock in __mptcp_push_pending() soc/tegra: fuse: Fix bitwise vs. logical OR warning igb: Fix removal of unicast MAC filters of VFs igbvf: fix double free in `igbvf_probe` igc: Fix typo in i225 LTR functions ixgbe: Document how to enable NBASE-T support ixgbe: set X550 MDIO speed before talking to PHY netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc net/packet: rx_owner_map depends on pg_vec net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup sfc_ef100: potential dereference of null pointer dsa: mv88e6xxx: fix debug print for SPEED_UNFORCED net: Fix double 0x prefix print in SKB dump net/smc: Prevent smc_release() from long blocking net: systemport: Add global locking for descriptor lifecycle sit: do not call ipip6_dev_free() from sit_init_net() afs: Fix mmap arm64: kexec: Fix missing error code 'ret' warning in load_other_segments() bpf: Fix extable fixup offset. bpf, selftests: Fix racing issue in btf_skc_cls_ingress test powerpc/85xx: Fix oops when CONFIG_FSL_PMC=n USB: gadget: bRequestType is a bitfield, not a enum Revert "usb: early: convert to readl_poll_timeout_atomic()" KVM: x86: Drop guest CPUID check for host initiated writes to MSR_IA32_PERF_CAPABILITIES tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) usb: dwc2: fix STM ID/VBUS detection startup delay in dwc2_driver_probe PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error PCI/MSI: Mask MSI-X vectors only on success usb: xhci-mtk: fix list_del warning when enable list debug usb: xhci: Extend support for runtime power management for AMD's Yellow carp. usb: cdnsp: Fix incorrect status for control request usb: cdnsp: Fix incorrect calling of cdnsp_died function usb: cdnsp: Fix issue in cdnsp_log_ep trace event usb: cdnsp: Fix lack of spin_lock_irqsave/spin_lock_restore usb: typec: tcpm: fix tcpm unregister port but leave a pending timer usb: gadget: u_ether: fix race in setting MAC address in setup phase USB: serial: cp210x: fix CP2105 GPIO registration USB: serial: option: add Telit FN990 compositions selinux: fix sleeping function called from invalid context btrfs: fix memory leak in __add_inode_ref() btrfs: fix double free of anon_dev after failure to create subvolume btrfs: check WRITE_ERR when trying to read an extent buffer btrfs: fix missing blkdev_put() call in btrfs_scan_one_device() zonefs: add MODULE_ALIAS_FS iocost: Fix divide-by-zero on donation from low hweight cgroup serial: 8250_fintek: Fix garbled text for console timekeeping: Really make sure wall_to_monotonic isn't positive cifs: sanitize multiple delimiters in prepath locking/rtmutex: Fix incorrect condition in rtmutex_spin_on_owner() riscv: dts: unleashed: Add gpio card detect to mmc-spi-slot riscv: dts: unmatched: Add gpio card detect to mmc-spi-slot perf inject: Fix segfault due to close without open perf inject: Fix segfault due to perf_data__fd() without open libata: if T_LENGTH is zero, dma direction should be DMA_NONE powerpc/module_64: Fix livepatching for RO modules drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE drm/amdgpu: don't override default ECO_BITs setting drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC Revert "can: m_can: remove support for custom bit timing" can: m_can: make custom bittiming fields const can: m_can: pci: use custom bit timings for Elkhart Lake ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name xsk: Do not sleep in poll() when need_wakeup set mptcp: add missing documented NL params bpf, x64: Factor out emission of REX byte in more cases bpf: Fix extable address check. USB: core: Make do_proc_control() and do_proc_bulk() killable media: mxl111sf: change mutex_init() location fuse: annotate lock in fuse_reverse_inval_entry() ovl: fix warning in ovl_create_real() scsi: scsi_debug: Don't call kcalloc() if size arg is zero scsi: scsi_debug: Fix type in min_t to avoid stack OOB scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() io-wq: remove spurious bit clear on task_work addition io-wq: check for wq exit after adding new worker task_work rcu: Mark accesses to rcu_state.n_force_qs io-wq: drop wqe lock before creating new worker bus: ti-sysc: Fix variable set but not used warning for reinit_modules selftests/damon: test debugfs file reads/writes with huge count Revert "xsk: Do not sleep in poll() when need_wakeup set" xen/blkfront: harden blkfront against event channel storms xen/netfront: harden netfront against event channel storms xen/console: harden hvc_xen against event channel storms xen/netback: fix rx queue stall detection xen/netback: don't queue unlimited number of packages Linux 5.15.11 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I20c400f64f45729c6f833c31ee18eb4b92f5ed89	2021-12-29 11:32:19 +01:00
Miklos Szeredi	d2ccdd4e4e	ovl: fix warning in ovl_create_real() commit 1f5573cfe7a7056e80a92c7a037a3e69f3a13d1c upstream. Syzbot triggered the following warning in ovl_workdir_create() -> ovl_create_real(): if (!err && WARN_ON(!newdentry->d_inode)) { The reason is that the cgroup2 filesystem returns from mkdir without instantiating the new dentry. Weird filesystems such as this will be rejected by overlayfs at a later stage during setup, but to prevent such a warning, call ovl_mkdir_real() directly from ovl_workdir_create() and reject this case early. Reported-and-tested-by: syzbot+75eab84fd0af9e8bf66b@syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-22 09:32:50 +01:00
David Anderson	611e67fd1a	FROMLIST: overlayfs: inode_owner_or_capable called during execv Using old_creds as an indication that we are not overriding the credentials, bypass call to inode_owner_or_capable. This solves a problem with all execv calls being blocked when using the caller's credentials. Bug: 204981027 Link: https://lore.kernel.org/lkml/20201021151903.652827-5-salyzyn@android.com/ Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com> Change-Id: I6b196483f7a3fa431f4f174c6671c2118e0088dd	2021-11-23 19:13:44 +00:00
David Anderson	84a6506ce6	FROMLIST: overlayfs: override_creds=off option bypass creator_cred By default, all access to the upper, lower and work directories is the recorded mounter's MAC and DAC credentials. The incoming accesses are checked against the caller's credentials. If the principles of least privilege are applied, the mounter's credentials might not overlap the credentials of the caller's when accessing the overlayfs filesystem. For example, a file that a lower DAC privileged caller can execute, is MAC denied to the generally higher DAC privileged mounter, to prevent an attack vector. We add the option to turn off override_creds in the mount options; all subsequent operations after mount on the filesystem will be only the caller's credentials. The module boolean parameter and mount option override_creds is also added as a presence check for this "feature", existence of /sys/module/overlay/parameters/override_creds. It was not always this way. Circa 4.6 there was no recorded mounter's credentials, instead privileged access to upper or work directories were temporarily increased to perform the operations. The MAC (selinux) policies were caller's in all cases. override_creds=off partially returns us to this older access model minus the insecure temporary credential increases. This is to permit use in a system with non-overlapping security models for each executable including the agent that mounts the overlayfs filesystem. In Android this is the case since init, which performs the mount operations, has a minimal MAC set of privileges to reduce any attack surface, and services that use the content have a different set of MAC privileges (eg: read, for vendor labelled configuration, execute for vendor libraries and modules). The caveats are not a problem in the Android usage model, however they should be fixed for completeness and for general use in time. Bug: 204981027 Link: https://lore.kernel.org/lkml/20211117015806.2192263-4-dvander@google.com Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com> Change-Id: I21516b3af483790fb0a7bfdeabf4770c486dbcbc	2021-11-23 19:13:38 +00:00
David Anderson	e884438aa5	Revert "FROMLIST: Add flags option to get xattr method paired to..." Revert submission 1881578 Reason for revert: broken build in CI Reverted Changes: Id2c6fa6ee:FROMLIST: Add flags option to get xattr method pai... Ifa966dabd:FROMLIST: overlayfs: inode_owner_or_capable called... I46e6c74ff:FROMLIST: overlayfs: override_creds=off option byp... I0b8fe9f1f:FROMLIST: overlayfs: handle XATTR_NOSECURITY flag ... Change-Id: Ic4f9a8dd92dc492ed0a474c783497ec525f1c762 Signed-off-by: David Anderson <dvander@google.com>	2021-11-20 03:15:20 +00:00
David Anderson	df1cc768a5	Revert "FROMLIST: overlayfs: handle XATTR_NOSECURITY flag for ge..." Revert submission 1881578 Reason for revert: broken build in CI Reverted Changes: Id2c6fa6ee:FROMLIST: Add flags option to get xattr method pai... Ifa966dabd:FROMLIST: overlayfs: inode_owner_or_capable called... I46e6c74ff:FROMLIST: overlayfs: override_creds=off option byp... I0b8fe9f1f:FROMLIST: overlayfs: handle XATTR_NOSECURITY flag ... Change-Id: Ie59bb4f7ad86f64c320a3e6f328a4e6f4fa1d204 Signed-off-by: David Anderson <dvander@google.com>	2021-11-20 03:15:14 +00:00
David Anderson	650b7fa416	Revert "FROMLIST: overlayfs: override_creds=off option bypass cr..." Revert submission 1881578 Reason for revert: broken build in CI Reverted Changes: Id2c6fa6ee:FROMLIST: Add flags option to get xattr method pai... Ifa966dabd:FROMLIST: overlayfs: inode_owner_or_capable called... I46e6c74ff:FROMLIST: overlayfs: override_creds=off option byp... I0b8fe9f1f:FROMLIST: overlayfs: handle XATTR_NOSECURITY flag ... Change-Id: Ib78cfc2cfb717a0c4a1997399aaa47d38c6f366d Signed-off-by: David Anderson <dvander@google.com>	2021-11-20 03:15:07 +00:00
David Anderson	c100cf8c92	Revert "FROMLIST: overlayfs: inode_owner_or_capable called durin..." Revert submission 1881578 Reason for revert: broken build in CI Reverted Changes: Id2c6fa6ee:FROMLIST: Add flags option to get xattr method pai... Ifa966dabd:FROMLIST: overlayfs: inode_owner_or_capable called... I46e6c74ff:FROMLIST: overlayfs: override_creds=off option byp... I0b8fe9f1f:FROMLIST: overlayfs: handle XATTR_NOSECURITY flag ... Change-Id: I7650b493f3b5e796f231280fe626312418190822 Signed-off-by: David Anderson <dvander@google.com>	2021-11-20 03:14:58 +00:00
Greg Kroah-Hartman	36de88a855	Merge 5.15.3 into android13-5.15 Changes in 5.15.3 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: scsi_ioctl: Validate command size scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding scsi: lpfc: Fix FCP I/O flush functionality for TMF routines scsi: qla2xxx: Fix crash in NVMe abort path scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path ce/gf100: fix incorrect CE0 address calculation on some GPUs char: xillybus: fix msg_ep UAF in xillyusb_probe() mmc: mtk-sd: Add wait dma stop done flow mmc: dw_mmc: Dont wait for DRTO on Write RSP error exfat: fix incorrect loading of i_blocks for large files io-wq: remove worker to owner tw dependency parisc: Fix set_fixmap() on PA1.x CPUs parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: rkvdec: Do not override sizeimage for output format media: ite-cir: IR receiver stop working after receive overflow media: rkvdec: Support dynamic resolution changes media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: hda: Free card instance properly at probe errors ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: pci: rme: Fix unaligned buffer addresses ALSA: PCM: Fix NULL dereference at mmap checks ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks" ext4: fix lazy initialization next schedule time computation in more granular unit ext4: ensure enough credits in ext4_ext_shift_path_extents ext4: refresh the ext4_ext_path struct after dropping i_data_sem. fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload x86/iopl: Fake iopl(3) CLI/STI usage btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device KVM: x86/mmu: Drop a redundant, broken remote TLB flush KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling ia64: kprobes: Fix to pass correct trampoline address to the handler selinux: fix race condition when computing ocontext SIDs ipmi:watchdog: Set panic count to proper value on a panic md/raid1: only allocate write behind bio for WriteMostly device hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init ifb: Depend on netfilter alternatively to tc platform/surface: aggregator_registry: Add support for Surface Laptop Studio mt76: mt7615: fix skb use-after-free on mac reset HID: surface-hid: Use correct event registry for managing HID events HID: surface-hid: Allow driver matching for target ID 1 devices wcn36xx: Fix HT40 capability for 2Ghz band wcn36xx: Fix tx_status mechanism wcn36xx: Fix (QoS) null data frame bitrate/modulation PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions mwifiex: Read a PCI register after writing the TX ring write pointer mwifiex: Try waking the firmware until we get an interrupt libata: fix checking of DMA state dma-buf: fix and rework dma_buf_poll v7 wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server perf/x86/intel/uncore: Fix invalid unit check perf/x86/intel/uncore: Fix Intel ICX IIO event constraints RDMA/qedr: Fix NULL deref for query_qp on the GSI QP ASoC: tegra: Set default card name for Trimslice ASoC: tegra: Restore AC97 support signal: Remove the bogus sigkill_pending in ptrace_stop memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode signal/mips: Update (_save\|_restore)_fp_context to fail with -EFAULT signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id soc: fsl: dpio: use the combined functions to protect critical zone mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines mctp: handle the struct sockaddr_mctp padding fields power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns iio: core: fix double free in iio_device_unregister_sysfs() iio: core: check return value when calling dev_set_name() KVM: arm64: Extract ESR_ELx.EC only KVM: x86: Fix recording of guest steal time / preempted status KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use KVM: nVMX: Handle dynamic MSR intercept toggling can: peak_usb: always ask for BERR reporting for PCAN-USB devices can: mcp251xfd: mcp251xfd_irq(): add missing can_rx_offload_threaded_irq_finish() in case of bus off can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM iio: adc: tsc2046: fix scan interval warning powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found io_uring: honour zeroes as io-wq worker limits ring-buffer: Protect ring_buffer_reset() from reentrancy serial: core: Fix initializing and restoring termios speed ifb: fix building without CONFIG_NET_CLS_ACT xen/balloon: add late_initcall_sync() for initial ballooning done ovl: fix use after free in struct ovl_aio_req ovl: fix filattr copy-up failure PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: cadence: Add cdns_plat_pcie_probe() missing return cxl/pci: Fix NULL vs ERR_PTR confusion PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix configuring Reference clock PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() cifs: To match file servers, make sure the server hostname matches cifs: set a minimum of 120s for next dns resolution mfd: simple-mfd-i2c: Select MFD_CORE to fix build error pinctrl: core: fix possible memory leak in pinctrl_enable() coresight: cti: Correct the parameter for pm_runtime_put coresight: trbe: Fix incorrect access of the sink specific data coresight: trbe: Defer the probe on offline CPUs iio: buffer: check return value of kstrdup_const() iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask() iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask() iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups() drivers: iio: dac: ad5766: Fix dt property name iio: dac: ad5446: Fix ad5622_write() return value iio: ad5770r: make devicetree property reading consistent Documentation:devicetree:bindings:iio:dac: Fix val USB: serial: keyspan: fix memleak on probe errors serial: 8250: fix racy uartclk update ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION io-wq: serialize hash clear with wakeup serial: 8250: Fix reporting real baudrate value in c_ospeed field Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field" most: fix control-message timeouts USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock power: supply: max17042_battery: Clear status bits in interrupt handler component: do not leave master devres group open after bind dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() Bluetooth: call sock_hold earlier in sco_conn_del drm/panel-orientation-quirks: add Valve Steam Deck rcutorture: Avoid problematic critical section nesting on PREEMPT_RT platform/x86: wmi: do not fail if disabling fails drm/amdgpu: move iommu_resume before ip init/resume MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes ACPI: resources: Add DMI-based legacy IRQ override quirk rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop smackfs: Fix use-after-free in netlbl_catmap_walk() ath11k: Align bss_chan_info structure with firmware crypto: aesni - check walk.nbytes instead of err x86/mm/64: Improve stack overflow warnings x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes spi: Check we have a spi_device_id for each DT compatible fscrypt: allow 256-bit master keys with AES-256-XTS drm/amdgpu: Fix MMIO access page fault drm/amd/display: Fix null pointer dereference for encoders selftests: net: fib_nexthops: Wait before checking reported idle time ath11k: Avoid reg rules update during firmware recovery ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets ath10k: high latency fixes for beacon buffer octeontx2-pf: Enable promisc/allmulti match MCAM entries. media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: atomisp: Fix error handling in probe media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: vidtv: Fix memory leak in remove media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: videobuf2: rework vb2_mem_ops API media: imx: set a media_device bus_info string media: rcar-vin: Use user provided buffers when starting media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK rtw88: fix RX clock gate setting while fifo dump brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic fs/proc/uptime.c: Fix idle time reporting in /proc/uptime kselftests/sched: cleanup the child processes ACPICA: Avoid evaluating methods too early during system resume cpufreq: Make policy min/max hard requirements ice: Move devlink port to PF/VF struct media: imx-jpeg: Fix possible null pointer dereference media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually drm/amdkfd: rm BO resv on validation to avoid deadlock tracefs: Have tracefs directories not set OTH permission bits by default tracing: Disable "other" permission bits in the tracefs files ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall mmc: moxart: Fix reference count leaks in moxart_probe iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full ACPI: scan: Release PM resources blocked by unused objects drm/amd/display: fix null pointer deref when plugging in display drm/amdkfd: fix resume error when iommu disabled in Picasso net: phy: micrel: make -skew-ps check more lenient leaking_addresses: Always print a trailing newline thermal/core: Fix null pointer dereference in thermal_release() drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() thermal/drivers/tsens: Add timeout to get_temp_tsens_valid block: bump max plugged deferred size from 16 to 32 floppy: fix calling platform_device_unregister() on invalid drives md: update superblock after changing rdev flags in state_store memstick: r592: Fix a UAF bug when removing the driver locking/rwsem: Disable preemption for spinning region lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_ functions signature mismatch mt76: mt7915: fix an off-by-one bound check mwl8k: Fix use-after-free in mwl8k_fw_state_machine() iwlwifi: change all JnP to NO-160 configuration block: remove inaccurate requeue check media: allegro: ignore interrupt if mailbox is not initialized drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh nvmet: fix use-after-free when a port is removed nvmet-rdma: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces samples/bpf: Fix application of sizeof to pointer arm64: vdso32: suppress error message for 'make mrproper' PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() selftests/bpf: Fix perf_buffer test on system with offline cpus iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to unsigned int gfs2: Cancel remote delete work asynchronously gfs2: Fix glock_hash_walk bugs ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 tools/latency-collector: Use correct size when writing queue_full_warning vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() ACPI: AC: Quirk GK45 to skip reading _PSR ACPI: resources: Add one more Medion model in IRQ override quirk btrfs: reflink: initialize return value to 0 in btrfs_extent_same() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() wcn36xx: Correct band/freq reporting on RX wcn36xx: Fix packet drop on resume Revert "wcn36xx: Enable firmware link monitoring" ftrace: do CPU checking after preemption disabled inet: remove races in inet{6}_getname() x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled selftests/core: fix conflicting types compile error for close_range() perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack erofs: don't trigger WARN() when decompression fails parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression fbdev/efifb: Release PCI device's runtime PM ref during FB destroy drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux() perf/x86/intel/uncore: Fix Intel SPR CHA event constraints perf/x86/intel/uncore: Fix Intel SPR IIO event constraints perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints drm/bridge: it66121: Initialize {device,vendor}_ids drm/bridge: it66121: Wait for next bridge to be probed Bluetooth: fix init and cleanup of sco_conn.timeout_work libbpf: Don't crash on object files with no symbol tables Bluetooth: hci_uart: fix GPF in h5_recv rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() MIPS: lantiq: dma: fix burst length for DEU x86/xen: Mark cpu_bringup_and_idle() as dead_end_function objtool: Handle __sanitize_cov() tail calls net/mlx5: Publish and unpublish all devlink parameters at once drm/v3d: fix wait for TMU write combiner flush crypto: sm4 - Do not change section of ck and sbox virtio-gpu: fix possible memory allocation failure lockdep: Let lock_is_held_type() detect recursive read as read net: net_namespace: Fix undefined member in key_remove_domain() net: phylink: don't call netif_carrier_off() with NULL netdev drm: bridge: it66121: Fix return value it66121_probe spi: Fixed division by zero warning cgroup: Make rebind_subsystems() disable v2 controllers all at once wcn36xx: Fix Antenna Diversity Switching wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync drm/amdgpu: Fix crash on device remove/driver unload drm/amd/display: Pass display_pipe_params_st as const in DML drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage crypto: caam - disable pkc for non-E SoCs crypto: qat - power up 4xxx device Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs bnxt_en: Check devlink allocation and registration status qed: Don't ignore devlink allocation failures rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() mptcp: do not shrink snd_nxt when recovering fortify: Fix dropped strcpy() compile-time write overflow check mac80211: twt: don't use potentially unaligned pointer cfg80211: always free wiphy specific regdomain net/mlx5: Accept devlink user input after driver initialization complete net: dsa: rtl8366rb: Fix off-by-one bug net: dsa: rtl8366: Fix a bug in deleting VLANs bpf/tests: Fix error in tail call limit tests ath11k: fix some sleeping in atomic bugs ath11k: Avoid race during regd updates ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status ath11k: Fix memory leak in ath11k_qmi_driver_event_work gve: DQO: avoid unused variable warnings ath10k: Fix missing frame timestamp for beacon/probe-resp ath10k: sdio: Add missing BH locking around napi_schdule() drm/ttm: stop calling tt_swapin in vm_access arm64: mm: update max_pfn after memory hotplug drm/amdgpu: fix warning for overflow check libbpf: Fix skel_internal.h to set errno on loader retval < 0 media: em28xx: add missing em28xx_close_extension media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()' media: cxd2880-spi: Fix a null pointer dereference on error handling path media: ttusb-dec: avoid release of non-acquired mutex media: dvb-usb: fix ununit-value in az6027_rc_query media: imx258: Fix getting clock frequency media: v4l2-ioctl: S_CTRL output the right value media: mtk-vcodec: venc: fix return value when start_streaming fails media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()' media: i2c: ths8200 needs V4L2_ASYNC media: sun6i-csi: Allow the video device to be open multiple times media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer media: atmel: fix the ispck initialization scs: Release kasan vmalloc poison in scs_free process kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency drm: fb_helper: fix CONFIG_FB dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath10k: Don't always treat modem stop events as crashes ath9k: Fix potential interrupt storm on queue reset PM: EM: Fix inefficient states detection x86/insn: Use get_unaligned() instead of memcpy() EDAC/amd64: Handle three rank interleaving mode rcu: Always inline rcu_dynticks_task_{enter,exit}() rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr netfilter: nft_dynset: relax superfluous check on set updates media: venus: fix vpp frequency calculation for decoder media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: ccree - avoid out-of-range warnings from clang crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops ima: fix deadlock when traversing "ima_default_rules". b43legacy: fix a lower bounds test b43: fix a lower bounds test gve: Recover from queue stall due to missed IRQ gve: Track RX buffer allocation failures mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured mmc: sdhci-omap: Fix context restore memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit kernel/sched: Fix sched_fork() access an invalid sched_task_group net: fealnx: fix build for UML net: intel: igc_ptp: fix build for UML net: tulip: winbond-840: fix build for UML tcp: switch orphan_count to bare per-cpu counters crypto: octeontx2 - set assoclen in aead_do_fallback() thermal/core: fix a UAF bug in __thermal_cooling_device_register() drm/msm/dsi: do not enable irq handler before powering up the host drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init() drm/msm: potential error pointer dereference in init() drm/msm: unlock on error in get_sched_entity() drm/msm: fix potential NULL dereference in cleanup drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done media: ivtv: fix build for UML media: ir_toy: assignment to be16 should be of correct type mmc: mxs-mmc: disable regulator on error and in the remove function io-wq: Remove duplicate code in io_workqueue_create() block: ataflop: fix breakage introduced at blk-mq refactoring blk-wbt: prevent NULL pointer dereference in wb_timer_fn platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mailbox: mtk-cmdq: Validate alias_id on probe mailbox: mtk-cmdq: Fix local clock ID usage ACPI: PM: Turn off unused wakeup power resources ACPI: PM: Fix sharing of wakeup power resources drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb mt76: mt7921: fix endianness warning in mt7921_update_txs mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal() mt76: connac: fix mt76_connac_gtk_rekey_tlv usage mt76: fix build error implicit enumeration conversion mt76: mt7921: fix survey-dump reporting mt76: mt76x02: fix endianness warnings in mt76x02_mac.c mt76: mt7921: Fix out of order process by invalid event pkt mt76: mt7915: fix potential overflow of eeprom page index mt76: mt7915: fix bit fields for HT rate idx mt76: mt7921: fix dma hang in rmmod mt76: connac: fix GTK rekey offload failure on WPA mixed mode mt76: overwrite default reg_ops if necessary mt76: mt7921: report HE MU radiotap mt76: mt7921: fix firmware usage of RA info using legacy rates mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate mt76: mt7921: always wake device if necessary in debugfs mt76: mt7915: fix hwmon temp sensor mem use-after-free mt76: mt7615: fix hwmon temp sensor mem use-after-free mt76: mt7915: fix possible infinite loop release semaphore mt76: mt7921: fix retrying release semaphore without end mt76: mt7615: fix monitor mode tear down crash mt76: connac: fix possible NULL pointer dereference in mt76_connac_get_phy_mode_v2 mt76: mt7915: fix sta_rec_wtbl tag len mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req() rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec iwlwifi: mvm: reset PM state on unsuccessful resume iwlwifi: pnvm: don't kmemdup() more than we have iwlwifi: pnvm: read EFI data only if long enough net: enetc: unmap DMA in enetc_send_cmd() phy: micrel: ksz8041nl: do not use power down mode nbd: Fix use-after-free in pid_show nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF x86/sev: Fix stack type check in vc_switch_off_ist() drm/msm: Fix potential NULL dereference in DPU SSPP drm/msm/dsi: fix wrong type in msm_dsi_host crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi KVM: selftests: Fix nested SVM tests when built with clang libbpf: Fix memory leak in btf__dedup() bpftool: Avoid leaking the JSON writer prepared for program metadata libbpf: Fix overflow in BTF sanity checks libbpf: Fix BTF header parsing checks mt76: mt7615: mt7622: fix ibss and meshpoint s390/gmap: validate VMA in __gmap_zap() s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() s390/mm: validate VMA in PGSTE manipulation functions s390/mm: fix VMA and page table handling code in storage key handling functions s390/uv: fully validate the VMA before calling follow_page() KVM: s390: pv: avoid double free of sida page KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm irq: mips: avoid nested irq_enter() net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error ARM: 9142/1: kasan: work around LPAE build warning ath10k: fix module load regression with iram-recovery feature block: ataflop: more blk-mq refactoring fixes blk-cgroup: synchronize blkg creation against policy deactivation libbpf: Fix off-by-one bug in bpf_core_apply_relo() tpm: fix Atmel TPM crash caused by too frequent queries tpm_tis_spi: Add missing SPI ID libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization spi: spi-rpc-if: Check return value of rpcif_sw_init() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path wcn36xx: Fix discarded frames due to wrong sequence number bpf: Avoid races in __bpf_prog_run() for 32bit arches bpf: Fixes possible race in update_prog_stats() for 32bit arches wcn36xx: Channel list update before hardware scan drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw() drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits selftests/bpf: Fix fd cleanup in sk_lookup test selftests/bpf: Fix memory leak in test_ima sctp: allow IP fragmentation when PLPMTUD enters Error state sctp: reset probe_timer in sctp_transport_pl_update sctp: subtract sctphdr len in sctp_transport_pl_hlen sctp: return true only for pathmtu update in sctp_transport_pl_toobig net: amd-xgbe: Toggle PLL settings during rate change ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()' nfp: fix NULL pointer access when scheduling dim work nfp: fix potential deadlock when canceling dim work net: phylink: avoid mvneta warning when setting pause parameters net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled selftests: net: bridge: update IGMP/MLD membership interval value crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts ibmvnic: delay complete() selftests: mptcp: fix proto type in link_failure tests skmsg: Lose offset info in sk_psock_skb_ingress cgroup: Fix rootcg cpu.stat guest double counting bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit. of: unittest: fix EXPECT text for gpio hog errors cpufreq: Fix parameter in parse_perf_domain() staging: r8188eu: fix memory leak in rtw_set_key arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4 iio: st_sensors: disable regulators after device unregistration RDMA/rxe: Fix wrong port_cap_flags ARM: dts: BCM5301X: Fix memory nodes names arm64: dts: broadcom: bcm4908: Fix UART clock name clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths scsi: pm80xx: Fix lockup in outbound queue management scsi: qla2xxx: edif: Use link event to wake up app scsi: lpfc: Fix NVMe I/O failover to non-optimized path ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie node arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: meson-g12a: Fix the pwm regulator supply properties arm64: dts: meson-g12b: Fix the pwm regulator supply properties arm64: dts: meson-sm1: Fix the pwm regulator supply properties bus: ti-sysc: Fix timekeeping_suspended warning on resume ARM: dts: at91: tse850: the emac<->phy interface is rmii arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality soc: qcom: llcc: Disable MMUHWT retention arm64: dts: qcom: sc7280: fix display port phy reg property scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount pinctrl: renesas: rzg2l: Fix missing port register 21h ASoC: wcd9335: Use correct version to initialize Class H arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock arm64: dts: renesas: beacon: Fix Ethernet PHY mode iommu/mediatek: Fix out-of-range warning with clang arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000 iommu/dma: Fix sync_sg with swiotlb iommu/dma: Fix arch_sync_dma for map ALSA: hda: Reduce udelay() at SKL+ position reporting ALSA: hda: Use position buffer for SKL+ again ALSA: usb-audio: Fix possible race at sync of urb completions soundwire: debugfs: use controller id and link_id for debugfs power: reset: at91-reset: check properly the return value of devm_of_iomap scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition scsi: ufs: core: Stop clearing UNIT ATTENTIONS scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp() driver core: Fix possible memory leak in device_link_add() arm: dts: omap3-gta04a4: accelerometer irq fix ASoC: SOF: topology: do not power down primary core during topology removal iio: st_pressure_spi: Add missing entries SPI to device ID table soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype for 'create_section_mapping' video: fbdev: chipsfb: use memset_io() instead of memset() powerpc: fix unbalanced node refcount in check_kvm_guest() powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV power: supply: max17040: fix null-ptr-deref in max17040_probe() scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering usb: musb: select GENERIC_PHY instead of depending on it staging: most: dim2: do not double-register the same device staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg() dyndbg: make dyndbg a known cli param powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10 pinctrl: renesas: checker: Fix off-by-one bug in drive register check ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx ARM: dts: stm32: fix SAI sub nodes register range ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 ASoC: cs42l42: Always configure both ASP TX channels ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER soc: qcom: rpmhpd: Make power_on actually enable the domain soc: qcom: socinfo: add two missing PMIC IDs iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask() usb: typec: STUSB160X should select REGMAP_I2C iio: adis: do not disabe IRQs in 'adis_init()' soundwire: bus: stop dereferencing invalid slave pointer scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset serial: imx: fix detach/attach of serial console usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled usb: dwc2: drd: reset current session before setting the new one powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() soc: qcom: rpmhpd: fix sm8350_mxc's peer domain soc: qcom: apr: Add of_node_put() before return arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock pinctrl: equilibrium: Fix function addition in multiple groups ASoC: topology: Fix stub for snd_soc_tplg_component_remove() phy: qcom-qusb2: Fix a memory leak on probe phy: ti: gmii-sel: check of_get_address() for failure phy: qcom-qmp: another fix for the sc8180x PCIe definition phy: qcom-snps: Correct the FSEL_MASK phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe() serial: xilinx_uartps: Fix race condition causing stuck TX clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL clk: at91: clk-master: check if div or pres is zero clk: at91: clk-master: fix prescaler logic HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect() powerpc/book3e: Fix set_memory_x() and set_memory_nx() powerpc/44x/fsp2: add missing of_node_put powerpc/xmon: fix task state output ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or later iommu/dma: Fix incorrect error return on iommu deferred attach powerpc: Don't provide __kernel_map_pages() without ARCH_SUPPORTS_DEBUG_PAGEALLOC ASoC: cs42l42: Correct configuring of switch inversion from ts-inv RDMA/hns: Fix initial arm_st of CQ RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()' serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE virtio_ring: check desc == NULL when using indirect with packed vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error RDMA/core: Require the driver to set the IOVA correctly during rereg_mr apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined mtd: rawnand: intel: Fix potential buffer overflow in probe nfsd: don't alloc under spinlock in rpc_parse_scope_id rtc: ds1302: Add SPI ID table rtc: ds1390: Add SPI ID table rtc: pcf2123: Add SPI ID table remoteproc: imx_rproc: Fix TCM io memory type i2c: i801: Use PCI bus rescan mutex to protect P2SB access dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission rtc: mcp795: Add SPI ID table Input: ariel-pwrbutton - add SPI device ID table i2c: mediatek: fixing the incorrect register offset NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA NFS: Ignore the directory size when marking for revalidation NFS: Fix dentry verifier races pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/bridge/lontium-lt9611uxc: fix provided connector suport drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() sparc: Add missing "FORCE" target when using if_changed fs: orangefs: fix error return code of orangefs_revalidate_lookup() Input: st1232 - increase "wait ready" timeout drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation mtd: rawnand: arasan: Prevent an unsupported configuration mtd: core: don't remove debugfs directory if device is in use remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' rtc: rv3032: fix error handling in rv3032_clkout_set_rate() dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro dmaengine: stm32-dma: fix stm32_dma_get_max_width NFS: Fix up commit deadlocks NFS: Fix an Oops in pnfs_mark_request_commit() Fix user namespace leak auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` dmaengine: tegra210-adma: fix pm runtime unbalance dmanegine: idxd: fix resource free ordering on driver removal dmaengine: idxd: reconfig device after device reset command signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: target: core: Remove from tmr_list during LUN unlink scsi: qla2xxx: Relogin during fabric disturbance scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip scsi: qla2xxx: edif: Fix app start fail scsi: qla2xxx: edif: Fix app start delay scsi: qla2xxx: edif: Flush stale events and msgs on session down scsi: qla2xxx: edif: Increase ELS payload scsi: qla2xxx: edif: Fix EDIF bsg NFSv4: Fix a regression in nfs_set_open_stateid_locked() dmaengine: idxd: fix resource leak on dmaengine driver disable i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' gpio: realtek-otto: fix GPIO line IRQ offset xen-pciback: Fix return in pm_ctrl_init() nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() io-wq: fix max-workers not correctly set on multi-node system net: davinci_emac: Fix interrupt pacing disable kselftests/net: add missed icmp.sh test to Makefile kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile kselftests/net: add missed SRv6 tests kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile ethtool: fix ethtool msg len calculation for pause stats openrisc: fix SMP tlb flush NULL pointer dereference net: vlan: fix a UAF in vlan_dev_real_dev() net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge ice: Fix replacing VF hardware MAC to existing MAC filter ice: Fix not stopping Tx queues for VFs kdb: Adopt scheduler's task classification ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses PCI: j721e: Fix j721e_pcie_probe() error path nvdimm/btt: do not call del_gendisk() if not needed scsi: bsg: Fix errno when scsi_bsg_register_queue() fails scsi: ufs: ufshpb: Use proper power management API scsi: ufs: core: Fix NULL pointer dereference scsi: ufs: ufshpb: Properly handle max-single-cmd selftests: net: properly support IPv6 in GSO GRE test drm/nouveau/svm: Fix refcount leak bug and missing check against null bug nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned block/ataflop: use the blk_cleanup_disk() helper block/ataflop: add registration bool before calling del_gendisk() block/ataflop: provide a helper for cleanup up an atari disk ataflop: remove ataflop_probe_lock mutex PCI: Do not enable AtomicOps on VFs cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline net: phy: fix duplex out of sync problem while changing settings block: fix device_add_disk() kobject_create_and_add() error handling drm/ttm: remove ttm_bo_vm_insert_huge() bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed octeontx2-pf: select CONFIG_NET_DEVLINK ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer mfd: core: Add missing of_node_put for loop iteration mfd: cpcap: Add SPI device ID table mfd: sprd: Add SPI device ID table mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion ACPI: PM: Fix device wakeup power reference counting error libbpf: Fix lookup_and_delete_elem_flags error reporting selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly selftests/bpf/xdp_redirect_multi: Limit the tests in netns drm: fb_helper: improve CONFIG_FB dependency Revert "drm/imx: Annotate dma-fence critical section in commit path" drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable() mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails litex_liteeth: Fix a double free in the remove function arm64: arm64_ftr_reg->name may not be a human-readable string arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf, sockmap: Remove unhash handler for BPF sockmap usage bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg dmaengine: stm32-dma: fix burst in case of unaligned memory address dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width gve: Fix off by one in gve_tx_timeout() drm/i915/fb: Fix rounding error in subsampled plane size calculation init: make unknown command line param message clearer seq_file: fix passing wrong private data drm/amdgpu: fix uvd crash on Polaris12 during driver unloading net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than 10 net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: fix ROCE base interrupt vector initialization bug net: hns3: fix pfc packet number incorrect after querying pfc parameters net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: allow configure ETS bandwidth of all TCs net: stmmac: allow a tc-taprio base-time of zero net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory net: marvell: mvpp2: Fix wrong SerDes reconfiguration order vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument thermal: int340x: fix build on 32-bit targets smb3: do not error on fsync when readonly ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page MIPS: fix duplicated slashes for Platform file path MIPS: fix -pkg builds for loongson2ef platform MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL x86/mce: Add errata workaround for Skylake SKX37 PCI/MSI: Move non-mask check back into low level accessors PCI/MSI: Destroy sysfs before freeing entries KVM: x86: move guest_pv_has out of user_access section posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes f2fs: include non-compressed blocks in compr_written_block f2fs: fix UAF in f2fs_available_free_memory ceph: fix mdsmap decode when there are MDS's beyond max_mds erofs: fix unsafe pagevec reuse of hooked pclusters drm/i915/guc: Fix blocked context accounting block: Hold invalidate_lock in BLKDISCARD ioctl block: Hold invalidate_lock in BLKZEROOUT ioctl block: Hold invalidate_lock in BLKRESETZONE ioctl ksmbd: Fix buffer length check in fsctl_validate_negotiate_info() ksmbd: don't need 8byte alignment for request length in ksmbd_check_message dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail dmaengine: bestcomm: fix system boot lockups net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors mm/filemap.c: remove bogus VM_BUG_ON memcg: prohibit unconditional exceeding the limit of dying tasks mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF mm, thp: lock filemap when truncating page cache mm, thp: fix incorrect unmap behavior for private pages mfd: dln2: Add cell for initializing DLN2 ADC video: backlight: Drop maximum brightness override for brightness zero bcache: fix use-after-free problem in bcache_device_free() bcache: Revert "bcache: use bvec_virt" PM: sleep: Avoid calling put_device() under dpm_list_mtx s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/ap: Fix hanging ioctl caused by orphaned replies s390/cio: make ccw_device_dma_ more robust remoteproc: elf_loader: Fix loading segment when is_iomem true remoteproc: Fix the wrong default value of is_iomem remoteproc: imx_rproc: Fix ignoring mapping vdev regions remoteproc: imx_rproc: Fix rsc-table name mtd: rawnand: fsmc: Fix use of SM ORDER mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines powerpc/vas: Fix potential NULL pointer dereference powerpc/bpf: Fix write protecting JIT code powerpc/32e: Ignore ESR in instruction storage interrupt handler powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload powerpc/security: Use a mutex for interrupt exit code patching powerpc/64s/interrupt: Fix check_return_regs_valid() false positive powerpc/pseries/mobility: ignore ibm, platform-facilities updates powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n drm/sun4i: Fix macros in sun8i_csc.h PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros PCI: aardvark: Fix PCIe Max Payload Size setting SUNRPC: Partial revert of commit `6f9f17287e` drm/amd/display: Look at firmware version to determine using dmub on dcn21 media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release() cifs: fix memory leak of smb3_fs_context_dup::server_hostname ath10k: fix invalid dma_addr_t token assignment mmc: moxart: Fix null pointer dereference on pointer host selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage selftests/bpf: Fix also no-alu32 strobemeta selftest arch/cc: Introduce a function to check for confidential computing features x86/sev: Add an x86 version of cc_platform_has() x86/sev: Make the #VC exception stacks part of the default stacks storage media: videobuf2: always set buffer vb2 pointer media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference Linux 5.15.3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I09574eb6b4fbe930bd13f932cc618846972fcc27	2021-11-19 15:38:07 +01:00
Miklos Szeredi	5cffa333a2	ovl: fix filattr copy-up failure commit 5b0a414d06c3ed2097e32ef7944a4abb644b89bd upstream. This regression can be reproduced with ntfs-3g and overlayfs: mkdir lower upper work overlay dd if=/dev/zero of=ntfs.raw bs=1M count=2 mkntfs -F ntfs.raw mount ntfs.raw lower touch lower/file.txt mount -t overlay -o lowerdir=lower,upperdir=upper,workdir=work - overlay mv overlay/file.txt overlay/file2.txt mv fails and (misleadingly) prints mv: cannot move 'overlay/file.txt' to a subdirectory of itself, 'overlay/file2.txt' The reason is that ovl_copy_fileattr() is triggered due to S_NOATIME being set on all inodes (by fuse) regardless of fileattr. ovl_copy_fileattr() tries to retrieve file attributes from lower file, but that fails because filesystem does not support this ioctl (this should fail with ENOTTY, but ntfs-3g return EINVAL instead). This failure is propagated to origial operation (in this case rename) that triggered the copy-up. The fix is to ignore ENOTTY and EINVAL errors from fileattr_get() in copy up. This also requires turning the internal ENOIOCTLCMD into ENOTTY. As a further measure to prevent unnecessary failures, only try the fileattr_get/set on upper if there are any flags to copy up. Side note: a number of filesystems set S_NOATIME (and sometimes other inode flags) irrespective of fileattr flags. This causes unnecessary calls during copy up, which might lead to a performance issue, especially if latency is high. To fix this, the kernel would need to differentiate between the two cases. E.g. introduce SB_NOATIME_UPDATE, a per-sb variant of S_NOATIME. SB_NOATIME doesn't work, because that's interpreted as "filesystem doesn't store an atime attribute" Reported-and-tested-by: Kevin Locke <kevin@kevinlocke.name> Fixes: `72db82115d` ("ovl: copy up sync/noatime fileattr flags") Cc: <stable@vger.kernel.org> # v5.15 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 19:16:04 +01:00
yangerkun	2f372e38f5	ovl: fix use after free in struct ovl_aio_req commit 9a254403760041528bc8f69fe2f5e1ef86950991 upstream. Example for triggering use after free in a overlay on ext4 setup: aio_read ovl_read_iter vfs_iter_read ext4_file_read_iter ext4_dio_read_iter iomap_dio_rw -> -EIOCBQUEUED /* * Here IO is completed in a separate thread, * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded / file_accessed(iocb->ki_filp); /BOOM*/ Fix by introducing a refcount in ovl_aio_req similarly to aio_kiocb. This guarantees that iocb is only freed after vfs_read/write_iter() returns on underlying fs. Fixes: `2406a307ac` ("ovl: implement async IO routines") Signed-off-by: yangerkun <yangerkun@huawei.com> Link: https://lore.kernel.org/r/20210930032228.3199690-3-yangerkun@huawei.com/ Cc: <stable@vger.kernel.org> # v5.6 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 19:16:04 +01:00
David Anderson	5accf46108	FROMLIST: overlayfs: inode_owner_or_capable called during execv Using old_creds as an indication that we are not overriding the credentials, bypass call to inode_owner_or_capable. This solves a problem with all execv calls being blocked when using the caller's credentials. Bug: 204981027 Link: https://lore.kernel.org/lkml/20211117015806.2192263-5-dvander@google.com Change-Id: Ifa966dabda7413873614d1da24629dc8054db131 Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com>	2021-11-16 18:15:16 -08:00
David Anderson	0792ff2e87	FROMLIST: overlayfs: override_creds=off option bypass creator_cred By default, all access to the upper, lower and work directories is the recorded mounter's MAC and DAC credentials. The incoming accesses are checked against the caller's credentials. If the principles of least privilege are applied, the mounter's credentials might not overlap the credentials of the caller's when accessing the overlayfs filesystem. For example, a file that a lower DAC privileged caller can execute, is MAC denied to the generally higher DAC privileged mounter, to prevent an attack vector. We add the option to turn off override_creds in the mount options; all subsequent operations after mount on the filesystem will be only the caller's credentials. The module boolean parameter and mount option override_creds is also added as a presence check for this "feature", existence of /sys/module/overlay/parameters/override_creds. It was not always this way. Circa 4.6 there was no recorded mounter's credentials, instead privileged access to upper or work directories were temporarily increased to perform the operations. The MAC (selinux) policies were caller's in all cases. override_creds=off partially returns us to this older access model minus the insecure temporary credential increases. This is to permit use in a system with non-overlapping security models for each executable including the agent that mounts the overlayfs filesystem. In Android this is the case since init, which performs the mount operations, has a minimal MAC set of privileges to reduce any attack surface, and services that use the content have a different set of MAC privileges (eg: read, for vendor labelled configuration, execute for vendor libraries and modules). The caveats are not a problem in the Android usage model, however they should be fixed for completeness and for general use in time. Bug: 204981027 Link: https://lore.kernel.org/lkml/20211117015806.2192263-4-dvander@google.com Change-Id: I46e6c74ff634eb064cf9d714017432171a898890 Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com>	2021-11-16 18:15:06 -08:00
David Anderson	78626d4b82	FROMLIST: overlayfs: handle XATTR_NOSECURITY flag for get xattr method __vfs_getxattr({dentry...XATTR_NOSECURITY}) -> handler->get({dentry...XATTR_NOSECURITY}) -> __vfs_getxattr({realdentry...XATTR_NOSECURITY}) -> lower_handler->get({realdentry...XATTR_NOSECURITY}) which would report back through the chain data and success as expected, the logging security layer at the top would have the data to determine the access permissions and report back to the logs and the caller that the target context was blocked. For selinux this would solve the cosmetic issue of the selinux log and allow audit2allow to correctly report the rule needed to address the access problem. Check impure, opaque, origin & meta xattr with no sepolicy audit (using __vfs_getxattr) since these operations are internal to overlayfs operations and do not disclose any data. This became an issue for credential override off since sys_admin would have been required by the caller; whereas would have been inherently present for the creator since it performed the mount. This is a change in operations since we do not check in the new ovl_do_getxattr function if the credential override is off or not. Reasoning is that the sepolicy check is unnecessary overhead, especially since the check can be expensive. Because for override credentials off, this affects _everyone_ that underneath performs private xattr calls without the appropriate sepolicy permissions and sys_admin capability. Providing blanket support for sys_admin would be bad for all possible callers. For the override credentials on, this will affect only the mounter, should it lack sepolicy permissions. Not considered a security problem since mounting by definition has sys_admin capabilities, but sepolicy contexts would still need to be crafted. It should be noted that there is precedence, __vfs_getxattr is used in other filesystems for their own internal trusted xattr management. Change-Id: I0b8fe9f1fe6c763fbd27a09c6de8209d1dc9d2f7 Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com> Link: https://lore.kernel.org/lkml/20211117015806.2192263-3-dvander@google.com Bug: 204981027	2021-11-16 18:14:59 -08:00
David Anderson	8c288004aa	FROMLIST: Add flags option to get xattr method paired to __vfs_getxattr Add a flag option to get xattr method that could have a bit flag of XATTR_NOSECURITY passed to it. XATTR_NOSECURITY is generally then set in the __vfs_getxattr path when called by security infrastructure. This handles the case of a union filesystem driver that is being requested by the security layer to report back the xattr data. For the use case where access is to be blocked by the security layer. The path then could be security(dentry) -> __vfs_getxattr(dentry...XATTR_NOSECURITY) -> handler->get(dentry...XATTR_NOSECURITY) -> __vfs_getxattr(lower_dentry...XATTR_NOSECURITY) -> lower_handler->get(lower_dentry...XATTR_NOSECURITY) which would report back through the chain data and success as expected, the logging security layer at the top would have the data to determine the access permissions and report back the target context that was blocked. Without the get handler flag, the path on a union filesystem would be the errant security(dentry) -> __vfs_getxattr(dentry) -> handler->get(dentry) -> vfs_getxattr(lower_dentry) -> nested -> security(lower_dentry, log off) -> lower_handler->get(lower_dentry) which would report back through the chain no data, and -EACCES. For selinux for both cases, this would translate to a correctly determined blocked access. In the first case with this change a correct avc log would be reported, in the second legacy case an incorrect avc log would be reported against an uninitialized u:object_r:unlabeled:s0 context making the logs cosmetically useless for audit2allow. This patch series is inert and is the wide-spread addition of the flags option for xattr functions, and a replacement of __vfs_getxattr with __vfs_getxattr(...XATTR_NOSECURITY). Bug: 204981027 Link: https://lore.kernel.org/lkml/20211117015806.2192263-2-dvander@google.com Change-Id: Id2c6fa6eeb2b5cca5a11e0cd02a3fbf2a5fcbef4 Signed-off-by: David Anderson <dvander@google.com> Signed-off-by: Mark Salyzyn <salyzyn@android.com>	2021-11-16 18:14:17 -08:00
Greg Kroah-Hartman	253e6970fe	Merge `60a9483534` ("Merge tag 'warning-fixes-20211005' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs") into android-mainline Steps on the way to 5.15-rc5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I6cb84e4ff3efc232c0aea55ef2d71ae0123f805d	2021-10-06 09:24:37 +02:00
Miklos Szeredi	1dc1eed46f	ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO Normally the check at open time suffices, but e.g loop device does set IOCB_DIRECT after doing its own checks (which are not sufficent for overlayfs). Make sure we don't call the underlying filesystem read/write method with the IOCB_DIRECT if it's not supported. Reported-by: Huang Jianan <huangjianan@oppo.com> Fixes: `16914e6fc7` ("ovl: add ovl_read_iter()") Cc: <stable@vger.kernel.org> # v4.19 Tested-by: Huang Jianan <huangjianan@oppo.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-09-28 09:16:12 +02:00
Zheng Liang	a295aef603	ovl: fix missing negative dentry check in ovl_rename() The following reproducer mkdir lower upper work merge touch lower/old touch lower/new mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge rm merge/new mv merge/old merge/new & unlink upper/new may result in this race: PROCESS A: rename("merge/old", "merge/new"); overwrite=true,ovl_lower_positive(old)=true, ovl_dentry_is_whiteout(new)=true -> flags \|= RENAME_EXCHANGE PROCESS B: unlink("upper/new"); PROCESS A: lookup newdentry in new_upperdir call vfs_rename() with negative newdentry and RENAME_EXCHANGE Fix by adding the missing check for negative newdentry. Signed-off-by: Zheng Liang <zhengliang6@huawei.com> Fixes: `e9be9d5e76` ("overlay filesystem") Cc: <stable@vger.kernel.org> # v3.18 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-09-24 21:00:31 +02:00
Greg Kroah-Hartman	a874acdc18	Merge `815409a12c` ("Merge tag 'ovl-update-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs") into android-mainline Steps on the way to 5.15-rc1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia61d00e6e4f49501323c3f4769793529c78d3713	2021-09-12 16:14:19 +02:00
Miklos Szeredi	332f606b32	ovl: enable RCU'd ->get_acl() Overlayfs does not cache ACL's (to avoid double caching). Instead it just calls the underlying filesystem's i_op->get_acl(), which will return the cached value, if possible. In rcu path walk, however, get_cached_acl_rcu() is employed to get the value from the cache, which will fail on overlayfs resulting in dropping out of rcu walk mode. This can result in a big performance hit in certain situations. Fix by calling ->get_acl() with rcu=true in case of ACL_DONT_CACHE (which indicates pass-through) Reported-by: garyhuang <zjh.20052005@163.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-18 22:08:24 +02:00
Miklos Szeredi	0cad624662	vfs: add rcu argument to ->get_acl() callback Add a rcu argument to the ->get_acl() callback to allow get_cached_acl_rcu() to call the ->get_acl() method in the next patch. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-18 22:08:24 +02:00
chenying	52d5a0c6bd	ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() If function ovl_instantiate() returns an error, ovl_cleanup will be called and try to remove newdentry from wdir, but the newdentry has been moved to udir at this time. This will causes BUG_ON(victim->d_parent->d_inode != dir) in fs/namei.c:may_delete. Signed-off-by: chenying <chenying.kernel@bytedance.com> Fixes: `01b39dcc95` ("ovl: use inode_insert5() to hash a newly created inode") Link: https://lore.kernel.org/linux-unionfs/e6496a94-a161-dc04-c38a-d2544633acb4@bytedance.com/ Cc: <stable@vger.kernel.org> # v4.18 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 17:37:53 +02:00
Miklos Szeredi	f945ca1963	ovl: use kvalloc in xattr copy-up Extended attributes are usually small, but could be up to 64k in size, so use the most efficient method for doing the allocation. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:45 +02:00
Chengguang Xu	d8991e8622	ovl: update ctime when changing fileattr Currently we keep size, mode and times of overlay inode as the same as upper inode, so should update ctime when changing file attribution as well. Signed-off-by: Chengguang Xu <cgxu519@mykernel.net> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:44 +02:00
Chengguang Xu	b71759ef1e	ovl: skip checking lower file's i_writecount on truncate It is possible that a directory tree is shared between multiple overlay instances as a lower layer. In this case when one instance executes a file residing on the lower layer, the other instance denies a truncate(2) call on this file. This only happens for truncate(2) and not for open(2) with the O_TRUNC flag. Fix this interference and inconsistency by removing the preliminary i_writecount check before copy-up. This means that unlike on normal filesystems truncate(argv[0]) will now succeed. If this ever causes a regression in a real world use case this needs to be revisited. One way to fix this properly would be to keep a correct i_writecount in the overlay inode, but that is difficult due to memory mapping code only dealing with the real file/inode. Signed-off-by: Chengguang Xu <cgxu519@mykernel.net> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:44 +02:00
Amir Goldstein	ffb24e3c65	ovl: relax lookup error on mismatch origin ftype We get occasional reports of lookup errors due to mismatched origin ftype from users that re-format a lower squashfs image. Commit `13c6ad0f45` ("ovl: document lower modification caveats") tries to discourage the practice of re-formating lower layers and describes the expected behavior as undefined. Commit `b0e0f69731` ("ovl: restrict lower null uuid for "xino=auto"") limits the configurations in which origin file handles are followed. In addition to these measures, change the behavior in case of detecting a mismatch origin ftype in lookup to issue a warning, not follow origin, but not fail the lookup operation either. That should make overall more users happy without any big consequences. Link: https://lore.kernel.org/linux-unionfs/CAOQ4uxgPq9E9xxwU2CDyHy-_yCZZeymg+3n+-6AqkGGE1YtwvQ@mail.gmail.com/ Signed-off-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:44 +02:00
Vyacheslav Yurkov	1fc31aac96	ovl: do not set overlay.opaque for new directories Enable optimizations only if user opted-in for any of extended features. If optimization is enabled, it breaks existing use case when a lower layer directory appears after directory was created on a merged layer. If overlay.opaque is applied, new files on lower layer are not visible. Consider the following scenario: - /lower and /upper are mounted to /merged - directory /merged/new-dir is created with a file test1 - overlay is unmounted - directory /lower/new-dir is created with a file test2 - overlay is mounted again If opaque is applied by default, file test2 is not going to be visible without explicitly clearing the overlay.opaque attribute Signed-off-by: Vyacheslav Yurkov <Vyacheslav.Yurkov@bruker.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:44 +02:00
Vyacheslav Yurkov	ca45275cd6	ovl: add ovl_allow_offline_changes() helper Allows to check whether any of extended features are enabled Signed-off-by: Vyacheslav Yurkov <Vyacheslav.Yurkov@bruker.com> Reviewed-by: Amir Goldstein <amir73il@gmail.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>	2021-08-17 11:47:44 +02:00

1 2 3 4 5 ...

799 Commits