msm-5.15

Author	SHA1	Message	Date
Greg Kroah-Hartman	eaa46dd972	Merge 5.15.76 into android13-5.15-lts Changes in 5.15.76 r8152: add PID for the Lenovo OneLink+ Dock arm64/mm: Consolidate TCR_EL1 fields usb: gadget: uvc: consistently use define for headerlen usb: gadget: uvc: use on returned header len in video_encode_isoc_sg usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer usb: gadget: uvc: giveback vb2 buffer on req complete usb: gadget: uvc: improve sg exit condition arm64: errata: Remove AES hwcap for COMPAT tasks perf/x86/intel/pt: Relax address filter validation btrfs: enhance unsupported compat RO flags handling ocfs2: clear dinode links count in case of error ocfs2: fix BUG when iput after ocfs2_mknod fails selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() cpufreq: qcom: fix writes in read-only memory region i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter x86/microcode/AMD: Apply the patch early on every logical thread hwmon/coretemp: Handle large core ID value ata: ahci-imx: Fix MODULE_ALIAS ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS x86/resctrl: Fix min_cbm_bits for AMD cpufreq: qcom: fix memory leak in error path drm/amdgpu: fix sdma doorbell init ordering on APUs mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages kvm: Add support for arch compat vm ioctls KVM: arm64: vgic: Fix exit condition in scan_its_table() media: ipu3-imgu: Fix NULL pointer dereference in active selection access media: mceusb: set timeout to at least timeout provided media: venus: dec: Handle the case where find_format fails x86/topology: Fix multiple packages shown on a single-package system x86/topology: Fix duplicated core ID within a package btrfs: fix processing of delayed data refs during backref walking btrfs: fix processing of delayed tree block refs during backref walking drm/vc4: Add module dependency on hdmi-codec ACPI: extlog: Handle multiple records tipc: Fix recognition of trial period tipc: fix an information leak in tipc_topsrv_kern_subscr i40e: Fix DMA mappings leak HID: magicmouse: Do not set BTN_MOUSE on double report sfc: Change VF mac via PF as first preference if available. net/atm: fix proc_mpc_write incorrect return value net: phy: dp83867: Extend RX strap quirk for SGMII mode net: phylink: add mac_managed_pm in phylink_config structure scsi: lpfc: Fix memory leak in lpfc_create_port() udp: Update reuse->has_conns under reuseport_lock. cifs: Fix xid leak in cifs_create() cifs: Fix xid leak in cifs_copy_file_range() cifs: Fix xid leak in cifs_flock() cifs: Fix xid leak in cifs_ses_add_channel() dm: remove unnecessary assignment statement in alloc_dev() net: hsr: avoid possible NULL deref in skb_clone() ionic: catch NULL pointer issue on reconfig netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags requirements nvme-hwmon: consistently ignore errors from nvme_hwmon_init nvme-hwmon: kmalloc the NVME SMART log buffer nvmet: fix workqueue MEM_RECLAIM flushing dependency net: sched: cake: fix null pointer access issue when cake_init() fails net: sched: delete duplicate cleanup of backlog and qlen net: sched: sfb: fix null pointer access issue when sfb_init() fails sfc: include vport_id in filter spec hash and equal() wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() net: hns: fix possible memory leak in hnae_ae_register() net: sched: fix race condition in qdisc_graft() net: phy: dp83822: disable MDI crossover status change interrupt iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() iommu/vt-d: Clean up si_domain in the init_dmars() error path fs: dlm: fix invalid derefence of sb_lvbptr arm64: mte: move register initialization to C ksmbd: handle smb2 query dir request for OutputBufferLength that is too small ksmbd: fix incorrect handling of iterate_dir tracing: Simplify conditional compilation code in tracing_set_tracer() tracing: Do not free snapshot if tracer is on cmdline mmc: sdhci-tegra: Use actual clock rate for SW tuning correction perf: Skip and warn on unknown format 'configN' attrs ACPI: video: Force backlight native for more TongFang devices x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB Makefile.debug: re-enable debug info for .S files mmc: core: Add SD card quirk for broken discard mm: /proc/pid/smaps_rollup: fix no vma's null-deref Linux 5.15.76 Change-Id: I7015bfc94dfd69b9ab2e83d4b20860f13a6c4be6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-29 16:12:51 +00:00
GONG, Ruiqi	3006766d24	selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() commit abe3c631447dcd1ba7af972fe6f054bee6f136fa upstream. The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sleeping function called from invalid context at __might_sleep+0x60/0x74 0x0 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 5943, name: tar CPU: 7 PID: 5943 Comm: tar Tainted: P O 5.10.0 #1 Call trace: dump_backtrace+0x0/0x1c8 show_stack+0x18/0x28 dump_stack+0xe8/0x15c ___might_sleep+0x168/0x17c __might_sleep+0x60/0x74 __kmalloc_track_caller+0xa0/0x7dc kstrdup+0x54/0xac convert_context+0x48/0x2e4 sidtab_context_to_sid+0x1c4/0x36c security_context_to_sid_core+0x168/0x238 security_context_to_sid_default+0x14/0x24 inode_doinit_use_xattr+0x164/0x1e4 inode_doinit_with_dentry+0x1c0/0x488 selinux_d_instantiate+0x20/0x34 security_d_instantiate+0x70/0xbc d_splice_alias+0x4c/0x3c0 ext4_lookup+0x1d8/0x200 [ext4] __lookup_slow+0x12c/0x1e4 walk_component+0x100/0x200 path_lookupat+0x88/0x118 filename_lookup+0x98/0x130 user_path_at_empty+0x48/0x60 vfs_statx+0x84/0x140 vfs_fstatat+0x20/0x30 __se_sys_newfstatat+0x30/0x74 __arm64_sys_newfstatat+0x1c/0x2c el0_svc_common.constprop.0+0x100/0x184 do_el0_svc+0x1c/0x2c el0_svc+0x20/0x34 el0_sync_handler+0x80/0x17c el0_sync+0x13c/0x140 SELinux: Context system_u:object_r:pssp_rsyslog_log_t:s0:c0 is not valid (left unmapped). It was found that within a critical section of spin_lock_irqsave in sidtab_context_to_sid(), convert_context() (hooked by sidtab_convert_params.func) might cause the process to sleep via allocating memory with GFP_KERNEL, which is problematic. As Ondrej pointed out [1], convert_context()/sidtab_convert_params.func has another caller sidtab_convert_tree(), which is okay with GFP_KERNEL. Therefore, fix this problem by adding a gfp_t argument for convert_context()/sidtab_convert_params.func and pass GFP_KERNEL/_ATOMIC properly in individual callers. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20221018120111.1474581-1-gongruiqi1@huawei.com/ [1] Reported-by: Tan Ninghao <tanninghao1@huawei.com> Fixes: `ee1a84fdfe` ("selinux: overhaul sidtab to fix bug and improve performance") Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com> [PM: wrap long BUG() output lines, tweak subject line] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-10-29 10:12:54 +02:00
Greg Kroah-Hartman	8fd5b33ea5	Merge 5.15.61 into android13-5.15-lts Changes in 5.15.61 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" pNFS/flexfiles: Report RDMA connection errors to the server NFSD: Clean up the show_nf_flags() macro nfsd: eliminate the NFSD_FILE_BREAK_* flags ALSA: usb-audio: Add quirk for Behringer UMC202HD ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate lockd: detect and reject lock arguments that overflow HID: hid-input: add Surface Go battery quirk HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: x86: Split kvm_is_valid_cr4() and export only the non-vendor bits KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: nVMX: Account for KVM reserved CR4 bits in consistency checks KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: nVMX: Always enable TSC scaling for L2 when it was enabled for L1 KVM: x86: Tag kvm_mmu_x86_module_init() with __init KVM: x86: do not report preemption if the steal time cache is stale KVM: x86: revalidate steal time cache if MSR value changes riscv: set default pm_power_off to NULL ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect fix short copy handling in copy_mc_pipe_to_iter() crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Drop pa_swapper_pg_lock spinlock parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode riscv:uprobe fix SR_SPIE set/clear handling dt-bindings: riscv: fix SiFive l2-cache's cache-sets RISC-V: kexec: Fixup use of smp_processor_id() in preemptible context RISC-V: Fixup get incorrect user mode PC for kernel mode regs RISC-V: Fixup schedule out issue in machine_crash_shutdown() RISC-V: Add modules to virtual kernel memory layout dump rtc: rx8025: fix 12/24 hour mode detection on RX-8035 drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/shmem-helper: Add missing vunmap on error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/hyperv-drm: Include framebuffer and EDID headers drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/nouveau/kms: Fix failure path for creating DP connectors drm/amdgpu: Check BO's requested pinning domains against its preferred_domains drm/amdgpu: fix check in fbdev init bpf: Fix KASAN use-after-free Read in compute_effective_progs btrfs: reject log replay if there is unsupported RO compat flag mtd: rawnand: arasan: Fix clock rate in NV-DDR mtd: rawnand: arasan: Update NAND bus clock instead of system clock um: Remove straying parenthesis um: seed rng using host OS rng iio: fix iio_format_avail_range() printing for none IIO_VAL_INT iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers soundwire: qcom: Check device status before reading devid ksmbd: fix memory leak in smb2_handle_negotiate ksmbd: prevent out of bound read for SMB2_TREE_CONNNECT ksmbd: fix use-after-free bug in smb2_tree_disconect fuse: limit nsec fuse: ioctl: translate ENOSYS serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arch: make TRACE_IRQFLAGS_NMI_SUPPORT generic arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" ext2: Add more validity checks for inode counts sched/fair: Introduce SIS_UTIL to search idle CPU based on sum of util_avg genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP sched/core: Always flush pending blk_plug irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 ARM: dts: ux500: Fix Codina accelerometer mounting matrix ARM: dts: ux500: Fix Gavini accelerometer mounting matrix spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ARM: OMAP2+: pdata-quirks: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() ARM: dts: qcom: sdx55: Fix the IRQ trigger type for UART arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() hwmon: (dell-smm) Add Dell XPS 13 7390 to fan control whitelist hwmon: (sht15) Fix wrong assumptions in device remove callback PM: hibernate: defer device probing when resuming from hibernation selinux: fix memleak in security_read_state_kernel() selinux: Add boundary check in put_entry() kasan: test: Silence GCC 12 warnings drm/amdgpu: Remove one duplicated ef removal powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names spi: spi-altera-dfl: Fix an error handling path ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values scsi: hisi_sas: Use managed PCI functions dt-bindings: iio: accel: Add DT binding doc for ADXL355 soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible ARM: dts: ast2600-evb-a1: fix board compatible arm64: dts: mt8192: Fix idle-states nodes naming scheme arm64: dts: mt8192: Fix idle-states entry-method arm64: select TRACE_IRQFLAGS_NMI_SUPPORT arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_() confusion arm64: dts: qcom: sc7180: Remove ipa_fw_mem node on trogdor soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init arm64: dts: qcom: sdm630: disable GPU by default arm64: dts: qcom: sdm630: fix the qusb2phy ref clock arm64: dts: qcom: sdm630: fix gpu's interconnect path arm64: dts: qcom: sdm636-sony-xperia-ganges-mermaid: correct sdc2 pinconf cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP ARM: dts: qcom-msm8974: fix irq type on blsp2_uart1 soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() stack: Declare {randomize_,}kstack_offset to fix Sparse warnings arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node ACPI: APEI: explicit init of HEST and GHES in apci_init() drivers/iio: Remove all strcpy() uses ACPI: VIOT: Fix ACS setup arm64: dts: qcom: sm6125: Move sdc2 pinctrl from seine-pdx201 to sm6125 arm64: dts: qcom: sm6125: Append -state suffix to pinctrl nodes arm64: dts: qcom: sm8250: add missing PCIe PHY clock-cells arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fixup SYSRAM references arm64: tegra: Update Tegra234 BPMP channel addresses arm64: tegra: Mark BPMP channels as no-memory-wc arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created spi: Fix simplification of devm_spi_register_controller spi: tegra20-slink: fix UAF in tegra_slink_remove() hwmon: (drivetemp) Add module alias blktrace: Trace remapped requests correctly PM: domains: Ensure genpd_debugfs_dir exists before remove dm writecache: return void from functions dm writecache: count number of blocks read, not number of read bios dm writecache: count number of blocks written, not number of write bios dm writecache: count number of blocks discarded, not number of discard bios regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment irqdomain: Report irq number for NOMAP domains drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() x86/extable: Fix ex_handler_msr() print condition selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Reduce number of devm memory allocations pwm: lpc18xx-sct: Simplify driver by not using pwm_[gs]et_chip_data() pwm: lpc18xx: Fix period handling drm/dp: Export symbol / kerneldoc fixes for DP AUX bus drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T drm/panel: Fix build error when CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20=y && CONFIG_DRM_DISPLAY_HELPER=m wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function drm/meson: encoder_hdmi: switch to bridge DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init drm/bridge: lt9611uxc: Cancel only driver's work i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior i2c: mxs: Silence a clang warning virtio-gpu: fix a missing check to avoid NULL dereference drm/shmem-helper: Unexport drm_gem_shmem_create_with_handle() drm/shmem-helper: Export dedicated wrappers for GEM object functions drm/shmem-helper: Pass GEM shmem object in public interfaces drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors can: netlink: allow configuring of fixed bit rates without need for do_set_bittiming callback can: netlink: allow configuring of fixed data bit rates without need for do_set_data_bittiming callback i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: atmel: atmel-sama7g5-isc: fix warning in configs without OF media: tw686x: Register the irq at the end of probe media: imx-jpeg: Correct some definition according specification media: imx-jpeg: Leave a blank space before the configuration data media: imx-jpeg: Add pm-runtime support for imx-jpeg media: imx-jpeg: use NV12M to represent non contiguous NV12 media: imx-jpeg: Set V4L2_BUF_FLAG_LAST at eos media: imx-jpeg: Refactor function mxc_jpeg_parse media: imx-jpeg: Identify and handle precision correctly media: imx-jpeg: Handle source change in a function media: imx-jpeg: Support dynamic resolution change media: imx-jpeg: Align upwards buffer size media: imx-jpeg: Implement drain using v4l2-mem2mem helpers ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers rcutorture: Warn on individual rcu_torture_init() error conditions rcutorture: Don't cpuhp_remove_state() if cpuhp_setup_state() failed rcutorture: Fix ksoftirqd boosting timing and iteration test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register media: imx-jpeg: Disable slot interrupt when frame done drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: driver/nxp/imx-jpeg: fix a unexpected return value problem media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/bridge: Add a function to abstract away panels drm/vc4: dsi: Switch to devm_drm_of_get_bridge drm/vc4: Use of_device_get_match_data() drm/vc4: dsi: Release workaround buffer and DMA drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Fix HPD GPIO detection drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Reset HDMI MISC_CONTROL register drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment drm/msm: Avoid dirtyfb stalls on video mode displays (v2) drm/msm/dpu: Fix for non-visible planes mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mt76: mt7615: do not update pm stats in case of error ieee80211: add EHT 1K aggregation definitions mt76: mt7921: fix aggregation subframes setting to HE max mt76: mt7921: enlarge maximum VHT MPDU length to 11454 mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() mediatek: mt76: eeprom: fix missing of_node_put() in mt76_find_power_limits_node() skmsg: Fix invalid last sg check in sk_msg_recvmsg() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing media: cedrus: h265: Fix flag name media: hantro: postproc: Fix motion vector space size media: hantro: Simplify postprocessor media: hevc: Embedded indexes in RPS media: staging: media: hantro: Fix typos wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow libbpf: fix an snprintf() overflow check can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS net/mlx5: Adjust log_max_qp to be 18 at most crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set netdevsim: fib: Fix reference count leak on route deletion failure wifi: rtw88: check the return value of alloc_workqueue() iavf: Fix max_rate limiting iavf: Fix 'tc qdisc show' listing too many queues netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock net: usb: make USB_RTL8153_ECM non user configurable wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow HID: amd_sfh: Don't show client init failed as error when discovery fails clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue of: check previous kernel's ima-kexec-buffer against memory bounds scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing scsi: qla2xxx: edif: Fix potential stuck session in sa update scsi: qla2xxx: edif: Reduce connection thrash scsi: qla2xxx: edif: Fix inconsistent check of db_flags scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application scsi: qla2xxx: edif: Add retry for ELS passthrough scsi: qla2xxx: edif: Fix n2n discovery issue with secure target scsi: qla2xxx: edif: Fix n2n login retry for secure device KVM: SVM: Unwind "speculative" RIP advancement if INTn injection "fails" KVM: SVM: Stuff next_rip on emulated INT3 injection if NRIPS is supported phy: samsung: exynosautov9-ufs: correct TSRV register configurations PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back scsi: qla2xxx: edif: Send LOGO for unexpected IKE message scsi: qla2xxx: edif: Reduce disruption due to multiple app start scsi: qla2xxx: edif: Fix no login after app start scsi: qla2xxx: edif: Tear down session if keys have been removed scsi: qla2xxx: edif: Fix session thrash scsi: qla2xxx: edif: Fix no logout on delete for N2N iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset lib/test_hmm: avoid accessing uninitialized pages memremap: remove support for external pgmap refcounts mm/memremap: fix memunmap_pages() race with get_dev_pagemap() KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv scsi: iscsi: Allow iscsi_if_stop_conn() to be called from kernel scsi: iscsi: Add helper to remove a session from the kernel scsi: iscsi: Fix session removal on shutdown dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics mtd: dataflash: Add SPI ID table clk: qcom: camcc-sm8250: Fix halt on boot by reducing driver's init level misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion clk: qcom: gcc-msm8939: Add missing SYSTEM_MM_NOC_BFDCD_CLK_SRC clk: qcom: gcc-msm8939: Fix bimc_ddr_clk_src rcgr base address clk: qcom: gcc-msm8939: Add missing system_mm_noc_bfdcd_clk_src clk: qcom: gcc-msm8939: Point MM peripherals to system_mm_noc clock usb: host: xhci: use snprintf() in xhci_decode_trb() RDMA/rxe: Fix deadlock in rxe_do_local_ops() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain clk: qcom: camcc-sm8250: Fix topology around titan_top power domain clk: qcom: clk-rcg2: Fail Duty-Cycle configuration if MND divider is not enabled. clk: qcom: clk-rcg2: Make sure to not write d=0 to the NMD register mm/mempolicy: fix get_nodes out of bound access PCI: dwc: Stop link on host_init errors and de-initialization PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Disable outbound windows only for controllers using iATU PCI: dwc: Set INCREASE_REGION_SIZE flag based on limit address PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support soundwire: revisit driver bind/unbind and callbacks KVM: arm64: Don't return from void function dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function scsi: qla2xxx: Check correct variable in qla24xx_async_gffid() intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers binder: fix redefinition of seq_file attributes staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch mmc: mxcmmc: Silence a clang warning mmc: renesas_sdhi: Get the reset handle early in the probe memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R of: device: Fix missing of_node_put() in of_dma_set_restricted_buffer mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() phy: stm32: fix error return in stm32_usbphyc_phy_init interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/irdma: Fix a window for use-after-free RDMA/irdma: Fix VLAN connection with wildcard address RDMA/irdma: Fix setting of QP context err_rq_idx_valid field RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/rtrs: Fix warning when use poll mode on client side. RDMA/rtrs: Replace duplicate check with is_pollqueue helper RDMA/rtrs: Introduce destroy_cq helper RDMA/rtrs: Do not allow sessname to contain special symbols / and . RDMA/rtrs: Rename rtrs_sess to rtrs_path RDMA/rtrs-srv: Rename rtrs_srv_sess to rtrs_srv_path RDMA/rtrs-clt: Rename rtrs_clt_sess to rtrs_clt_path RDMA/rtrs-clt: Replace list_next_or_null_rr_rcu with an inline function RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event iio: cros: Register FIFO callback after sensor is registered clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() HID: amd_sfh: Add NULL check for hid device dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) scripts/gdb: lx-dmesg: read records individually scripts/gdb: fix 'lx-dmesg' on 32 bits arch RDMA/rxe: Fix mw bind to allow any consumer key portion mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support RDMA/rxe: For invalidate compare according to set keys in mr PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence HID: amd_sfh: Handle condition of "no sensors" USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() KVM: nVMX: Set UMIP bit CR4_FIXED1 MSR when emulating UMIP platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free android: binder: stop saving a pointer to the VMA mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall of/fdt: declared return type does not match actual return type RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Add memory barriers to kernel queues RDMA/rxe: Remove the is_user members of struct rxe_sq/rxe_rq/rxe_srq RDMA/rxe: Fix error unwind in rxe_create_qp() block/rnbd-srv: Set keep_id to true after mutex_trylock null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() nvme: define compat_ioctl again to unbreak 32-bit userspace. nvme: disable namespace access for unsupported metadata nvme: don't return an error from nvme_configure_metadata nvme: catch -ENODEV from nvme_revalidate_zones again block/bio: remove duplicate append pages code block: ensure iov_iter advances for added pages jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: imx-audmux: Silence a clang warning ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250: dma: Allow driver operations before starting DMA transfers serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: char: Add mutex protection for rpmsg_eptdev_open() rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix tty registration before control channel open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix missing timer to handle stalled links tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() tty: n_gsm: fix resource allocation order in gsm_activate_mux() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() ASoC: imx-card: Fix DSD/PDM mclk frequency remoteproc: qcom: wcnss: Fix handling of IRQs vfio/ccw: Do not change FSM state in subchannel event serial: 8250_fsl: Don't report FE, PE and OE twice tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() MIPS: vdso: Utilize __pa() for gic_pfn swiotlb: fail map correctly with failed io_tlb_default_mem ASoC: mt6359: Fix refcount leak bug serial: 8250_bcm7271: Save/restore RTS in suspend/resume iommu/exynos: Handle failed IOMMU device registration properly 9p: fix a bunch of checkpatch warnings 9p: Drop kref usage 9p: Add client parameter to p9_req_put() net: 9p: fix refcount leak in p9_read_work() error handling MIPS: Fixed __debug_virt_addr_valid() rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call proc: fix a dentry lock race between release_task and lookup remoteproc: qcom: pas: Check if coredump is enabled remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/maccess: fix semantics of memcpy_real() and its callers s390/crash: fix incorrect number of bytes to copy to user space s390/zcore: fix race when reading from hardware system area ASoC: fsl_asrc: force cast the asrc_format type ASoC: fsl-asoc-card: force cast the asrc_format type ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: imx-card: use snd_pcm_format_t type for asrc_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Call mmu_mark_initmem_nx() regardless of data block mapping. powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/iommu: Fix iommu_table_in_use for a small default DMA window case powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias tty: serial: fsl_lpuart: correct the count of break characters s390/dump: fix os_info virtual vs physical address confusion s390/smp: cleanup target CPU callback starting s390/smp: cleanup control register update routines s390/maccess: rework absolute lowcore accessors s390/smp: enforce lowcore protection on CPU restart f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas x86/bus_lock: Don't assume the init value of DEBUGCTLMSR.BUS_LOCK_DETECT to be zero powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist sched: Remove the limitation of WF_ON_CPU on wakelist if wakee cpu is idle sched/core: Do not requeue task on CPU excluded from cpus_mask x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y f2fs: allow compression for mmap files in compress_mode=user f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: ufs: core: Correct ufshcd_shutdown() flow scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix imbalance vha->vref_count scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts scsi: qla2xxx: Fix excessive I/O error messages by default scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Wind down adapter after PCIe error scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing target when it reappears during delete scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/kprobes: Update kcb status flag after singlestepping x86/olpc: fix 'logical not is only applied to the left hand side' SMB3: fix lease break timeout when multiple deferred close handles for the same file. posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer crypto: blake2s - remove shash module drm/dp/mst: Read the extended DPCD capabilities during system resume drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling usbnet: smsc95xx: Fix deadlock on runtime resume firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails scsi: lpfc: Fix EEH support for NVMe I/O scsi: lpfc: SLI path split: Refactor lpfc_iocbq scsi: lpfc: SLI path split: Refactor fast and slow paths to native SLI4 scsi: lpfc: SLI path split: Refactor SCSI paths scsi: lpfc: Remove extra atomic_inc on cmd_pending in queuecommand after VMID intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Iterate over error counters instead of error strings PCI: qcom: Power on PHY before IPQ8074 DBI register accesses serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code serial: 8250: Add proper clock handling for OxSemi PCIe devices tty: 8250: Add support for Brainboxes PX cards. dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback net/9p: Initialize the iounit field during fid creation ARM: remove some dead code timekeeping: contribute wall clock to rng on time change locking/csd_lock: Change csdlock_debug from early_param to __setup block: remove the struct blk_queue_ctx forward declaration block: don't allow the same type rq_qos add more than once btrfs: ensure pages are unlocked on cow_file_range() failure btrfs: reset block group chunk force if we have to wait btrfs: properly flag filesystem with BTRFS_FEATURE_INCOMPAT_BIG_METADATA ACPI: CPPC: Do not prevent CPPC from working in the future powerpc/powernv/kvm: Use darn for H_RANDOM on Power9 KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl KVM: VMX: Add helper to check if the guest PMU has PERF_GLOBAL_CTRL KVM: nVMX: Attempt to load PERF_GLOBAL_CTRL on nVMX xfer iff it exists dm raid: fix address sanitizer warning in raid_status dm raid: fix address sanitizer warning in raid_resume tracing: Add '__rel_loc' using trace event macros tracing: Avoid -Warray-bounds warning for __rel_loc macro ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix use-after-free in ext4_xattr_set_entry ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: check if directory block is within i_size ext4: make sure ext4_append() always allocates new block ext4: remove EA inode entry from mbcache on inode eviction ext4: use kmemdup() to replace kmalloc + memcpy ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect powerpc: Fix eh field when calling lwarx on PPC32 tracing: Use a struct alignof to determine trace event field alignment net_sched: cls_route: remove from list when handle is 0 mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() crypto: lib/blake2s - reduce stack frame usage in self test Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" Revert "s390/smp: enforce lowcore protection on CPU restart" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function net: phy: smsc: Disable Energy Detect Power-Down in interrupt mode drm/vc4: change vc4_dma_range_matches from a global to static tracing/perf: Avoid -Warray-bounds warning for __rel_loc macro drm/msm: Fix dirtyfb refcounting drm/meson: Fix refcount leak in meson_encoder_hdmi_init io_uring: mem-account pbuf buckets Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression drm/bridge: Move devm_drm_of_get_bridge to bridge/panel.c scsi: lpfc: Fix locking for lpfc_sli_iocbq_lookup() scsi: lpfc: Fix element offset in __lpfc_sli_release_iocbq_s4() scsi: lpfc: Resolve some cleanup issues following SLI path refactoring Linux 5.15.61 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0849e49fb265651bf6277e4ead9c440d50ed7536	2022-08-22 14:29:30 +02:00
Xiu Jianfeng	7363a69d8c	selinux: Add boundary check in put_entry() [ Upstream commit 15ec76fb29be31df2bccb30fc09875274cba2776 ] Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-17 14:23:05 +02:00
Xiu Jianfeng	c877c52171	selinux: fix memleak in security_read_state_kernel() [ Upstream commit 73de1befcc53a7c68b0c5e76b9b5ac41c517760f ] In this function, it directly returns the result of __security_read_policy without freeing the allocated memory in *data, cause memory leak issue, so free the memory if __security_read_policy failed. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-17 14:23:04 +02:00
Greg Kroah-Hartman	813550e7cc	Merge 5.15.42 into android13-5.15-lts Changes in 5.15.42 usb: gadget: fix race when gadget driver register via ioctl io_uring: arm poll for non-nowait files floppy: use a statically allocated error counter kernel/resource: Introduce request_mem_region_muxed() i2c: piix4: Replace hardcoded memory map size with a #define i2c: piix4: Move port I/O region request/release code into functions i2c: piix4: Move SMBus controller base address detect into function i2c: piix4: Move SMBus port selection into function i2c: piix4: Add EFCH MMIO support to region request and release i2c: piix4: Add EFCH MMIO support to SMBus base address detect i2c: piix4: Add EFCH MMIO support for SMBus port select i2c: piix4: Enable EFCH MMIO for Family 17h+ Watchdog: sp5100_tco: Move timer initialization into function Watchdog: sp5100_tco: Refactor MMIO base address initialization Watchdog: sp5100_tco: Add initialization using EFCH MMIO Watchdog: sp5100_tco: Enable Family 17h+ CPUs mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" rtc: fix use-after-free on device removal rtc: pcf2127: fix bug when reading alarm registers um: Cleanup syscall_handler_t definition/cast, fix warning Input: add bounds checking to input_set_capability() Input: stmfts - fix reference leak in stmfts_input_open nvme-pci: add quirks for Samsung X5 SSDs gfs2: Disable page faults during lockless buffered reads rtc: sun6i: Fix time overflow handling crypto: stm32 - fix reference leak in stm32_crc_remove crypto: x86/chacha20 - Avoid spurious jumps to other functions ALSA: hda/realtek: Enable headset mic on Lenovo P360 s390/traps: improve panic message for translation-specification exception s390/pci: improve zpci_dev reference counting vhost_vdpa: don't setup irq offloading when irq_num < 0 tools/virtio: compile with -pthread nvmet: use a private workqueue instead of the system workqueue nvme-multipath: fix hang when disk goes live over reconnect rtc: mc146818-lib: Fix the AltCentury for AMD platforms fs: fix an infinite loop in iomap_fiemap MIPS: lantiq: check the return value of kzalloc() drbd: remove usage of list iterator variable after loop platform/chrome: cros_ec_debugfs: detach log reader wq from devm ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() nilfs2: fix lockdep warnings in page operations for btree nodes nilfs2: fix lockdep warnings during disk space reclamation ALSA: usb-audio: Restore Rane SL-1 quirk ALSA: wavefront: Proper check of get_user() error ALSA: hda/realtek: Add quirk for TongFang devices with pop noise perf: Fix sys_perf_event_open() race against self selinux: fix bad cleanup on error in hashtab_duplicate() Fix double fget() in vhost_net_set_backend() PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold Revert "can: m_can: pci: use custom bit timings for Elkhart Lake" KVM: x86/mmu: Update number of zapped pages even if page list is stable arm64: paravirt: Use RCU read locks to guard stolen_time arm64: mte: Ensure the cleared tags are visible before setting the PTE crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ libceph: fix potential use-after-free on linger ping and resends drm/amd: Don't reset dGPUs if the system is going to s2idle drm/i915/dmc: Add MMIO range restrictions drm/dp/mst: fix a possible memory leak in fetch_monitor_name() dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace dma-buf: ensure unique directory name for dmabuf stats ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi pinctrl: pinctrl-aspeed-g6: remove FWQSPID group in pinctrl ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group ARM: dts: aspeed: Add ADC for AST2600 and enable for Rainier and Everest ARM: dts: aspeed: Add secure boot controller node ARM: dts: aspeed: Add video engine to g6 pinctrl: mediatek: mt8365: fix IES control pins ALSA: hda - fix unused Realtek function when PM is not enabled net: ipa: record proper RX transaction count net: macb: Increment rx bd head after allocating skb and buffer xfrm: rework default policy structure xfrm: fix "disable_policy" flag use when arriving from different devices net/sched: act_pedit: sanitize shift argument before usage netfilter: flowtable: fix excessive hw offload attempts after failure netfilter: nft_flow_offload: skip dst neigh lookup for ppp devices net: fix dev_fill_forward_path with pppoe + bridge netfilter: nft_flow_offload: fix offload with pppoe + vlan Revert "PCI: aardvark: Rewrite IRQ code to chained IRQ handler" net: systemport: Fix an error handling path in bcm_sysport_probe() net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() ice: fix crash when writing timestamp on RX rings ice: fix possible under reporting of ethtool Tx and Rx statistics ice: move ice_container_type onto ice_ring_container ice: Fix interrupt moderation settings getting cleared clk: at91: generated: consider range when calculating best rate net/qla3xxx: Fix a test in ql_reset_work() NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc net/mlx5: DR, Fix missing flow_source when creating multi-destination FW table net/mlx5e: Properly block LRO when XDP is enabled net: af_key: add check for pfkey_broadcast in function pfkey_process ARM: 9196/1: spectre-bhb: enable for Cortex-A15 ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 mptcp: change the parameter of __mptcp_make_csum mptcp: reuse __mptcp_make_csum in validate_data_csum mptcp: fix checksum byte order igb: skip phy status check where unavailable netfilter: flowtable: fix TCP flow teardown netfilter: flowtable: pass flowtable to nf_flow_table_iterate() netfilter: flowtable: move dst_check to packet path net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. riscv: dts: sifive: fu540-c000: align dma node name with dtschema scsi: ufs: core: Fix referencing invalid rsp field perf build: Fix check for btf__load_from_kernel_by_id() in libbpf gpio: gpio-vf610: do not touch other bits when set the target bit gpio: mvebu/pwm: Refuse requests with inverted polarity perf regs x86: Fix arch__intr_reg_mask() for the hybrid platform perf bench numa: Address compiler error on s390 scsi: scsi_dh_alua: Properly handle the ALUA transitioning state scsi: qla2xxx: Fix missed DMA unmap for aborted commands mac80211: fix rx reordering with non explicit / psmp ack policy nl80211: validate S1G channel width selftests: add ping test with ping_group_range tuned Revert "fbdev: Make fb_release() return -ENODEV if fbdev was unregistered" fbdev: Prevent possible use-after-free in fb_release() net: fix wrong network header length nl80211: fix locking in nl80211_set_tx_bitrate_mask() ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() net: atlantic: fix "frag[0] not initialized" net: atlantic: reduce scope of is_rsc_complete net: atlantic: add check for MAX_SKB_FRAGS net: atlantic: verify hw_head_ lies within TX buffer ring arm64: Enable repeat tlbi workaround on KRYO4XX gold CPUs Input: ili210x - fix reset timing dt-bindings: pinctrl: aspeed-g6: remove FWQSPID group mt76: mt7921e: fix possible probe failure after reboot lockdown: also lock down previous kgdb use i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() afs: Fix afs_getattr() to refetch file status if callback break occurred Linux 5.15.42 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ifad49f172050c7f8d07f9432a48766cfd5ddf2ca	2022-06-06 16:38:53 +02:00
Ondrej Mosnacek	0f71433eb7	selinux: fix bad cleanup on error in hashtab_duplicate() commit 6254bd3db316c9ccb3b05caa8b438be63245466f upstream. The code attempts to free the 'new' pointer using kmem_cache_free(), which is wrong because this function isn't responsible of freeing it. Instead, the function should free new->htable and clear the contents of *new (to prevent double-free). Cc: stable@vger.kernel.org Fixes: `c7c556f1e8` ("selinux: refactor changing booleans") Reported-by: Wander Lairson Costa <wander@redhat.com> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-05-25 09:57:27 +02:00
Greg Kroah-Hartman	a74d4e284c	Merge 5.15.22 into android13-5.15 Changes in 5.15.22 drm/i915: Disable DSB usage for now selinux: fix double free of cond_list on error paths audit: improve audit queue handling when "audit=1" on cmdline ipc/sem: do not sleep with a spin lock held spi: stm32-qspi: Update spi registering ASoC: hdmi-codec: Fix OOB memory accesses ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() ALSA: usb-audio: Correct quirk for VF0770 ALSA: hda: Fix UAF of leds class devs at unbinding ALSA: hda: realtek: Fix race at concurrent COEF updates ALSA: hda/realtek: Add quirk for ASUS GU603 ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset) ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows btrfs: don't start transaction for scrub if the fs is mounted read-only btrfs: fix deadlock between quota disable and qgroup rescan worker btrfs: fix use-after-free after failure to create a snapshot Revert "fs/9p: search open fids first" drm/nouveau: fix off by one in BIOS boundary checking drm/i915/adlp: Fix TypeC PHY-ready status readout drm/amd/pm: correct the MGpuFanBoost support for Beige Goby drm/amd/display: watermark latencies is not enough on DCN31 drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() mm/debug_vm_pgtable: remove pte entry from the page table mm/pgtable: define pte_index so that preprocessor could recognize it mm/kmemleak: avoid scanning potential huge holes block: bio-integrity: Advance seed correctly for larger interval sizes dma-buf: heaps: Fix potential spectre v1 gadget IB/hfi1: Fix AIP early init panic Revert "fbcon: Disable accelerated scrolling" fbcon: Add option to enable legacy hardware acceleration mptcp: fix msk traversal in mptcp_nl_cmd_set_flags() Revert "ASoC: mediatek: Check for error clk pointer" KVM: arm64: Avoid consuming a stale esr value when SError occur KVM: arm64: Stop handle_exit() from handling HVC twice when an SError occurs RDMA/cma: Use correct address when leaving multicast group RDMA/ucma: Protect mc during concurrent multicast leaves RDMA/siw: Fix refcounting leak in siw_create_qp() IB/rdmavt: Validate remote_addr during loopback atomic tests RDMA/siw: Fix broken RDMA Read Fence/Resume logic. RDMA/mlx4: Don't continue event handler after memory allocation failure ALSA: usb-audio: initialize variables that could ignore errors ALSA: hda: Fix signedness of sscanf() arguments ALSA: hda: Skip codec shutdown in case the codec is not registered iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() spi: bcm-qspi: check for valid cs before applying chip select spi: mediatek: Avoid NULL pointer crash in interrupt spi: meson-spicc: add IRQ check in meson_spicc_probe spi: uniphier: fix reference count leak in uniphier_spi_probe() IB/hfi1: Fix tstats alloc and dealloc IB/cm: Release previously acquired reference counter in the cm_id_priv net: ieee802154: hwsim: Ensure proper channel selection at probe time net: ieee802154: mcr20a: Fix lifs/sifs periods net: ieee802154: ca8210: Stop leaking skb's netfilter: nft_reject_bridge: Fix for missing reply from prerouting net: ieee802154: Return meaningful error codes from the netlink helpers net/smc: Forward wakeup to smc socket waitqueue after fallback net: stmmac: dwmac-visconti: No change to ETHER_CLOCK_SEL for unexpected speed request. net: stmmac: properly handle with runtime pm in stmmac_dvr_remove() net: macsec: Fix offload support for NETDEV_UNREGISTER event net: macsec: Verify that send_sci is on when setting Tx sci explicitly net: stmmac: dump gmac4 DMA registers correctly net: stmmac: ensure PTP time register reads are consistent drm/kmb: Fix for build errors with Warray-bounds drm/i915/overlay: Prevent divide by zero bugs in scaling drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled ASoC: fsl: Add missing error handling in pcm030_fabric_probe ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes ASoC: simple-card: fix probe failure on platform component ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name ASoC: max9759: fix underflow in speaker_gain_control_put() ASoC: codecs: wcd938x: fix incorrect used of portid ASoC: codecs: lpass-rx-macro: fix sidetone register offsets ASoC: codecs: wcd938x: fix return value of mixer put function pinctrl: sunxi: Fix H616 I2S3 pin data pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line pinctrl: intel: fix unexpected interrupt pinctrl: bcm2835: Fix a few error paths scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. gve: fix the wrong AdminQ buffer queue index check bpf: Use VM_MAP instead of VM_ALLOC for ringbuf selftests/exec: Remove pipe from TEST_GEN_FILES selftests: futex: Use variable MAKE instead of make tools/resolve_btfids: Do not print any commands when building silently e1000e: Separate ADP board type from TGP rtc: cmos: Evaluate century appropriate kvm: add guest_state_{enter,exit}_irqoff() kvm/arm64: rework guest entry logic perf: Copy perf_event_attr::sig_data on modification perf stat: Fix display of grouped aliased events perf/x86/intel/pt: Fix crash with stop filters in single-range mode x86/perf: Default set FREEZE_ON_SMI for all EDAC/altera: Fix deferred probing EDAC/xgene: Fix deferred probing ext4: prevent used blocks from being allocated during fast commit replay ext4: modify the logic of ext4_mb_new_blocks_simple ext4: fix error handling in ext4_restore_inline_data() ext4: fix error handling in ext4_fc_record_modified_inode() ext4: fix incorrect type issue during replay_del_range net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning tools include UAPI: Sync sound/asound.h copy with the kernel sources gpio: idt3243x: Fix an ignored error return from platform_get_irq() gpio: mpc8xxx: Fix an ignored error return from platform_get_irq() selftests: nft_concat_range: add test for reload with no element add/del selftests: netfilter: check stateless nat udp checksum fixup Linux 5.15.22 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9143b858b768a8497c1df9440a74d8c105c32271	2022-02-09 08:15:44 +01:00
Vratislav Bendel	70caa32e6d	selinux: fix double free of cond_list on error paths commit 186edf7e368c40d06cf727a1ad14698ea67b74ad upstream. On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functions, resulting in NULL pointer deref. Fix this by resetting the cond_list_len to 0 in cond_list_destroy(), making subsequent calls a noop. Also consistently reset the cond_list pointer to NULL after freeing. Cc: stable@vger.kernel.org Signed-off-by: Vratislav Bendel <vbendel@redhat.com> [PM: fix line lengths in the description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-08 18:34:02 +01:00
Greg Kroah-Hartman	966869fb2a	Merge 5.15.5 into android13-5.15 Changes in 5.15.5 arm64: zynqmp: Do not duplicate flash partition label property arm64: zynqmp: Fix serial compatible string clk: sunxi-ng: Unregister clocks/resets when unbinding ARM: dts: sunxi: Fix OPPs node name arm64: dts: allwinner: h5: Fix GPU thermal zone node name arm64: dts: allwinner: a100: Fix thermal zone node name staging: wfx: ensure IRQ is ready before enabling it ARM: dts: BCM5301X: Fix nodes names ARM: dts: BCM5301X: Fix MDIO mux binding ARM: dts: NSP: Fix mpcore, mmc node names arm64: dts: broadcom: bcm4908: Move reboot syscon out of bus scsi: pm80xx: Fix memory leak during rmmod scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() ASoC: mediatek: mt8195: Add missing of_node_put() arm64: dts: rockchip: Disable CDN DP on Pinebook Pro arm64: dts: hisilicon: fix arm,sp805 compatible string RDMA/bnxt_re: Check if the vlan is valid before reporting bus: ti-sysc: Add quirk handling for reinit on context lost bus: ti-sysc: Use context lost quirk for otg usb: musb: tusb6010: check return value after calling platform_get_resource() usb: typec: tipd: Remove WARN_ON in tps6598x_block_read ARM: dts: ux500: Skomer regulator fixes staging: rtl8723bs: remove possible deadlock when disconnect (v2) staging: rtl8723bs: remove a second possible deadlock staging: rtl8723bs: remove a third possible deadlock ARM: BCM53016: Specify switch ports for Meraki MR32 arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency arm64: dts: qcom: ipq6018: Fix qcom,controlled-remotely property arm64: dts: qcom: ipq8074: Fix qcom,controlled-remotely property arm64: dts: qcom: sdm845: Fix qcom,controlled-remotely property arm64: dts: freescale: fix arm,sp805 compatible string arm64: dts: ls1012a: Add serial alias for ls1012a-rdb RDMA/rxe: Separate HW and SW l/rkeys ASoC: SOF: Intel: hda-dai: fix potential locking issue scsi: core: Fix scsi_mode_sense() buffer length handling ALSA: usb-audio: disable implicit feedback sync for Behringer UFX1204 and UFX1604 clk: imx: imx6ul: Move csi_sel mux to correct base register ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ ASoC: rt5651: Use IRQF_NO_AUTOEN when requesting the IRQ ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect scsi: advansys: Fix kernel pointer leak scsi: smartpqi: Add controller handshake during kdump arm64: dts: imx8mm-kontron: Fix reset delays for ethernet PHY ALSA: intel-dsp-config: add quirk for APL/GLK/TGL devices based on ES8336 codec ASoC: Intel: soc-acpi: add missing quirk for TGL SDCA single amp ASoC: Intel: sof_sdw: add missing quirk for Dell SKU 0A45 firmware_loader: fix pre-allocated buf built-in firmware use HID: multitouch: disable sticky fingers for UPERFECT Y ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 Mixer/Soundcard ARM: dts: omap: fix gpmc,mux-add-data type usb: host: ohci-tmio: check return value after calling platform_get_resource() ASoC: rt5682: fix a little pop while playback ARM: dts: ls1021a: move thermal-zones node out of soc/ ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for flash ALSA: ISA: not for M68K iommu/vt-d: Do not falsely log intel_iommu is unsupported kernel option tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc MIPS: sni: Fix the build scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() scsi: target: Fix ordered tag handling scsi: target: Fix alua_tg_pt_gps_count tracking iio: imu: st_lsm6dsx: Avoid potential array overflow in st_lsm6dsx_set_odr() RDMA/core: Use kvzalloc when allocating the struct ib_port scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine scsi: lpfc: Fix link down processing to address NULL pointer dereference scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss memory: tegra20-emc: Add runtime dependency on devfreq governor module powerpc/5200: dts: fix memory node unit name ARM: dts: qcom: fix memory and mdio nodes naming for RB3011 arm64: dts: qcom: Fix node name of rpm-msg-ram device nodes ALSA: gus: fix null pointer dereference on pointer block ALSA: usb-audio: fix null pointer dereference on pointer cs_desc clk: at91: sama7g5: remove prescaler part of master clock iommu/dart: Initialize DART_STREAMS_ENABLE powerpc/dcr: Use cmplwi instead of 3-argument cmpli powerpc/8xx: Fix Oops with STRICT_KERNEL_RWX without DEBUG_RODATA_TEST sh: check return code of request_irq maple: fix wrong return value of maple_bus_init(). f2fs: fix up f2fs_lookup tracepoints f2fs: fix to use WHINT_MODE f2fs: fix wrong condition to trigger background checkpoint correctly sh: fix kconfig unmet dependency warning for FRAME_POINTER sh: math-emu: drop unused functions sh: define __BIG_ENDIAN for math-emu f2fs: compress: disallow disabling compress on non-empty compressed file f2fs: fix incorrect return value in f2fs_sanity_check_ckpt() clk: ingenic: Fix bugs with divided dividers clk/ast2600: Fix soc revision for AHB clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk KVM: arm64: Fix host stage-2 finalization mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set MIPS: boot/compressed/: add __bswapdi2() to target for ZSTD decompression sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() sched/fair: Prevent dead task groups from regaining cfs_rq's perf/x86/vlbr: Add c->flags to vlbr event constraints blkcg: Remove extra blkcg_bio_issue_init tracing/histogram: Do not copy the fixed-size char array field over the field size perf bpf: Avoid memory leak from perf_env__insert_btf() perf bench futex: Fix memory leak of perf_cpu_map__new() perf tests: Remove bash construct from record+zstd_comp_decomp.sh drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame bpf: Fix inner map state pruning regression. samples/bpf: Fix summary per-sec stats in xdp_sample_user samples/bpf: Fix incorrect use of strlen in xdp_redirect_cpu selftests: net: switch to socat in the GSO GRE test net/ipa: ipa_resource: Fix wrong for loop range tcp: Fix uninitialized access in skb frags array for Rx 0cp. tracing: Add length protection to histogram string copies nl80211: fix radio statistics in survey dump mac80211: fix monitor_sdata RCU/locking assertions net: ipa: HOLB register sometimes must be written twice net: ipa: disable HOLB drop when updating timer selftests: gpio: fix gpio compiling error net: bnx2x: fix variable dereferenced before check bnxt_en: reject indirect blk offload when hw-tc-offload is off tipc: only accept encrypted MSG_CRYPTO msgs sock: fix /proc/net/sockstat underflow in sk_clone_lock() net/smc: Make sure the link_id is unique NFSD: Fix exposure in nfsd4_decode_bitmap() iavf: Fix return of set the new channel count iavf: check for null in iavf_fix_features iavf: free q_vectors before queues in iavf_disable_vf iavf: don't clear a lock we don't hold iavf: Fix failure to exit out from last all-multicast mode iavf: prevent accidental free of filter structure iavf: validate pointers iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset iavf: Fix for setting queues to 0 iavf: Restore VLAN filters after link down bpf: Fix toctou on read-only map's constant scalar tracking MIPS: generic/yamon-dt: fix uninitialized variable error mips: bcm63xx: add support for clk_get_parent() mips: lantiq: add support for clk_get_parent() gpio: rockchip: needs GENERIC_IRQ_CHIP to fix build errors platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()' platform/x86: think-lmi: Abort probe on analyze failure udp: Validate checksum in udp_read_sock() btrfs: make 1-bit bit-fields of scrub_page unsigned int RDMA/core: Set send and receive CQ before forwarding to the driver net/mlx5e: kTLS, Fix crash in RX resync flow net/mlx5e: Wait for concurrent flow deletion during neigh/fib events net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() net/mlx5: Update error handler for UCTX and UMEM net/mlx5: E-Switch, rebuild lag only when needed net/mlx5e: CT, Fix multiple allocations and memleak of mod acts net/mlx5: Lag, update tracker when state change event received net/mlx5: E-Switch, return error if encap isn't supported scsi: ufs: core: Improve SCSI abort handling scsi: core: sysfs: Fix hang when device state is set via sysfs scsi: ufs: core: Fix task management completion timeout race scsi: ufs: core: Fix another task management completion race net: mvmdio: fix compilation warning net: sched: act_mirred: drop dst for the direction from egress to ingress net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove net: virtio_net_hdr_to_skb: count transport header in UFO i40e: Fix correct max_pkt_size on VF RX queue i40e: Fix NULL ptr dereference on VSI filter sync i40e: Fix changing previously set num_queue_pairs for PFs i40e: Fix ping is lost after configuring ADq on VF RDMA/mlx4: Do not fail the registration on port stats i40e: Fix warning message and call stack during rmmod i40e driver i40e: Fix creation of first queue by omitting it if is not power of two i40e: Fix display error code in dmesg NFC: reorganize the functions in nci_request NFC: reorder the logic in nfc_{un,}register_device NFC: add NCI_UNREG flag to eliminate the race e100: fix device suspend/resume ptp: ocp: Fix a couple NULL vs IS_ERR() checks tools build: Fix removal of feature-sync-compare-and-swap feature detection riscv: fix building external modules KVM: PPC: Book3S HV: Use GLOBAL_TOC for kvmppc_h_set_dabr/xdabr() powerpc: clean vdso32 and vdso64 directories powerpc/pseries: rename numa_dist_table to form2_distances powerpc/pseries: Fix numa FORM2 parsing fallback code pinctrl: qcom: sdm845: Enable dual edge errata pinctrl: qcom: sm8350: Correct UFS and SDC offsets perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server perf/x86/intel/uncore: Fix IIO event constraints for Snowridge s390/kexec: fix return code handling blk-cgroup: fix missing put device in error path from blkg_conf_pref() dmaengine: remove debugfs #ifdef tun: fix bonding active backup with arp monitoring Revert "mark pstore-blk as broken" pstore/blk: Use "%lu" to format unsigned long hexagon: export raw I/O routines for modules hexagon: clean up timer-regs.h tipc: check for null after calling kmemdup ipc: WARN if trying to remove ipc object which is absent shm: extend forced shm destroy to support objects from several IPC nses mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag hugetlb, userfaultfd: fix reservation restore on userfaultfd error kmap_local: don't assume kmap PTEs are linear arrays in memory mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation mm/damon/dbgfs: fix missed use of damon_dbgfs_lock x86/boot: Pull up cmdline preparation and early param parsing x86/sgx: Fix free page accounting x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails KVM: x86: Assume a 64-bit hypercall for guests with protected state KVM: x86: Fix uninitialized eoi_exit_bitmap usage in vcpu_load_eoi_exitmap() KVM: x86/mmu: include EFER.LMA in extended mmu role KVM: x86/xen: Fix get_attr of KVM_XEN_ATTR_TYPE_SHARED_INFO powerpc/signal32: Fix sigset_t copy powerpc/xive: Change IRQ domain to a tree domain powerpc/8xx: Fix pinned TLBs with CONFIG_STRICT_KERNEL_RWX Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping" Revert "parisc: Reduce sigreturn trampoline to 3 instructions" ata: libata: improve ata_read_log_page() error message ata: libata: add missing ata_identify_page_supported() calls scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() pinctrl: ralink: include 'ralink_regs.h' in 'pinctrl-mt7620.c' s390/setup: avoid reserving memory above identity mapping s390/boot: simplify and fix kernel memory layout setup s390/vdso: filter out -mstack-guard and -mstack-size s390/kexec: fix memory leak of ipl report buffer s390/dump: fix copying to user-space of swapped kdump oldmem block: Check ADMIN before NICE for IOPRIO_CLASS_RT fbdev: Prevent probing generic drivers if a FB is already registered KVM: SEV: Disallow COPY_ENC_CONTEXT_FROM if target has created vCPUs KVM: nVMX: don't use vcpu->arch.efer when checking host state on nested state load drm/cma-helper: Release non-coherent memory with dma_free_noncoherent() printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces udf: Fix crash after seekdir spi: fix use-after-free of the add_lock mutex net: stmmac: socfpga: add runtime suspend/resume callback for stratix10 platform Drivers: hv: balloon: Use VMBUS_RING_SIZE() wrapper for dm_ring_size btrfs: fix memory ordering between normal and ordered work functions fs: handle circular mappings correctly net: stmmac: Fix signed/unsigned wreckage parisc/sticon: fix reverse colors cfg80211: call cfg80211_stop_ap when switch from P2P_GO type mac80211: fix radiotap header generation mac80211: drop check for DONT_REORDER in __ieee80211_select_queue drm/amd/display: Update swizzle mode enums drm/amd/display: Limit max DSC target bpp for specific monitors drm/i915/guc: Fix outstanding G2H accounting drm/i915/guc: Don't enable scheduling on a banned context, guc_id invalid, not registered drm/i915/guc: Workaround reset G2H is received after schedule done G2H drm/i915/guc: Don't drop ce->guc_active.lock when unwinding context drm/i915/guc: Unwind context requests in reverse order drm/udl: fix control-message timeout drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap drm/nouveau: Add a dedicated mutex for the clients list drm/nouveau: use drm_dev_unplug() during device removal drm/nouveau: clean up all clients on device removal drm/i915/dp: Ensure sink rate values are always valid drm/i915/dp: Ensure max link params are always valid drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors drm/amd/pm: avoid duplicate powergate/ungate setting signal: Implement force_fatal_sig exit/syscall_user_dispatch: Send ordinary signals on failure signal/powerpc: On swapcontext failure force SIGSEGV signal/s390: Use force_sigsegv in default_trap_handler signal/sparc32: Exit with a fatal signal when try_to_clear_window_buffer fails signal/sparc32: In setup_rt_frame and setup_fram use force_fatal_sig signal/vm86_32: Properly send SIGSEGV when the vm86 state cannot be saved. signal/x86: In emulate_vsyscall force a signal instead of calling do_exit signal: Replace force_sigsegv(SIGSEGV) with force_fatal_sig(SIGSEGV) signal: Don't always set SA_IMMUTABLE for forced signals signal: Replace force_fatal_sig with force_exit_sig when in doubt hugetlbfs: flush TLBs correctly after huge_pmd_unshare RDMA/netlink: Add __maybe_unused to static inline in C file bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs selinux: fix NULL-pointer dereference when hashtab allocation fails ASoC: DAPM: Cover regression by kctl change notification fix ASoC: rsnd: fixup DMAEngine API usb: max-3421: Use driver data instead of maintaining a list of bound devices ice: Fix VF true promiscuous mode ice: Delete always true check of PF pointer fs: export an inode_update_time helper btrfs: update device path inode time instead of bd_inode net: add and use skb_unclone_keeptruesize() helper x86/Kconfig: Fix an unused variable error in dell-smm-hwmon ALSA: hda: hdac_ext_stream: fix potential locking issues ALSA: hda: hdac_stream: fix potential locking issue in snd_hdac_stream_assign() Linux 5.15.5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If86a02ba2cf9af765d9838ada3b9a2cbcea9a08d	2021-11-25 10:40:10 +01:00
Ondrej Mosnacek	83c8ab8503	selinux: fix NULL-pointer dereference when hashtab allocation fails commit dc27f3c5d10c58069672215787a96b4fae01818b upstream. When the hash table slot array allocation fails in hashtab_init(), h->size is left initialized with a non-zero value, but the h->htable pointer is NULL. This may then cause a NULL pointer dereference, since the policydb code relies on the assumption that even after a failed hashtab_init(), hashtab_map() and hashtab_destroy() can be safely called on it. Yet, these detect an empty hashtab only by looking at the size. Fix this by making sure that hashtab_init() always leaves behind a valid empty hashtab when the allocation fails. Cc: stable@vger.kernel.org Fixes: `03414a49ad` ("selinux: do not allocate hashtabs dynamically") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-25 09:49:07 +01:00
Greg Kroah-Hartman	36de88a855	Merge 5.15.3 into android13-5.15 Changes in 5.15.3 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: scsi_ioctl: Validate command size scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding scsi: lpfc: Fix FCP I/O flush functionality for TMF routines scsi: qla2xxx: Fix crash in NVMe abort path scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path ce/gf100: fix incorrect CE0 address calculation on some GPUs char: xillybus: fix msg_ep UAF in xillyusb_probe() mmc: mtk-sd: Add wait dma stop done flow mmc: dw_mmc: Dont wait for DRTO on Write RSP error exfat: fix incorrect loading of i_blocks for large files io-wq: remove worker to owner tw dependency parisc: Fix set_fixmap() on PA1.x CPUs parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: rkvdec: Do not override sizeimage for output format media: ite-cir: IR receiver stop working after receive overflow media: rkvdec: Support dynamic resolution changes media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: hda: Free card instance properly at probe errors ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: pci: rme: Fix unaligned buffer addresses ALSA: PCM: Fix NULL dereference at mmap checks ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks" ext4: fix lazy initialization next schedule time computation in more granular unit ext4: ensure enough credits in ext4_ext_shift_path_extents ext4: refresh the ext4_ext_path struct after dropping i_data_sem. fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload x86/iopl: Fake iopl(3) CLI/STI usage btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device KVM: x86/mmu: Drop a redundant, broken remote TLB flush KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling ia64: kprobes: Fix to pass correct trampoline address to the handler selinux: fix race condition when computing ocontext SIDs ipmi:watchdog: Set panic count to proper value on a panic md/raid1: only allocate write behind bio for WriteMostly device hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init ifb: Depend on netfilter alternatively to tc platform/surface: aggregator_registry: Add support for Surface Laptop Studio mt76: mt7615: fix skb use-after-free on mac reset HID: surface-hid: Use correct event registry for managing HID events HID: surface-hid: Allow driver matching for target ID 1 devices wcn36xx: Fix HT40 capability for 2Ghz band wcn36xx: Fix tx_status mechanism wcn36xx: Fix (QoS) null data frame bitrate/modulation PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions mwifiex: Read a PCI register after writing the TX ring write pointer mwifiex: Try waking the firmware until we get an interrupt libata: fix checking of DMA state dma-buf: fix and rework dma_buf_poll v7 wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server perf/x86/intel/uncore: Fix invalid unit check perf/x86/intel/uncore: Fix Intel ICX IIO event constraints RDMA/qedr: Fix NULL deref for query_qp on the GSI QP ASoC: tegra: Set default card name for Trimslice ASoC: tegra: Restore AC97 support signal: Remove the bogus sigkill_pending in ptrace_stop memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode signal/mips: Update (_save\|_restore)_fp_context to fail with -EFAULT signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id soc: fsl: dpio: use the combined functions to protect critical zone mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines mctp: handle the struct sockaddr_mctp padding fields power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns iio: core: fix double free in iio_device_unregister_sysfs() iio: core: check return value when calling dev_set_name() KVM: arm64: Extract ESR_ELx.EC only KVM: x86: Fix recording of guest steal time / preempted status KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use KVM: nVMX: Handle dynamic MSR intercept toggling can: peak_usb: always ask for BERR reporting for PCAN-USB devices can: mcp251xfd: mcp251xfd_irq(): add missing can_rx_offload_threaded_irq_finish() in case of bus off can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM iio: adc: tsc2046: fix scan interval warning powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found io_uring: honour zeroes as io-wq worker limits ring-buffer: Protect ring_buffer_reset() from reentrancy serial: core: Fix initializing and restoring termios speed ifb: fix building without CONFIG_NET_CLS_ACT xen/balloon: add late_initcall_sync() for initial ballooning done ovl: fix use after free in struct ovl_aio_req ovl: fix filattr copy-up failure PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: cadence: Add cdns_plat_pcie_probe() missing return cxl/pci: Fix NULL vs ERR_PTR confusion PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix configuring Reference clock PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() cifs: To match file servers, make sure the server hostname matches cifs: set a minimum of 120s for next dns resolution mfd: simple-mfd-i2c: Select MFD_CORE to fix build error pinctrl: core: fix possible memory leak in pinctrl_enable() coresight: cti: Correct the parameter for pm_runtime_put coresight: trbe: Fix incorrect access of the sink specific data coresight: trbe: Defer the probe on offline CPUs iio: buffer: check return value of kstrdup_const() iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask() iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask() iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups() drivers: iio: dac: ad5766: Fix dt property name iio: dac: ad5446: Fix ad5622_write() return value iio: ad5770r: make devicetree property reading consistent Documentation:devicetree:bindings:iio:dac: Fix val USB: serial: keyspan: fix memleak on probe errors serial: 8250: fix racy uartclk update ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION io-wq: serialize hash clear with wakeup serial: 8250: Fix reporting real baudrate value in c_ospeed field Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field" most: fix control-message timeouts USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock power: supply: max17042_battery: Clear status bits in interrupt handler component: do not leave master devres group open after bind dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() Bluetooth: call sock_hold earlier in sco_conn_del drm/panel-orientation-quirks: add Valve Steam Deck rcutorture: Avoid problematic critical section nesting on PREEMPT_RT platform/x86: wmi: do not fail if disabling fails drm/amdgpu: move iommu_resume before ip init/resume MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes ACPI: resources: Add DMI-based legacy IRQ override quirk rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop smackfs: Fix use-after-free in netlbl_catmap_walk() ath11k: Align bss_chan_info structure with firmware crypto: aesni - check walk.nbytes instead of err x86/mm/64: Improve stack overflow warnings x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes spi: Check we have a spi_device_id for each DT compatible fscrypt: allow 256-bit master keys with AES-256-XTS drm/amdgpu: Fix MMIO access page fault drm/amd/display: Fix null pointer dereference for encoders selftests: net: fib_nexthops: Wait before checking reported idle time ath11k: Avoid reg rules update during firmware recovery ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets ath10k: high latency fixes for beacon buffer octeontx2-pf: Enable promisc/allmulti match MCAM entries. media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: atomisp: Fix error handling in probe media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: vidtv: Fix memory leak in remove media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: videobuf2: rework vb2_mem_ops API media: imx: set a media_device bus_info string media: rcar-vin: Use user provided buffers when starting media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK rtw88: fix RX clock gate setting while fifo dump brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic fs/proc/uptime.c: Fix idle time reporting in /proc/uptime kselftests/sched: cleanup the child processes ACPICA: Avoid evaluating methods too early during system resume cpufreq: Make policy min/max hard requirements ice: Move devlink port to PF/VF struct media: imx-jpeg: Fix possible null pointer dereference media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually drm/amdkfd: rm BO resv on validation to avoid deadlock tracefs: Have tracefs directories not set OTH permission bits by default tracing: Disable "other" permission bits in the tracefs files ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall mmc: moxart: Fix reference count leaks in moxart_probe iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full ACPI: scan: Release PM resources blocked by unused objects drm/amd/display: fix null pointer deref when plugging in display drm/amdkfd: fix resume error when iommu disabled in Picasso net: phy: micrel: make -skew-ps check more lenient leaking_addresses: Always print a trailing newline thermal/core: Fix null pointer dereference in thermal_release() drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() thermal/drivers/tsens: Add timeout to get_temp_tsens_valid block: bump max plugged deferred size from 16 to 32 floppy: fix calling platform_device_unregister() on invalid drives md: update superblock after changing rdev flags in state_store memstick: r592: Fix a UAF bug when removing the driver locking/rwsem: Disable preemption for spinning region lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_ functions signature mismatch mt76: mt7915: fix an off-by-one bound check mwl8k: Fix use-after-free in mwl8k_fw_state_machine() iwlwifi: change all JnP to NO-160 configuration block: remove inaccurate requeue check media: allegro: ignore interrupt if mailbox is not initialized drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh nvmet: fix use-after-free when a port is removed nvmet-rdma: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces samples/bpf: Fix application of sizeof to pointer arm64: vdso32: suppress error message for 'make mrproper' PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() selftests/bpf: Fix perf_buffer test on system with offline cpus iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to unsigned int gfs2: Cancel remote delete work asynchronously gfs2: Fix glock_hash_walk bugs ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 tools/latency-collector: Use correct size when writing queue_full_warning vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() ACPI: AC: Quirk GK45 to skip reading _PSR ACPI: resources: Add one more Medion model in IRQ override quirk btrfs: reflink: initialize return value to 0 in btrfs_extent_same() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() wcn36xx: Correct band/freq reporting on RX wcn36xx: Fix packet drop on resume Revert "wcn36xx: Enable firmware link monitoring" ftrace: do CPU checking after preemption disabled inet: remove races in inet{6}_getname() x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled selftests/core: fix conflicting types compile error for close_range() perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack erofs: don't trigger WARN() when decompression fails parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression fbdev/efifb: Release PCI device's runtime PM ref during FB destroy drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux() perf/x86/intel/uncore: Fix Intel SPR CHA event constraints perf/x86/intel/uncore: Fix Intel SPR IIO event constraints perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints drm/bridge: it66121: Initialize {device,vendor}_ids drm/bridge: it66121: Wait for next bridge to be probed Bluetooth: fix init and cleanup of sco_conn.timeout_work libbpf: Don't crash on object files with no symbol tables Bluetooth: hci_uart: fix GPF in h5_recv rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() MIPS: lantiq: dma: fix burst length for DEU x86/xen: Mark cpu_bringup_and_idle() as dead_end_function objtool: Handle __sanitize_cov() tail calls net/mlx5: Publish and unpublish all devlink parameters at once drm/v3d: fix wait for TMU write combiner flush crypto: sm4 - Do not change section of ck and sbox virtio-gpu: fix possible memory allocation failure lockdep: Let lock_is_held_type() detect recursive read as read net: net_namespace: Fix undefined member in key_remove_domain() net: phylink: don't call netif_carrier_off() with NULL netdev drm: bridge: it66121: Fix return value it66121_probe spi: Fixed division by zero warning cgroup: Make rebind_subsystems() disable v2 controllers all at once wcn36xx: Fix Antenna Diversity Switching wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync drm/amdgpu: Fix crash on device remove/driver unload drm/amd/display: Pass display_pipe_params_st as const in DML drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage crypto: caam - disable pkc for non-E SoCs crypto: qat - power up 4xxx device Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs bnxt_en: Check devlink allocation and registration status qed: Don't ignore devlink allocation failures rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() mptcp: do not shrink snd_nxt when recovering fortify: Fix dropped strcpy() compile-time write overflow check mac80211: twt: don't use potentially unaligned pointer cfg80211: always free wiphy specific regdomain net/mlx5: Accept devlink user input after driver initialization complete net: dsa: rtl8366rb: Fix off-by-one bug net: dsa: rtl8366: Fix a bug in deleting VLANs bpf/tests: Fix error in tail call limit tests ath11k: fix some sleeping in atomic bugs ath11k: Avoid race during regd updates ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status ath11k: Fix memory leak in ath11k_qmi_driver_event_work gve: DQO: avoid unused variable warnings ath10k: Fix missing frame timestamp for beacon/probe-resp ath10k: sdio: Add missing BH locking around napi_schdule() drm/ttm: stop calling tt_swapin in vm_access arm64: mm: update max_pfn after memory hotplug drm/amdgpu: fix warning for overflow check libbpf: Fix skel_internal.h to set errno on loader retval < 0 media: em28xx: add missing em28xx_close_extension media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()' media: cxd2880-spi: Fix a null pointer dereference on error handling path media: ttusb-dec: avoid release of non-acquired mutex media: dvb-usb: fix ununit-value in az6027_rc_query media: imx258: Fix getting clock frequency media: v4l2-ioctl: S_CTRL output the right value media: mtk-vcodec: venc: fix return value when start_streaming fails media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()' media: i2c: ths8200 needs V4L2_ASYNC media: sun6i-csi: Allow the video device to be open multiple times media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer media: atmel: fix the ispck initialization scs: Release kasan vmalloc poison in scs_free process kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency drm: fb_helper: fix CONFIG_FB dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath10k: Don't always treat modem stop events as crashes ath9k: Fix potential interrupt storm on queue reset PM: EM: Fix inefficient states detection x86/insn: Use get_unaligned() instead of memcpy() EDAC/amd64: Handle three rank interleaving mode rcu: Always inline rcu_dynticks_task_{enter,exit}() rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr netfilter: nft_dynset: relax superfluous check on set updates media: venus: fix vpp frequency calculation for decoder media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: ccree - avoid out-of-range warnings from clang crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops ima: fix deadlock when traversing "ima_default_rules". b43legacy: fix a lower bounds test b43: fix a lower bounds test gve: Recover from queue stall due to missed IRQ gve: Track RX buffer allocation failures mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured mmc: sdhci-omap: Fix context restore memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit kernel/sched: Fix sched_fork() access an invalid sched_task_group net: fealnx: fix build for UML net: intel: igc_ptp: fix build for UML net: tulip: winbond-840: fix build for UML tcp: switch orphan_count to bare per-cpu counters crypto: octeontx2 - set assoclen in aead_do_fallback() thermal/core: fix a UAF bug in __thermal_cooling_device_register() drm/msm/dsi: do not enable irq handler before powering up the host drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init() drm/msm: potential error pointer dereference in init() drm/msm: unlock on error in get_sched_entity() drm/msm: fix potential NULL dereference in cleanup drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done media: ivtv: fix build for UML media: ir_toy: assignment to be16 should be of correct type mmc: mxs-mmc: disable regulator on error and in the remove function io-wq: Remove duplicate code in io_workqueue_create() block: ataflop: fix breakage introduced at blk-mq refactoring blk-wbt: prevent NULL pointer dereference in wb_timer_fn platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mailbox: mtk-cmdq: Validate alias_id on probe mailbox: mtk-cmdq: Fix local clock ID usage ACPI: PM: Turn off unused wakeup power resources ACPI: PM: Fix sharing of wakeup power resources drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb mt76: mt7921: fix endianness warning in mt7921_update_txs mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal() mt76: connac: fix mt76_connac_gtk_rekey_tlv usage mt76: fix build error implicit enumeration conversion mt76: mt7921: fix survey-dump reporting mt76: mt76x02: fix endianness warnings in mt76x02_mac.c mt76: mt7921: Fix out of order process by invalid event pkt mt76: mt7915: fix potential overflow of eeprom page index mt76: mt7915: fix bit fields for HT rate idx mt76: mt7921: fix dma hang in rmmod mt76: connac: fix GTK rekey offload failure on WPA mixed mode mt76: overwrite default reg_ops if necessary mt76: mt7921: report HE MU radiotap mt76: mt7921: fix firmware usage of RA info using legacy rates mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate mt76: mt7921: always wake device if necessary in debugfs mt76: mt7915: fix hwmon temp sensor mem use-after-free mt76: mt7615: fix hwmon temp sensor mem use-after-free mt76: mt7915: fix possible infinite loop release semaphore mt76: mt7921: fix retrying release semaphore without end mt76: mt7615: fix monitor mode tear down crash mt76: connac: fix possible NULL pointer dereference in mt76_connac_get_phy_mode_v2 mt76: mt7915: fix sta_rec_wtbl tag len mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req() rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec iwlwifi: mvm: reset PM state on unsuccessful resume iwlwifi: pnvm: don't kmemdup() more than we have iwlwifi: pnvm: read EFI data only if long enough net: enetc: unmap DMA in enetc_send_cmd() phy: micrel: ksz8041nl: do not use power down mode nbd: Fix use-after-free in pid_show nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF x86/sev: Fix stack type check in vc_switch_off_ist() drm/msm: Fix potential NULL dereference in DPU SSPP drm/msm/dsi: fix wrong type in msm_dsi_host crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi KVM: selftests: Fix nested SVM tests when built with clang libbpf: Fix memory leak in btf__dedup() bpftool: Avoid leaking the JSON writer prepared for program metadata libbpf: Fix overflow in BTF sanity checks libbpf: Fix BTF header parsing checks mt76: mt7615: mt7622: fix ibss and meshpoint s390/gmap: validate VMA in __gmap_zap() s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() s390/mm: validate VMA in PGSTE manipulation functions s390/mm: fix VMA and page table handling code in storage key handling functions s390/uv: fully validate the VMA before calling follow_page() KVM: s390: pv: avoid double free of sida page KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm irq: mips: avoid nested irq_enter() net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error ARM: 9142/1: kasan: work around LPAE build warning ath10k: fix module load regression with iram-recovery feature block: ataflop: more blk-mq refactoring fixes blk-cgroup: synchronize blkg creation against policy deactivation libbpf: Fix off-by-one bug in bpf_core_apply_relo() tpm: fix Atmel TPM crash caused by too frequent queries tpm_tis_spi: Add missing SPI ID libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization spi: spi-rpc-if: Check return value of rpcif_sw_init() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path wcn36xx: Fix discarded frames due to wrong sequence number bpf: Avoid races in __bpf_prog_run() for 32bit arches bpf: Fixes possible race in update_prog_stats() for 32bit arches wcn36xx: Channel list update before hardware scan drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw() drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits selftests/bpf: Fix fd cleanup in sk_lookup test selftests/bpf: Fix memory leak in test_ima sctp: allow IP fragmentation when PLPMTUD enters Error state sctp: reset probe_timer in sctp_transport_pl_update sctp: subtract sctphdr len in sctp_transport_pl_hlen sctp: return true only for pathmtu update in sctp_transport_pl_toobig net: amd-xgbe: Toggle PLL settings during rate change ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()' nfp: fix NULL pointer access when scheduling dim work nfp: fix potential deadlock when canceling dim work net: phylink: avoid mvneta warning when setting pause parameters net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled selftests: net: bridge: update IGMP/MLD membership interval value crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts ibmvnic: delay complete() selftests: mptcp: fix proto type in link_failure tests skmsg: Lose offset info in sk_psock_skb_ingress cgroup: Fix rootcg cpu.stat guest double counting bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit. of: unittest: fix EXPECT text for gpio hog errors cpufreq: Fix parameter in parse_perf_domain() staging: r8188eu: fix memory leak in rtw_set_key arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4 iio: st_sensors: disable regulators after device unregistration RDMA/rxe: Fix wrong port_cap_flags ARM: dts: BCM5301X: Fix memory nodes names arm64: dts: broadcom: bcm4908: Fix UART clock name clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths scsi: pm80xx: Fix lockup in outbound queue management scsi: qla2xxx: edif: Use link event to wake up app scsi: lpfc: Fix NVMe I/O failover to non-optimized path ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie node arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: meson-g12a: Fix the pwm regulator supply properties arm64: dts: meson-g12b: Fix the pwm regulator supply properties arm64: dts: meson-sm1: Fix the pwm regulator supply properties bus: ti-sysc: Fix timekeeping_suspended warning on resume ARM: dts: at91: tse850: the emac<->phy interface is rmii arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality soc: qcom: llcc: Disable MMUHWT retention arm64: dts: qcom: sc7280: fix display port phy reg property scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount pinctrl: renesas: rzg2l: Fix missing port register 21h ASoC: wcd9335: Use correct version to initialize Class H arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock arm64: dts: renesas: beacon: Fix Ethernet PHY mode iommu/mediatek: Fix out-of-range warning with clang arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000 iommu/dma: Fix sync_sg with swiotlb iommu/dma: Fix arch_sync_dma for map ALSA: hda: Reduce udelay() at SKL+ position reporting ALSA: hda: Use position buffer for SKL+ again ALSA: usb-audio: Fix possible race at sync of urb completions soundwire: debugfs: use controller id and link_id for debugfs power: reset: at91-reset: check properly the return value of devm_of_iomap scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition scsi: ufs: core: Stop clearing UNIT ATTENTIONS scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp() driver core: Fix possible memory leak in device_link_add() arm: dts: omap3-gta04a4: accelerometer irq fix ASoC: SOF: topology: do not power down primary core during topology removal iio: st_pressure_spi: Add missing entries SPI to device ID table soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype for 'create_section_mapping' video: fbdev: chipsfb: use memset_io() instead of memset() powerpc: fix unbalanced node refcount in check_kvm_guest() powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV power: supply: max17040: fix null-ptr-deref in max17040_probe() scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering usb: musb: select GENERIC_PHY instead of depending on it staging: most: dim2: do not double-register the same device staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg() dyndbg: make dyndbg a known cli param powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10 pinctrl: renesas: checker: Fix off-by-one bug in drive register check ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx ARM: dts: stm32: fix SAI sub nodes register range ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 ASoC: cs42l42: Always configure both ASP TX channels ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER soc: qcom: rpmhpd: Make power_on actually enable the domain soc: qcom: socinfo: add two missing PMIC IDs iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask() usb: typec: STUSB160X should select REGMAP_I2C iio: adis: do not disabe IRQs in 'adis_init()' soundwire: bus: stop dereferencing invalid slave pointer scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset serial: imx: fix detach/attach of serial console usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled usb: dwc2: drd: reset current session before setting the new one powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() soc: qcom: rpmhpd: fix sm8350_mxc's peer domain soc: qcom: apr: Add of_node_put() before return arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock pinctrl: equilibrium: Fix function addition in multiple groups ASoC: topology: Fix stub for snd_soc_tplg_component_remove() phy: qcom-qusb2: Fix a memory leak on probe phy: ti: gmii-sel: check of_get_address() for failure phy: qcom-qmp: another fix for the sc8180x PCIe definition phy: qcom-snps: Correct the FSEL_MASK phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe() serial: xilinx_uartps: Fix race condition causing stuck TX clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL clk: at91: clk-master: check if div or pres is zero clk: at91: clk-master: fix prescaler logic HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect() powerpc/book3e: Fix set_memory_x() and set_memory_nx() powerpc/44x/fsp2: add missing of_node_put powerpc/xmon: fix task state output ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or later iommu/dma: Fix incorrect error return on iommu deferred attach powerpc: Don't provide __kernel_map_pages() without ARCH_SUPPORTS_DEBUG_PAGEALLOC ASoC: cs42l42: Correct configuring of switch inversion from ts-inv RDMA/hns: Fix initial arm_st of CQ RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()' serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE virtio_ring: check desc == NULL when using indirect with packed vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error RDMA/core: Require the driver to set the IOVA correctly during rereg_mr apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined mtd: rawnand: intel: Fix potential buffer overflow in probe nfsd: don't alloc under spinlock in rpc_parse_scope_id rtc: ds1302: Add SPI ID table rtc: ds1390: Add SPI ID table rtc: pcf2123: Add SPI ID table remoteproc: imx_rproc: Fix TCM io memory type i2c: i801: Use PCI bus rescan mutex to protect P2SB access dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission rtc: mcp795: Add SPI ID table Input: ariel-pwrbutton - add SPI device ID table i2c: mediatek: fixing the incorrect register offset NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA NFS: Ignore the directory size when marking for revalidation NFS: Fix dentry verifier races pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/bridge/lontium-lt9611uxc: fix provided connector suport drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() sparc: Add missing "FORCE" target when using if_changed fs: orangefs: fix error return code of orangefs_revalidate_lookup() Input: st1232 - increase "wait ready" timeout drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation mtd: rawnand: arasan: Prevent an unsupported configuration mtd: core: don't remove debugfs directory if device is in use remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' rtc: rv3032: fix error handling in rv3032_clkout_set_rate() dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro dmaengine: stm32-dma: fix stm32_dma_get_max_width NFS: Fix up commit deadlocks NFS: Fix an Oops in pnfs_mark_request_commit() Fix user namespace leak auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` dmaengine: tegra210-adma: fix pm runtime unbalance dmanegine: idxd: fix resource free ordering on driver removal dmaengine: idxd: reconfig device after device reset command signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: target: core: Remove from tmr_list during LUN unlink scsi: qla2xxx: Relogin during fabric disturbance scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip scsi: qla2xxx: edif: Fix app start fail scsi: qla2xxx: edif: Fix app start delay scsi: qla2xxx: edif: Flush stale events and msgs on session down scsi: qla2xxx: edif: Increase ELS payload scsi: qla2xxx: edif: Fix EDIF bsg NFSv4: Fix a regression in nfs_set_open_stateid_locked() dmaengine: idxd: fix resource leak on dmaengine driver disable i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' gpio: realtek-otto: fix GPIO line IRQ offset xen-pciback: Fix return in pm_ctrl_init() nbd: fix max value for 'first_minor' nbd: fix possible overflow for 'first_minor' in nbd_dev_add() io-wq: fix max-workers not correctly set on multi-node system net: davinci_emac: Fix interrupt pacing disable kselftests/net: add missed icmp.sh test to Makefile kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile kselftests/net: add missed SRv6 tests kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile ethtool: fix ethtool msg len calculation for pause stats openrisc: fix SMP tlb flush NULL pointer dereference net: vlan: fix a UAF in vlan_dev_real_dev() net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge ice: Fix replacing VF hardware MAC to existing MAC filter ice: Fix not stopping Tx queues for VFs kdb: Adopt scheduler's task classification ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses PCI: j721e: Fix j721e_pcie_probe() error path nvdimm/btt: do not call del_gendisk() if not needed scsi: bsg: Fix errno when scsi_bsg_register_queue() fails scsi: ufs: ufshpb: Use proper power management API scsi: ufs: core: Fix NULL pointer dereference scsi: ufs: ufshpb: Properly handle max-single-cmd selftests: net: properly support IPv6 in GSO GRE test drm/nouveau/svm: Fix refcount leak bug and missing check against null bug nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned block/ataflop: use the blk_cleanup_disk() helper block/ataflop: add registration bool before calling del_gendisk() block/ataflop: provide a helper for cleanup up an atari disk ataflop: remove ataflop_probe_lock mutex PCI: Do not enable AtomicOps on VFs cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline net: phy: fix duplex out of sync problem while changing settings block: fix device_add_disk() kobject_create_and_add() error handling drm/ttm: remove ttm_bo_vm_insert_huge() bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed octeontx2-pf: select CONFIG_NET_DEVLINK ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer mfd: core: Add missing of_node_put for loop iteration mfd: cpcap: Add SPI device ID table mfd: sprd: Add SPI device ID table mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion ACPI: PM: Fix device wakeup power reference counting error libbpf: Fix lookup_and_delete_elem_flags error reporting selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly selftests/bpf/xdp_redirect_multi: Limit the tests in netns drm: fb_helper: improve CONFIG_FB dependency Revert "drm/imx: Annotate dma-fence critical section in commit path" drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable() mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails litex_liteeth: Fix a double free in the remove function arm64: arm64_ftr_reg->name may not be a human-readable string arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf, sockmap: Remove unhash handler for BPF sockmap usage bpf, sockmap: Fix race in ingress receive verdict with redirect to self bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg dmaengine: stm32-dma: fix burst in case of unaligned memory address dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width gve: Fix off by one in gve_tx_timeout() drm/i915/fb: Fix rounding error in subsampled plane size calculation init: make unknown command line param message clearer seq_file: fix passing wrong private data drm/amdgpu: fix uvd crash on Polaris12 during driver unloading net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than 10 net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: fix ROCE base interrupt vector initialization bug net: hns3: fix pfc packet number incorrect after querying pfc parameters net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: allow configure ETS bandwidth of all TCs net: stmmac: allow a tc-taprio base-time of zero net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory net: marvell: mvpp2: Fix wrong SerDes reconfiguration order vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument thermal: int340x: fix build on 32-bit targets smb3: do not error on fsync when readonly ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page MIPS: fix duplicated slashes for Platform file path MIPS: fix -pkg builds for loongson2ef platform MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL x86/mce: Add errata workaround for Skylake SKX37 PCI/MSI: Move non-mask check back into low level accessors PCI/MSI: Destroy sysfs before freeing entries KVM: x86: move guest_pv_has out of user_access section posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes f2fs: include non-compressed blocks in compr_written_block f2fs: fix UAF in f2fs_available_free_memory ceph: fix mdsmap decode when there are MDS's beyond max_mds erofs: fix unsafe pagevec reuse of hooked pclusters drm/i915/guc: Fix blocked context accounting block: Hold invalidate_lock in BLKDISCARD ioctl block: Hold invalidate_lock in BLKZEROOUT ioctl block: Hold invalidate_lock in BLKRESETZONE ioctl ksmbd: Fix buffer length check in fsctl_validate_negotiate_info() ksmbd: don't need 8byte alignment for request length in ksmbd_check_message dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail dmaengine: bestcomm: fix system boot lockups net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors mm/filemap.c: remove bogus VM_BUG_ON memcg: prohibit unconditional exceeding the limit of dying tasks mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF mm, thp: lock filemap when truncating page cache mm, thp: fix incorrect unmap behavior for private pages mfd: dln2: Add cell for initializing DLN2 ADC video: backlight: Drop maximum brightness override for brightness zero bcache: fix use-after-free problem in bcache_device_free() bcache: Revert "bcache: use bvec_virt" PM: sleep: Avoid calling put_device() under dpm_list_mtx s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/ap: Fix hanging ioctl caused by orphaned replies s390/cio: make ccw_device_dma_ more robust remoteproc: elf_loader: Fix loading segment when is_iomem true remoteproc: Fix the wrong default value of is_iomem remoteproc: imx_rproc: Fix ignoring mapping vdev regions remoteproc: imx_rproc: Fix rsc-table name mtd: rawnand: fsmc: Fix use of SM ORDER mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines powerpc/vas: Fix potential NULL pointer dereference powerpc/bpf: Fix write protecting JIT code powerpc/32e: Ignore ESR in instruction storage interrupt handler powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload powerpc/security: Use a mutex for interrupt exit code patching powerpc/64s/interrupt: Fix check_return_regs_valid() false positive powerpc/pseries/mobility: ignore ibm, platform-facilities updates powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n drm/sun4i: Fix macros in sun8i_csc.h PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros PCI: aardvark: Fix PCIe Max Payload Size setting SUNRPC: Partial revert of commit `6f9f17287e` drm/amd/display: Look at firmware version to determine using dmub on dcn21 media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release() cifs: fix memory leak of smb3_fs_context_dup::server_hostname ath10k: fix invalid dma_addr_t token assignment mmc: moxart: Fix null pointer dereference on pointer host selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage selftests/bpf: Fix also no-alu32 strobemeta selftest arch/cc: Introduce a function to check for confidential computing features x86/sev: Add an x86 version of cc_platform_has() x86/sev: Make the #VC exception stacks part of the default stacks storage media: videobuf2: always set buffer vb2 pointer media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference Linux 5.15.3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I09574eb6b4fbe930bd13f932cc618846972fcc27	2021-11-19 15:38:07 +01:00
Ondrej Mosnacek	dcfba48960	selinux: fix race condition when computing ocontext SIDs commit cbfcd13be5cb2a07868afe67520ed181956579a7 upstream. Current code contains a lot of racy patterns when converting an ocontext's context structure to an SID. This is being done in a "lazy" fashion, such that the SID is looked up in the SID table only when it's first needed and then cached in the "sid" field of the ocontext structure. However, this is done without any locking or memory barriers and is thus unsafe. Between commits `24ed7fdae6` ("selinux: use separate table for initial SID lookup") and `66f8e2f03c` ("selinux: sidtab reverse lookup hash table"), this race condition lead to an actual observable bug, because a pointer to the shared sid field was passed directly to sidtab_context_to_sid(), which was using this location to also store an intermediate value, which could have been read by other threads and interpreted as an SID. In practice this caused e.g. new mounts to get a wrong (seemingly random) filesystem context, leading to strange denials. This bug has been spotted in the wild at least twice, see [1] and [2]. Fix the race condition by making all the racy functions use a common helper that ensures the ocontext::sid accesses are made safely using the appropriate SMP constructs. Note that security_netif_sid() was populating the sid field of both contexts stored in the ocontext, but only the first one was actually used. The SELinux wiki's documentation on the "netifcon" policy statement [3] suggests that using only the first context is intentional. I kept only the handling of the first context here, as there is really no point in doing the SID lookup for the unused one. I wasn't able to reproduce the bug mentioned above on any kernel that includes commit `66f8e2f03c`, even though it has been reported that the issue occurs with that commit, too, just less frequently. Thus, I wasn't able to verify that this patch fixes the issue, but it makes sense to avoid the race condition regardless. [1] https://github.com/containers/container-selinux/issues/89 [2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/ [3] https://selinuxproject.org/page/NetworkStatements#netifcon Cc: stable@vger.kernel.org Cc: Xinjie Zheng <xinjie@google.com> Reported-by: Sujithra Periasamy <sujithra@google.com> Fixes: `1da177e4c3` ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-18 19:15:57 +01:00
Kuan-Ying Lee	f2d4bb3c0e	ANDROID: selinux: add restricted vendor hook in selinux Add restricted vendor hook for selinux_state, so we can know if the selinux_state is initialized Bug: 186363840 Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Change-Id: Ideed051a1d53ed1bce7d7915e38366264a7d77eb	2021-10-29 14:20:11 +08:00
Greg Kroah-Hartman	bc2f6edebd	Merge `9e9fb7655e` ("Merge tag 'net-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") into android-mainline Steps on the way to 5.15-rc1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I49577d606b2710975407eae3fee60bc331397810	2021-09-07 14:40:30 +02:00
Linus Torvalds	befa491ce6	Merge tag 'selinux-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux update from Paul Moore: "We've got an unusually small SELinux pull request for v5.15 that consists of only one (?!) patch that is really pretty minor when you look at it. Unsurprisingly it passes all of our tests and merges cleanly on top of your tree right now, please merge this for v5.15" * tag 'selinux-pr-20210830' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: return early for possible NULL audit buffers	2021-08-31 12:53:34 -07:00
Greg Kroah-Hartman	04a7de0108	Merge tag 'v5.14-rc5' into `android-mainline` Linux 5.14-rc5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If7a0d687213a5b75839f83341f9eb6871e87b55e	2021-08-09 08:39:57 +02:00
Xiu Jianfeng	4c156084da	selinux: correct the return value when loads initial sids It should not return 0 when SID 0 is assigned to isids. This patch fixes it. Cc: stable@vger.kernel.org Fixes: `e3e0b582c3` ("selinux: remove unused initial SIDs and improve handling") Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> [PM: remove changelog from description] Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-08-02 09:59:50 -04:00
Austin Kim	893c47d196	selinux: return early for possible NULL audit buffers audit_log_start() may return NULL in below cases: - when audit is not initialized. - when audit backlog limit exceeds. After the call to audit_log_start() is made and then possible NULL audit buffer argument is passed to audit_log_() functions, audit_log_() functions return immediately in case of a NULL audit buffer argument. But it is optimal to return early when audit_log_start() returns NULL, because it is not necessary for audit_log_*() functions to be called with NULL audit buffer argument. So add exception handling for possible NULL audit buffers where return value can be handled from callers. Signed-off-by: Austin Kim <austin.kim@lge.com> [PM: tweak subject line] Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-07-14 15:25:27 -04:00
Lee Jones	8e658623d4	Merge commit `c288d9cd71` ("Merge tag 'for-5.14/io_uring-2021-06-30' of git://git.kernel.dk/linux-block") into android-mainline Another small step en route to v5.14-rc1 Change-Id: I24899ab78da7d367574ed69ceaa82ab0837d9556 Signed-off-by: Lee Jones <lee.jones@linaro.org>	2021-07-12 10:02:27 +01:00
Yang Li	d0a83314db	selinux: Fix kernel-doc Fix function name and add comment for parameter state in ss/services.c kernel-doc to remove some warnings found by running make W=1 LLVM=1. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Yang Li <yang.lee@linux.alibaba.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-06-11 12:59:45 -04:00
Bram Bonné	fac07550bd	ANDROID: selinux: modify RTM_GETNEIGH{TBL} Map the permission gating RTM_GETNEIGH/RTM_GETNEIGHTBL messages to a new permission so that it can be distinguished from the other netlink route permissions in selinux policy. The new permission is triggered by a flag set in system images T and up. This change is intended to be backported to all kernels that a T system image can run on top of. Bug: 171572148 Test: atest NetworkInterfaceTest Test: atest CtsSelinuxTargetSdkCurrentTestCases Test: atest bionic-unit-tests-static Test: On Cuttlefish, run combinations of: - Policy bit set or omitted (see https://r.android.com/1701847) - This patch applied or omitted - App having nlmsg_readneigh permission or not Verify that only the combination of this patch + the policy bit being set + the app not having the nlmsg_readneigh permission prevents the app from sending RTM_GETNEIGH messages. Change-Id: I4bcfce4decb34ea9388eeedfc4be67403de8a980 Signed-off-by: Bram Bonné <brambonne@google.com>	2021-06-02 16:46:28 +02:00
Lee Jones	e11858ac17	Merge `9ccce092fc` Merge tag 'for-linus-5.13-ofs-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux into android-mainline A little step en route to v5.13-rc1 Signed-off-by: Lee Jones <lee.jones@linaro.org> Change-Id: Ib6cc40149287da7aa1626104b295999e4ab0b53a	2021-05-13 11:06:28 +01:00
Jiapeng Chong	fd781f459b	selinux: Remove redundant assignment to rc Variable rc is set to '-EINVAL' but this value is never read as it is overwritten or not used later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: security/selinux/ss/services.c:2103:3: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. security/selinux/ss/services.c:2079:2: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. security/selinux/ss/services.c:2071:2: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. security/selinux/ss/services.c:2062:2: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. security/selinux/ss/policydb.c:2592:3: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-05-10 21:48:11 -04:00
Ondrej Mosnacek	e1cce3a3cb	selinux: constify some avtab function arguments This makes the code a bit easier to reason about. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-05-10 21:35:02 -04:00
Ondrej Mosnacek	fba472bb38	selinux: simplify duplicate_policydb_cond_list() by using kmemdup() We can do the allocation + copying of expr.nodes in one go using kmemdup(). Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-05-10 21:31:58 -04:00
Linus Torvalds	17ae69aba8	Merge tag 'landlock_v34' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull Landlock LSM from James Morris: "Add Landlock, a new LSM from Mickaël Salaün. Briefly, Landlock provides for unprivileged application sandboxing. From Mickaël's cover letter: "The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes. Because Landlock is a stackable LSM [1], it makes possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user-space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves. Landlock is inspired by seccomp-bpf but instead of filtering syscalls and their raw arguments, a Landlock rule can restrict the use of kernel objects like file hierarchies, according to the kernel semantic. Landlock also takes inspiration from other OS sandbox mechanisms: XNU Sandbox, FreeBSD Capsicum or OpenBSD Pledge/Unveil. In this current form, Landlock misses some access-control features. This enables to minimize this patch series and ease review. This series still addresses multiple use cases, especially with the combined use of seccomp-bpf: applications with built-in sandboxing, init systems, security sandbox tools and security-oriented APIs [2]" The cover letter and v34 posting is here: https://lore.kernel.org/linux-security-module/20210422154123.13086-1-mic@digikod.net/ See also: https://landlock.io/ This code has had extensive design discussion and review over several years" Link: https://lore.kernel.org/lkml/50db058a-7dde-441b-a7f9-f6837fe8b69f@schaufler-ca.com/ [1] Link: https://lore.kernel.org/lkml/f646e1c7-33cf-333f-070c-0a40ad0468cd@digikod.net/ [2] * tag 'landlock_v34' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: landlock: Enable user space to infer supported features landlock: Add user and kernel documentation samples/landlock: Add a sandbox manager example selftests/landlock: Add user space tests landlock: Add syscall implementations arch: Wire up Landlock syscalls fs,security: Add sb_delete hook landlock: Support filesystem access-control LSM: Infrastructure management of the superblock landlock: Add ptrace restrictions landlock: Set up the security framework and manage credentials landlock: Add ruleset and domain management landlock: Add object management	2021-05-01 18:50:44 -07:00
Lee Jones	7561514944	Merge commit `e7c6e405e1` ("Fix misc new gcc warnings") into android-mainline Steps on the way to 5.13-rc1 Signed-off-by: Lee Jones <lee.jones@linaro.org> Change-Id: Iff6fb6b3991943905d20a8b40e2b2dd87c0d792b	2021-04-29 10:20:06 +01:00
Linus Torvalds	f1c921fb70	Merge tag 'selinux-pr-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Add support for measuring the SELinux state and policy capabilities using IMA. - A handful of SELinux/NFS patches to compare the SELinux state of one mount with a set of mount options. Olga goes into more detail in the patch descriptions, but this is important as it allows more flexibility when using NFS and SELinux context mounts. - Properly differentiate between the subjective and objective LSM credentials; including support for the SELinux and Smack. My clumsy attempt at a proper fix for AppArmor didn't quite pass muster so John is working on a proper AppArmor patch, in the meantime this set of patches shouldn't change the behavior of AppArmor in any way. This change explains the bulk of the diffstat beyond security/. - Fix a problem where we were not properly terminating the permission list for two SELinux object classes. * tag 'selinux-pr-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: add proper NULL termination to the secclass_map permissions smack: differentiate between subjective and objective task credentials selinux: clarify task subjective and objective credentials lsm: separate security_task_getsecid() into subjective and objective variants nfs: account for selinux security context when deciding to share superblock nfs: remove unneeded null check in nfs_fill_super() lsm,selinux: add new hook to compare new mount to an existing mount selinux: fix misspellings using codespell tool selinux: fix misspellings using codespell tool selinux: measure state and policy capabilities selinux: Allow context mounts for unpriviliged overlayfs	2021-04-27 13:42:11 -07:00
Casey Schaufler	1aea780837	LSM: Infrastructure management of the superblock Move management of the superblock->sb_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules, the modules tell the infrastructure how much space is required, and the space is allocated there. Cc: John Johansen <john.johansen@canonical.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: Serge Hallyn <serge@hallyn.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20210422154123.13086-6-mic@digikod.net Signed-off-by: James Morris <jamorris@linux.microsoft.com>	2021-04-22 12:22:10 -07:00
Greg Kroah-Hartman	44ef0c2e4b	Merge `60144b23c9` ("Merge tag 'selinux-pr-20210409' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux") into android-mainline Steps on the way to 5.12-rc7 Signed-off-by Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia4b9f3dfdd7f6b6a93b5348fe6fc343248b4b0b2	2021-04-19 10:52:19 +02:00
Linus Torvalds	60144b23c9	Merge tag 'selinux-pr-20210409' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: "Three SELinux fixes. These fix known problems relating to (re)loading SELinux policy or changing the policy booleans, and pass our test suite without problem" * tag 'selinux-pr-20210409' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix race between old and new sidtab selinux: fix cond_list corruption when changing booleans selinux: make nslot handling in avtab more robust	2021-04-09 11:51:06 -07:00
Ondrej Mosnacek	9ad6e9cb39	selinux: fix race between old and new sidtab Since commit `1b8b31a2e6` ("selinux: convert policy read-write lock to RCU"), there is a small window during policy load where the new policy pointer has already been installed, but some threads may still be holding the old policy pointer in their read-side RCU critical sections. This means that there may be conflicting attempts to add a new SID entry to both tables via sidtab_context_to_sid(). See also (and the rest of the thread): https://lore.kernel.org/selinux/CAFqZXNvfux46_f8gnvVvRYMKoes24nwm2n3sPbMjrB8vKTW00g@mail.gmail.com/ Fix this by installing the new policy pointer under the old sidtab's spinlock along with marking the old sidtab as "frozen". Then, if an attempt to add new entry to a "frozen" sidtab is detected, make sidtab_context_to_sid() return -ESTALE to indicate that a new policy has been installed and that the caller will have to abort the policy transaction and try again after re-taking the policy pointer (which is guaranteed to be a newer policy). This requires adding a retry-on-ESTALE logic to all callers of sidtab_context_to_sid(), but fortunately these are easy to determine and aren't that many. This seems to be the simplest solution for this problem, even if it looks somewhat ugly. Note that other places in the kernel (e.g. do_mknodat() in fs/namei.c) use similar stale-retry patterns, so I think it's reasonable. Cc: stable@vger.kernel.org Fixes: `1b8b31a2e6` ("selinux: convert policy read-write lock to RCU") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-04-07 20:42:56 -04:00
Ondrej Mosnacek	d8f5f0ea5b	selinux: fix cond_list corruption when changing booleans Currently, duplicate_policydb_cond_list() first copies the whole conditional avtab and then tries to link to the correct entries in cond_dup_av_list() using avtab_search(). However, since the conditional avtab may contain multiple entries with the same key, this approach often fails to find the right entry, potentially leading to wrong rules being activated/deactivated when booleans are changed. To fix this, instead start with an empty conditional avtab and add the individual entries one-by-one while building the new av_lists. This approach leads to the correct result, since each entry is present in the av_lists exactly once. The issue can be reproduced with Fedora policy as follows: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t public_content_rw_t:dir { add_name create link remove_name rename reparent rmdir setattr unlink watch watch_reads write }; [ ftpd_anon_write ]:True # setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off ftpd_connect_db=off ftpd_full_access=off On fixed kernels, the sesearch output is the same after the setsebool command: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t public_content_rw_t:dir { add_name create link remove_name rename reparent rmdir setattr unlink watch watch_reads write }; [ ftpd_anon_write ]:True While on the broken kernels, it will be different: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True While there, also simplify the computation of nslots. This changes the nslots values for nrules 2 or 3 to just two slots instead of 4, which makes the sequence more consistent. Cc: stable@vger.kernel.org Fixes: `c7c556f1e8` ("selinux: refactor changing booleans") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-04-02 11:46:55 -04:00
Ondrej Mosnacek	442dc00f82	selinux: make nslot handling in avtab more robust 1. Make sure all fileds are initialized in avtab_init(). 2. Slightly refactor avtab_alloc() to use the above fact. 3. Use h->nslot == 0 as a sentinel in the access functions to prevent dereferencing h->htable when it's not allocated. Cc: stable@vger.kernel.org Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-04-02 11:46:37 -04:00
Greg Kroah-Hartman	b9a74a3076	Merge `8419639062` ("Merge tag 'selinux-pr-20210322' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux") into android-mainline Steps on the way to 5.12-rc5 Resolves merge conflicts in: security/selinux/include/security.h Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic6a0922be222c6bdb829a43c00c7bff3d96a9009	2021-03-24 06:44:11 +01:00
Linus Torvalds	8419639062	Merge tag 'selinux-pr-20210322' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fixes from Paul Moore: "Three SELinux patches: - Fix a problem where a local variable is used outside its associated function. Thankfully this can only be triggered by reloading the SELinux policy, which is a restricted operation for other obvious reasons. - Fix some incorrect, and inconsistent, audit and printk messages when loading the SELinux policy. All three patches are relatively minor and have been through our testing with no failures" * tag 'selinux-pr-20210322' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinuxfs: unify policy load error reporting selinux: fix variable scope issue in live sidtab conversion selinux: don't log MAC_POLICY_LOAD record on failed policy load	2021-03-22 11:34:31 -07:00
Ondrej Mosnacek	6406887a12	selinux: fix variable scope issue in live sidtab conversion Commit `02a52c5c8c` ("selinux: move policy commit after updating selinuxfs") moved the selinux_policy_commit() call out of security_load_policy() into sel_write_load(), which caused a subtle yet rather serious bug. The problem is that security_load_policy() passes a reference to the convert_params local variable to sidtab_convert(), which stores it in the sidtab, where it may be accessed until the policy is swapped over and RCU synchronized. Before `02a52c5c8c`, selinux_policy_commit() was called directly from security_load_policy(), so the convert_params pointer remained valid all the way until the old sidtab was destroyed, but now that's no longer the case and calls to sidtab_context_to_sid() on the old sidtab after security_load_policy() returns may cause invalid memory accesses. This can be easily triggered using the stress test from commit `ee1a84fdfe` ("selinux: overhaul sidtab to fix bug and improve performance"): ``` function rand_cat() { echo $(( $RANDOM % 1024 )) } function do_work() { while true; do echo -n "system_u:system_r:kernel_t:s0:c$(rand_cat),c$(rand_cat)" \ >/sys/fs/selinux/context 2>/dev/null \|\| true done } do_work >/dev/null & do_work >/dev/null & do_work >/dev/null & while load_policy; do echo -n .; sleep 0.1; done kill %1 kill %2 kill %3 ``` Fix this by allocating the temporary sidtab convert structures dynamically and passing them among the selinux_policy_{load,cancel,commit} functions. Fixes: `02a52c5c8c` ("selinux: move policy commit after updating selinuxfs") Cc: stable@vger.kernel.org Tested-by: Tyler Hicks <tyhicks@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> [PM: merge fuzz in security.h and services.c] Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-03-18 23:23:46 -04:00
Xiong Zhenwu	63ddf1baa0	selinux: fix misspellings using codespell tool A typo is found out by codespell tool in 16th line of hashtab.c $ codespell ./security/selinux/ss/ ./hashtab.c:16: rouding ==> rounding Fix a typo found by codespell. Signed-off-by: Xiong Zhenwu <xiong.zhenwu@zte.com.cn> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-03-08 19:44:30 -05:00
Lakshmi Ramasubramanian	2554a48f44	selinux: measure state and policy capabilities SELinux stores the configuration state and the policy capabilities in kernel memory. Changes to this data at runtime would have an impact on the security guarantees provided by SELinux. Measuring this data through IMA subsystem provides a tamper-resistant way for an attestation service to remotely validate it at runtime. Measure the configuration state and policy capabilities by calling the IMA hook ima_measure_critical_data(). To enable SELinux data measurement, the following steps are required: 1, Add "ima_policy=critical_data" to the kernel command line arguments to enable measuring SELinux data at boot time. For example, BOOT_IMAGE=/boot/vmlinuz-5.11.0-rc3+ root=UUID=fd643309-a5d2-4ed3-b10d-3c579a5fab2f ro nomodeset security=selinux ima_policy=critical_data 2, Add the following rule to /etc/ima/ima-policy measure func=CRITICAL_DATA label=selinux Sample measurement of SELinux state and policy capabilities: 10 2122...65d8 ima-buf sha256:13c2...1292 selinux-state 696e...303b Execute the following command to extract the measured data from the IMA's runtime measurements list: grep "selinux-state" /sys/kernel/security/integrity/ima/ascii_runtime_measurements \| tail -1 \| cut -d' ' -f 6 \| xxd -r -p The output should be a list of key-value pairs. For example, initialized=1;enforcing=0;checkreqprot=1;network_peer_controls=1;open_perms=1;extended_socket_class=1;always_check_network=0;cgroup_seclabel=1;nnp_nosuid_transition=1;genfs_seclabel_symlinks=0; To verify the measurement is consistent with the current SELinux state reported on the system, compare the integer values in the following files with those set in the IMA measurement (using the following commands): - cat /sys/fs/selinux/enforce - cat /sys/fs/selinux/checkreqprot - cat /sys/fs/selinux/policy_capabilities/[capability_file] Note that the actual verification would be against an expected state and done on a separate system (likely an attestation server) requiring "initialized=1;enforcing=1;checkreqprot=0;" for a secure state and then whatever policy capabilities are actually set in the expected policy (which can be extracted from the policy itself via seinfo, for example). Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> Suggested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-03-08 19:39:07 -05:00
Greg Kroah-Hartman	b70c8301f1	Merge `31caf8b2a8` ("Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6") into android-mainline Steps on the way to 5.12-rc1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I68dc8fda66552ee76f33c02a6711d684c2c40e54	2021-03-03 18:10:14 +01:00
Greg Kroah-Hartman	84645f0a33	Merge `d1fec2214b` ("Merge tag 'selinux-pr-20210215' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux") into android-mainline Steps on the way to 5.12-rc1 Resolves conflicts in: security/selinux/hooks.c security/selinux/include/classmap.h Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5aedc69f0f2b3b16351b1f39ed69994ca1ba59a5	2021-03-03 15:35:26 +01:00
Linus Torvalds	d643a99089	Merge tag 'integrity-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull IMA updates from Mimi Zohar: "New is IMA support for measuring kernel critical data, as per usual based on policy. The first example measures the in memory SELinux policy. The second example measures the kernel version. In addition are four bug fixes to address memory leaks and a missing 'static' function declaration" * tag 'integrity-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: integrity: Make function integrity_add_key() static ima: Free IMA measurement buffer after kexec syscall ima: Free IMA measurement buffer on error IMA: Measure kernel version in early boot selinux: include a consumer of the new IMA critical data hook IMA: define a builtin critical data measurement policy IMA: extend critical data hook to limit the measurement based on a label IMA: limit critical data measurement based on a label IMA: add policy rule to measure critical data IMA: define a hook to measure kernel integrity critical data IMA: add support to measure buffer data hash IMA: generalize keyring specific measurement constructs evm: Fix memleak in init_desc	2021-02-21 17:08:06 -08:00
Lakshmi Ramasubramanian	fdd1ffe8a8	selinux: include a consumer of the new IMA critical data hook SELinux stores the active policy in memory, so the changes to this data at runtime would have an impact on the security guarantees provided by SELinux. Measuring in-memory SELinux policy through IMA subsystem provides a secure way for the attestation service to remotely validate the policy contents at runtime. Measure the hash of the loaded policy by calling the IMA hook ima_measure_critical_data(). Since the size of the loaded policy can be large (several MB), measure the hash of the policy instead of the entire policy to avoid bloating the IMA log entry. To enable SELinux data measurement, the following steps are required: 1, Add "ima_policy=critical_data" to the kernel command line arguments to enable measuring SELinux data at boot time. For example, BOOT_IMAGE=/boot/vmlinuz-5.10.0-rc1+ root=UUID=fd643309-a5d2-4ed3-b10d-3c579a5fab2f ro nomodeset security=selinux ima_policy=critical_data 2, Add the following rule to /etc/ima/ima-policy measure func=CRITICAL_DATA label=selinux Sample measurement of the hash of SELinux policy: To verify the measured data with the current SELinux policy run the following commands and verify the output hash values match. sha256sum /sys/fs/selinux/policy \| cut -d' ' -f 1 grep "selinux-policy-hash" /sys/kernel/security/integrity/ima/ascii_runtime_measurements \| tail -1 \| cut -d' ' -f 6 Note that the actual verification of SELinux policy would require loading the expected policy into an identical kernel on a pristine/known-safe system and run the sha256sum /sys/kernel/selinux/policy there to get the expected hash. Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: Paul Moore <paul@paul-moore.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>	2021-01-14 23:41:46 -05:00
Ondrej Mosnacek	cd2bb4cb09	selinux: mark some global variables __ro_after_init All of these are never modified outside initcalls, so they can be __ro_after_init. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-01-12 10:08:55 -05:00
Ondrej Mosnacek	3c797e514b	selinux: drop the unnecessary aurule_callback variable Its value is actually not changed anywhere, so it can be substituted for a direct call to audit_update_lsm_rules(). Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2021-01-12 09:53:57 -05:00
Greg Kroah-Hartman	a14ed4197e	Merge `69f637c335` ("Merge tag 'for-5.11/drivers-2020-12-14' of git://git.kernel.dk/linux-block") into android-mainline Steps on the way to 5.11-rc1 Resolves conflicts in: arch/arm64/include/asm/thread_info.h fs/proc/base.c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ibc53e7c14fc0953a95f89af81b0e0373ddad986a	2020-12-19 16:06:54 +01:00
bauen1	44141f58e1	selinux: allow dontauditx and auditallowx rules to take effect without allowx This allows for dontauditing very specific ioctls e.g. TCGETS without dontauditing every ioctl or granting additional permissions. Now either an allowx, dontauditx or auditallowx rules enables checking for extended permissions. Signed-off-by: Jonathan Hettwer <j2468h@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>	2020-10-27 22:21:11 -04:00
Greg Kroah-Hartman	75c90a8c3a	Merge `d5660df4a5` ("Merge branch 'akpm' (patches from Andrew)") into android-mainline steps on the way to 5.10-rc1 Change-Id: Iddc84c25b6a9d71fa8542b927d6f69c364131c3d Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-10-25 11:57:29 +01:00
Linus Torvalds	7b540812cc	Merge tag 'selinux-pr-20201012' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: "A decent number of SELinux patches for v5.10, twenty two in total. The highlights are listed below, but all of the patches pass our test suite and merge cleanly. - A number of changes to how the SELinux policy is loaded and managed inside the kernel with the goal of improving the atomicity of a SELinux policy load operation. These changes account for the bulk of the diffstat as well as the patch count. A special thanks to everyone who contributed patches and fixes for this work. - Convert the SELinux policy read-write lock to RCU. - A tracepoint was added for audited SELinux access control events; this should help provide a more unified backtrace across kernel and userspace. - Allow the removal of security.selinux xattrs when a SELinux policy is not loaded. - Enable policy capabilities in SELinux policies created with the scripts/selinux/mdp tool. - Provide some "no sooner than" dates for the SELinux checkreqprot sysfs deprecation" * tag 'selinux-pr-20201012' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: (22 commits) selinux: provide a "no sooner than" date for the checkreqprot removal selinux: Add helper functions to get and set checkreqprot selinux: access policycaps with READ_ONCE/WRITE_ONCE selinux: simplify away security_policydb_len() selinux: move policy mutex to selinux_state, use in lockdep checks selinux: fix error handling bugs in security_load_policy() selinux: convert policy read-write lock to RCU selinux: delete repeated words in comments selinux: add basic filtering for audit trace events selinux: add tracepoint on audited events selinux: Create new booleans and class dirs out of tree selinux: Standardize string literal usage for selinuxfs directory names selinux: Refactor selinuxfs directory populating functions selinux: Create function for selinuxfs directory cleanup selinux: permit removing security.selinux xattr before policy load selinux: fix memdup.cocci warnings selinux: avoid dereferencing the policy prior to initialization selinux: fix allocation failure check on newpolicy->sidtab selinux: refactor changing booleans selinux: move policy commit after updating selinuxfs ...	2020-10-13 16:29:55 -07:00

1 2 3 4 5 ...

533 Commits