2021-11-16 01:47:50

by Greg KH

Subject: [PATCH 5.14 000/849] 5.14.19-rc1 review

This is the start of the stable review cycle for the 5.14.19 release.
There are 849 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 17 Nov 2021 16:52:23 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.19-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.14.19-rc1

Mario Limonciello <[email protected]>
drm/amd/display: Look at firmware version to determine using dmub on dcn21

Basavaraj Natikar <[email protected]>
pinctrl: amd: Handle wake-up interrupt

Basavaraj Natikar <[email protected]>
pinctrl: amd: Add irq field data

Trond Myklebust <[email protected]>
SUNRPC: Partial revert of commit 6f9f17287e78

Pali Rohár <[email protected]>
PCI: aardvark: Fix PCIe Max Payload Size setting

Pali Rohár <[email protected]>
PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros

Jernej Skrabec <[email protected]>
drm/sun4i: Fix macros in sun8i_csc.h

Xiaoming Ni <[email protected]>
powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n

Nathan Lynch <[email protected]>
powerpc/pseries/mobility: ignore ibm, platform-facilities updates

Nicholas Piggin <[email protected]>
powerpc/64s/interrupt: Fix check_return_regs_valid() false positive

Russell Currey <[email protected]>
powerpc/security: Use a mutex for interrupt exit code patching

Vasant Hegde <[email protected]>
powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload

Nicholas Piggin <[email protected]>
powerpc/32e: Ignore ESR in instruction storage interrupt handler

Hari Bathini <[email protected]>
powerpc/bpf: Fix write protecting JIT code

Gustavo A. R. Silva <[email protected]>
powerpc/vas: Fix potential NULL pointer dereference

Miquel Raynal <[email protected]>
mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines

Miquel Raynal <[email protected]>
mtd: rawnand: fsmc: Fix use of SM ORDER

Dong Aisheng <[email protected]>
remoteproc: imx_rproc: Fix rsc-table name

Dong Aisheng <[email protected]>
remoteproc: imx_rproc: Fix ignoring mapping vdev regions

Dong Aisheng <[email protected]>
remoteproc: Fix the wrong default value of is_iomem

Peng Fan <[email protected]>
remoteproc: elf_loader: Fix loading segment when is_iomem true

Halil Pasic <[email protected]>
s390/cio: make ccw_device_dma_* more robust

Harald Freudenberger <[email protected]>
s390/ap: Fix hanging ioctl caused by orphaned replies

Sven Schnelle <[email protected]>
s390/tape: fix timer initialization in tape_std_assign()

Vineeth Vijayan <[email protected]>
s390/cio: check the subchannel validity for dev_busid

Thomas Richter <[email protected]>
s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove

Rafael J. Wysocki <[email protected]>
PM: sleep: Avoid calling put_device() under dpm_list_mtx

Marek Vasut <[email protected]>
video: backlight: Drop maximum brightness override for brightness zero

Jack Andersen <[email protected]>
mfd: dln2: Add cell for initializing DLN2 ADC

Michal Hocko <[email protected]>
mm, oom: do not trigger out_of_memory from the #PF

Vasily Averin <[email protected]>
mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks

Jens Axboe <[email protected]>
io-wq: serialize hash clear with wakeup

Jens Axboe <[email protected]>
io-wq: fix queue stalling race

Jens Axboe <[email protected]>
io-wq: ensure that hash wait lock is IRQ disabling

Vasily Averin <[email protected]>
memcg: prohibit unconditional exceeding the limit of dying tasks

Matthew Wilcox (Oracle) <[email protected]>
mm/filemap.c: remove bogus VM_BUG_ON

Dominique Martinet <[email protected]>
9p/net: fix missing error check in p9_check_errors

Daniel Borkmann <[email protected]>
bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt

Daniel Borkmann <[email protected]>
bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode

Daniel Borkmann <[email protected]>
net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE

Anatolij Gustschin <[email protected]>
dmaengine: bestcomm: fix system boot lockups

Kishon Vijay Abraham I <[email protected]>
dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail

Kishon Vijay Abraham I <[email protected]>
dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail

Gao Xiang <[email protected]>
erofs: fix unsafe pagevec reuse of hooked pclusters

Dongliang Mu <[email protected]>
f2fs: fix UAF in f2fs_available_free_memory

Daeho Jeong <[email protected]>
f2fs: include non-compressed blocks in compr_written_block

Jaegeuk Kim <[email protected]>
f2fs: should use GFP_NOFS for directory inodes

Guo Ren <[email protected]>
irqchip/sifive-plic: Fixup EOI failed when masked

Michael Pratt <[email protected]>
posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()

Paolo Bonzini <[email protected]>
KVM: x86: move guest_pv_has out of user_access section

Dave Jones <[email protected]>
x86/mce: Add errata workaround for Skylake SKX37

Maciej W. Rozycki <[email protected]>
MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL

Masahiro Yamada <[email protected]>
MIPS: fix duplicated slashes for Platform file path

John David Anglin <[email protected]>
parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page

Helge Deller <[email protected]>
parisc: Fix backtrace to always include init funtion names

Arnd Bergmann <[email protected]>
ARM: 9156/1: drop cc-option fallbacks for architecture selection

Michał Mirosław <[email protected]>
ARM: 9155/1: fix early early_iounmap()

Steve French <[email protected]>
smb3: do not error on fsync when readonly

Willem de Bruijn <[email protected]>
selftests/net: udpgso_bench_rx: fix port argument

Rahul Lakkireddy <[email protected]>
cxgb4: fix eeprom len when diagnostics not implemented

Dust Li <[email protected]>
net/smc: fix sk_refcnt underflow on linkdown and fallback

Eiichi Tsukata <[email protected]>
vsock: prevent unnecessary refcnt inc for nonblocking connect

Marek Behún <[email protected]>
net: marvell: mvpp2: Fix wrong SerDes reconfiguration order

Christophe JAILLET <[email protected]>
net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory

Vladimir Oltean <[email protected]>
net: stmmac: allow a tc-taprio base-time of zero

Guangbin Huang <[email protected]>
net: hns3: allow configure ETS bandwidth of all TCs

Yufeng Mo <[email protected]>
net: hns3: fix kernel crash when unload VF while it is being reset

Jie Wang <[email protected]>
net: hns3: fix pfc packet number incorrect after querying pfc parameters

Jie Wang <[email protected]>
net: hns3: fix ROCE base interrupt vector initialization bug

Eric Dumazet <[email protected]>
net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any

Marek Behún <[email protected]>
net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than 10

Muchun Song <[email protected]>
seq_file: fix passing wrong private data

Imre Deak <[email protected]>
drm/i915/fb: Fix rounding error in subsampled plane size calculation

Dan Carpenter <[email protected]>
gve: Fix off by one in gve_tx_timeout()

Arnd Bergmann <[email protected]>
dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width

Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: fix burst in case of unaligned memory address

Jussi Maki <[email protected]>
bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg

John Fastabend <[email protected]>
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding

John Fastabend <[email protected]>
bpf, sockmap: Fix race in ingress receive verdict with redirect to self

John Fastabend <[email protected]>
bpf, sockmap: Remove unhash handler for BPF sockmap usage

Arnd Bergmann <[email protected]>
arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions

Reiji Watanabe <[email protected]>
arm64: arm64_ftr_reg->name may not be a human-readable string

Chengfeng Ye <[email protected]>
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails

Eric Dumazet <[email protected]>
llc: fix out-of-bound array index in llc_sk_dev_hash()

Ian Rogers <[email protected]>
perf bpf: Add missing free to bpf_event__print_bpf_prog_info()

Dan Carpenter <[email protected]>
zram: off by one in read_block_state()

Miaohe Lin <[email protected]>
mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()

Marc Kleine-Budde <[email protected]>
can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable()

Vincent Mailhol <[email protected]>
can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path

Fabio Estevam <[email protected]>
Revert "drm/imx: Annotate dma-fence critical section in commit path"

Arnd Bergmann <[email protected]>
drm: fb_helper: improve CONFIG_FB dependency

Hangbin Liu <[email protected]>
selftests/bpf/xdp_redirect_multi: Limit the tests in netns

Hangbin Liu <[email protected]>
selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly

Hangbin Liu <[email protected]>
selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number

Hangbin Liu <[email protected]>
selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder

Mehrdad Arshad Rad <[email protected]>
libbpf: Fix lookup_and_delete_elem_flags error reporting

Rafael J. Wysocki <[email protected]>
ACPI: PM: Fix device wakeup power reference counting error

Kai Song <[email protected]>
mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion

Mark Brown <[email protected]>
mfd: sprd: Add SPI device ID table

Mark Brown <[email protected]>
mfd: cpcap: Add SPI device ID table

Krzysztof Kozlowski <[email protected]>
mfd: core: Add missing of_node_put for loop iteration

Takashi Iwai <[email protected]>
ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer

Huang Guobin <[email protected]>
bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed

Jason Gunthorpe <[email protected]>
drm/ttm: remove ttm_bo_vm_insert_huge()

Heiner Kallweit <[email protected]>
net: phy: fix duplex out of sync problem while changing settings

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline

Selvin Xavier <[email protected]>
PCI: Do not enable AtomicOps on VFs

Tetsuo Handa <[email protected]>
ataflop: remove ataflop_probe_lock mutex

Luis Chamberlain <[email protected]>
block/ataflop: provide a helper for cleanup up an atari disk

Luis Chamberlain <[email protected]>
block/ataflop: add registration bool before calling del_gendisk()

Luis Chamberlain <[email protected]>
block/ataflop: use the blk_cleanup_disk() helper

Chenyuan Mi <[email protected]>
drm/nouveau/svm: Fix refcount leak bug and missing check against null bug

Luis Chamberlain <[email protected]>
nvdimm/btt: do not call del_gendisk() if not needed

Christophe JAILLET <[email protected]>
PCI: j721e: Fix j721e_pcie_probe() error path

Hans de Goede <[email protected]>
ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses

Brett Creeley <[email protected]>
ice: Fix not stopping Tx queues for VFs

Sylwester Dziedziuch <[email protected]>
ice: Fix replacing VF hardware MAC to existing MAC filter

Vladimir Oltean <[email protected]>
net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge

Vladimir Oltean <[email protected]>
net: dsa: tag_ocelot: break circular dependency with ocelot switch lib driver

Ziyang Xuan <[email protected]>
net: vlan: fix a UAF in vlan_dev_real_dev()

Stafford Horne <[email protected]>
openrisc: fix SMP tlb flush NULL pointer dereference

Jakub Kicinski <[email protected]>
ethtool: fix ethtool msg len calculation for pause stats

Hangbin Liu <[email protected]>
kselftests/net: add missed icmp.sh test to Makefile

Maxim Kiselev <[email protected]>
net: davinci_emac: Fix interrupt pacing disable

Yu Kuai <[email protected]>
nbd: fix possible overflow for 'first_minor' in nbd_dev_add()

Yu Kuai <[email protected]>
nbd: fix max value for 'first_minor'

YueHaibing <[email protected]>
xen-pciback: Fix return in pm_ctrl_init()

Sander Vanheule <[email protected]>
gpio: realtek-otto: fix GPIO line IRQ offset

Christophe JAILLET <[email protected]>
i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'

Trond Myklebust <[email protected]>
NFSv4: Fix a regression in nfs_set_open_stateid_locked()

Quinn Tran <[email protected]>
scsi: qla2xxx: Turn off target reset during issue_lip

Quinn Tran <[email protected]>
scsi: qla2xxx: Fix gnl list corruption

Dmitry Bogdanov <[email protected]>
scsi: target: core: Remove from tmr_list during LUN unlink

Jackie Liu <[email protected]>
ar7: fix kernel builds for compiler test

Ahmad Fatoum <[email protected]>
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT

Randy Dunlap <[email protected]>
m68k: set a default value for MEMORY_RESERVE

Eric W. Biederman <[email protected]>
signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)

Lars-Peter Clausen <[email protected]>
dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: fix OOB when mac header was cleared

Robert-Ionut Alexa <[email protected]>
soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read

Geert Uytterhoeven <[email protected]>
auxdisplay: ht16k33: Fix frame buffer device blanking

Geert Uytterhoeven <[email protected]>
auxdisplay: ht16k33: Connect backlight to fbdev

Geert Uytterhoeven <[email protected]>
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string

Alexey Gladkov <[email protected]>
Fix user namespace leak

Trond Myklebust <[email protected]>
NFS: Fix an Oops in pnfs_mark_request_commit()

Trond Myklebust <[email protected]>
NFS: Fix up commit deadlocks

Amelie Delaunay <[email protected]>
dmaengine: stm32-dma: fix stm32_dma_get_max_width

Claudiu Beznea <[email protected]>
dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro

Claudiu Beznea <[email protected]>
dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path

Dan Carpenter <[email protected]>
rtc: rv3032: fix error handling in rv3032_clkout_set_rate()

Christophe JAILLET <[email protected]>
remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()'

Zev Weiss <[email protected]>
mtd: core: don't remove debugfs directory if device is in use

Miquel Raynal <[email protected]>
mtd: rawnand: arasan: Prevent an unsupported configuration

Kunihiko Hayashi <[email protected]>
PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation

Evgeny Novikov <[email protected]>
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()

John Keeping <[email protected]>
Input: st1232 - increase "wait ready" timeout

Jia-Ju Bai <[email protected]>
fs: orangefs: fix error return code of orangefs_revalidate_lookup()

Trond Myklebust <[email protected]>
NFS: Fix deadlocks in nfs_scan_commit_list()

YueHaibing <[email protected]>
opp: Fix return in _opp_add_static_v2()

Pali Rohár <[email protected]>
PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge

Marek Behún <[email protected]>
PCI: aardvark: Don't spam about PIO Response Status

Alex Xu (Hello71) <[email protected]>
drm/plane-helper: fix uninitialized variable reference

Dmitry Baryshkov <[email protected]>
drm/bridge/lontium-lt9611uxc: fix provided connector suport

Baptiste Lepers <[email protected]>
pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds

Trond Myklebust <[email protected]>
NFS: Fix dentry verifier races

Trond Myklebust <[email protected]>
NFS: Ignore the directory size when marking for revalidation

Trond Myklebust <[email protected]>
NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA

Trond Myklebust <[email protected]>
NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED

Kewei Xu <[email protected]>
i2c: mediatek: fixing the incorrect register offset

Mark Brown <[email protected]>
Input: ariel-pwrbutton - add SPI device ID table

Mark Brown <[email protected]>
rtc: mcp795: Add SPI ID table

Dong Aisheng <[email protected]>
remoteproc: imx_rproc: Fix TCM io memory type

Mark Brown <[email protected]>
rtc: pcf2123: Add SPI ID table

Mark Brown <[email protected]>
rtc: ds1390: Add SPI ID table

Mark Brown <[email protected]>
rtc: ds1302: Add SPI ID table

J. Bruce Fields <[email protected]>
nfsd: don't alloc under spinlock in rpc_parse_scope_id

Evgeny Novikov <[email protected]>
mtd: rawnand: intel: Fix potential buffer overflow in probe

Arnaud Pouliquen <[email protected]>
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined

Tom Rix <[email protected]>
apparmor: fix error check

Aharon Landau <[email protected]>
RDMA/core: Require the driver to set the IOVA correctly during rereg_mr

Hans de Goede <[email protected]>
power: supply: bq27xxx: Fix kernel crash on IRQ handler register error

Geert Uytterhoeven <[email protected]>
mips: cm: Convert to bitfield API to fix out-of-bounds access

Xuan Zhuo <[email protected]>
virtio_ring: check desc == NULL when using indirect with packed

Geert Uytterhoeven <[email protected]>
serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE

Christophe JAILLET <[email protected]>
ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'

Yixing Liu <[email protected]>
RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility

Haoyue Xu <[email protected]>
RDMA/hns: Fix initial arm_st of CQ

Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Correct configuring of switch inversion from ts-inv

Christophe Leroy <[email protected]>
powerpc: Don't provide __kernel_map_pages() without ARCH_SUPPORTS_DEBUG_PAGEALLOC

Takashi Sakamoto <[email protected]>
ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or later

Denis Kirjanov <[email protected]>
powerpc/xmon: fix task state output

Bixuan Cui <[email protected]>
powerpc/44x/fsp2: add missing of_node_put

Christophe Leroy <[email protected]>
powerpc/book3e: Fix set_memory_x() and set_memory_nx()

Christophe Leroy <[email protected]>
powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()

Andrej Shadura <[email protected]>
HID: u2fzero: properly handle timeouts in usb_submit_urb

Andrej Shadura <[email protected]>
HID: u2fzero: clarify error check and length calculations

Claudiu Beznea <[email protected]>
clk: at91: clk-master: fix prescaler logic

Claudiu Beznea <[email protected]>
clk: at91: clk-master: check if div or pres is zero

Claudiu Beznea <[email protected]>
clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL

Anssi Hannula <[email protected]>
serial: xilinx_uartps: Fix race condition causing stuck TX

Yang Yingliang <[email protected]>
phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()

Sandeep Maheswaram <[email protected]>
phy: qcom-snps: Correct the FSEL_MASK

Dan Carpenter <[email protected]>
phy: ti: gmii-sel: check of_get_address() for failure

Vladimir Zapolskiy <[email protected]>
phy: qcom-qusb2: Fix a memory leak on probe

Mark Brown <[email protected]>
ASoC: topology: Fix stub for snd_soc_tplg_component_remove()

Rahul Tanwar <[email protected]>
pinctrl: equilibrium: Fix function addition in multiple groups

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock

Bhupesh Sharma <[email protected]>
arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly

Marijn Suijten <[email protected]>
arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node

Wan Jiabing <[email protected]>
soc: qcom: apr: Add of_node_put() before return

Dmitry Baryshkov <[email protected]>
soc: qcom: rpmhpd: fix sm8350_mxc's peer domain

Guru Das Srinagesh <[email protected]>
firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()

Christophe Leroy <[email protected]>
powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE

Amelie Delaunay <[email protected]>
usb: dwc2: drd: reset current session before setting the new one

Amelie Delaunay <[email protected]>
usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled

Amelie Delaunay <[email protected]>
usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init

Stefan Agner <[email protected]>
serial: imx: fix detach/attach of serial console

James Smart <[email protected]>
scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset

Srinivas Kandagatla <[email protected]>
scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer

Srinivas Kandagatla <[email protected]>
soundwire: bus: stop dereferencing invalid slave pointer

Nuno Sá <[email protected]>
iio: adis: do not disabe IRQs in 'adis_init()'

Randy Dunlap <[email protected]>
usb: typec: STUSB160X should select REGMAP_I2C

Yang Yingliang <[email protected]>
iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()

Dmitry Baryshkov <[email protected]>
soc: qcom: socinfo: add two missing PMIC IDs

Bjorn Andersson <[email protected]>
soc: qcom: rpmhpd: Make power_on actually enable the domain

Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER

Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Correct some register default values

Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Always configure both ASP TX channels

Olivier Moysan <[email protected]>
ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15

Olivier Moysan <[email protected]>
ARM: dts: stm32: fix SAI sub nodes register range

Fabrice Gasnier <[email protected]>
ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx

Marek Vasut <[email protected]>
ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz

Geert Uytterhoeven <[email protected]>
pinctrl: renesas: checker: Fix off-by-one bug in drive register check

Athira Rajeev <[email protected]>
powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10

Andrew Halaney <[email protected]>
dyndbg: make dyndbg a known cli param

Vegard Nossum <[email protected]>
staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC

Nikita Yushchenko <[email protected]>
staging: most: dim2: do not double-register the same device

Randy Dunlap <[email protected]>
usb: musb: select GENERIC_PHY instead of depending on it

Leon Romanovsky <[email protected]>
RDMA/mlx4: Return missed an error if device doesn't support steering

Dan Carpenter <[email protected]>
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()

Yang Yingliang <[email protected]>
power: supply: max17040: fix null-ptr-deref in max17040_probe()

Jakob Hauser <[email protected]>
power: supply: rt5033_battery: Change voltage values to µV

Dan Carpenter <[email protected]>
usb: gadget: hid: fix error code in do_config()

Andy Shevchenko <[email protected]>
serial: 8250_dw: Drop wrong use of ACPI_PTR()

Nathan Lynch <[email protected]>
powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()

Nathan Lynch <[email protected]>
powerpc: fix unbalanced node refcount in check_kvm_guest()

Christophe Leroy <[email protected]>
video: fbdev: chipsfb: use memset_io() instead of memset()

Christophe Leroy <[email protected]>
powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype for 'create_section_mapping'

Clément Léger <[email protected]>
clk: at91: check pmc node status before registering syscore ops

Dongliang Mu <[email protected]>
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe

Christophe JAILLET <[email protected]>
soc/tegra: Fix an error handling path in tegra_powergate_power_up()

Mark Brown <[email protected]>
iio: st_pressure_spi: Add missing entries SPI to device ID table

Ranjani Sridharan <[email protected]>
ASoC: SOF: topology: do not power down primary core during topology removal

Andreas Kemnade <[email protected]>
arm: dts: omap3-gta04a4: accelerometer irq fix

Yang Yingliang <[email protected]>
driver core: Fix possible memory leak in device_link_add()

Igor Pylypiv <[email protected]>
scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()

Sumit Saxena <[email protected]>
scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt

Claudiu Beznea <[email protected]>
power: reset: at91-reset: check properly the return value of devm_of_iomap

Srinivas Kandagatla <[email protected]>
soundwire: debugfs: use controller id and link_id for debugfs

Takashi Iwai <[email protected]>
ALSA: hda: Use position buffer for SKL+ again

Takashi Iwai <[email protected]>
ALSA: hda: Reduce udelay() at SKL+ position reporting

David Stevens <[email protected]>
iommu/dma: Fix arch_sync_dma for map

Stephan Gerhold <[email protected]>
arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000

Arnd Bergmann <[email protected]>
iommu/mediatek: Fix out-of-range warning with clang

Geert Uytterhoeven <[email protected]>
arm64: dts: renesas: beacon: Fix Ethernet PHY mode

Stephan Gerhold <[email protected]>
arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock

Yassine Oudjana <[email protected]>
ASoC: wcd9335: Use correct version to initialize Class H

Dongliang Mu <[email protected]>
JFS: fix memleak in jfs_mount

Jackie Liu <[email protected]>
MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT

Tong Zhang <[email protected]>
scsi: dc395: Fix error case unwinding

Naina Mehta <[email protected]>
soc: qcom: llcc: Disable MMUHWT retention

Douglas Anderson <[email protected]>
arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality

Peter Rosin <[email protected]>
ARM: dts: at91: tse850: the emac<->phy interface is rmii

Tony Lindgren <[email protected]>
bus: ti-sysc: Fix timekeeping_suspended warning on resume

Anand Moon <[email protected]>
arm64: dts: meson-sm1: Fix the pwm regulator supply properties

Anand Moon <[email protected]>
arm64: dts: meson-g12b: Fix the pwm regulator supply properties

Anand Moon <[email protected]>
arm64: dts: meson-g12a: Fix the pwm regulator supply properties

Kishon Vijay Abraham I <[email protected]>
arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe

Kishon Vijay Abraham I <[email protected]>
arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie node

Kishon Vijay Abraham I <[email protected]>
arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe

Kishon Vijay Abraham I <[email protected]>
arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix query SRQ failure

Marijn Suijten <[email protected]>
ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY

Alex Bee <[email protected]>
arm64: dts: rockchip: Fix GPU register width for RK3328

Peter Geis <[email protected]>
arm64: dts: rockchip: fix rk3568 mbi-alias

Jackie Liu <[email protected]>
ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()

Ajish Koshy <[email protected]>
scsi: pm80xx: Fix lockup in outbound queue management

Christophe JAILLET <[email protected]>
clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths

Rafał Miłecki <[email protected]>
arm64: dts: broadcom: bcm4908: Fix UART clock name

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: Fix memory nodes names

Junji Wei <[email protected]>
RDMA/rxe: Fix wrong port_cap_flags

Alexandru Ardelean <[email protected]>
iio: st_sensors: disable regulators after device unregistration

Dongjin Kim <[email protected]>
arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4

Frank Rowand <[email protected]>
of: unittest: fix EXPECT text for gpio hog errors

Alexei Starovoitov <[email protected]>
bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.

Alexei Starovoitov <[email protected]>
bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.

Dan Schatzberg <[email protected]>
cgroup: Fix rootcg cpu.stat guest double counting

Liu Jian <[email protected]>
skmsg: Lose offset info in sk_psock_skb_ingress

Sukadev Bhattiprolu <[email protected]>
ibmvnic: delay complete()

Sukadev Bhattiprolu <[email protected]>
ibmvnic: Process crqs after enabling interrupts

Sukadev Bhattiprolu <[email protected]>
ibmvnic: don't stop queue in xmit

Jakub Kicinski <[email protected]>
udp6: allow SO_MARK ctrl msg to affect routing

Andrea Righi <[email protected]>
selftests/bpf: Fix fclose/pclose mismatch in test_progs

Daniel Jordan <[email protected]>
crypto: pcrypt - Delay write to padata->info

Nikolay Aleksandrov <[email protected]>
selftests: net: bridge: update IGMP/MLD membership interval value

Ivan Vecera <[email protected]>
net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled

Russell King (Oracle) <[email protected]>
net: phylink: avoid mvneta warning when setting pause parameters

Christophe JAILLET <[email protected]>
ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()'

Shyam Sundar S K <[email protected]>
net: amd-xgbe: Toggle PLL settings during rate change

Xin Long <[email protected]>
sctp: return true only for pathmtu update in sctp_transport_pl_toobig

Xin Long <[email protected]>
sctp: subtract sctphdr len in sctp_transport_pl_hlen

Xin Long <[email protected]>
sctp: reset probe_timer in sctp_transport_pl_update

Xin Long <[email protected]>
sctp: allow IP fragmentation when PLPMTUD enters Error state

Kumar Kartikeya Dwivedi <[email protected]>
selftests/bpf: Fix memory leak in test_ima

Kumar Kartikeya Dwivedi <[email protected]>
selftests/bpf: Fix fd cleanup in sk_lookup test

Alex Deucher <[email protected]>
drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits

Lang Yu <[email protected]>
drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()

Loic Poulain <[email protected]>
wcn36xx: Channel list update before hardware scan

Eric Dumazet <[email protected]>
bpf: Fixes possible race in update_prog_stats() for 32bit arches

Loic Poulain <[email protected]>
wcn36xx: Fix discarded frames due to wrong sequence number

Benjamin Li <[email protected]>
wcn36xx: add proper DMA memory barriers in rx path

Wang Hai <[email protected]>
libertas: Fix possible memory leak in probe and disconnect

Wang Hai <[email protected]>
libertas_tf: Fix possible memory leak in probe and disconnect

Janis Schoetterl-Glausch <[email protected]>
KVM: s390: Fix handle_sske page fault handling

Tiezhu Yang <[email protected]>
samples/kretprobes: Fix return value if register_kretprobe() failed

Peter Zijlstra <[email protected]>
x86: Fix __get_wchan() for !STACKTRACE

Kees Cook <[email protected]>
sched: Add wrapper for get_wchan() to keep task blocked

Lad Prabhakar <[email protected]>
spi: spi-rpc-if: Check return value of rpcif_sw_init()

Zhang Rui <[email protected]>
cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization

Jon Maxwell <[email protected]>
tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()

Ilya Leoshkevich <[email protected]>
libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()

Mark Brown <[email protected]>
tpm_tis_spi: Add missing SPI ID

Hao Wu <[email protected]>
tpm: fix Atmel TPM crash caused by too frequent queries

Yu Kuai <[email protected]>
blk-cgroup: synchronize blkg creation against policy deactivation

Michael Schmitz <[email protected]>
block: ataflop: more blk-mq refactoring fixes

Abinaya Kalaiselvan <[email protected]>
ath10k: fix module load regression with iram-recovery feature

Arnd Bergmann <[email protected]>
ARM: 9142/1: kasan: work around LPAE build warning

Vladimir Oltean <[email protected]>
net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error

Mark Rutland <[email protected]>
irq: mips: avoid nested irq_enter()

Claudio Imbrenda <[email protected]>
KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm

Claudio Imbrenda <[email protected]>
KVM: s390: pv: avoid double free of sida page

David Hildenbrand <[email protected]>
s390/uv: fully validate the VMA before calling follow_page()

David Hildenbrand <[email protected]>
s390/mm: fix VMA and page table handling code in storage key handling functions

David Hildenbrand <[email protected]>
s390/mm: validate VMA in PGSTE manipulation functions

David Hildenbrand <[email protected]>
s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()

David Hildenbrand <[email protected]>
s390/gmap: validate VMA in __gmap_zap()

Nick Hainke <[email protected]>
mt76: mt7615: mt7622: fix ibss and meshpoint

Andrii Nakryiko <[email protected]>
libbpf: Fix BTF header parsing checks

Andrii Nakryiko <[email protected]>
libbpf: Fix overflow in BTF sanity checks

Quentin Monnet <[email protected]>
bpftool: Avoid leaking the JSON writer prepared for program metadata

Mauricio Vásquez <[email protected]>
libbpf: Fix memory leak in btf__dedup()

Jim Mattson <[email protected]>
KVM: selftests: Fix nested SVM tests when built with clang

Tetsuo Handa <[email protected]>
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi

Horia Geantă <[email protected]>
crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks

Jessica Zhang <[email protected]>
drm/msm: Fix potential NULL dereference in DPU SSPP

Joerg Roedel <[email protected]>
x86/sev: Fix stack type check in vc_switch_off_ist()

Kees Cook <[email protected]>
clocksource/drivers/timer-ti-dm: Select TIMER_OF

Anders Roxell <[email protected]>
PM: hibernate: fix sparse warnings

Max Gurtovoy <[email protected]>
nvme-rdma: fix error code in nvme_rdma_setup_ctrl

Ye Bin <[email protected]>
nbd: Fix use-after-free in pid_show

Stefan Agner <[email protected]>
phy: micrel: ksz8041nl: do not use power down mode

Tim Gardner <[email protected]>
net: enetc: unmap DMA in enetc_send_cmd()

Johannes Berg <[email protected]>
iwlwifi: pnvm: read EFI data only if long enough

Johannes Berg <[email protected]>
iwlwifi: pnvm: don't kmemdup() more than we have

Johannes Berg <[email protected]>
iwlwifi: mvm: reset PM state on unsuccessful resume

Jonas Dreßler <[email protected]>
mwifiex: Send DELBA requests according to spec

Ziyang Xuan <[email protected]>
rsi: stop thread firstly in rsi_91x_init() error handling

Shayne Chen <[email protected]>
mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()

Shayne Chen <[email protected]>
mt76: mt7915: fix sta_rec_wtbl tag len

Lorenzo Bianconi <[email protected]>
mt76: connac: fix possible NULL pointer dereference in mt76_connac_get_phy_mode_v2

Ryder Lee <[email protected]>
mt76: mt7615: fix monitor mode tear down crash

Sean Wang <[email protected]>
mt76: mt7921: fix retrying release semaphore without end

Lorenzo Bianconi <[email protected]>
mt76: mt7915: fix possible infinite loop release semaphore

Ryder Lee <[email protected]>
mt76: mt7615: fix hwmon temp sensor mem use-after-free

Ben Greear <[email protected]>
mt76: mt7915: fix hwmon temp sensor mem use-after-free

Lorenzo Bianconi <[email protected]>
mt76: mt7921: always wake device if necessary in debugfs

Sean Wang <[email protected]>
mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate

Sean Wang <[email protected]>
mt76: mt7921: fix firmware usage of RA info using legacy rates

Sean Wang <[email protected]>
mt76: mt7921: report HE MU radiotap

Lorenzo Bianconi <[email protected]>
mt76: overwrite default reg_ops if necessary

Leon Yen <[email protected]>
mt76: connac: fix GTK rekey offload failure on WPA mixed mode

Deren Wu <[email protected]>
mt76: mt7921: fix dma hang in rmmod

Shayne Chen <[email protected]>
mt76: mt7915: fix bit fields for HT rate idx

Shayne Chen <[email protected]>
mt76: mt7915: fix potential overflow of eeprom page index

Deren Wu <[email protected]>
mt76: mt7921: Fix out of order process by invalid event pkt

Lorenzo Bianconi <[email protected]>
mt76: mt76x02: fix endianness warnings in mt76x02_mac.c

Lorenzo Bianconi <[email protected]>
mt76: mt7921: fix survey-dump reporting

Sean Wang <[email protected]>
mt76: fix build error implicit enumeration conversion

Leon Yen <[email protected]>
mt76: connac: fix mt76_connac_gtk_rekey_tlv usage

Dan Carpenter <[email protected]>
mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()

Lorenzo Bianconi <[email protected]>
mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi

Lorenzo Bianconi <[email protected]>
mt76: mt7921: fix endianness warning in mt7921_update_txs

Lorenzo Bianconi <[email protected]>
mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb

Lorenzo Bianconi <[email protected]>
mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event

Lang Yu <[email protected]>
drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu

Rafael J. Wysocki <[email protected]>
ACPI: PM: Fix sharing of wakeup power resources

Rafael J. Wysocki <[email protected]>
ACPI: PM: Turn off unused wakeup power resources

Nathan Chancellor <[email protected]>
platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning

Michael Schmitz <[email protected]>
block: ataflop: fix breakage introduced at blk-mq refactoring

Christophe JAILLET <[email protected]>
mmc: mxs-mmc: disable regulator on error and in the remove function

Sean Young <[email protected]>
media: ir_toy: assignment to be16 should be of correct type

Randy Dunlap <[email protected]>
media: ivtv: fix build for UML

jason-jh.lin <[email protected]>
mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done

Jakub Kicinski <[email protected]>
net: stream: don't purge sk_error_queue in sk_stream_kill_queues()

Dan Carpenter <[email protected]>
drm/msm: uninitialized variable in msm_gem_import()

Dan Carpenter <[email protected]>
drm/msm: fix potential NULL dereference in cleanup

Dan Carpenter <[email protected]>
drm/msm: potential error pointer dereference in init()

Dan Carpenter <[email protected]>
drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()

Ziyang Xuan <[email protected]>
thermal/core: fix a UAF bug in __thermal_cooling_device_register()

Ovidiu Panait <[email protected]>
crypto: octeontx2 - set assoclen in aead_do_fallback()

Eric Dumazet <[email protected]>
tcp: switch orphan_count to bare per-cpu counters

Qi Zheng <[email protected]>
x86: Fix get_wchan() to support the ORC unwinder

Randy Dunlap <[email protected]>
net: tulip: winbond-840: fix build for UML

Randy Dunlap <[email protected]>
net: fealnx: fix build for UML

Zhang Qiao <[email protected]>
kernel/sched: Fix sched_fork() access an invalid sched_task_group

Sven Eckelmann <[email protected]>
ath10k: fix max antenna gain unit

Zev Weiss <[email protected]>
hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff

Yang Yingliang <[email protected]>
hwmon: Fix possible memleak in __hwmon_device_register()

Daniel Borkmann <[email protected]>
net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE

Dan Carpenter <[email protected]>
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()

Arnd Bergmann <[email protected]>
memstick: avoid out-of-range warning

Tony Lindgren <[email protected]>
mmc: sdhci-omap: Fix context restore

Tony Lindgren <[email protected]>
mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured

Catherine Sullivan <[email protected]>
gve: Track RX buffer allocation failures

John Fraker <[email protected]>
gve: Recover from queue stall due to missed IRQ

Dan Carpenter <[email protected]>
b43: fix a lower bounds test

Dan Carpenter <[email protected]>
b43legacy: fix a lower bounds test

THOBY Simon <[email protected]>
IMA: block writes of the security.ima xattr with unsupported algorithms

Markus Schneider-Pargmann <[email protected]>
hwrng: mtk - Force runtime pm ops for sleep ops

Giovanni Cabiddu <[email protected]>
crypto: qat - disregard spurious PFVF interrupts

Giovanni Cabiddu <[email protected]>
crypto: qat - detect PFVF collision after ACK

Arnd Bergmann <[email protected]>
crypto: ccree - avoid out-of-range warnings from clang

Evgeny Novikov <[email protected]>
media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()

Mansur Alisha Shaik <[email protected]>
media: venus: fix vpp frequency calculation for decoder

Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: relax superfluous check on set updates

Peter Zijlstra <[email protected]>
rcu: Always inline rcu_dynticks_task*_{enter,exit}()

Yazen Ghannam <[email protected]>
EDAC/amd64: Handle three rank interleaving mode

Borislav Petkov <[email protected]>
x86/insn: Use get_unaligned() instead of memcpy()

Vincent Donnefort <[email protected]>
PM: EM: Fix inefficient states detection

Linus Lüssing <[email protected]>
ath9k: Fix potential interrupt storm on queue reset

Stephen Boyd <[email protected]>
ath10k: Don't always treat modem stop events as crashes

Colin Ian King <[email protected]>
media: em28xx: Don't use ops->suspend if it is NULL

Anel Orazgaliyeva <[email protected]>
cpuidle: Fix kobject memory leaks in error paths

Arnd Bergmann <[email protected]>
drm: fb_helper: fix CONFIG_FB dependency

Arnd Bergmann <[email protected]>
crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency

Punit Agrawal <[email protected]>
kprobes: Do not use local variable when creating debugfs file

Yee Lee <[email protected]>
scs: Release kasan vmalloc poison in scs_free process

Eugen Hristev <[email protected]>
media: atmel: fix the ispck initialization

Colin Ian King <[email protected]>
media: cx23885: Fix snd_card_free call on null card pointer

Kees Cook <[email protected]>
media: tm6000: Avoid card name truncation

Kees Cook <[email protected]>
media: si470x: Avoid card name truncation

Kees Cook <[email protected]>
media: radio-wl1273: Avoid card name truncation

Ondrej Jirman <[email protected]>
media: sun6i-csi: Allow the video device to be open multiple times

Randy Dunlap <[email protected]>
media: i2c: ths8200 needs V4L2_ASYNC

Christophe JAILLET <[email protected]>
media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'

Christophe JAILLET <[email protected]>
media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'

Tom Rix <[email protected]>
media: TDA1997x: handle short reads of hdmi info frame.

Dafna Hirschfeld <[email protected]>
media: mtk-vcodec: venc: fix return value when start_streaming fails

Ricardo Ribalda <[email protected]>
media: v4l2-ioctl: S_CTRL output the right value

Sakari Ailus <[email protected]>
media: imx258: Fix getting clock frequency

Pavel Skripkin <[email protected]>
media: dvb-usb: fix ununit-value in az6027_rc_query

Evgeny Novikov <[email protected]>
media: ttusb-dec: avoid release of non-acquired mutex

Colin Ian King <[email protected]>
media: cxd2880-spi: Fix a null pointer dereference on error handling path

Christophe JAILLET <[email protected]>
media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()'

Pavel Skripkin <[email protected]>
media: em28xx: add missing em28xx_close_extension

Kumar Kartikeya Dwivedi <[email protected]>
libbpf: Fix skel_internal.h to set errno on loader retval < 0

Arnd Bergmann <[email protected]>
drm/amdgpu: fix warning for overflow check

Sudarshan Rajagopalan <[email protected]>
arm64: mm: update max_pfn after memory hotplug

Matthew Auld <[email protected]>
drm/ttm: stop calling tt_swapin in vm_access

Fabio Estevam <[email protected]>
ath10k: sdio: Add missing BH locking around napi_schdule()

Loic Poulain <[email protected]>
ath10k: Fix missing frame timestamp for beacon/probe-resp

Arnd Bergmann <[email protected]>
gve: DQO: avoid unused variable warnings

Baochen Qiang <[email protected]>
ath11k: Fix memory leak in ath11k_qmi_driver_event_work

Pradeep Kumar Chitrapu <[email protected]>
ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status

Sriram R <[email protected]>
ath11k: Avoid race during regd updates

Dan Carpenter <[email protected]>
ath11k: fix some sleeping in atomic bugs

Linus Walleij <[email protected]>
net: dsa: rtl8366: Fix a bug in deleting VLANs

Linus Walleij <[email protected]>
net: dsa: rtl8366rb: Fix off-by-one bug

Johannes Berg <[email protected]>
cfg80211: always free wiphy specific regdomain

Kees Cook <[email protected]>
fortify: Fix dropped strcpy() compile-time write overflow check

Jiasheng Jiang <[email protected]>
rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()

Leon Romanovsky <[email protected]>
qed: Don't ignore devlink allocation failures

Leon Romanovsky <[email protected]>
bnxt_en: Check devlink allocation and registration status

Michael Walle <[email protected]>
crypto: caam - disable pkc for non-E SoCs

Guchun Chen <[email protected]>
drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage

Dinghao Liu <[email protected]>
Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync

Ajay Singh <[email protected]>
wilc1000: fix possible memory leak in cfg_scan_result()

Bryan O'Donoghue <[email protected]>
wcn36xx: Fix Antenna Diversity Switching

Waiman Long <[email protected]>
cgroup: Make rebind_subsystems() disable v2 controllers all at once

Yoshitaka Ikeda <[email protected]>
spi: Fixed division by zero warning

Alex Bee <[email protected]>
drm: bridge: it66121: Fix return value it66121_probe

Russell King (Oracle) <[email protected]>
net: phylink: don't call netif_carrier_off() with NULL netdev

Yajun Deng <[email protected]>
net: net_namespace: Fix undefined member in key_remove_domain()

Sebastian Andrzej Siewior <[email protected]>
lockdep: Let lock_is_held_type() detect recursive read as read

liuyuntao <[email protected]>
virtio-gpu: fix possible memory allocation failure

Iago Toral Quiroga <[email protected]>
drm/v3d: fix wait for TMU write combiner flush

Peter Zijlstra <[email protected]>
objtool: Handle __sanitize_cov*() tail calls

Peter Zijlstra <[email protected]>
x86/xen: Mark cpu_bringup_and_idle() as dead_end_function

Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: dma: fix burst length for DEU

Neeraj Upadhyay <[email protected]>
rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()

Toke Høiland-Jørgensen <[email protected]>
libbpf: Don't crash on object files with no symbol tables

Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: fix init and cleanup of sco_conn.timeout_work

Paul Cercueil <[email protected]>
drm/bridge: it66121: Wait for next bridge to be probed

Paul Cercueil <[email protected]>
drm/bridge: it66121: Initialize {device,vendor}_ids

Robert Foss <[email protected]>
drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()

Imre Deak <[email protected]>
fbdev/efifb: Release PCI device's runtime PM ref during FB destroy

Andrii Nakryiko <[email protected]>
selftests/bpf: Fix strobemeta selftest regression

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state

Sven Schnelle <[email protected]>
parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling

Sven Schnelle <[email protected]>
parisc/unwind: fix unwinder when CONFIG_64BIT is enabled

Gao Xiang <[email protected]>
erofs: don't trigger WARN() when decompression fails

Helge Deller <[email protected]>
task_stack: Fix end_of_stack() for architectures with upwards-growing stack

Sven Schnelle <[email protected]>
parisc: fix warning in flush_tlb_all

Stephane Eranian <[email protected]>
perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings

Shuah Khan <[email protected]>
selftests/core: fix conflicting types compile error for close_range()

Anson Jacob <[email protected]>
drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled

Vitaly Kuznetsov <[email protected]>
x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted

王贇 <[email protected]>
ftrace: do CPU checking after preemption disabled

Bryan O'Donoghue <[email protected]>
Revert "wcn36xx: Enable firmware link monitoring"

Loic Poulain <[email protected]>
wcn36xx: Fix packet drop on resume

Loic Poulain <[email protected]>
wcn36xx: Correct band/freq reporting on RX

Yang Yingliang <[email protected]>
spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()

Josef Bacik <[email protected]>
btrfs: do not take the uuid_mutex in btrfs_rm_device

Sidong Yang <[email protected]>
btrfs: reflink: initialize return value to 0 in btrfs_extent_same()

Hui Wang <[email protected]>
ACPI: resources: Add one more Medion model in IRQ override quirk

Stefan Schaeckeler <[email protected]>
ACPI: AC: Quirk GK45 to skip reading _PSR

Eric Dumazet <[email protected]>
net: annotate data-race in neigh_output()

Florian Westphal <[email protected]>
vrf: run conntrack only in context of lower/physdev for locally generated packets

Viktor Rosendahl <[email protected]>
tools/latency-collector: Use correct size when writing queue_full_warning

Arnd Bergmann <[email protected]>
ARM: 9136/1: ARMv7-M uses BE-8, not BE-32

Andreas Gruenbacher <[email protected]>
gfs2: Fix glock_hash_walk bugs

Andreas Gruenbacher <[email protected]>
gfs2: Cancel remote delete work asynchronously

Marc Kleine-Budde <[email protected]>
can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to unsigned int

Vladimir Oltean <[email protected]>
net: dsa: lantiq_gswip: serialize access to the PCE table

Stephen Suryaputra <[email protected]>
gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE

Masami Hiramatsu <[email protected]>
ARM: clang: Do not rely on lr register for stacktrace

Tetsuo Handa <[email protected]>
smackfs: use __GFP_NOFAIL for smk_cipso_doi()

Johannes Berg <[email protected]>
iwlwifi: mvm: disable RX-diversity in powersave

Jiri Olsa <[email protected]>
selftests/bpf: Fix perf_buffer test on system with offline cpus

Shuah Khan <[email protected]>
selftests: kvm: fix mismatched fclose() after popen()

Ye Bin <[email protected]>
PM: hibernate: Get block device exclusively in swsusp_check()

Nick Desaulniers <[email protected]>
arm64: vdso32: suppress error message for 'make mrproper'

Hannes Reinecke <[email protected]>
nvme: drop scan_lock and always kick requeue list when removing namespaces

Israel Rukshin <[email protected]>
nvmet-tcp: fix use-after-free when a port is removed

Israel Rukshin <[email protected]>
nvmet-rdma: fix use-after-free when a port is removed

Israel Rukshin <[email protected]>
nvmet: fix use-after-free when a port is removed

Alex Deucher <[email protected]>
drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh

Michael Tretter <[email protected]>
media: allegro: ignore interrupt if mailbox is not initialized

Jens Axboe <[email protected]>
block: remove inaccurate requeue check

Yaara Baruch <[email protected]>
iwlwifi: change all JnP to NO-160 configuration

Zheyu Ma <[email protected]>
mwl8k: Fix use-after-free in mwl8k_fw_state_machine()

Ryder Lee <[email protected]>
mt76: mt7915: fix an off-by-one bound check

Kalesh Singh <[email protected]>
tracing/cfi: Fix cmp_entries_* functions signature mismatch

Menglong Dong <[email protected]>
workqueue: make sysfs of unbound kworker cpumask more clever

Lasse Collin <[email protected]>
lib/xz: Validate the value before assigning it to an enum variable

Lasse Collin <[email protected]>
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression

Yanfei Xu <[email protected]>
locking/rwsem: Disable preemption for spinning region

Zheyu Ma <[email protected]>
memstick: r592: Fix a UAF bug when removing the driver

Xiao Ni <[email protected]>
md: update superblock after changing rdev flags in state_store

Luis Chamberlain <[email protected]>
floppy: fix calling platform_device_unregister() on invalid drives

Jens Axboe <[email protected]>
block: bump max plugged deferred size from 16 to 32

Ansuel Smith <[email protected]>
thermal/drivers/tsens: Add timeout to get_temp_tsens_valid

Tim Gardner <[email protected]>
drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()

Yuanzheng Song <[email protected]>
thermal/core: Fix null pointer dereference in thermal_release()

Kees Cook <[email protected]>
leaking_addresses: Always print a trailing newline

Matthias Schiffer <[email protected]>
net: phy: micrel: make *-skew-ps check more lenient

Yifan Zhang <[email protected]>
drm/amdkfd: fix resume error when iommu disabled in Picasso

Aurabindo Pillai <[email protected]>
drm/amd/display: fix null pointer deref when plugging in display

Rafael J. Wysocki <[email protected]>
ACPI: scan: Release PM resources blocked by unused objects

André Almeida <[email protected]>
ACPI: battery: Accept charges over the design capacity as full

Andreas Gruenbacher <[email protected]>
iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value

Xin Xiong <[email protected]>
mmc: moxart: Fix reference count leaks in moxart_probe

Tuo Li <[email protected]>
ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()

Steven Rostedt (VMware) <[email protected]>
tracing: Disable "other" permission bits in the tracefs files

Steven Rostedt (VMware) <[email protected]>
tracefs: Have tracefs directories not set OTH permission bits by default

Alex Sierra <[email protected]>
drm/amdkfd: rm BO resv on validation to avoid deadlock

Antoine Tenart <[email protected]>
net-sysfs: try not to restart the syscall if it will fail eventually

Anant Thazhemadam <[email protected]>
media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()

Ricardo Ribalda <[email protected]>
media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info

Ricardo Ribalda <[email protected]>
media: ipu3-imgu: imgu_fmt: Handle properly try

Mirela Rabulea <[email protected]>
media: imx-jpeg: Fix possible null pointer dereference

Wojciech Drewek <[email protected]>
ice: Move devlink port to PF/VF struct

Vincent Donnefort <[email protected]>
cpufreq: Make policy min/max hard requirements

Rafael J. Wysocki <[email protected]>
ACPICA: Avoid evaluating methods too early during system resume

Li Zhijian <[email protected]>
kselftests/sched: cleanup the child processes

Josh Don <[email protected]>
fs/proc/uptime.c: Fix idle time reporting in /proc/uptime

Corey Minyard <[email protected]>
ipmi: Disable some operations during a panic

Nadezda Lutovinova <[email protected]>
media: rcar-csi2: Add checking to rcsi2_start_receiver()

Hans de Goede <[email protected]>
brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet

Zong-Zhe Yang <[email protected]>
rtw88: fix RX clock gate setting while fifo dump

Randy Dunlap <[email protected]>
ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK

Rajat Asthana <[email protected]>
media: mceusb: return without resubmitting URB in case of -EPROTO error.

Niklas Söderlund <[email protected]>
media: rcar-vin: Use user provided buffers when starting

Martin Kepplinger <[email protected]>
media: imx: set a media_device bus_info string

Sergey Senozhatsky <[email protected]>
media: videobuf2: rework vb2_mem_ops API

Nadezda Lutovinova <[email protected]>
media: s5p-mfc: Add checking to s5p_mfc_probe().

Tuo Li <[email protected]>
media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()

Evgeny Novikov <[email protected]>
media: vidtv: Fix memory leak in remove

Ricardo Ribalda <[email protected]>
media: uvcvideo: Set unique vdev name based in type

Ricardo Ribalda <[email protected]>
media: uvcvideo: Return -EIO for control errors

Ricardo Ribalda <[email protected]>
media: uvcvideo: Set capability in s_param

Dmitriy Ulitin <[email protected]>
media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()

Evgeny Novikov <[email protected]>
media: atomisp: Fix error handling in probe

Zheyu Ma <[email protected]>
media: netup_unidvb: handle interrupt properly according to the firmware

Dirk Bender <[email protected]>
media: mt9p031: Fix corrupted frame after restarting stream

Rakesh Babu <[email protected]>
octeontx2-pf: Enable promisc/allmulti match MCAM entries.

Alagu Sankar <[email protected]>
ath10k: high latency fixes for beacon buffer

Baochen Qiang <[email protected]>
ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets

Wen Gong <[email protected]>
ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED

Sriram R <[email protected]>
ath11k: Avoid reg rules update during firmware recovery

Johannes Berg <[email protected]>
leds: trigger: use RCU to protect the led_cdevs list

Petr Machata <[email protected]>
selftests: net: fib_nexthops: Wait before checking reported idle time

Jimmy Kizito <[email protected]>
drm/amd/display: Fix null pointer dereference for encoders

Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix MMIO access page fault

Eric Biggers <[email protected]>
fscrypt: allow 256-bit master keys with AES-256-XTS

Mark Brown <[email protected]>
spi: Check we have a spi_device_id for each DT compatible

Jonas Dreßler <[email protected]>
mwifiex: Properly initialize private structure on interface type changes

Jonas Dreßler <[email protected]>
mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type

Peter Zijlstra <[email protected]>
x86: Increase exception stack sizes

Peter Zijlstra <[email protected]>
x86/mm/64: Improve stack overflow warnings

Shreyansh Chouhan <[email protected]>
crypto: aesni - check walk.nbytes instead of err

Seevalamuthu Mariappan <[email protected]>
ath11k: Align bss_chan_info structure with firmware

Pawan Gupta <[email protected]>
smackfs: Fix use-after-free in netlbl_catmap_walk()

Paul E. McKenney <[email protected]>
rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop

Hui Wang <[email protected]>
ACPI: resources: Add DMI-based legacy IRQ override quirk

Jakub Kicinski <[email protected]>
net: sched: update default qdisc visibility after Tx queue cnt changes

Peter Zijlstra <[email protected]>
locking/lockdep: Avoid RCU-induced noinstr fail

Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: dma: reset correct number of channel

Aleksander Jan Bajkowski <[email protected]>
MIPS: lantiq: dma: add small delay after reset

Barnabás Pőcze <[email protected]>
platform/x86: wmi: do not fail if disabling fails

Scott Wood <[email protected]>
rcutorture: Avoid problematic critical section nesting on PREEMPT_RT

Simon Ser <[email protected]>
drm/panel-orientation-quirks: add Valve Steam Deck

Wang ShaoBo <[email protected]>
Bluetooth: fix use-after-free error in lock_sock_nested()

Takashi Iwai <[email protected]>
Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()

Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6

Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1

Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)

Charan Teja Reddy <[email protected]>
dma-buf: WARN on dmabuf release with pending attachments

Kai Vehmanen <[email protected]>
component: do not leave master devres group open after bind

Sebastian Krzyszkowiak <[email protected]>
power: supply: max17042_battery: Clear status bits in interrupt handler

Johan Hovold <[email protected]>
USB: chipidea: fix interrupt deadlock

Johan Hovold <[email protected]>
USB: iowarrior: fix control-message timeouts

Johan Hovold <[email protected]>
most: fix control-message timeouts

Johan Hovold <[email protected]>
serial: 8250: fix racy uartclk update

Wang Hai <[email protected]>
USB: serial: keyspan: fix memleak on probe errors

Mihail Chindris <[email protected]>
Documentation:devicetree:bindings:iio:dac: Fix val

Nuno Sá <[email protected]>
iio: ad5770r: make devicetree property reading consistent

Pekka Korpinen <[email protected]>
iio: dac: ad5446: Fix ad5622_write() return value

Mihail Chindris <[email protected]>
drivers: iio: dac: ad5766: Fix dt property name

Yang Yingliang <[email protected]>
iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()

Yang Yingliang <[email protected]>
iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()

Yang Yingliang <[email protected]>
iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()

Yang Yingliang <[email protected]>
iio: buffer: check return value of kstrdup_const()

Suzuki K Poulose <[email protected]>
coresight: trbe: Defer the probe on offline CPUs

Suzuki K Poulose <[email protected]>
coresight: trbe: Fix incorrect access of the sink specific data

Tao Zhang <[email protected]>
coresight: cti: Correct the parameter for pm_runtime_put

Yang Yingliang <[email protected]>
pinctrl: core: fix possible memory leak in pinctrl_enable()

Paulo Alcantara <[email protected]>
cifs: set a minimum of 120s for next dns resolution

Shyam Prasad N <[email protected]>
cifs: To match file servers, make sure the server hostname matches

Zhang Yi <[email protected]>
quota: correct error number in free_dqentry()

Zhang Yi <[email protected]>
quota: check block number when reading the block in quota file

Pali Rohár <[email protected]>
PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge

Pali Rohár <[email protected]>
PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge

Pali Rohár <[email protected]>
PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge

Pali Rohár <[email protected]>
PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge

Marek Behún <[email protected]>
PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG

Marek Behún <[email protected]>
PCI: aardvark: Fix return value of MSI domain .alloc() method

Pali Rohár <[email protected]>
PCI: aardvark: Fix configuring Reference clock

Pali Rohár <[email protected]>
PCI: aardvark: Fix reporting Data Link Layer Link Active

Pali Rohár <[email protected]>
PCI: aardvark: Do not unmask unused interrupts

Pali Rohár <[email protected]>
PCI: aardvark: Fix checking for link up via LTSSM state

Pali Rohár <[email protected]>
PCI: aardvark: Do not clear status bits of masked interrupts

Dan Williams <[email protected]>
cxl/pci: Fix NULL vs ERR_PTR confusion

Li Chen <[email protected]>
PCI: cadence: Add cdns_plat_pcie_probe() missing return

Marek Behún <[email protected]>
PCI: pci-bridge-emul: Fix emulation of W1C bits

yangerkun <[email protected]>
ovl: fix use after free in struct ovl_aio_req

Juergen Gross <[email protected]>
xen/balloon: add late_initcall_sync() for initial ballooning done

Arnd Bergmann <[email protected]>
ifb: fix building without CONFIG_NET_CLS_ACT

Pali Rohár <[email protected]>
serial: core: Fix initializing and restoring termios speed

Steven Rostedt (VMware) <[email protected]>
ring-buffer: Protect ring_buffer_reset() from reentrancy

Xiaoming Ni <[email protected]>
powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found

Oleksij Rempel <[email protected]>
iio: adc: tsc2046: fix scan interval warning

Zhang Changzhong <[email protected]>
can: j1939: j1939_can_recv(): ignore messages with invalid source address

Zhang Changzhong <[email protected]>
can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport

Sean Christopherson <[email protected]>
KVM: nVMX: Handle dynamic MSR intercept toggling

Sean Christopherson <[email protected]>
KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use

Sean Christopherson <[email protected]>
KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows

David Woodhouse <[email protected]>
KVM: x86: Fix recording of guest steal time / preempted status

Mark Rutland <[email protected]>
KVM: arm64: Extract ESR_ELx.EC only

Yang Yingliang <[email protected]>
iio: core: check return value when calling dev_set_name()

Yang Yingliang <[email protected]>
iio: core: fix double free in iio_device_unregister_sysfs()

Henrik Grimler <[email protected]>
power: supply: max17042_battery: use VFSOC for capacity when no rsns

Sebastian Krzyszkowiak <[email protected]>
power: supply: max17042_battery: Prevent int underflow in set_soc_threshold

Miquel Raynal <[email protected]>
mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines

Meng Li <[email protected]>
soc: fsl: dpio: use the combined functions to protect critical zone

Meng Li <[email protected]>
soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id

David Virag <[email protected]>
soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE

Eric W. Biederman <[email protected]>
signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT

Wolfram Sang <[email protected]>
memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode

Eric W. Biederman <[email protected]>
signal: Remove the bogus sigkill_pending in ptrace_stop

Dmitry Osipenko <[email protected]>
ASoC: tegra: Restore AC97 support

Dmitry Osipenko <[email protected]>
ASoC: tegra: Set default card name for Trimslice

Alok Prasad <[email protected]>
RDMA/qedr: Fix NULL deref for query_qp on the GSI QP

Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix Intel ICX IIO event constraints

Kan Liang <[email protected]>
perf/x86/intel/uncore: Fix invalid unit check

Kan Liang <[email protected]>
perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server

Marek Vasut <[email protected]>
rsi: Fix module dev_oper_mode parameter description

Martin Fuzzey <[email protected]>
rsi: fix rate mask set leading to P2P failure

Martin Fuzzey <[email protected]>
rsi: fix key enabled check causing unwanted encryption for vap_id > 0

Martin Fuzzey <[email protected]>
rsi: fix occasional initialisation failure with BT coex

Benjamin Li <[email protected]>
wcn36xx: handle connection loss indication

Reimar Döffinger <[email protected]>
libata: fix checking of DMA state

Jonas Dreßler <[email protected]>
mwifiex: Try waking the firmware until we get an interrupt

Jonas Dreßler <[email protected]>
mwifiex: Read a PCI register after writing the TX ring write pointer

Rafael J. Wysocki <[email protected]>
PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions

Loic Poulain <[email protected]>
wcn36xx: Fix (QoS) null data frame bitrate/modulation

Loic Poulain <[email protected]>
wcn36xx: Fix tx_status mechanism

Loic Poulain <[email protected]>
wcn36xx: Fix HT40 capability for 2Ghz band

Maximilian Luz <[email protected]>
HID: surface-hid: Allow driver matching for target ID 1 devices

Maximilian Luz <[email protected]>
HID: surface-hid: Use correct event registry for managing HID events

Felix Fietkau <[email protected]>
mt76: mt7615: fix skb use-after-free on mac reset

Maximilian Luz <[email protected]>
platform/surface: aggregator_registry: Add support for Surface Laptop Studio

Lukas Wunner <[email protected]>
ifb: Depend on netfilter alternatively to tc

Austin Kim <[email protected]>
evm: mark evm_fixmode as __ro_after_init

Johan Hovold <[email protected]>
rtl8187: fix control-message timeouts

Ingmar Klein <[email protected]>
PCI: Mark Atheros QCA6174 to avoid bus reset

Johan Hovold <[email protected]>
ath10k: fix division by zero in send path

Johan Hovold <[email protected]>
ath10k: fix control-message timeout

Johan Hovold <[email protected]>
ath6kl: fix control-message timeout

Johan Hovold <[email protected]>
ath6kl: fix division by zero in send path

Johan Hovold <[email protected]>
mwifiex: fix division by zero in fw download path

Eric Badger <[email protected]>
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell

Krzysztof Kozlowski <[email protected]>
regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property

Krzysztof Kozlowski <[email protected]>
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled

Zev Weiss <[email protected]>
hwmon: (pmbus/lm25066) Add offset coefficients

Guoqing Jiang <[email protected]>
md/raid1: only allocate write behind bio for WriteMostly device

Corey Minyard <[email protected]>
ipmi:watchdog: Set panic count to proper value on a panic

Ondrej Mosnacek <[email protected]>
selinux: fix race condition when computing ocontext SIDs

Masami Hiramatsu <[email protected]>
ia64: kprobes: Fix to pass correct trampoline address to the handler

Laurent Vivier <[email protected]>
KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling

Andreas Gruenbacher <[email protected]>
powerpc/kvm: Fix kvm_use_magic_page

Sean Christopherson <[email protected]>
KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup

Anand Jain <[email protected]>
btrfs: call btrfs_check_rw_degradable only if there is a missing device

Filipe Manana <[email protected]>
btrfs: fix lost error handling when replaying directory deletes

Li Zhang <[email protected]>
btrfs: clear MISSING device status bit in btrfs_close_one_device

David Yang <[email protected]>
tools/testing/selftests/vm/split_huge_page_test.c: fix application of sizeof to pointer

Wen Gu <[email protected]>
net/smc: Correct spelling mistake to TCPF_SYN_RECV

Tony Lu <[email protected]>
net/smc: Fix smc_link->llc_testlink_time overflow

Yu Xiao <[email protected]>
nfp: bpf: relax prog rejection for mtu check through max_pkt_offset

Dongli Zhang <[email protected]>
vmxnet3: do not stop tx queues after netif_device_detach()

Janghyub Seo <[email protected]>
r8169: Add device 10ec:8162 to driver r8169

Guangbin Huang <[email protected]>
net: hns3: ignore reset event before initialization process is done

Yufeng Mo <[email protected]>
net: hns3: change hclge/hclgevf workqueue to WQ_UNBOUND mode

Amit Engel <[email protected]>
nvmet-tcp: fix header digest verification

Naohiro Aota <[email protected]>
block: schedule queue restart after BLK_STS_ZONE_RESOURCE

Mario <[email protected]>
drm: panel-orientation-quirks: Add quirk for GPD Win3

Walter Stoll <[email protected]>
watchdog: Fix OMAP watchdog early handling

Cyril Strejc <[email protected]>
net: multicast: calculate csum of looped-back and forwarded packets

Thomas Perrot <[email protected]>
spi: spl022: fix Microwire full duplex mode

Maurizio Lombardi <[email protected]>
nvmet-tcp: fix a memory leak when releasing a queue

Dongli Zhang <[email protected]>
xen/netfront: stop tx queues during live migration

Asmaa Mnebhi <[email protected]>
gpio: mlxbf2.c: Add check for bgpio_init failure

Lorenz Bauer <[email protected]>
bpf: Prevent increasing bpf_jit_limit above max

Lorenz Bauer <[email protected]>
bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT

Lorenz Bauer <[email protected]>
bpf: Define bpf_jit_alloc_exec_limit for riscv JIT

Florian Westphal <[email protected]>
fcnal-test: kill hanging ping/nettest binaries on cleanup

Bryant Mairs <[email protected]>
drm: panel-orientation-quirks: Add quirk for Aya Neo 2021

Russ Weight <[email protected]>
spi: altera: Change to dynamic allocation of spi id

Randy Dunlap <[email protected]>
mmc: winbond: don't build on M68K

Paweł Anikiel <[email protected]>
reset: socfpga: add empty driver allowing consumers to probe

Mikko Perttunen <[email protected]>
reset: tegra-bpmp: Handle errors in BPMP response

Bastien Roucariès <[email protected]>
ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode

Arnd Bergmann <[email protected]>
hyperv/vmbus: include linux/bitops.h

Erik Ekman <[email protected]>
sfc: Don't use netif_info before net_device setup

Erik Ekman <[email protected]>
sfc: Export fibre-specific supported link modes

Zheyu Ma <[email protected]>
cavium: Fix return values of the probe function

Zheyu Ma <[email protected]>
mISDN: Fix return values of the probe function

Dmitry Bogdanov <[email protected]>
scsi: qla2xxx: Fix unmap of already freed sgl

Zheyu Ma <[email protected]>
scsi: qla2xxx: Return -ENOMEM if kzalloc() fails

Zheyu Ma <[email protected]>
cavium: Return negative value when pci_alloc_irq_vectors() fails

Wan Jiabing <[email protected]>
net: mscc: ocelot: Add of_node_put() before goto

Wan Jiabing <[email protected]>
net: sparx5: Add of_node_put() before goto

Kele Huang <[email protected]>
ptp: fix error print of ptp_kvm on X86_64 platform

Davide Baldo <[email protected]>
ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers

Stefan Binding <[email protected]>
ASoC: cs42l42: Ensure 0dB full scale volume is used for headsets

Yang Yingliang <[email protected]>
ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked()

Quentin Perret <[email protected]>
KVM: arm64: Report corrupted refcount at EL2

Peter Zijlstra <[email protected]>
x86/iopl: Fake iopl(3) CLI/STI usage

Sean Christopherson <[email protected]>
x86/irq: Ensure PI wakeup handler is unregistered before module unload

Jane Malalane <[email protected]>
x86/cpu: Fix migration safety with X86_BUG_NULL_SEL

Tom Lendacky <[email protected]>
x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c

Miklos Szeredi <[email protected]>
fuse: fix page stealing

yangerkun <[email protected]>
ext4: refresh the ext4_ext_path struct after dropping i_data_sem.

yangerkun <[email protected]>
ext4: ensure enough credits in ext4_ext_shift_path_extents

Shaoying Xu <[email protected]>
ext4: fix lazy initialization next schedule time computation in more granular unit

Takashi Iwai <[email protected]>
ALSA: timer: Unconditionally unlink slave instances, too

Wang Wensheng <[email protected]>
ALSA: timer: Fix use-after-free problem

Takashi Iwai <[email protected]>
ALSA: PCM: Fix NULL dereference at mmap checks

Austin Kim <[email protected]>
ALSA: synth: missing check for possible NULL after the call to kstrdup

Takashi Iwai <[email protected]>
ALSA: hda: Free card instance properly at probe errors

Alexander Tsoy <[email protected]>
ALSA: usb-audio: Add registration quirk for JBL Quantum 400

Jason Ormes <[email protected]>
ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk

Pavel Skripkin <[email protected]>
ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume

Takashi Iwai <[email protected]>
ALSA: mixer: oss: Fix racy access to slots

Johan Hovold <[email protected]>
ALSA: line6: fix control and interrupt message timeouts

Johan Hovold <[email protected]>
ALSA: 6fire: fix control and bulk message timeouts

Johan Hovold <[email protected]>
ALSA: ua101: fix division by zero at probe

Kai-Heng Feng <[email protected]>
ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED

Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS UX550VE

Jaroslav Kysela <[email protected]>
ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N

Jeremy Soller <[email protected]>
ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ

Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo PC70HS

Takashi Iwai <[email protected]>
ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED

Johnathon Clark <[email protected]>
ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14

Ricardo Ribalda <[email protected]>
media: v4l2-ioctl: Fix check_ext_ctrls

Sean Young <[email protected]>
media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers

Chen-Yu Tsai <[email protected]>
media: rkvdec: Support dynamic resolution changes

Sean Young <[email protected]>
media: ite-cir: IR receiver stop working after receive overflow

Chen-Yu Tsai <[email protected]>
media: rkvdec: Do not override sizeimage for output format

Tang Bin <[email protected]>
crypto: s5p-sss - Add error handling in s5p_aes_probe()

jing yangyang <[email protected]>
firmware/psci: fix application of sizeof to pointer

Dan Carpenter <[email protected]>
tpm: Check for integer overflow in tpm2_map_response_body()

Helge Deller <[email protected]>
parisc: Fix ptrace check on syscall return

Helge Deller <[email protected]>
parisc: Fix set_fixmap() on PA1.x CPUs

Sungjong Seo <[email protected]>
exfat: fix incorrect loading of i_blocks for large files

Christian Löhle <[email protected]>
mmc: dw_mmc: Dont wait for DRTO on Write RSP error

Derong Liu <[email protected]>
mmc: mtk-sd: Add wait dma stop done flow

Ziyang Xuan <[email protected]>
char: xillybus: fix msg_ep UAF in xillyusb_probe()

Ben Skeggs <[email protected]>
ce/gf100: fix incorrect CE0 address calculation on some GPUs

Quinn Tran <[email protected]>
scsi: qla2xxx: Fix use after free in eh_abort path

Arun Easi <[email protected]>
scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file

James Smart <[email protected]>
scsi: lpfc: Fix FCP I/O flush functionality for TMF routines

James Smart <[email protected]>
scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding

Tadeusz Struk <[email protected]>
scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()

Ewan D. Milne <[email protected]>
scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run

Jan Kara <[email protected]>
ocfs2: fix data corruption on truncate

Damien Le Moal <[email protected]>
libata: fix read log timeout value

Takashi Iwai <[email protected]>
Input: i8042 - Add quirk for Fujitsu Lifebook T725

Phoenix Huang <[email protected]>
Input: elantench - fix misreporting trackpoint coordinates

Johan Hovold <[email protected]>
Input: iforce - fix control-message timeout

Nehal Bakulchandra Shah <[email protected]>
usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform

Mathias Nyman <[email protected]>
xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay


-------------

Diffstat:

Documentation/admin-guide/kernel-parameters.txt | 7 +
.../devicetree/bindings/iio/dac/adi,ad5766.yaml | 2 +-
.../bindings/regulator/samsung,s5m8767.txt | 23 +-
Documentation/filesystems/fscrypt.rst | 10 +-
Makefile | 4 +-
arch/alpha/include/asm/processor.h | 2 +-
arch/alpha/kernel/process.c | 5 +-
arch/arc/include/asm/processor.h | 2 +-
arch/arc/kernel/stacktrace.c | 4 +-
arch/arm/Makefile | 22 +-
arch/arm/boot/dts/at91-tse850-3.dts | 2 +-
arch/arm/boot/dts/bcm4708-netgear-r6250.dts | 2 +-
arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts | 2 +-
arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 2 +-
arch/arm/boot/dts/bcm4709-linksys-ea9200.dts | 2 +-
arch/arm/boot/dts/bcm4709-netgear-r7000.dts | 2 +-
arch/arm/boot/dts/bcm4709-netgear-r8000.dts | 2 +-
arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts | 2 +-
arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts | 2 +-
arch/arm/boot/dts/bcm53016-meraki-mr32.dts | 2 +-
arch/arm/boot/dts/bcm94708.dts | 2 +-
arch/arm/boot/dts/bcm94709.dts | 2 +-
arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
arch/arm/boot/dts/qcom-msm8974.dtsi | 4 +-
arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 8 +-
arch/arm/boot/dts/stm32mp151.dtsi | 16 +-
arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 2 +-
arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 2 +-
arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +-
arch/arm/include/asm/processor.h | 2 +-
arch/arm/kernel/process.c | 4 +-
arch/arm/kernel/stacktrace.c | 3 +-
arch/arm/mach-s3c/irq-s3c24xx.c | 22 +-
arch/arm/mm/Kconfig | 2 +-
arch/arm/mm/kasan_init.c | 2 +-
arch/arm/mm/mmu.c | 4 +-
arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts | 2 +-
arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts | 2 +-
arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +-
.../boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi | 4 +-
.../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi | 4 +-
.../boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +-
.../boot/dts/amlogic/meson-sm1-khadas-vim3l.dts | 2 +-
arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi | 6 +-
arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 2 +-
arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 +-
arch/arm64/boot/dts/qcom/msm8916.dtsi | 8 +-
arch/arm64/boot/dts/qcom/pm8916.dtsi | 1 -
arch/arm64/boot/dts/qcom/pmi8994.dtsi | 2 +-
.../arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +-
.../arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sc7180.dtsi | 52 ++---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 6 +-
.../arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 1 +
arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +-
arch/arm64/boot/dts/rockchip/rk3568.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 6 +-
arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 16 +-
arch/arm64/include/asm/esr.h | 1 +
arch/arm64/include/asm/pgtable.h | 12 +-
arch/arm64/include/asm/processor.h | 2 +-
arch/arm64/kernel/cpufeature.c | 10 +-
arch/arm64/kernel/process.c | 4 +-
arch/arm64/kernel/vdso32/Makefile | 3 +-
arch/arm64/kvm/hyp/hyp-entry.S | 2 +-
arch/arm64/kvm/hyp/nvhe/host.S | 2 +-
arch/arm64/kvm/hyp/nvhe/page_alloc.c | 1 +
arch/arm64/mm/mmu.c | 5 +
arch/arm64/net/bpf_jit_comp.c | 5 +
arch/csky/include/asm/processor.h | 2 +-
arch/csky/kernel/stacktrace.c | 5 +-
arch/h8300/include/asm/processor.h | 2 +-
arch/h8300/kernel/process.c | 5 +-
arch/hexagon/include/asm/processor.h | 2 +-
arch/hexagon/kernel/process.c | 4 +-
arch/ia64/Kconfig.debug | 2 +-
arch/ia64/include/asm/processor.h | 2 +-
arch/ia64/kernel/kprobes.c | 9 +-
arch/ia64/kernel/process.c | 5 +-
arch/m68k/Kconfig.machine | 1 +
arch/m68k/include/asm/processor.h | 2 +-
arch/m68k/kernel/process.c | 4 +-
arch/microblaze/include/asm/processor.h | 2 +-
arch/microblaze/kernel/process.c | 2 +-
arch/mips/Kconfig | 1 +
arch/mips/Makefile | 2 +
arch/mips/include/asm/cmpxchg.h | 5 +-
arch/mips/include/asm/mips-cm.h | 12 +-
arch/mips/include/asm/processor.h | 2 +-
arch/mips/kernel/mips-cm.c | 21 +-
arch/mips/kernel/process.c | 8 +-
arch/mips/kernel/r2300_fpu.S | 4 +-
arch/mips/kernel/syscall.c | 9 -
arch/mips/lantiq/xway/dma.c | 23 +-
arch/nds32/include/asm/processor.h | 2 +-
arch/nds32/kernel/process.c | 7 +-
arch/nios2/include/asm/processor.h | 2 +-
arch/nios2/kernel/process.c | 5 +-
arch/openrisc/include/asm/processor.h | 2 +-
arch/openrisc/kernel/dma.c | 4 +-
arch/openrisc/kernel/process.c | 2 +-
arch/openrisc/kernel/smp.c | 6 +-
arch/parisc/include/asm/pgtable.h | 10 +-
arch/parisc/include/asm/processor.h | 2 +-
arch/parisc/kernel/cache.c | 4 +-
arch/parisc/kernel/entry.S | 2 +-
arch/parisc/kernel/process.c | 5 +-
arch/parisc/kernel/smp.c | 19 +-
arch/parisc/kernel/unwind.c | 21 +-
arch/parisc/kernel/vmlinux.lds.S | 3 +-
arch/parisc/mm/fixmap.c | 5 +-
arch/parisc/mm/init.c | 4 +-
arch/powerpc/Kconfig | 6 +-
arch/powerpc/include/asm/nohash/32/pgtable.h | 19 +-
arch/powerpc/include/asm/nohash/32/pte-8xx.h | 22 ++
arch/powerpc/include/asm/nohash/64/pgtable.h | 5 -
arch/powerpc/include/asm/nohash/pte-book3e.h | 18 +-
arch/powerpc/include/asm/paravirt.h | 18 +-
arch/powerpc/include/asm/processor.h | 2 +-
arch/powerpc/kernel/firmware.c | 7 +-
arch/powerpc/kernel/head_booke.h | 15 +-
arch/powerpc/kernel/interrupt.c | 2 +-
arch/powerpc/kernel/kvm.c | 2 +-
arch/powerpc/kernel/process.c | 9 +-
arch/powerpc/kvm/book3s_hv.c | 30 ++-
arch/powerpc/kvm/booke.c | 16 +-
arch/powerpc/lib/feature-fixups.c | 11 +
arch/powerpc/mm/mem.c | 2 +-
arch/powerpc/mm/nohash/tlb_low_64e.S | 8 +-
arch/powerpc/mm/pgtable_32.c | 2 +-
arch/powerpc/net/bpf_jit_comp.c | 2 +-
arch/powerpc/perf/power10-events-list.h | 8 +-
arch/powerpc/perf/power10-pmu.c | 44 ++--
arch/powerpc/platforms/44x/fsp2.c | 2 +
arch/powerpc/platforms/85xx/Makefile | 4 +-
arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 7 +-
arch/powerpc/platforms/85xx/smp.c | 12 +-
arch/powerpc/platforms/book3s/vas-api.c | 4 +-
arch/powerpc/platforms/powernv/opal-prd.c | 12 +-
arch/powerpc/platforms/pseries/mobility.c | 34 +++
arch/powerpc/xmon/xmon.c | 3 +-
arch/riscv/include/asm/processor.h | 2 +-
arch/riscv/kernel/stacktrace.c | 12 +-
arch/riscv/net/bpf_jit_core.c | 5 +
arch/s390/include/asm/processor.h | 2 +-
arch/s390/kernel/perf_cpum_cf.c | 4 +-
arch/s390/kernel/process.c | 4 +-
arch/s390/kernel/uv.c | 2 +-
arch/s390/kvm/priv.c | 2 +
arch/s390/kvm/pv.c | 21 +-
arch/s390/mm/gmap.c | 11 +-
arch/s390/mm/pgtable.c | 70 ++++--
arch/sh/include/asm/processor_32.h | 2 +-
arch/sh/kernel/cpu/fpu.c | 10 +-
arch/sh/kernel/process_32.c | 5 +-
arch/sparc/include/asm/processor_32.h | 2 +-
arch/sparc/include/asm/processor_64.h | 2 +-
arch/sparc/kernel/process_32.c | 5 +-
arch/sparc/kernel/process_64.c | 5 +-
arch/um/include/asm/processor-generic.h | 2 +-
arch/um/kernel/process.c | 5 +-
arch/x86/crypto/aesni-intel_glue.c | 2 +-
arch/x86/events/intel/core.c | 5 +-
arch/x86/events/intel/ds.c | 5 +-
arch/x86/events/intel/uncore_discovery.h | 2 +-
arch/x86/events/intel/uncore_snbep.c | 6 +-
arch/x86/hyperv/hv_init.c | 5 +-
arch/x86/include/asm/insn-eval.h | 1 +
arch/x86/include/asm/irq_stack.h | 37 ++-
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/include/asm/page_64_types.h | 2 +-
arch/x86/include/asm/processor.h | 3 +-
arch/x86/include/asm/stacktrace.h | 10 +
arch/x86/include/asm/traps.h | 6 +-
arch/x86/kernel/cpu/amd.c | 2 +
arch/x86/kernel/cpu/common.c | 44 +++-
arch/x86/kernel/cpu/cpu.h | 1 +
arch/x86/kernel/cpu/hygon.c | 2 +
arch/x86/kernel/cpu/mce/intel.c | 5 +-
arch/x86/kernel/dumpstack_64.c | 6 +
arch/x86/kernel/irq.c | 4 +-
arch/x86/kernel/process.c | 66 ++----
arch/x86/kernel/traps.c | 60 +++--
arch/x86/kvm/cpuid.c | 47 ++--
arch/x86/kvm/vmx/nested.c | 103 ++++-----
arch/x86/kvm/vmx/vmx.c | 68 +-----
arch/x86/kvm/vmx/vmx.h | 63 ++++++
arch/x86/kvm/x86.c | 108 ++++++---
arch/x86/lib/insn-eval.c | 2 +-
arch/x86/lib/insn.c | 5 +-
arch/x86/mm/fault.c | 20 +-
arch/x86/mm/mem_encrypt_identity.c | 9 +
arch/xtensa/include/asm/processor.h | 2 +-
arch/xtensa/kernel/process.c | 5 +-
block/blk-cgroup.c | 10 +
block/blk-mq.c | 18 +-
block/blk.h | 6 +
crypto/Kconfig | 2 +-
crypto/pcrypt.c | 12 +-
crypto/tcrypt.c | 5 +-
drivers/acpi/ac.c | 19 ++
drivers/acpi/acpica/acglobal.h | 2 +
drivers/acpi/acpica/hwesleep.c | 8 +-
drivers/acpi/acpica/hwsleep.c | 11 +-
drivers/acpi/acpica/hwxfsleep.c | 7 +
drivers/acpi/battery.c | 2 +-
drivers/acpi/glue.c | 25 ++
drivers/acpi/internal.h | 1 +
drivers/acpi/pmic/intel_pmic.c | 51 +++--
drivers/acpi/power.c | 86 +++----
drivers/acpi/resource.c | 56 ++++-
drivers/acpi/scan.c | 6 +
drivers/ata/libata-core.c | 2 +-
drivers/ata/libata-eh.c | 8 +
drivers/auxdisplay/ht16k33.c | 66 +++---
drivers/auxdisplay/img-ascii-lcd.c | 10 +
drivers/base/component.c | 5 +-
drivers/base/core.c | 4 +-
drivers/base/power/main.c | 93 +++++---
drivers/block/ataflop.c | 141 +++++++-----
drivers/block/floppy.c | 9 +-
drivers/block/nbd.c | 24 +-
drivers/block/zram/zram_drv.c | 2 +-
drivers/bluetooth/btmtkuart.c | 13 +-
drivers/bus/ti-sysc.c | 65 +++++-
drivers/char/hw_random/mtk-rng.c | 9 +-
drivers/char/ipmi/ipmi_msghandler.c | 10 +-
drivers/char/ipmi/ipmi_watchdog.c | 25 +-
drivers/char/ipmi/kcs_bmc_serio.c | 4 +-
drivers/char/tpm/tpm2-space.c | 3 +
drivers/char/tpm/tpm_tis_core.c | 26 ++-
drivers/char/tpm/tpm_tis_core.h | 4 +
drivers/char/tpm/tpm_tis_spi_main.c | 1 +
drivers/char/xillybus/xillyusb.c | 1 +
drivers/clk/at91/clk-master.c | 6 +-
drivers/clk/at91/clk-sam9x60-pll.c | 4 +-
drivers/clk/at91/pmc.c | 5 +
drivers/clk/mvebu/ap-cpu-clk.c | 14 +-
drivers/clocksource/Kconfig | 1 +
drivers/cpufreq/cpufreq.c | 7 +
drivers/cpufreq/intel_pstate.c | 37 ++-
drivers/cpuidle/sysfs.c | 5 +-
drivers/crypto/caam/caampkc.c | 19 +-
drivers/crypto/caam/regs.h | 3 +
drivers/crypto/ccree/cc_driver.c | 3 +-
drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 1 +
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 13 ++
drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 +
drivers/crypto/s5p-sss.c | 2 +
drivers/cxl/pci.c | 2 +-
drivers/dma-buf/dma-buf.c | 1 +
drivers/dma/at_xdmac.c | 53 +++--
drivers/dma/bestcomm/ata.c | 2 +-
drivers/dma/bestcomm/bestcomm.c | 22 +-
drivers/dma/bestcomm/fec.c | 4 +-
drivers/dma/bestcomm/gen_bd.c | 4 +-
drivers/dma/dmaengine.h | 2 +-
drivers/dma/stm32-dma.c | 23 +-
drivers/dma/ti/k3-udma.c | 32 ++-
drivers/edac/amd64_edac.c | 22 +-
drivers/edac/sb_edac.c | 2 +-
drivers/firmware/psci/psci_checker.c | 2 +-
drivers/firmware/qcom_scm.c | 2 +-
drivers/gpio/gpio-mlxbf2.c | 5 +
drivers/gpio/gpio-realtek-otto.c | 2 +-
drivers/gpu/drm/Kconfig | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 2 +-
drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 8 +-
drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 17 +-
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 1 +
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +-
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +-
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
.../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 16 +-
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 +-
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 89 +++-----
drivers/gpu/drm/bridge/analogix/anx7625.c | 12 +-
drivers/gpu/drm/bridge/ite-it66121.c | 21 +-
drivers/gpu/drm/bridge/lontium-lt9611uxc.c | 9 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 47 +++-
drivers/gpu/drm/drm_plane_helper.c | 1 -
drivers/gpu/drm/i915/display/intel_fb.c | 5 +-
drivers/gpu/drm/imx/imx-drm-core.c | 2 -
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 6 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 8 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +
drivers/gpu/drm/msm/msm_gem.c | 5 +-
drivers/gpu/drm/msm/msm_gpu.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_gem.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_svm.c | 4 +
drivers/gpu/drm/nouveau/nvkm/engine/ce/gt215.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 3 +-
drivers/gpu/drm/radeon/radeon_gem.c | 2 +-
drivers/gpu/drm/sun4i/sun8i_csc.h | 4 +-
drivers/gpu/drm/ttm/ttm_bo_vm.c | 99 +-------
drivers/gpu/drm/v3d/v3d_gem.c | 4 +-
drivers/gpu/drm/virtio/virtgpu_vq.c | 8 +-
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 -
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 72 +-----
drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c | 3 -
drivers/hid/hid-u2fzero.c | 10 +-
drivers/hid/surface-hid/surface_hid.c | 4 +-
drivers/hv/hyperv_vmbus.h | 1 +
drivers/hwmon/hwmon.c | 6 +-
drivers/hwmon/pmbus/lm25066.c | 25 +-
drivers/hwtracing/coresight/coresight-cti-core.c | 2 +-
drivers/hwtracing/coresight/coresight-trbe.c | 10 +-
drivers/i2c/busses/i2c-mt65xx.c | 2 +-
drivers/i2c/busses/i2c-xlr.c | 6 +-
drivers/iio/accel/st_accel_i2c.c | 4 +-
drivers/iio/accel/st_accel_spi.c | 4 +-
drivers/iio/adc/ti-tsc2046.c | 2 +-
drivers/iio/dac/ad5446.c | 9 +-
drivers/iio/dac/ad5766.c | 6 +-
drivers/iio/dac/ad5770r.c | 2 +-
drivers/iio/gyro/st_gyro_i2c.c | 4 +-
drivers/iio/gyro/st_gyro_spi.c | 4 +-
drivers/iio/imu/adis.c | 4 +-
drivers/iio/industrialio-buffer.c | 28 ++-
drivers/iio/industrialio-core.c | 9 +-
drivers/iio/magnetometer/st_magn_i2c.c | 4 +-
drivers/iio/magnetometer/st_magn_spi.c | 4 +-
drivers/iio/pressure/st_pressure_i2c.c | 4 +-
drivers/iio/pressure/st_pressure_spi.c | 8 +-
drivers/infiniband/core/uverbs_cmd.c | 3 -
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 +-
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +-
drivers/infiniband/hw/mlx4/qp.c | 4 +-
drivers/infiniband/hw/qedr/verbs.c | 15 +-
drivers/infiniband/sw/rxe/rxe_param.h | 2 +-
drivers/input/joystick/iforce/iforce-usb.c | 2 +-
drivers/input/misc/ariel-pwrbutton.c | 7 +
drivers/input/mouse/elantech.c | 13 ++
drivers/input/serio/i8042-x86ia64io.h | 14 ++
drivers/input/touchscreen/st1232.c | 2 +-
drivers/iommu/dma-iommu.c | 16 +-
drivers/iommu/mtk_iommu.c | 4 +-
drivers/irqchip/irq-bcm6345-l1.c | 2 +-
drivers/irqchip/irq-sifive-plic.c | 8 +-
drivers/isdn/hardware/mISDN/hfcpci.c | 8 +-
drivers/leds/led-triggers.c | 41 ++--
drivers/mailbox/mtk-cmdq-mailbox.c | 1 -
drivers/md/md.c | 11 +-
drivers/md/raid1.c | 2 +-
drivers/media/common/videobuf2/videobuf2-core.c | 42 ++--
.../media/common/videobuf2/videobuf2-dma-contig.c | 36 +--
drivers/media/common/videobuf2/videobuf2-dma-sg.c | 33 +--
drivers/media/common/videobuf2/videobuf2-vmalloc.c | 30 +--
drivers/media/dvb-frontends/mn88443x.c | 18 +-
drivers/media/i2c/Kconfig | 1 +
drivers/media/i2c/imx258.c | 12 +-
drivers/media/i2c/ir-kbd-i2c.c | 1 +
drivers/media/i2c/mt9p031.c | 28 ++-
drivers/media/i2c/tda1997x.c | 8 +-
drivers/media/pci/cx23885/cx23885-alsa.c | 3 +-
drivers/media/pci/ivtv/ivtvfb.c | 4 +-
drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 27 ++-
drivers/media/platform/allegro-dvt/allegro-core.c | 9 +
drivers/media/platform/atmel/atmel-isc-base.c | 25 +-
drivers/media/platform/atmel/atmel-isc.h | 2 +
drivers/media/platform/atmel/atmel-sama5d2-isc.c | 39 ++--
drivers/media/platform/atmel/atmel-sama7g5-isc.c | 22 +-
drivers/media/platform/imx-jpeg/mxc-jpeg.c | 6 +
drivers/media/platform/meson/ge2d/ge2d.c | 6 +-
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 8 +-
drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 +-
drivers/media/platform/qcom/venus/pm_helpers.c | 8 +-
drivers/media/platform/rcar-vin/rcar-csi2.c | 2 +
drivers/media/platform/rcar-vin/rcar-dma.c | 3 +-
drivers/media/platform/s5p-mfc/s5p_mfc.c | 6 +-
drivers/media/platform/stm32/stm32-dcmi.c | 19 +-
.../media/platform/sunxi/sun6i-csi/sun6i_video.c | 6 +-
drivers/media/radio/radio-wl1273.c | 2 +-
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
drivers/media/radio/si470x/radio-si470x-usb.c | 2 +-
drivers/media/rc/ir_toy.c | 2 +-
drivers/media/rc/ite-cir.c | 2 +-
drivers/media/rc/mceusb.c | 1 +
drivers/media/spi/cxd2880-spi.c | 2 +-
drivers/media/test-drivers/vidtv/vidtv_bridge.c | 1 +
drivers/media/usb/dvb-usb/az6027.c | 1 +
drivers/media/usb/dvb-usb/dibusb-common.c | 2 +-
drivers/media/usb/em28xx/em28xx-cards.c | 5 +-
drivers/media/usb/em28xx/em28xx-core.c | 5 +-
drivers/media/usb/tm6000/tm6000-video.c | 3 +-
drivers/media/usb/ttusb-dec/ttusb_dec.c | 10 +-
drivers/media/usb/uvc/uvc_driver.c | 7 +-
drivers/media/usb/uvc/uvc_v4l2.c | 7 +-
drivers/media/usb/uvc/uvc_video.c | 5 +
drivers/media/v4l2-core/v4l2-ioctl.c | 67 ++++--
drivers/memory/fsl_ifc.c | 13 +-
drivers/memory/renesas-rpc-if.c | 113 +++++++---
drivers/memstick/core/ms_block.c | 2 +-
drivers/memstick/host/jmb38x_ms.c | 2 +-
drivers/memstick/host/r592.c | 8 +-
drivers/mfd/altera-sysmgr.c | 2 +-
drivers/mfd/dln2.c | 18 ++
drivers/mfd/mfd-core.c | 2 +
drivers/mfd/motorola-cpcap.c | 8 +
drivers/mfd/sprd-sc27xx-spi.c | 7 +
drivers/mmc/host/Kconfig | 2 +-
drivers/mmc/host/dw_mmc.c | 3 +-
drivers/mmc/host/moxart-mmc.c | 16 +-
drivers/mmc/host/mtk-sd.c | 5 +
drivers/mmc/host/mxs-mmc.c | 10 +
drivers/mmc/host/sdhci-omap.c | 18 +-
drivers/most/most_usb.c | 5 +-
drivers/mtd/mtdcore.c | 4 +-
drivers/mtd/nand/raw/ams-delta.c | 12 +-
drivers/mtd/nand/raw/arasan-nand-controller.c | 15 ++
drivers/mtd/nand/raw/au1550nd.c | 12 +-
drivers/mtd/nand/raw/fsmc_nand.c | 4 +-
drivers/mtd/nand/raw/gpio.c | 12 +-
drivers/mtd/nand/raw/intel-nand-controller.c | 5 +
drivers/mtd/nand/raw/mpc5121_nfc.c | 12 +-
drivers/mtd/nand/raw/orion_nand.c | 12 +-
drivers/mtd/nand/raw/pasemi_nand.c | 12 +-
drivers/mtd/nand/raw/plat_nand.c | 12 +-
drivers/mtd/nand/raw/socrates_nand.c | 12 +-
drivers/mtd/nand/raw/xway_nand.c | 12 +-
drivers/mtd/spi-nor/controllers/hisi-sfc.c | 1 -
drivers/net/Kconfig | 2 +-
drivers/net/bonding/bond_sysfs_slave.c | 36 +--
drivers/net/can/dev/bittiming.c | 2 +-
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
drivers/net/can/usb/etas_es58x/es58x_core.c | 6 +-
drivers/net/dsa/lantiq_gswip.c | 28 ++-
drivers/net/dsa/mv88e6xxx/chip.c | 5 +-
drivers/net/dsa/ocelot/felix.c | 9 +-
drivers/net/dsa/rtl8366.c | 2 +-
drivers/net/dsa/rtl8366rb.c | 2 +-
drivers/net/ethernet/amd/xgbe/xgbe-common.h | 8 +
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 13 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h | 13 --
drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 +-
drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 7 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.h | 2 +
.../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +-
.../chelsio/inline_crypto/chtls/chtls_cm.h | 2 +-
drivers/net/ethernet/dec/tulip/winbond-840.c | 2 +-
drivers/net/ethernet/fealnx.c | 2 +-
drivers/net/ethernet/freescale/enetc/enetc_qos.c | 18 +-
drivers/net/ethernet/google/gve/gve.h | 17 +-
drivers/net/ethernet/google/gve/gve_adminq.h | 1 +
drivers/net/ethernet/google/gve/gve_main.c | 48 +++-
drivers/net/ethernet/google/gve/gve_rx.c | 7 +-
drivers/net/ethernet/google/gve/gve_tx.c | 23 +-
drivers/net/ethernet/google/gve/gve_tx_dqo.c | 84 ++++---
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 20 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 45 +---
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 7 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 77 +++----
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 4 +-
.../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 15 +-
.../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 5 +-
drivers/net/ethernet/ibm/ibmvnic.c | 21 +-
drivers/net/ethernet/intel/ice/ice.h | 7 +-
drivers/net/ethernet/intel/ice/ice_base.c | 2 +-
drivers/net/ethernet/intel/ice/ice_devlink.c | 109 ++++++---
drivers/net/ethernet/intel/ice/ice_devlink.h | 6 +-
drivers/net/ethernet/intel/ice/ice_lib.c | 3 +-
drivers/net/ethernet/intel/ice/ice_main.c | 4 +-
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 22 +-
drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h | 9 +
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 38 ++--
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 78 ++++---
.../net/ethernet/microchip/sparx5/sparx5_main.c | 1 +
drivers/net/ethernet/mscc/ocelot.c | 17 --
drivers/net/ethernet/mscc/ocelot_net.c | 1 +
drivers/net/ethernet/mscc/ocelot_vsc7514.c | 1 +
drivers/net/ethernet/netronome/nfp/bpf/main.c | 16 +-
drivers/net/ethernet/netronome/nfp/bpf/main.h | 2 +
drivers/net/ethernet/netronome/nfp/bpf/offload.c | 17 +-
drivers/net/ethernet/qlogic/qede/qede_main.c | 12 +-
drivers/net/ethernet/realtek/r8169_main.c | 1 +
drivers/net/ethernet/sfc/mcdi_port_common.c | 37 ++-
drivers/net/ethernet/sfc/ptp.c | 4 +-
drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 -
drivers/net/ethernet/ti/cpsw_ale.c | 6 +-
drivers/net/ethernet/ti/davinci_emac.c | 16 +-
drivers/net/ifb.c | 2 +
drivers/net/phy/micrel.c | 9 +-
drivers/net/phy/phy.c | 7 +-
drivers/net/phy/phylink.c | 7 +-
drivers/net/vmxnet3/vmxnet3_drv.c | 1 -
drivers/net/vrf.c | 28 ++-
drivers/net/wireless/ath/ath10k/core.c | 11 +-
drivers/net/wireless/ath/ath10k/coredump.c | 11 +-
drivers/net/wireless/ath/ath10k/coredump.h | 7 +
drivers/net/wireless/ath/ath10k/mac.c | 37 ++-
drivers/net/wireless/ath/ath10k/qmi.c | 3 +-
drivers/net/wireless/ath/ath10k/sdio.c | 5 +-
drivers/net/wireless/ath/ath10k/snoc.c | 77 +++++++
drivers/net/wireless/ath/ath10k/snoc.h | 5 +
drivers/net/wireless/ath/ath10k/usb.c | 7 +-
drivers/net/wireless/ath/ath10k/wmi.c | 4 +
drivers/net/wireless/ath/ath10k/wmi.h | 3 +
drivers/net/wireless/ath/ath11k/dbring.c | 16 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 13 +-
drivers/net/wireless/ath/ath11k/mac.c | 2 +-
drivers/net/wireless/ath/ath11k/qmi.c | 4 +-
drivers/net/wireless/ath/ath11k/reg.c | 11 +-
drivers/net/wireless/ath/ath11k/reg.h | 2 +-
drivers/net/wireless/ath/ath11k/wmi.c | 40 ++--
drivers/net/wireless/ath/ath11k/wmi.h | 3 +-
drivers/net/wireless/ath/ath6kl/usb.c | 7 +-
drivers/net/wireless/ath/ath9k/main.c | 4 +-
drivers/net/wireless/ath/dfs_pattern_detector.c | 10 +-
drivers/net/wireless/ath/wcn36xx/dxe.c | 49 ++--
drivers/net/wireless/ath/wcn36xx/hal.h | 32 +++
drivers/net/wireless/ath/wcn36xx/main.c | 21 +-
drivers/net/wireless/ath/wcn36xx/smd.c | 126 ++++++++++-
drivers/net/wireless/ath/wcn36xx/smd.h | 1 +
drivers/net/wireless/ath/wcn36xx/txrx.c | 64 +++---
drivers/net/wireless/ath/wcn36xx/txrx.h | 3 +-
drivers/net/wireless/broadcom/b43/phy_g.c | 2 +-
drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
.../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 10 +
drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 13 +-
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 5 +-
drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 6 +-
drivers/net/wireless/marvell/libertas/if_usb.c | 2 +
drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +
drivers/net/wireless/marvell/mwifiex/11n.c | 5 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 32 +--
drivers/net/wireless/marvell/mwifiex/pcie.c | 36 ++-
drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++
drivers/net/wireless/marvell/mwl8k.c | 2 +-
drivers/net/wireless/mediatek/mt76/debugfs.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt76.h | 8 +-
.../net/wireless/mediatek/mt76/mt7615/debugfs.c | 29 ++-
drivers/net/wireless/mediatek/mt76/mt7615/init.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 60 ++---
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 18 +-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.c | 30 ++-
.../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 8 +-
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 13 +-
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 10 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.h | 3 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 22 +-
.../net/wireless/mediatek/mt76/mt7921/debugfs.c | 36 ++-
drivers/net/wireless/mediatek/mt76/mt7921/init.c | 13 ++
drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 68 +++++-
drivers/net/wireless/mediatek/mt76/mt7921/mac.h | 8 +
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 22 +-
drivers/net/wireless/mediatek/mt76/mt7921/mcu.h | 10 +-
drivers/net/wireless/mediatek/mt76/mt7921/regs.h | 8 +-
drivers/net/wireless/microchip/wilc1000/cfg80211.c | 3 +-
.../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +-
drivers/net/wireless/realtek/rtw88/fw.c | 7 +-
drivers/net/wireless/realtek/rtw88/reg.h | 1 +
drivers/net/wireless/rsi/rsi_91x_core.c | 2 +
drivers/net/wireless/rsi/rsi_91x_hal.c | 10 +-
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 ++----
drivers/net/wireless/rsi/rsi_91x_main.c | 17 +-
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 24 +-
drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 +-
drivers/net/wireless/rsi/rsi_91x_usb.c | 5 +-
drivers/net/wireless/rsi/rsi_hal.h | 11 +
drivers/net/wireless/rsi/rsi_main.h | 15 +-
drivers/net/xen-netfront.c | 8 +
drivers/nfc/pn533/pn533.c | 6 +-
drivers/nvdimm/btt.c | 1 -
drivers/nvme/host/multipath.c | 9 +-
drivers/nvme/host/rdma.c | 2 +
drivers/nvme/target/configfs.c | 2 +
drivers/nvme/target/rdma.c | 24 ++
drivers/nvme/target/tcp.c | 21 +-
drivers/of/unittest.c | 16 +-
drivers/opp/of.c | 2 +-
drivers/pci/controller/cadence/pci-j721e.c | 2 +-
drivers/pci/controller/cadence/pcie-cadence-plat.c | 2 +
drivers/pci/controller/dwc/pcie-uniphier.c | 26 +--
drivers/pci/controller/pci-aardvark.c | 251 ++++++++++++++++++---
drivers/pci/pci-bridge-emul.c | 13 ++
drivers/pci/pci.c | 8 +
drivers/pci/quirks.c | 1 +
drivers/phy/microchip/sparx5_serdes.c | 4 +-
drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 +-
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 2 +-
drivers/phy/ti/phy-gmii-sel.c | 2 +
drivers/pinctrl/core.c | 2 +
drivers/pinctrl/pinctrl-amd.c | 19 +-
drivers/pinctrl/pinctrl-amd.h | 1 +
drivers/pinctrl/pinctrl-equilibrium.c | 7 +-
drivers/pinctrl/renesas/core.c | 2 +-
.../platform/surface/surface_aggregator_registry.c | 54 +++++
drivers/platform/x86/thinkpad_acpi.c | 2 +-
drivers/platform/x86/wmi.c | 9 +-
drivers/power/reset/at91-reset.c | 4 +-
drivers/power/supply/bq27xxx_battery_i2c.c | 3 +-
drivers/power/supply/max17040_battery.c | 2 +
drivers/power/supply/max17042_battery.c | 12 +-
drivers/power/supply/rt5033_battery.c | 2 +-
drivers/ptp/ptp_kvm_x86.c | 4 +-
drivers/regulator/s5m8767.c | 21 +-
drivers/remoteproc/imx_rproc.c | 41 ++--
drivers/remoteproc/remoteproc_core.c | 8 +-
drivers/remoteproc/remoteproc_coredump.c | 2 +-
drivers/remoteproc/remoteproc_elf_loader.c | 4 +-
drivers/reset/reset-socfpga.c | 26 +++
drivers/reset/tegra/reset-bpmp.c | 9 +-
drivers/rtc/rtc-ds1302.c | 7 +
drivers/rtc/rtc-ds1390.c | 7 +
drivers/rtc/rtc-mcp795.c | 7 +
drivers/rtc/rtc-pcf2123.c | 9 +
drivers/rtc/rtc-rv3032.c | 4 +-
drivers/s390/char/tape_std.c | 3 +-
drivers/s390/cio/css.c | 4 +-
drivers/s390/cio/device_ops.c | 12 +-
drivers/s390/crypto/ap_queue.c | 2 +
drivers/scsi/csiostor/csio_lnode.c | 2 +-
drivers/scsi/dc395x.c | 1 +
drivers/scsi/hosts.c | 1 +
drivers/scsi/lpfc/lpfc_els.c | 11 +-
drivers/scsi/lpfc/lpfc_hbadisc.c | 10 +-
drivers/scsi/lpfc/lpfc_nvme.c | 5 +-
drivers/scsi/lpfc/lpfc_scsi.c | 7 +
drivers/scsi/lpfc/lpfc_sli.c | 101 +++++++--
drivers/scsi/megaraid/megaraid_sas_fusion.c | 11 +-
drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
drivers/scsi/pm8001/pm8001_sas.h | 3 +-
drivers/scsi/pm8001/pm80xx_hwi.c | 53 ++++-
drivers/scsi/qedf/qedf_main.c | 2 +
drivers/scsi/qla2xxx/qla_attr.c | 24 +-
drivers/scsi/qla2xxx/qla_gbl.h | 2 -
drivers/scsi/qla2xxx/qla_init.c | 4 +-
drivers/scsi/qla2xxx/qla_mr.c | 23 --
drivers/scsi/qla2xxx/qla_os.c | 37 +--
drivers/scsi/qla2xxx/qla_target.c | 14 +-
drivers/scsi/scsi_error.c | 25 ++
drivers/scsi/scsi_lib.c | 3 +-
drivers/scsi/ufs/ufshcd-pltfrm.c | 4 +-
drivers/soc/fsl/dpaa2-console.c | 1 +
drivers/soc/fsl/dpio/dpio-service.c | 2 +-
drivers/soc/fsl/dpio/qbman-portal.c | 9 +-
drivers/soc/qcom/apr.c | 2 +
drivers/soc/qcom/llcc-qcom.c | 2 +-
drivers/soc/qcom/rpmhpd.c | 20 +-
drivers/soc/qcom/socinfo.c | 4 +-
drivers/soc/samsung/Kconfig | 1 +
drivers/soc/tegra/pmc.c | 2 +-
drivers/soundwire/bus.c | 2 +-
drivers/soundwire/debugfs.c | 2 +-
drivers/spi/atmel-quadspi.c | 2 +-
drivers/spi/spi-altera-dfl.c | 2 +-
drivers/spi/spi-altera-platform.c | 2 +-
drivers/spi/spi-bcm-qspi.c | 8 +-
drivers/spi/spi-mtk-nor.c | 2 +-
drivers/spi/spi-pl022.c | 5 +-
drivers/spi/spi-rpc-if.c | 4 +-
drivers/spi/spi-stm32-qspi.c | 2 +-
drivers/spi/spi.c | 41 ++++
drivers/staging/ks7010/Kconfig | 3 +
drivers/staging/media/atomisp/i2c/atomisp-lm3554.c | 37 +--
drivers/staging/media/imx/imx-media-dev-common.c | 2 +
drivers/staging/media/ipu3/ipu3-v4l2.c | 7 +-
drivers/staging/media/rkvdec/rkvdec-h264.c | 5 +-
drivers/staging/media/rkvdec/rkvdec.c | 40 ++--
drivers/staging/most/dim2/Makefile | 2 +-
drivers/staging/most/dim2/dim2.c | 24 +-
drivers/staging/most/dim2/sysfs.c | 49 ----
drivers/staging/most/dim2/sysfs.h | 11 -
drivers/target/target_core_tmr.c | 17 +-
drivers/target/target_core_transport.c | 30 ++-
drivers/thermal/qcom/tsens.c | 29 ++-
drivers/thermal/thermal_core.c | 16 +-
drivers/tty/serial/8250/8250_dw.c | 2 +-
drivers/tty/serial/8250/8250_port.c | 21 +-
drivers/tty/serial/cpm_uart/cpm_uart_core.c | 2 +
drivers/tty/serial/imx.c | 4 +-
drivers/tty/serial/serial_core.c | 16 +-
drivers/tty/serial/xilinx_uartps.c | 3 +-
drivers/usb/chipidea/core.c | 23 +-
drivers/usb/dwc2/drd.c | 24 +-
drivers/usb/gadget/legacy/hid.c | 4 +-
drivers/usb/host/xhci-hub.c | 3 +-
drivers/usb/host/xhci-pci.c | 16 ++
drivers/usb/misc/iowarrior.c | 8 +-
drivers/usb/musb/Kconfig | 2 +-
drivers/usb/serial/keyspan.c | 15 +-
drivers/usb/typec/Kconfig | 4 +-
drivers/video/backlight/backlight.c | 6 -
drivers/video/fbdev/chipsfb.c | 2 +-
drivers/video/fbdev/efifb.c | 21 +-
drivers/virtio/virtio_ring.c | 14 +-
drivers/watchdog/Kconfig | 2 +-
drivers/watchdog/f71808e_wdt.c | 4 +-
drivers/watchdog/omap_wdt.c | 6 +-
drivers/xen/balloon.c | 86 +++++--
drivers/xen/xen-pciback/conf_space_capability.c | 2 +-
fs/btrfs/disk-io.c | 3 +-
fs/btrfs/reflink.c | 2 +-
fs/btrfs/tree-log.c | 4 +-
fs/btrfs/volumes.c | 14 +-
fs/cifs/cifsglob.h | 3 +-
fs/cifs/connect.c | 21 +-
fs/cifs/file.c | 35 ++-
fs/cifs/fs_context.c | 8 +
fs/cifs/fs_context.h | 1 +
fs/crypto/fscrypt_private.h | 5 +-
fs/crypto/hkdf.c | 11 +-
fs/crypto/keysetup.c | 57 ++++-
fs/erofs/decompressor.c | 1 -
fs/erofs/zdata.c | 13 +-
fs/erofs/zpvec.h | 13 +-
fs/exfat/inode.c | 2 +-
fs/ext4/extents.c | 63 +++---
fs/ext4/super.c | 9 +-
fs/f2fs/compress.c | 1 +
fs/f2fs/inode.c | 2 +-
fs/f2fs/namei.c | 2 +-
fs/f2fs/super.c | 2 +
fs/fuse/dev.c | 14 +-
fs/gfs2/glock.c | 24 +-
fs/io-wq.c | 38 ++--
fs/jfs/jfs_mount.c | 51 ++---
fs/nfs/dir.c | 9 +-
fs/nfs/direct.c | 2 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 +-
fs/nfs/inode.c | 13 +-
fs/nfs/nfs3xdr.c | 2 +-
fs/nfs/nfs4idmap.c | 2 +-
fs/nfs/nfs4proc.c | 15 +-
fs/nfs/pnfs.h | 2 +-
fs/nfs/pnfs_nfs.c | 6 +-
fs/nfs/proc.c | 2 +-
fs/nfs/write.c | 26 +--
fs/ocfs2/file.c | 8 +-
fs/orangefs/dcache.c | 4 +-
fs/overlayfs/file.c | 16 +-
fs/proc/stat.c | 4 +-
fs/proc/uptime.c | 14 +-
fs/quota/quota_tree.c | 15 ++
fs/tracefs/inode.c | 3 +-
include/drm/ttm/ttm_bo_api.h | 3 +-
include/linux/blkdev.h | 2 -
include/linux/cgroup-defs.h | 107 +++------
include/linux/cgroup.h | 22 +-
include/linux/console.h | 2 +
include/linux/dsa/ocelot.h | 38 ++++
include/linux/ethtool_netlink.h | 3 +
include/linux/filter.h | 1 +
include/linux/fortify-string.h | 5 +-
include/linux/kernel_stat.h | 1 +
include/linux/leds.h | 2 +-
include/linux/libata.h | 2 +-
include/linux/nfs_fs.h | 1 +
include/linux/posix-timers.h | 2 +
include/linux/rpmsg.h | 2 +-
include/linux/sched.h | 1 +
include/linux/sched/task.h | 3 +-
include/linux/sched/task_stack.h | 4 +
include/linux/seq_file.h | 2 +-
include/linux/skmsg.h | 18 +-
include/linux/surface_aggregator/controller.h | 4 +-
include/linux/tpm.h | 1 +
include/media/videobuf2-core.h | 37 +--
include/memory/renesas-rpc-if.h | 1 +
include/net/inet_connection_sock.h | 2 +-
include/net/llc.h | 4 +-
include/net/neighbour.h | 12 +-
include/net/sch_generic.h | 4 +
include/net/sctp/sctp.h | 7 +-
include/net/sock.h | 2 +-
include/net/strparser.h | 20 +-
include/net/tcp.h | 17 +-
include/net/udp.h | 5 +-
include/scsi/scsi_cmnd.h | 2 +-
include/scsi/scsi_host.h | 1 +
include/soc/mscc/ocelot.h | 24 --
include/sound/soc-topology.h | 3 +-
include/uapi/linux/ethtool_netlink.h | 4 +-
include/uapi/linux/pci_regs.h | 6 +
kernel/bpf/core.c | 4 +-
kernel/bpf/trampoline.c | 6 +-
kernel/bpf/verifier.c | 4 +-
kernel/cgroup/cgroup.c | 94 ++++----
kernel/cgroup/rstat.c | 2 -
kernel/fork.c | 3 +-
kernel/kprobes.c | 3 +-
kernel/locking/lockdep.c | 4 +-
kernel/locking/rwsem.c | 53 +++--
kernel/power/energy_model.c | 23 +-
kernel/power/swap.c | 7 +-
kernel/rcu/rcutorture.c | 48 +++-
kernel/rcu/tasks.h | 3 +-
kernel/rcu/tree_exp.h | 2 +-
kernel/rcu/tree_plugin.h | 8 +-
kernel/sched/core.c | 62 +++--
kernel/scs.c | 1 +
kernel/signal.c | 18 +-
kernel/time/posix-cpu-timers.c | 19 +-
kernel/trace/ftrace.c | 23 +-
kernel/trace/ring_buffer.c | 5 +
kernel/trace/trace.c | 73 +++---
kernel/trace/trace.h | 3 +
kernel/trace/trace_dynevent.c | 2 +-
kernel/trace/trace_event_perf.c | 6 +-
kernel/trace/trace_events.c | 42 ++--
kernel/trace/trace_events_synth.c | 4 +-
kernel/trace/trace_functions_graph.c | 2 +-
kernel/trace/trace_hwlat.c | 6 +-
kernel/trace/trace_kprobe.c | 8 +-
kernel/trace/trace_osnoise.c | 14 +-
kernel/trace/trace_printk.c | 2 +-
kernel/trace/trace_recursion_record.c | 4 +-
kernel/trace/trace_stack.c | 6 +-
kernel/trace/trace_stat.c | 6 +-
kernel/trace/trace_uprobe.c | 4 +-
kernel/trace/tracing_map.c | 40 ++--
kernel/workqueue.c | 15 +-
lib/decompress_unxz.c | 2 +-
lib/dynamic_debug.c | 12 +
lib/iov_iter.c | 5 +-
lib/xz/xz_dec_lzma2.c | 21 +-
lib/xz/xz_dec_stream.c | 6 +-
mm/filemap.c | 1 -
mm/memcontrol.c | 27 +--
mm/oom_kill.c | 23 +-
mm/zsmalloc.c | 7 +-
net/8021q/vlan.c | 3 -
net/8021q/vlan_dev.c | 3 +
net/9p/client.c | 2 +
net/bluetooth/l2cap_sock.c | 10 +-
net/bluetooth/sco.c | 33 +--
net/bridge/br_private.h | 2 +
net/can/j1939/main.c | 7 +
net/can/j1939/transport.c | 6 +
net/core/dev.c | 5 +-
net/core/filter.c | 58 ++++-
net/core/neighbour.c | 48 ++--
net/core/net-sysfs.c | 55 +++++
net/core/net_namespace.c | 4 +
net/core/netclassid_cgroup.c | 7 +-
net/core/netprio_cgroup.c | 10 +-
net/core/skmsg.c | 43 +++-
net/core/stream.c | 3 -
net/core/sysctl_net_core.c | 2 +-
net/dccp/dccp.h | 2 +-
net/dccp/proto.c | 14 +-
net/dsa/Kconfig | 2 -
net/dsa/switch.c | 4 +-
net/dsa/tag_ocelot.c | 4 +-
net/dsa/tag_ocelot_8021q.c | 1 +
net/ethtool/pause.c | 3 +-
net/ipv4/inet_connection_sock.c | 4 +-
net/ipv4/inet_hashtables.c | 2 +-
net/ipv4/proc.c | 2 +-
net/ipv4/tcp.c | 40 +++-
net/ipv4/tcp_bpf.c | 48 +++-
net/ipv6/addrconf.c | 3 +
net/ipv6/udp.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 7 +-
net/netfilter/nfnetlink_queue.c | 2 +-
net/netfilter/nft_dynset.c | 11 +-
net/rxrpc/rtt.c | 2 +-
net/sched/sch_generic.c | 9 +
net/sched/sch_mq.c | 24 ++
net/sched/sch_mqprio.c | 23 ++
net/sched/sch_taprio.c | 27 ++-
net/sctp/output.c | 13 +-
net/sctp/transport.c | 11 +-
net/smc/af_smc.c | 20 +-
net/smc/smc_llc.c | 2 +-
net/strparser/strparser.c | 10 +-
net/sunrpc/addr.c | 40 ++--
net/sunrpc/xprt.c | 28 +--
net/vmw_vsock/af_vsock.c | 2 +
net/wireless/core.c | 10 +
samples/kprobes/kretprobe_example.c | 2 +-
scripts/leaking_addresses.pl | 3 +-
security/apparmor/label.c | 4 +-
security/integrity/evm/evm_main.c | 2 +-
security/integrity/ima/ima.h | 2 +-
security/integrity/ima/ima_appraise.c | 49 +++-
security/selinux/ss/services.c | 162 +++++++------
security/smack/smackfs.c | 11 +-
sound/core/memalloc.c | 7 +-
sound/core/oss/mixer_oss.c | 44 +++-
sound/core/timer.c | 17 +-
sound/firewire/oxfw/oxfw-stream.c | 7 +-
sound/firewire/oxfw/oxfw.c | 8 +
sound/firewire/oxfw/oxfw.h | 5 +
sound/pci/hda/hda_intel.c | 52 ++---
sound/pci/hda/patch_realtek.c | 82 +++++++
sound/soc/codecs/cs42l42.c | 43 ++--
sound/soc/codecs/wcd9335.c | 2 +-
sound/soc/sh/rcar/core.c | 1 +
sound/soc/soc-core.c | 1 +
sound/soc/sof/topology.c | 9 +
sound/soc/tegra/tegra_asoc_machine.c | 60 ++++-
sound/soc/tegra/tegra_asoc_machine.h | 1 +
sound/synth/emux/emux.c | 2 +-
sound/usb/6fire/comm.c | 2 +-
sound/usb/6fire/firmware.c | 6 +-
sound/usb/format.c | 1 +
sound/usb/line6/driver.c | 14 +-
sound/usb/line6/driver.h | 2 +-
sound/usb/line6/podhd.c | 6 +-
sound/usb/line6/toneport.c | 2 +-
sound/usb/misc/ua101.c | 4 +-
sound/usb/quirks.c | 1 +
tools/arch/x86/lib/insn.c | 5 +-
tools/bpf/bpftool/prog.c | 16 +-
tools/include/asm-generic/unaligned.h | 23 ++
tools/lib/bpf/bpf.c | 4 +-
tools/lib/bpf/bpf_core_read.h | 2 +-
tools/lib/bpf/btf.c | 22 +-
tools/lib/bpf/libbpf.c | 6 +
tools/lib/bpf/skel_internal.h | 6 +-
tools/objtool/arch/x86/decode.c | 20 ++
tools/objtool/check.c | 159 +++++++------
tools/objtool/include/objtool/arch.h | 1 +
tools/perf/util/bpf-event.c | 4 +-
tools/perf/util/intel-pt-decoder/Build | 2 +
.../testing/selftests/bpf/prog_tests/perf_buffer.c | 4 +-
tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 4 +-
tools/testing/selftests/bpf/prog_tests/test_ima.c | 3 +-
tools/testing/selftests/bpf/progs/strobemeta.h | 11 +
tools/testing/selftests/bpf/test_progs.c | 4 +-
.../selftests/bpf/test_xdp_redirect_multi.sh | 62 ++---
.../testing/selftests/bpf/verifier/array_access.c | 2 +-
tools/testing/selftests/bpf/xdp_redirect_multi.c | 4 +-
tools/testing/selftests/core/close_range_test.c | 2 +-
tools/testing/selftests/kvm/lib/x86_64/svm.c | 14 +-
.../selftests/kvm/x86_64/mmio_warning_test.c | 2 +-
tools/testing/selftests/net/Makefile | 2 +-
tools/testing/selftests/net/fcnal-test.sh | 3 +
tools/testing/selftests/net/fib_nexthops.sh | 1 +
.../selftests/net/forwarding/bridge_igmp.sh | 12 +-
.../testing/selftests/net/forwarding/bridge_mld.sh | 12 +-
tools/testing/selftests/net/udpgso_bench_rx.c | 11 +-
tools/testing/selftests/sched/cs_prctl_test.c | 28 ++-
tools/testing/selftests/vm/split_huge_page_test.c | 2 +-
tools/tracing/latency/latency-collector.c | 2 +-
950 files changed, 7792 insertions(+), 4374 deletions(-)

2021-11-16 01:48:13

by Greg KH

Subject: [PATCH 5.14 051/849] fuse: fix page stealing

From: Miklos Szeredi <[email protected]>

commit 712a951025c0667ff00b25afc360f74e639dfabe upstream.

It is possible to trigger a crash by splicing anon pipe bufs to the fuse
device.

The reason for this is that anon_pipe_buf_release() will reuse buf->page if
the refcount is 1, but that page might have already been stolen and its
flags modified (e.g. PG_lru added).

This happens in the unlikely case of fuse_dev_splice_write() getting around
to calling pipe_buf_release() after a page has been stolen, added to the
page cache and removed from the page cache.

Fix by calling pipe_buf_release() right after the page was inserted into
the page cache. In this case the page has an elevated refcount so any
release function will know that the page isn't reusable.

Reported-by: Frank Dinoff <[email protected]>
Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1yw@mail.gmail.com/
Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: <[email protected]> # v2.6.35
Signed-off-by: Miklos Szeredi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/fuse/dev.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)

--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -847,6 +847,12 @@ static int fuse_try_move_page(struct fus

replace_page_cache_page(oldpage, newpage);

+ /*
+ * Release while we have extra ref on stolen page. Otherwise
+ * anon_pipe_buf_release() might think the page can be reused.
+ */
+ pipe_buf_release(cs->pipe, buf);
+
get_page(newpage);

if (!(buf->flags & PIPE_BUF_FLAG_LRU))
@@ -2031,8 +2037,12 @@ static ssize_t fuse_dev_splice_write(str

pipe_lock(pipe);
out_free:
- for (idx = 0; idx < nbuf; idx++)
- pipe_buf_release(pipe, &bufs[idx]);
+ for (idx = 0; idx < nbuf; idx++) {
+ struct pipe_buffer *buf = &bufs[idx];
+
+ if (buf->ops)
+ pipe_buf_release(pipe, buf);
+ }
pipe_unlock(pipe);

kvfree(bufs);

2021-11-16 01:48:13

by Greg KH

Subject: [PATCH 5.14 055/849] x86/iopl: Fake iopl(3) CLI/STI usage

From: Peter Zijlstra <[email protected]>

commit b968e84b509da593c50dc3db679e1d33de701f78 upstream.

Since commit c8137ace5638 ("x86/iopl: Restrict iopl() permission
scope") it's possible to emulate iopl(3) using ioperm(), except for
the CLI/STI usage.

Userspace CLI/STI usage is very dubious (read broken), since any
exception taken during that window can lead to rescheduling anyway (or
worse). The IOPL(2) manpage even states that usage of CLI/STI is highly
discouraged and might even crash the system.

Of course, that won't stop people and HP has the dubious honour of
being the first vendor to be found using this in their hp-health
package.

In order to enable this 'software' to still 'work', have the #GP treat
the CLI/STI instructions as NOPs when iopl(3). Warn the user that
their program is doing dubious things.

Fixes: a24ca9976843 ("x86/iopl: Remove legacy IOPL option")
Reported-by: Ondrej Zary <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Reviewed-by: Thomas Gleixner <[email protected]>
Cc: [email protected] # v5.5+
Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
arch/x86/include/asm/insn-eval.h | 1 +
arch/x86/include/asm/processor.h | 1 +
arch/x86/kernel/process.c | 1 +
arch/x86/kernel/traps.c | 33 +++++++++++++++++++++++++++++++++
arch/x86/lib/insn-eval.c | 2 +-
5 files changed, 37 insertions(+), 1 deletion(-)

--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -21,6 +21,7 @@ int insn_get_modrm_rm_off(struct insn *i
int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs);
unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx);
int insn_get_code_seg_params(struct pt_regs *regs);
+int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip);
int insn_fetch_from_user(struct pt_regs *regs,
unsigned char buf[MAX_INSN_SIZE]);
int insn_fetch_from_user_inatomic(struct pt_regs *regs,
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -516,6 +516,7 @@ struct thread_struct {
*/
unsigned long iopl_emul;

+ unsigned int iopl_warn:1;
unsigned int sig_on_uaccess_err:1;

/*
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -132,6 +132,7 @@ int copy_thread(unsigned long clone_flag
frame->ret_addr = (unsigned long) ret_from_fork;
p->thread.sp = (unsigned long) fork_frame;
p->thread.io_bitmap = NULL;
+ p->thread.iopl_warn = 0;
memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));

#ifdef CONFIG_X86_64
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -528,6 +528,36 @@ static enum kernel_gp_hint get_kernel_gp

#define GPFSTR "general protection fault"

+static bool fixup_iopl_exception(struct pt_regs *regs)
+{
+ struct thread_struct *t = &current->thread;
+ unsigned char byte;
+ unsigned long ip;
+
+ if (!IS_ENABLED(CONFIG_X86_IOPL_IOPERM) || t->iopl_emul != 3)
+ return false;
+
+ if (insn_get_effective_ip(regs, &ip))
+ return false;
+
+ if (get_user(byte, (const char __user *)ip))
+ return false;
+
+ if (byte != 0xfa && byte != 0xfb)
+ return false;
+
+ if (!t->iopl_warn && printk_ratelimit()) {
+ pr_err("%s[%d] attempts to use CLI/STI, pretending it's a NOP, ip:%lx",
+ current->comm, task_pid_nr(current), ip);
+ print_vma_addr(KERN_CONT " in ", ip);
+ pr_cont("\n");
+ t->iopl_warn = 1;
+ }
+
+ regs->ip += 1;
+ return true;
+}
+
DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
{
char desc[sizeof(GPFSTR) + 50 + 2*sizeof(unsigned long) + 1] = GPFSTR;
@@ -553,6 +583,9 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_pr
tsk = current;

if (user_mode(regs)) {
+ if (fixup_iopl_exception(regs))
+ goto exit;
+
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_GP;

--- a/arch/x86/lib/insn-eval.c
+++ b/arch/x86/lib/insn-eval.c
@@ -1417,7 +1417,7 @@ void __user *insn_get_addr_ref(struct in
}
}

-static int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
+int insn_get_effective_ip(struct pt_regs *regs, unsigned long *ip)
{
unsigned long seg_base = 0;

2021-11-16 01:48:13

by Greg KH

Subject: [PATCH 5.14 001/849] xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay

From: Mathias Nyman <[email protected]>

commit e1959faf085b004e6c3afaaaa743381f00e7c015 upstream.

Some USB 3.1 enumeration issues were reported after the hub driver removed
the minimum 100ms limit for the power-on-good delay.

Since commit 90d28fb53d4a ("usb: core: reduce power-on-good delay time of
root hub") the hub driver sets the power-on-delay based on the
bPwrOn2PwrGood value in the hub descriptor.

xhci driver has a 20ms bPwrOn2PwrGood value for both roothubs based
on xhci spec section 5.4.8, but it's clearly not enough for the
USB 3.1 devices, causing enumeration issues.

Tests indicate full 100ms delay is needed.

Reported-by: Walt Jr. Brake <[email protected]>
Signed-off-by: Mathias Nyman <[email protected]>
Fixes: 90d28fb53d4a ("usb: core: reduce power-on-good delay time of root hub")
Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/host/xhci-hub.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -257,7 +257,6 @@ static void xhci_common_hub_descriptor(s
{
u16 temp;

- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */
desc->bHubContrCurrent = 0;

desc->bNbrPorts = ports;
@@ -292,6 +291,7 @@ static void xhci_usb2_hub_descriptor(str
desc->bDescriptorType = USB_DT_HUB;
temp = 1 + (ports / 8);
desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp;
+ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */

/* The Device Removable bits are reported on a byte granularity.
* If the port doesn't exist within that byte, the bit is set to 0.
@@ -344,6 +344,7 @@ static void xhci_usb3_hub_descriptor(str
xhci_common_hub_descriptor(xhci, desc, ports);
desc->bDescriptorType = USB_DT_SS_HUB;
desc->bDescLength = USB_DT_SS_HUB_SIZE;
+ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */

/* header decode latency should be zero for roothubs,
* see section 4.23.5.2.

2021-11-16 01:48:18

by Greg KH

Subject: [PATCH 5.14 012/849] scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file

From: Arun Easi <[email protected]>

commit 3ef68d4f0c9e7cb589ae8b70f07d77f528105331 upstream.

Kernel crashes when accessing port_speed sysfs file. The issue happens on
a CNA when the local array was accessed beyond bounds. Fix this by changing
the lookup.

BUG: unable to handle kernel paging request at 0000000000004000
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 15 PID: 455213 Comm: sosreport Kdump: loaded Not tainted
4.18.0-305.7.1.el8_4.x86_64 #1
RIP: 0010:string_nocheck+0x12/0x70
Code: 00 00 4c 89 e2 be 20 00 00 00 48 89 ef e8 86 9a 00 00 4c 01
e3 eb 81 90 49 89 f2 48 89 ce 48 89 f8 48 c1 fe 30 66 85 f6 74 4f <44> 0f b6 0a
45 84 c9 74 46 83 ee 01 41 b8 01 00 00 00 48 8d 7c 37
RSP: 0018:ffffb5141c1afcf0 EFLAGS: 00010286
RAX: ffff8bf4009f8000 RBX: ffff8bf4009f9000 RCX: ffff0a00ffffff04
RDX: 0000000000004000 RSI: ffffffffffffffff RDI: ffff8bf4009f8000
RBP: 0000000000004000 R08: 0000000000000001 R09: ffffb5141c1afb84
R10: ffff8bf4009f9000 R11: ffffb5141c1afce6 R12: ffff0a00ffffff04
R13: ffffffffc08e21aa R14: 0000000000001000 R15: ffffffffc08e21aa
FS: 00007fc4ebfff700(0000) GS:ffff8c717f7c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000004000 CR3: 000000edfdee6006 CR4: 00000000001706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
string+0x40/0x50
vsnprintf+0x33c/0x520
scnprintf+0x4d/0x90
qla2x00_port_speed_show+0xb5/0x100 [qla2xxx]
dev_attr_show+0x1c/0x40
sysfs_kf_seq_show+0x9b/0x100
seq_read+0x153/0x410
vfs_read+0x91/0x140
ksys_read+0x4f/0xb0
do_syscall_64+0x5b/0x1a0
entry_SYSCALL_64_after_hwframe+0x65/0xca

Link: https://lore.kernel.org/r/[email protected]
Fixes: 4910b524ac9e ("scsi: qla2xxx: Add support for setting port speed")
Cc: [email protected]
Reviewed-by: Himanshu Madhani <[email protected]>
Signed-off-by: Arun Easi <[email protected]>
Signed-off-by: Nilesh Javali <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/scsi/qla2xxx/qla_attr.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)

--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1868,6 +1868,18 @@ qla2x00_port_speed_store(struct device *
return strlen(buf);
}

+static const struct {
+ u16 rate;
+ char *str;
+} port_speed_str[] = {
+ { PORT_SPEED_4GB, "4" },
+ { PORT_SPEED_8GB, "8" },
+ { PORT_SPEED_16GB, "16" },
+ { PORT_SPEED_32GB, "32" },
+ { PORT_SPEED_64GB, "64" },
+ { PORT_SPEED_10GB, "10" },
+};
+
static ssize_t
qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr,
char *buf)
@@ -1875,7 +1887,8 @@ qla2x00_port_speed_show(struct device *d
struct scsi_qla_host *vha = shost_priv(dev_to_shost(dev));
struct qla_hw_data *ha = vha->hw;
ssize_t rval;
- char *spd[7] = {"0", "0", "0", "4", "8", "16", "32"};
+ u16 i;
+ char *speed = "Unknown";

rval = qla2x00_get_data_rate(vha);
if (rval != QLA_SUCCESS) {
@@ -1884,7 +1897,14 @@ qla2x00_port_speed_show(struct device *d
return -EINVAL;
}

- return scnprintf(buf, PAGE_SIZE, "%s\n", spd[ha->link_data_rate]);
+ for (i = 0; i < ARRAY_SIZE(port_speed_str); i++) {
+ if (port_speed_str[i].rate != ha->link_data_rate)
+ continue;
+ speed = port_speed_str[i].str;
+ break;
+ }
+
+ return scnprintf(buf, PAGE_SIZE, "%s\n", speed);
}

/* ----- */

2021-11-16 01:48:24

by Greg KH

Subject: [PATCH 5.14 011/849] scsi: lpfc: Fix FCP I/O flush functionality for TMF routines

From: James Smart <[email protected]>

commit cd8a36a90babf958082b87bc6b4df5dd70901eba upstream.

A prior patch inadvertently caused lpfc_sli_sum_iocb() to exclude counting
of outstanding aborted I/Os and ABORT IOCBs. Thus,
lpfc_reset_flush_io_context() called from any TMF routine does not properly
wait to flush all outstanding FCP IOCBs leading to a block layer crash on
an invalid scsi_cmnd->request pointer.

kernel BUG at ../block/blk-core.c:1489!
RIP: 0010:blk_requeue_request+0xaf/0xc0
...
Call Trace:
<IRQ>
__scsi_queue_insert+0x90/0xe0 [scsi_mod]
blk_done_softirq+0x7e/0x90
__do_softirq+0xd2/0x280
irq_exit+0xd5/0xe0
do_IRQ+0x4c/0xd0
common_interrupt+0x87/0x87
</IRQ>

Fix by separating out the LPFC_IO_FCP, LPFC_IO_ON_TXCMPLQ,
LPFC_DRIVER_ABORTED, and CMD_ABORT_XRI_CN || CMD_CLOSE_XRI_CN checks into a
new lpfc_sli_validate_fcp_iocb_for_abort() routine when determining to
build an ABORT iocb.

Restore lpfc_reset_flush_io_context() functionality by including counting
of outstanding aborted IOCBs and ABORT IOCBs in lpfc_sli_sum_iocb().

Link: https://lore.kernel.org/r/[email protected]
Fixes: e1364711359f ("scsi: lpfc: Fix illegal memory access on Abort IOCBs")
Cc: <[email protected]> # v5.12+
Co-developed-by: Justin Tee <[email protected]>
Signed-off-by: Justin Tee <[email protected]>
Signed-off-by: James Smart <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/scsi/lpfc/lpfc_sli.c | 101 +++++++++++++++++++++++++++++++++----------
1 file changed, 78 insertions(+), 23 deletions(-)

--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -11806,15 +11806,54 @@ lpfc_sli_hba_iocb_abort(struct lpfc_hba
}

/**
- * lpfc_sli_validate_fcp_iocb - find commands associated with a vport or LUN
+ * lpfc_sli_validate_fcp_iocb_for_abort - filter iocbs appropriate for FCP aborts
+ * @iocbq: Pointer to iocb object.
+ * @vport: Pointer to driver virtual port object.
+ *
+ * This function acts as an iocb filter for functions which abort FCP iocbs.
+ *
+ * Return values
+ * -ENODEV, if a null iocb or vport ptr is encountered
+ * -EINVAL, if the iocb is not an FCP I/O, not on the TX cmpl queue, premarked as
+ * driver already started the abort process, or is an abort iocb itself
+ * 0, passes criteria for aborting the FCP I/O iocb
+ **/
+static int
+lpfc_sli_validate_fcp_iocb_for_abort(struct lpfc_iocbq *iocbq,
+ struct lpfc_vport *vport)
+{
+ IOCB_t *icmd = NULL;
+
+ /* No null ptr vports */
+ if (!iocbq || iocbq->vport != vport)
+ return -ENODEV;
+
+ /* iocb must be for FCP IO, already exists on the TX cmpl queue,
+ * can't be premarked as driver aborted, nor be an ABORT iocb itself
+ */
+ icmd = &iocbq->iocb;
+ if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
+ !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) ||
+ (iocbq->iocb_flag & LPFC_DRIVER_ABORTED) ||
+ (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
+ icmd->ulpCommand == CMD_CLOSE_XRI_CN))
+ return -EINVAL;
+
+ return 0;
+}
+
+/**
+ * lpfc_sli_validate_fcp_iocb - validate commands associated with a SCSI target
* @iocbq: Pointer to driver iocb object.
* @vport: Pointer to driver virtual port object.
* @tgt_id: SCSI ID of the target.
* @lun_id: LUN ID of the scsi device.
* @ctx_cmd: LPFC_CTX_LUN/LPFC_CTX_TGT/LPFC_CTX_HOST
*
- * This function acts as an iocb filter for functions which abort or count
- * all FCP iocbs pending on a lun/SCSI target/SCSI host. It will return
+ * This function acts as an iocb filter for validating a lun/SCSI target/SCSI
+ * host.
+ *
+ * It will return
* 0 if the filtering criteria is met for the given iocb and will return
* 1 if the filtering criteria is not met.
* If ctx_cmd == LPFC_CTX_LUN, the function returns 0 only if the
@@ -11833,22 +11872,8 @@ lpfc_sli_validate_fcp_iocb(struct lpfc_i
lpfc_ctx_cmd ctx_cmd)
{
struct lpfc_io_buf *lpfc_cmd;
- IOCB_t *icmd = NULL;
int rc = 1;

- if (!iocbq || iocbq->vport != vport)
- return rc;
-
- if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
- !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ) ||
- iocbq->iocb_flag & LPFC_DRIVER_ABORTED)
- return rc;
-
- icmd = &iocbq->iocb;
- if (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
- icmd->ulpCommand == CMD_CLOSE_XRI_CN)
- return rc;
-
lpfc_cmd = container_of(iocbq, struct lpfc_io_buf, cur_iocbq);

if (lpfc_cmd->pCmd == NULL)
@@ -11903,17 +11928,33 @@ lpfc_sli_sum_iocb(struct lpfc_vport *vpo
{
struct lpfc_hba *phba = vport->phba;
struct lpfc_iocbq *iocbq;
+ IOCB_t *icmd = NULL;
int sum, i;
+ unsigned long iflags;

- spin_lock_irq(&phba->hbalock);
+ spin_lock_irqsave(&phba->hbalock, iflags);
for (i = 1, sum = 0; i <= phba->sli.last_iotag; i++) {
iocbq = phba->sli.iocbq_lookup[i];

- if (lpfc_sli_validate_fcp_iocb (iocbq, vport, tgt_id, lun_id,
- ctx_cmd) == 0)
+ if (!iocbq || iocbq->vport != vport)
+ continue;
+ if (!(iocbq->iocb_flag & LPFC_IO_FCP) ||
+ !(iocbq->iocb_flag & LPFC_IO_ON_TXCMPLQ))
+ continue;
+
+ /* Include counting outstanding aborts */
+ icmd = &iocbq->iocb;
+ if (icmd->ulpCommand == CMD_ABORT_XRI_CN ||
+ icmd->ulpCommand == CMD_CLOSE_XRI_CN) {
+ sum++;
+ continue;
+ }
+
+ if (lpfc_sli_validate_fcp_iocb(iocbq, vport, tgt_id, lun_id,
+ ctx_cmd) == 0)
sum++;
}
- spin_unlock_irq(&phba->hbalock);
+ spin_unlock_irqrestore(&phba->hbalock, iflags);

return sum;
}
@@ -11980,7 +12021,11 @@ lpfc_sli_abort_fcp_cmpl(struct lpfc_hba
*
* This function sends an abort command for every SCSI command
* associated with the given virtual port pending on the ring
- * filtered by lpfc_sli_validate_fcp_iocb function.
+ * filtered by lpfc_sli_validate_fcp_iocb_for_abort and then
+ * lpfc_sli_validate_fcp_iocb function. The ordering for validation before
+ * submitting abort iocbs must be lpfc_sli_validate_fcp_iocb_for_abort
+ * followed by lpfc_sli_validate_fcp_iocb.
+ *
* When abort_cmd == LPFC_CTX_LUN, the function sends abort only to the
* FCP iocbs associated with lun specified by tgt_id and lun_id
* parameters
@@ -12012,6 +12057,9 @@ lpfc_sli_abort_iocb(struct lpfc_vport *v
for (i = 1; i <= phba->sli.last_iotag; i++) {
iocbq = phba->sli.iocbq_lookup[i];

+ if (lpfc_sli_validate_fcp_iocb_for_abort(iocbq, vport))
+ continue;
+
if (lpfc_sli_validate_fcp_iocb(iocbq, vport, tgt_id, lun_id,
abort_cmd) != 0)
continue;
@@ -12044,7 +12092,11 @@ lpfc_sli_abort_iocb(struct lpfc_vport *v
*
* This function sends an abort command for every SCSI command
* associated with the given virtual port pending on the ring
- * filtered by lpfc_sli_validate_fcp_iocb function.
+ * filtered by lpfc_sli_validate_fcp_iocb_for_abort and then
+ * lpfc_sli_validate_fcp_iocb function. The ordering for validation before
+ * submitting abort iocbs must be lpfc_sli_validate_fcp_iocb_for_abort
+ * followed by lpfc_sli_validate_fcp_iocb.
+ *
* When taskmgmt_cmd == LPFC_CTX_LUN, the function sends abort only to the
* FCP iocbs associated with lun specified by tgt_id and lun_id
* parameters
@@ -12082,6 +12134,9 @@ lpfc_sli_abort_taskmgmt(struct lpfc_vpor
for (i = 1; i <= phba->sli.last_iotag; i++) {
iocbq = phba->sli.iocbq_lookup[i];

+ if (lpfc_sli_validate_fcp_iocb_for_abort(iocbq, vport))
+ continue;
+
if (lpfc_sli_validate_fcp_iocb(iocbq, vport, tgt_id, lun_id,
cmd) != 0)
continue;

2021-11-16 01:49:21

by Greg KH

Subject: [PATCH 5.14 106/849] ipmi:watchdog: Set panic count to proper value on a panic

From: Corey Minyard <[email protected]>

commit db05ddf7f321634c5659a0cf7ea56594e22365f7 upstream.

You will get two decrements when the messages on a panic are sent, not
one, since commit 2033f6858970 ("ipmi: Free receive messages when in an
oops") was added, but the watchdog code had a bug where it didn't set
the value properly.

Reported-by: Anton Lundin <[email protected]>
Cc: <[email protected]> # v5.4+
Fixes: 2033f6858970 ("ipmi: Free receive messages when in an oops")
Signed-off-by: Corey Minyard <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/char/ipmi/ipmi_watchdog.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -497,7 +497,7 @@ static void panic_halt_ipmi_heartbeat(vo
msg.cmd = IPMI_WDOG_RESET_TIMER;
msg.data = NULL;
msg.data_len = 0;
- atomic_inc(&panic_done_count);
+ atomic_add(2, &panic_done_count);
rv = ipmi_request_supply_msgs(watchdog_user,
(struct ipmi_addr *) &addr,
0,
@@ -507,7 +507,7 @@ static void panic_halt_ipmi_heartbeat(vo
&panic_halt_heartbeat_recv_msg,
1);
if (rv)
- atomic_dec(&panic_done_count);
+ atomic_sub(2, &panic_done_count);
}

static struct ipmi_smi_msg panic_halt_smi_msg = {
@@ -531,12 +531,12 @@ static void panic_halt_ipmi_set_timeout(
/* Wait for the messages to be free. */
while (atomic_read(&panic_done_count) != 0)
ipmi_poll_interface(watchdog_user);
- atomic_inc(&panic_done_count);
+ atomic_add(2, &panic_done_count);
rv = __ipmi_set_timeout(&panic_halt_smi_msg,
&panic_halt_recv_msg,
&send_heartbeat_now);
if (rv) {
- atomic_dec(&panic_done_count);
+ atomic_sub(2, &panic_done_count);
pr_warn("Unable to extend the watchdog timeout\n");
} else {
if (send_heartbeat_now)

2021-11-16 01:49:30

by Greg KH

Subject: [PATCH 5.14 105/849] selinux: fix race condition when computing ocontext SIDs

From: Ondrej Mosnacek <[email protected]>

commit cbfcd13be5cb2a07868afe67520ed181956579a7 upstream.

Current code contains a lot of racy patterns when converting an
ocontext's context structure to an SID. This is being done in a "lazy"
fashion, such that the SID is looked up in the SID table only when it's
first needed and then cached in the "sid" field of the ocontext
structure. However, this is done without any locking or memory barriers
and is thus unsafe.

Between commits 24ed7fdae669 ("selinux: use separate table for initial
SID lookup") and 66f8e2f03c02 ("selinux: sidtab reverse lookup hash
table"), this race condition lead to an actual observable bug, because a
pointer to the shared sid field was passed directly to
sidtab_context_to_sid(), which was using this location to also store an
intermediate value, which could have been read by other threads and
interpreted as an SID. In practice this caused e.g. new mounts to get a
wrong (seemingly random) filesystem context, leading to strange denials.
This bug has been spotted in the wild at least twice, see [1] and [2].

Fix the race condition by making all the racy functions use a common
helper that ensures the ocontext::sid accesses are made safely using the
appropriate SMP constructs.

Note that security_netif_sid() was populating the sid field of both
contexts stored in the ocontext, but only the first one was actually
used. The SELinux wiki's documentation on the "netifcon" policy
statement [3] suggests that using only the first context is intentional.
I kept only the handling of the first context here, as there is really
no point in doing the SID lookup for the unused one.

I wasn't able to reproduce the bug mentioned above on any kernel that
includes commit 66f8e2f03c02, even though it has been reported that the
issue occurs with that commit, too, just less frequently. Thus, I wasn't
able to verify that this patch fixes the issue, but it makes sense to
avoid the race condition regardless.

[1] https://github.com/containers/container-selinux/issues/89
[2] https://lists.fedoraproject.org/archives/list/[email protected]/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/
[3] https://selinuxproject.org/page/NetworkStatements#netifcon

Cc: [email protected]
Cc: Xinjie Zheng <[email protected]>
Reported-by: Sujithra Periasamy <[email protected]>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ondrej Mosnacek <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
security/selinux/ss/services.c | 162 +++++++++++++++++++----------------------
1 file changed, 77 insertions(+), 85 deletions(-)

--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2375,6 +2375,43 @@ err_policy:
}

/**
+ * ocontext_to_sid - Helper to safely get sid for an ocontext
+ * @sidtab: SID table
+ * @c: ocontext structure
+ * @index: index of the context entry (0 or 1)
+ * @out_sid: pointer to the resulting SID value
+ *
+ * For all ocontexts except OCON_ISID the SID fields are populated
+ * on-demand when needed. Since updating the SID value is an SMP-sensitive
+ * operation, this helper must be used to do that safely.
+ *
+ * WARNING: This function may return -ESTALE, indicating that the caller
+ * must retry the operation after re-acquiring the policy pointer!
+ */
+static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c,
+ size_t index, u32 *out_sid)
+{
+ int rc;
+ u32 sid;
+
+ /* Ensure the associated sidtab entry is visible to this thread. */
+ sid = smp_load_acquire(&c->sid[index]);
+ if (!sid) {
+ rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid);
+ if (rc)
+ return rc;
+
+ /*
+ * Ensure the new sidtab entry is visible to other threads
+ * when they see the SID.
+ */
+ smp_store_release(&c->sid[index], sid);
+ }
+ *out_sid = sid;
+ return 0;
+}
+
+/**
* security_port_sid - Obtain the SID for a port.
* @state: SELinux state
* @protocol: protocol number
@@ -2412,17 +2449,13 @@ retry:
}

if (c) {
- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab, &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- *out_sid = c->sid[0];
+ if (rc)
+ goto out;
} else {
*out_sid = SECINITSID_PORT;
}
@@ -2471,18 +2504,13 @@ retry:
}

if (c) {
- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab,
- &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- *out_sid = c->sid[0];
+ if (rc)
+ goto out;
} else
*out_sid = SECINITSID_UNLABELED;

@@ -2531,17 +2559,13 @@ retry:
}

if (c) {
- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab, &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- *out_sid = c->sid[0];
+ if (rc)
+ goto out;
} else
*out_sid = SECINITSID_UNLABELED;

@@ -2585,25 +2609,13 @@ retry:
}

if (c) {
- if (!c->sid[0] || !c->sid[1]) {
- rc = sidtab_context_to_sid(sidtab, &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
- rc = sidtab_context_to_sid(sidtab, &c->context[1],
- &c->sid[1]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, if_sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- *if_sid = c->sid[0];
+ if (rc)
+ goto out;
} else
*if_sid = SECINITSID_NETIF;

@@ -2695,18 +2707,13 @@ retry:
}

if (c) {
- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab,
- &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- *out_sid = c->sid[0];
+ if (rc)
+ goto out;
} else {
*out_sid = SECINITSID_NODE;
}
@@ -2871,7 +2878,7 @@ static inline int __security_genfs_sid(s
u16 sclass;
struct genfs *genfs;
struct ocontext *c;
- int rc, cmp = 0;
+ int cmp = 0;

while (path[0] == '/' && path[1] == '/')
path++;
@@ -2885,9 +2892,8 @@ static inline int __security_genfs_sid(s
break;
}

- rc = -ENOENT;
if (!genfs || cmp)
- goto out;
+ return -ENOENT;

for (c = genfs->head; c; c = c->next) {
len = strlen(c->u.name);
@@ -2896,20 +2902,10 @@ static inline int __security_genfs_sid(s
break;
}

- rc = -ENOENT;
if (!c)
- goto out;
+ return -ENOENT;

- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]);
- if (rc)
- goto out;
- }
-
- *sid = c->sid[0];
- rc = 0;
-out:
- return rc;
+ return ocontext_to_sid(sidtab, c, 0, sid);
}

/**
@@ -2994,17 +2990,13 @@ retry:

if (c) {
sbsec->behavior = c->v.behavior;
- if (!c->sid[0]) {
- rc = sidtab_context_to_sid(sidtab, &c->context[0],
- &c->sid[0]);
- if (rc == -ESTALE) {
- rcu_read_unlock();
- goto retry;
- }
- if (rc)
- goto out;
+ rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid);
+ if (rc == -ESTALE) {
+ rcu_read_unlock();
+ goto retry;
}
- sbsec->sid = c->sid[0];
+ if (rc)
+ goto out;
} else {
rc = __security_genfs_sid(policy, fstype, "/",
SECCLASS_DIR, &sbsec->sid);

2021-11-16 01:49:37

by Greg KH

Subject: [PATCH 5.14 135/849] rsi: fix rate mask set leading to P2P failure

From: Martin Fuzzey <[email protected]>

commit b515d097053a71d624e0c5840b42cd4caa653941 upstream.

P2P client mode was only working the first time.
On subsequent connection attempts the group was successfully created but
no data was sent (no transmitted data packets were seen with a sniffer).

The reason for this was that the hardware was being configured in fixed
rate mode with rate RSI_RATE_1 (1Mbps) which is not valid in the 5GHz band.

In P2P mode wpa_supplicant uses NL80211_CMD_SET_TX_BITRATE_MASK to disallow
the 11b rates in the 2.4GHz band which updated common->fixedrate_mask.

rsi_set_min_rate() then used the fixedrate_mask to calculate the minimum
allowed rate, or 0xffff = auto if none was found.
However that calculation did not account for the different rate sets
allowed in the different bands leading to the error.

Fixing set_min_rate() would result in 6Mb/s being used all the time
which is not what we want either.

The reason the problem did not occur on the first connection is that
rsi_mac80211_set_rate_mask() only updated the fixedrate_mask for
the *current* band. When it was called that was still 2.4GHz as the
switch is done later. So the when set_min_rate() was subsequently
called after the switch to 5GHz it still had a mask of zero, leading
to defaulting to auto mode.

Fix this by differentiating the case of a single rate being
requested, in which case the hardware will be used in fixed rate
mode with just that rate, and multiple rates being requested,
in which case we remain in auto mode but the firmware rate selection
algorithm is configured with a restricted set of rates.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Signed-off-by: Martin Fuzzey <[email protected]>
CC: [email protected]
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +--
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 ++++++++--------------------
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 21 +++++--
drivers/net/wireless/rsi/rsi_main.h | 12 +++-
4 files changed, 50 insertions(+), 65 deletions(-)

--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -214,15 +214,17 @@ int rsi_prepare_data_desc(struct rsi_com
RSI_WIFI_DATA_Q);
data_desc->header_len = ieee80211_size;

- if (common->min_rate != RSI_RATE_AUTO) {
+ if (common->rate_config[common->band].fixed_enabled) {
/* Send fixed rate */
+ u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate;
+
data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE);
- data_desc->rate_info = cpu_to_le16(common->min_rate);
+ data_desc->rate_info = cpu_to_le16(fixed_rate);

if (conf_is_ht40(&common->priv->hw->conf))
data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE);

- if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) {
+ if (common->vif_info[0].sgi && (fixed_rate & 0x100)) {
/* Only MCS rates */
data_desc->rate_info |=
cpu_to_le16(ENABLE_SHORTGI_RATE);
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -510,7 +510,6 @@ static int rsi_mac80211_add_interface(st
if ((vif->type == NL80211_IFTYPE_AP) ||
(vif->type == NL80211_IFTYPE_P2P_GO)) {
rsi_send_rx_filter_frame(common, DISALLOW_BEACONS);
- common->min_rate = RSI_RATE_AUTO;
for (i = 0; i < common->max_stations; i++)
common->stations[i].sta = NULL;
}
@@ -1228,20 +1227,32 @@ static int rsi_mac80211_set_rate_mask(st
struct ieee80211_vif *vif,
const struct cfg80211_bitrate_mask *mask)
{
+ const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates);
struct rsi_hw *adapter = hw->priv;
struct rsi_common *common = adapter->priv;
- enum nl80211_band band = hw->conf.chandef.chan->band;
+ int i;

mutex_lock(&common->mutex);
- common->fixedrate_mask[band] = 0;

- if (mask->control[band].legacy == 0xfff) {
- common->fixedrate_mask[band] =
- (mask->control[band].ht_mcs[0] << 12);
- } else {
- common->fixedrate_mask[band] =
- mask->control[band].legacy;
+ for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) {
+ struct rsi_rate_config *cfg = &common->rate_config[i];
+ u32 bm;
+
+ bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset);
+ if (hweight32(bm) == 1) { /* single rate */
+ int rate_index = ffs(bm) - 1;
+
+ if (rate_index < mcs_offset)
+ cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value;
+ else
+ cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset];
+ cfg->fixed_enabled = true;
+ } else {
+ cfg->configured_mask = bm;
+ cfg->fixed_enabled = false;
+ }
}
+
mutex_unlock(&common->mutex);

return 0;
@@ -1378,46 +1389,6 @@ void rsi_indicate_pkt_to_os(struct rsi_c
ieee80211_rx_irqsafe(hw, skb);
}

-static void rsi_set_min_rate(struct ieee80211_hw *hw,
- struct ieee80211_sta *sta,
- struct rsi_common *common)
-{
- u8 band = hw->conf.chandef.chan->band;
- u8 ii;
- u32 rate_bitmap;
- bool matched = false;
-
- common->bitrate_mask[band] = sta->supp_rates[band];
-
- rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]);
-
- if (rate_bitmap & 0xfff) {
- /* Find out the min rate */
- for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
- if (rate_bitmap & BIT(ii)) {
- common->min_rate = rsi_rates[ii].hw_value;
- matched = true;
- break;
- }
- }
- }
-
- common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
-
- if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) {
- for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) {
- if ((rate_bitmap >> 12) & BIT(ii)) {
- common->min_rate = rsi_mcsrates[ii];
- matched = true;
- break;
- }
- }
- }
-
- if (!matched)
- common->min_rate = 0xffff;
-}
-
/**
* rsi_mac80211_sta_add() - This function notifies driver about a peer getting
* connected.
@@ -1516,9 +1487,9 @@ static int rsi_mac80211_sta_add(struct i

if ((vif->type == NL80211_IFTYPE_STATION) ||
(vif->type == NL80211_IFTYPE_P2P_CLIENT)) {
- rsi_set_min_rate(hw, sta, common);
+ common->bitrate_mask[common->band] = sta->supp_rates[common->band];
+ common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
if (sta->ht_cap.ht_supported) {
- common->vif_info[0].is_ht = true;
common->bitrate_mask[NL80211_BAND_2GHZ] =
sta->supp_rates[NL80211_BAND_2GHZ];
if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
@@ -1592,7 +1563,6 @@ static int rsi_mac80211_sta_remove(struc
bss->qos = sta->wme;
common->bitrate_mask[NL80211_BAND_2GHZ] = 0;
common->bitrate_mask[NL80211_BAND_5GHZ] = 0;
- common->min_rate = 0xffff;
common->vif_info[0].is_ht = false;
common->vif_info[0].sgi = false;
common->vif_info[0].seq_start = 0;
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -276,7 +276,7 @@ static void rsi_set_default_parameters(s
common->channel_width = BW_20MHZ;
common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
common->channel = 1;
- common->min_rate = 0xffff;
+ memset(&common->rate_config, 0, sizeof(common->rate_config));
common->fsm_state = FSM_CARD_NOT_READY;
common->iface_down = true;
common->endpoint = EP_2GHZ_20MHZ;
@@ -1314,7 +1314,7 @@ static int rsi_send_auto_rate_request(st
u8 band = hw->conf.chandef.chan->band;
u8 num_supported_rates = 0;
u8 rate_table_offset, rate_offset = 0;
- u32 rate_bitmap;
+ u32 rate_bitmap, configured_rates;
u16 *selected_rates, min_rate;
bool is_ht = false, is_sgi = false;
u16 frame_len = sizeof(struct rsi_auto_rate);
@@ -1364,6 +1364,10 @@ static int rsi_send_auto_rate_request(st
is_sgi = true;
}

+ /* Limit to any rates administratively configured by cfg80211 */
+ configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff;
+ rate_bitmap &= configured_rates;
+
if (band == NL80211_BAND_2GHZ) {
if ((rate_bitmap == 0) && (is_ht))
min_rate = RSI_RATE_MCS0;
@@ -1389,10 +1393,13 @@ static int rsi_send_auto_rate_request(st
num_supported_rates = jj;

if (is_ht) {
- for (ii = 0; ii < ARRAY_SIZE(mcs); ii++)
- selected_rates[jj++] = mcs[ii];
- num_supported_rates += ARRAY_SIZE(mcs);
- rate_offset += ARRAY_SIZE(mcs);
+ for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) {
+ if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) {
+ selected_rates[jj++] = mcs[ii];
+ num_supported_rates++;
+ rate_offset++;
+ }
+ }
}

sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL);
@@ -1482,7 +1489,7 @@ void rsi_inform_bss_status(struct rsi_co
qos_enable,
aid, sta_id,
vif);
- if (common->min_rate == 0xffff)
+ if (!common->rate_config[common->band].fixed_enabled)
rsi_send_auto_rate_request(common, sta, sta_id, vif);
if (opmode == RSI_OPMODE_STA &&
!(assoc_cap & WLAN_CAPABILITY_PRIVACY) &&
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -61,6 +61,7 @@ enum RSI_FSM_STATES {
extern u32 rsi_zone_enabled;
extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...);

+#define RSI_MAX_BANDS 2
#define RSI_MAX_VIFS 3
#define NUM_EDCA_QUEUES 4
#define IEEE80211_ADDR_LEN 6
@@ -230,6 +231,12 @@ struct rsi_9116_features {
u32 ps_options;
};

+struct rsi_rate_config {
+ u32 configured_mask; /* configured by mac80211 bits 0-11=legacy 12+ mcs */
+ u16 fixed_hw_rate;
+ bool fixed_enabled;
+};
+
struct rsi_common {
struct rsi_hw *priv;
struct vif_priv vif_info[RSI_MAX_VIFS];
@@ -255,8 +262,8 @@ struct rsi_common {
u8 channel_width;

u16 rts_threshold;
- u16 bitrate_mask[2];
- u32 fixedrate_mask[2];
+ u32 bitrate_mask[RSI_MAX_BANDS];
+ struct rsi_rate_config rate_config[RSI_MAX_BANDS];

u8 rf_reset;
struct transmit_q_stats tx_stats;
@@ -277,7 +284,6 @@ struct rsi_common {
u8 mac_id;
u8 radio_id;
u16 rate_pwr[20];
- u16 min_rate;

/* WMM algo related */
u8 selected_qnum;

2021-11-16 01:49:40

by Greg KH

Subject: [PATCH 5.14 131/849] libata: fix checking of DMA state

From: Reimar Döffinger <[email protected]>

commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream.

Checking if DMA is enabled should be done via the
ata_dma_enabled helper function, since the init state
0xff indicates disabled.
This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed
for before DMA was enabled, which caused hangs for some combinations
of controllers and devices.
It might also have caused it to be incorrectly disabled as broken,
but there have been no reports of that.

Cc: [email protected]
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195895
Signed-off-by: Reimar Döffinger <[email protected]>
Tested-by: Paul Menzel <[email protected]>
Signed-off-by: Damien Le Moal <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2004,7 +2004,7 @@ unsigned int ata_read_log_page(struct at

retry:
ata_tf_init(dev, &tf);
- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
+ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) &&
!(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) {
tf.command = ATA_CMD_READ_LOG_DMA_EXT;
tf.protocol = ATA_PROT_DMA;

2021-11-16 01:49:50

by Greg KH

Subject: [PATCH 5.14 134/849] rsi: fix key enabled check causing unwanted encryption for vap_id > 0

From: Martin Fuzzey <[email protected]>

commit 99ac6018821253ec67f466086afb63fc18ea48e2 upstream.

My previous patch checked if encryption should be enabled by directly
checking info->control.hw_key (like the downstream driver).
However that missed that the control and driver_info members of
struct ieee80211_tx_info are union fields.

Due to this when rsi_core_xmit() updates fields in "tx_params"
(driver_info) it can overwrite the control.hw_key, causing the result
of the later test to be incorrect.

With the current structure layout the first byte of control.hw_key is
overlayed with the vap_id so, since we only test if control.hw_key is
NULL / non NULL, a non zero vap_id will incorrectly enable encryption.

In basic STA and AP modes the vap_id is always zero so it works but in
P2P client mode a second VIF is created causing vap_id to be non zero
and hence encryption to be enabled before keys have been set.

Fix this by extracting the key presence flag to a new field in the driver
private tx_params structure and populating it first.

Fixes: 314538041b56 ("rsi: fix AP mode with WPA failure due to encrypted EAPOL")
Signed-off-by: Martin Fuzzey <[email protected]>
CC: [email protected]
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_core.c | 2 ++
drivers/net/wireless/rsi/rsi_91x_hal.c | 2 +-
drivers/net/wireless/rsi/rsi_main.h | 1 +
3 files changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rsi/rsi_91x_core.c
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -399,6 +399,8 @@ void rsi_core_xmit(struct rsi_common *co

info = IEEE80211_SKB_CB(skb);
tx_params = (struct skb_info *)info->driver_data;
+ /* info->driver_data and info->control part of union so make copy */
+ tx_params->have_key = !!info->control.hw_key;
wh = (struct ieee80211_hdr *)&skb->data[0];
tx_params->sta_id = 0;

--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -203,7 +203,7 @@ int rsi_prepare_data_desc(struct rsi_com
wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE);

if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
- info->control.hw_key) {
+ tx_params->have_key) {
if (rsi_is_cipher_wep(common))
ieee80211_size += 4;
else
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -139,6 +139,7 @@ struct skb_info {
u8 internal_hdr_size;
struct ieee80211_vif *vif;
u8 vap_id;
+ bool have_key;
};

enum edca_queue {

2021-11-16 01:49:52

by Greg KH

Subject: [PATCH 5.14 136/849] rsi: Fix module dev_oper_mode parameter description

From: Marek Vasut <[email protected]>

commit 31f97cf9f0c31143a2a6fcc89c4a1286ce20157e upstream.

The module parameters are missing dev_oper_mode 12, BT classic alone,
add it. Moreover, the parameters encode newlines, which ends up being
printed malformed e.g. by modinfo, so fix that too.

However, the module parameter string is duplicated in both USB and SDIO
modules and the dev_oper_mode mode enumeration in those module parameters
is a duplicate of macros used by the driver. Furthermore, the enumeration
is confusing.

So, deduplicate the module parameter string and use __stringify() to
encode the correct mode enumeration values into the module parameter
string. Finally, replace 'Wi-Fi' with 'Wi-Fi alone' and 'BT' with
'BT classic alone' to clarify what those modes really mean.

Fixes: 898b255339310 ("rsi: add module parameter operating mode")
Signed-off-by: Marek Vasut <[email protected]>
Cc: Amitkumar Karwar <[email protected]>
Cc: Angus Ainslie <[email protected]>
Cc: David S. Miller <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Kalle Valo <[email protected]>
Cc: Karun Eagalapati <[email protected]>
Cc: Martin Fuzzey <[email protected]>
Cc: Martin Kepplinger <[email protected]>
Cc: Prameela Rani Garnepudi <[email protected]>
Cc: Sebastian Krzyszkowiak <[email protected]>
Cc: Siva Rebbagondla <[email protected]>
Cc: [email protected]
Cc: <[email protected]> # 4.17+
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_sdio.c | 5 +----
drivers/net/wireless/rsi/rsi_91x_usb.c | 5 +----
drivers/net/wireless/rsi/rsi_hal.h | 11 +++++++++++
3 files changed, 13 insertions(+), 8 deletions(-)

--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -24,10 +24,7 @@
/* Default operating mode is wlan STA + BT */
static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);

/**
* rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -25,10 +25,7 @@
/* Default operating mode is wlan STA + BT */
static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
- "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);

static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags);

--- a/drivers/net/wireless/rsi/rsi_hal.h
+++ b/drivers/net/wireless/rsi/rsi_hal.h
@@ -28,6 +28,17 @@
#define DEV_OPMODE_AP_BT 6
#define DEV_OPMODE_AP_BT_DUAL 14

+#define DEV_OPMODE_PARAM_DESC \
+ __stringify(DEV_OPMODE_WIFI_ALONE) "[Wi-Fi alone], " \
+ __stringify(DEV_OPMODE_BT_ALONE) "[BT classic alone], " \
+ __stringify(DEV_OPMODE_BT_LE_ALONE) "[BT LE alone], " \
+ __stringify(DEV_OPMODE_BT_DUAL) "[BT classic + BT LE alone], " \
+ __stringify(DEV_OPMODE_STA_BT) "[Wi-Fi STA + BT classic], " \
+ __stringify(DEV_OPMODE_STA_BT_LE) "[Wi-Fi STA + BT LE], " \
+ __stringify(DEV_OPMODE_STA_BT_DUAL) "[Wi-Fi STA + BT classic + BT LE], " \
+ __stringify(DEV_OPMODE_AP_BT) "[Wi-Fi AP + BT classic], " \
+ __stringify(DEV_OPMODE_AP_BT_DUAL) "[Wi-Fi AP + BT classic + BT LE]"
+
#define FLASH_WRITE_CHUNK_SIZE (4 * 1024)
#define FLASH_SECTOR_SIZE (4 * 1024)

2021-11-16 01:52:02

by Greg KH

Subject: [PATCH 5.14 128/849] PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions

From: Rafael J. Wysocki <[email protected]>

commit 928265e3601cde78c7e0a3e518a93b27defed3b1 upstream.

There is no reason to allow "syscore" devices to runtime-suspend
during system-wide PM transitions, because they are subject to the
same possible failure modes as any other devices in that respect.

Accordingly, change device_prepare() and device_complete() to call
pm_runtime_get_noresume() and pm_runtime_put(), respectively, for
"syscore" devices too.

Fixes: 057d51a1268f ("Merge branch 'pm-sleep'")
Signed-off-by: Rafael J. Wysocki <[email protected]>
Cc: 3.10+ <[email protected]> # 3.10+
Reviewed-by: Ulf Hansson <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/base/power/main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1051,7 +1051,7 @@ static void device_complete(struct devic
const char *info = NULL;

if (dev->power.syscore)
- return;
+ goto out;

device_lock(dev);

@@ -1081,6 +1081,7 @@ static void device_complete(struct devic

device_unlock(dev);

+out:
pm_runtime_put(dev);
}

@@ -1794,9 +1795,6 @@ static int device_prepare(struct device
int (*callback)(struct device *) = NULL;
int ret = 0;

- if (dev->power.syscore)
- return 0;
-
/*
* If a device's parent goes into runtime suspend at the wrong time,
* it won't be possible to resume the device. To prevent this we
@@ -1805,6 +1803,9 @@ static int device_prepare(struct device
*/
pm_runtime_get_noresume(dev);

+ if (dev->power.syscore)
+ return 0;
+
device_lock(dev);

dev->power.wakeup_path = false;

2021-11-16 01:52:02

by Greg KH

Subject: [PATCH 5.14 130/849] mwifiex: Try waking the firmware until we get an interrupt

From: Jonas Dreßler <[email protected]>

commit 8e3e59c31fea5de95ffc52c46f0c562c39f20c59 upstream.

It seems that the PCIe+USB firmware (latest version 15.68.19.p21) of the
88W8897 card sometimes ignores or misses when we try to wake it up by
writing to the firmware status register. This leads to the firmware
wakeup timeout expiring and the driver resetting the card because we
assume the firmware has hung up or crashed.

Turns out that the firmware actually didn't hang up, but simply "missed"
our wakeup request and didn't send us an interrupt with an AWAKE event.

Trying again to read the firmware status register after a short timeout
usually makes the firmware wake up as expected, so add a small retry
loop to mwifiex_pm_wakeup_card() that looks at the interrupt status to
check whether the card woke up.

The number of tries and timeout lengths for this were determined
experimentally: The firmware usually takes about 500 us to wake up
after we attempt to read the status register. In some cases where the
firmware is very busy (for example while doing a bluetooth scan) it
might even miss our requests for multiple milliseconds, which is why
after 15 tries the waiting time gets increased to 10 ms. The maximum
number of tries it took to wake the firmware when testing this was
around 20, so a maximum number of 50 tries should give us plenty of
safety margin.

Here's a reproducer for those firmware wakeup failures I've found:

1) Make sure wifi powersaving is enabled (iw dev wlp1s0 set power_save on)
2) Connect to any wifi network (makes firmware go into wifi powersaving
mode, not deep sleep)
3) Make sure bluetooth is turned off (to ensure the firmware actually
enters powersave mode and doesn't keep the radio active doing bluetooth
stuff)
4) To confirm that wifi powersaving is entered ping a device on the LAN,
pings should be a few ms higher than without powersaving
5) Run "while true; do iwconfig; sleep 0.0001; done", this wakes and
suspends the firmware extremely often
6) Wait until things explode, for me it consistently takes <5 minutes

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681
Cc: [email protected]
Signed-off-by: Jonas Dreßler <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/marvell/mwifiex/pcie.c | 28 +++++++++++++++++++++++-----
1 file changed, 23 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -17,6 +17,7 @@
* this warranty disclaimer.
*/

+#include <linux/iopoll.h>
#include <linux/firmware.h>

#include "decl.h"
@@ -636,11 +637,15 @@ static void mwifiex_delay_for_sleep_cook
"max count reached while accessing sleep cookie\n");
}

+#define N_WAKEUP_TRIES_SHORT_INTERVAL 15
+#define N_WAKEUP_TRIES_LONG_INTERVAL 35
+
/* This function wakes up the card by reading fw_status register. */
static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
{
struct pcie_service_card *card = adapter->card;
const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+ int retval;

mwifiex_dbg(adapter, EVENT,
"event: Wakeup device...\n");
@@ -648,11 +653,24 @@ static int mwifiex_pm_wakeup_card(struct
if (reg->sleep_cookie)
mwifiex_pcie_dev_wakeup_delay(adapter);

- /* Accessing fw_status register will wakeup device */
- if (mwifiex_write_reg(adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
- mwifiex_dbg(adapter, ERROR,
- "Writing fw_status register failed\n");
- return -1;
+ /* The 88W8897 PCIe+USB firmware (latest version 15.68.19.p21) sometimes
+ * appears to ignore or miss our wakeup request, so we continue trying
+ * until we receive an interrupt from the card.
+ */
+ if (read_poll_timeout(mwifiex_write_reg, retval,
+ READ_ONCE(adapter->int_status) != 0,
+ 500, 500 * N_WAKEUP_TRIES_SHORT_INTERVAL,
+ false,
+ adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
+ if (read_poll_timeout(mwifiex_write_reg, retval,
+ READ_ONCE(adapter->int_status) != 0,
+ 10000, 10000 * N_WAKEUP_TRIES_LONG_INTERVAL,
+ false,
+ adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
+ mwifiex_dbg(adapter, ERROR,
+ "Firmware didn't wake up\n");
+ return -EIO;
+ }
}

if (reg->sleep_cookie) {

2021-11-16 01:52:03

by Greg KH

Subject: [PATCH 5.14 123/849] HID: surface-hid: Use correct event registry for managing HID events

From: Maximilian Luz <[email protected]>

commit dc0fd0acb6e0e8025a0a43ada54513b216254fac upstream.

Until now, we have only ever seen the REG-category registry being used
on devices addressed with target ID 2. In fact, we have only ever seen
Surface Aggregator Module (SAM) HID devices with target ID 2. For those
devices, the registry also has to be addressed with target ID 2.

Some devices, like the new Surface Laptop Studio, however, address their
HID devices on target ID 1. As a result of this, any target ID 2
commands time out. This includes event management commands addressed to
the target ID 2 REG-category registry. For these devices, the registry
has to be addressed via target ID 1 instead.

We therefore assume that the target ID of the registry to be used
depends on the target ID of the respective device. Implement this
accordingly.

Note that we currently allow the surface HID driver to only load against
devices with target ID 2, so these timeouts are not happening (yet).
This is just a preparation step before we allow the driver to load
against all target IDs.

Cc: [email protected] # 5.14+
Signed-off-by: Maximilian Luz <[email protected]>
Acked-by: Benjamin Tissoires <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Hans de Goede <[email protected]>
Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/hid/surface-hid/surface_hid.c | 2 +-
include/linux/surface_aggregator/controller.h | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/hid/surface-hid/surface_hid.c
+++ b/drivers/hid/surface-hid/surface_hid.c
@@ -209,7 +209,7 @@ static int surface_hid_probe(struct ssam

shid->notif.base.priority = 1;
shid->notif.base.fn = ssam_hid_event_fn;
- shid->notif.event.reg = SSAM_EVENT_REGISTRY_REG;
+ shid->notif.event.reg = SSAM_EVENT_REGISTRY_REG(sdev->uid.target);
shid->notif.event.id.target_category = sdev->uid.category;
shid->notif.event.id.instance = sdev->uid.instance;
shid->notif.event.mask = SSAM_EVENT_MASK_STRICT;
--- a/include/linux/surface_aggregator/controller.h
+++ b/include/linux/surface_aggregator/controller.h
@@ -792,8 +792,8 @@ enum ssam_event_mask {
#define SSAM_EVENT_REGISTRY_KIP \
SSAM_EVENT_REGISTRY(SSAM_SSH_TC_KIP, 0x02, 0x27, 0x28)

-#define SSAM_EVENT_REGISTRY_REG \
- SSAM_EVENT_REGISTRY(SSAM_SSH_TC_REG, 0x02, 0x01, 0x02)
+#define SSAM_EVENT_REGISTRY_REG(tid)\
+ SSAM_EVENT_REGISTRY(SSAM_SSH_TC_REG, tid, 0x01, 0x02)

/**
* enum ssam_event_notifier_flags - Flags for event notifiers.

2021-11-16 01:52:03

by Greg KH

Subject: [PATCH 5.14 124/849] HID: surface-hid: Allow driver matching for target ID 1 devices

From: Maximilian Luz <[email protected]>

commit ab5fe33925c6b03f646a1153771dab047548e4d8 upstream.

Until now we have only ever seen HID devices with target ID 2. The new
Surface Laptop Studio however uses HID devices with target ID 1. Allow
matching this driver to those as well.

Cc: [email protected] # 5.14+
Signed-off-by: Maximilian Luz <[email protected]>
Acked-by: Benjamin Tissoires <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Hans de Goede <[email protected]>
Signed-off-by: Hans de Goede <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/hid/surface-hid/surface_hid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hid/surface-hid/surface_hid.c
+++ b/drivers/hid/surface-hid/surface_hid.c
@@ -230,7 +230,7 @@ static void surface_hid_remove(struct ss
}

static const struct ssam_device_id surface_hid_match[] = {
- { SSAM_SDEV(HID, 0x02, SSAM_ANY_IID, 0x00) },
+ { SSAM_SDEV(HID, SSAM_ANY_TID, SSAM_ANY_IID, 0x00) },
{ },
};
MODULE_DEVICE_TABLE(ssam, surface_hid_match);

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 077/849] fcnal-test: kill hanging ping/nettest binaries on cleanup

From: Florian Westphal <[email protected]>

[ Upstream commit 1f83b835a3eaa5ae4bd825fb07182698bfc243ba ]

On my box I see a bunch of ping/nettest processes hanging
around after fcntal-test.sh is done.

Clean those up before netns deletion.

Signed-off-by: Florian Westphal <[email protected]>
Acked-by: David Ahern <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
tools/testing/selftests/net/fcnal-test.sh | 3 +++
1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index a8ad92850e630..8acc4f2a20071 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -436,10 +436,13 @@ cleanup()
ip -netns ${NSA} link set dev ${NSA_DEV} down
ip -netns ${NSA} link del dev ${NSA_DEV}

+ ip netns pids ${NSA} | xargs kill 2>/dev/null
ip netns del ${NSA}
fi

+ ip netns pids ${NSB} | xargs kill 2>/dev/null
ip netns del ${NSB}
+ ip netns pids ${NSC} | xargs kill 2>/dev/null
ip netns del ${NSC} >/dev/null 2>&1
}

--
2.33.0

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 067/849] cavium: Fix return values of the probe function

From: Zheyu Ma <[email protected]>

[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]

During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.

Signed-off-by: Zheyu Ma <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index e2b290135fd97..a61107e05216c 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1224,7 +1224,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (ret < 0) {
netdev_err(nic->netdev,
"Req for #%d msix vectors failed\n", nic->num_vec);
- return 1;
+ return ret;
}

sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
@@ -1243,7 +1243,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (!nicvf_check_pf_ready(nic)) {
nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
nicvf_unregister_interrupts(nic);
- return 1;
+ return -EIO;
}

return 0;
--
2.33.0

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 042/849] ALSA: usb-audio: Add registration quirk for JBL Quantum 400

From: Alexander Tsoy <[email protected]>

commit 763d92ed5dece7d439fc28a88b2d2728d525ffd9 upstream.

Add another device ID for JBL Quantum 400. It requires the same quirk as
other JBL Quantum devices.

Signed-off-by: Alexander Tsoy <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/usb/quirks.c | 1 +
1 file changed, 1 insertion(+)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1899,6 +1899,7 @@ static const struct registration_quirk r
REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */
REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */
REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */
+ REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */
REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */
REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */
REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 058/849] ASoC: cs42l42: Ensure 0dB full scale volume is used for headsets

From: Stefan Binding <[email protected]>

[ Upstream commit aa18457c4af7a9dad1f2b150b11beae1d8ab57aa ]

Ensure the default 0dB playback path is always used.

The code that set FULL_SCALE_VOL based on LOAD_DET_RCSTAT was
spurious, and resulted in a -6dB attenuation being accidentally
inserted into the playback path.

Signed-off-by: Stefan Binding <[email protected]>
Signed-off-by: Richard Fitzgerald <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/soc/codecs/cs42l42.c | 16 +++-------------
1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 99c022be94a68..8838b9a0de8e4 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -901,7 +901,6 @@ static int cs42l42_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
struct snd_soc_component *component = dai->component;
struct cs42l42_private *cs42l42 = snd_soc_component_get_drvdata(component);
unsigned int regval;
- u8 fullScaleVol;
int ret;

if (mute) {
@@ -972,20 +971,11 @@ static int cs42l42_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
cs42l42->stream_use |= 1 << stream;

if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
- /* Read the headphone load */
- regval = snd_soc_component_read(component, CS42L42_LOAD_DET_RCSTAT);
- if (((regval & CS42L42_RLA_STAT_MASK) >> CS42L42_RLA_STAT_SHIFT) ==
- CS42L42_RLA_STAT_15_OHM) {
- fullScaleVol = CS42L42_HP_FULL_SCALE_VOL_MASK;
- } else {
- fullScaleVol = 0;
- }
-
- /* Un-mute the headphone, set the full scale volume flag */
+ /* Un-mute the headphone */
snd_soc_component_update_bits(component, CS42L42_HP_CTL,
CS42L42_HP_ANA_AMUTE_MASK |
- CS42L42_HP_ANA_BMUTE_MASK |
- CS42L42_HP_FULL_SCALE_VOL_MASK, fullScaleVol);
+ CS42L42_HP_ANA_BMUTE_MASK,
+ 0);
}
}

--
2.33.0

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 045/849] ALSA: PCM: Fix NULL dereference at mmap checks

From: Takashi Iwai <[email protected]>

commit 8e537d5dec34cac746dd6abf6a83e5de3aa471fc upstream.

The recent refactoring of mmap handling caused Oops on some devices
that don't use the standard memory allocations. This patch addresses
it by allowing snd_dma_buffer_mmap() helper to receive the NULL
pointer dmab argument (and return an error appropriately).

Fixes: a202bd1ad86d ("ALSA: core: Move mmap handler into memalloc ops")
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/core/memalloc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

--- a/sound/core/memalloc.c
+++ b/sound/core/memalloc.c
@@ -135,8 +135,11 @@ EXPORT_SYMBOL(snd_dma_free_pages);
int snd_dma_buffer_mmap(struct snd_dma_buffer *dmab,
struct vm_area_struct *area)
{
- const struct snd_malloc_ops *ops = snd_dma_get_ops(dmab);
+ const struct snd_malloc_ops *ops;

+ if (!dmab)
+ return -ENOENT;
+ ops = snd_dma_get_ops(dmab);
if (ops && ops->mmap)
return ops->mmap(dmab, area);
else

2021-11-16 01:52:07

by Greg KH

Subject: [PATCH 5.14 046/849] ALSA: timer: Fix use-after-free problem

From: Wang Wensheng <[email protected]>

commit c0317c0e87094f5b5782b6fdef5ae0a4b150496c upstream.

When the timer instance was add into ack_list but was not currently in
process, the user could stop it via snd_timer_stop1() without delete it
from the ack_list. Then the user could free the timer instance and when
it was actually processed UAF occurred.

This issue could be reproduced via testcase snd_timer01 in ltp - running
several instances of that testcase at the same time.

What I actually met was that the ack_list of the timer broken and the
kernel went into deadloop with irqoff. That could be detected by
hardlockup detector on board or when we run it on qemu, we could use gdb
to dump the ack_list when the console has no response.

To fix this issue, we delete the timer instance from ack_list and
active_list unconditionally in snd_timer_stop1().

Signed-off-by: Wang Wensheng <[email protected]>
Suggested-by: Takashi Iwai <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/core/timer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -624,13 +624,13 @@ static int snd_timer_stop1(struct snd_ti
if (!timer)
return -EINVAL;
spin_lock_irqsave(&timer->lock, flags);
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
SNDRV_TIMER_IFLG_START))) {
result = -EBUSY;
goto unlock;
}
- list_del_init(&timeri->ack_list);
- list_del_init(&timeri->active_list);
if (timer->card && timer->card->shutdown)
goto unlock;
if (stop) {

2021-11-16 01:52:09

by Greg KH

Subject: [PATCH 5.14 043/849] ALSA: hda: Free card instance properly at probe errors

From: Takashi Iwai <[email protected]>

commit 39173303c83859723dab32c2abfb97296d6af3bf upstream.

The recent change in hda-intel driver to allow repeated probes
surfaced a problem that has been hidden until; the probe process in
the work calls azx_free() at the error path, and this skips the card
free process that eventually releases codec instances. As a result,
we get a kernel WARNING like:

snd_hda_intel 0000:00:1f.3: Cannot probe codecs, giving up
------------[ cut here ]------------
WARNING: CPU: 14 PID: 186 at sound/hda/hdac_bus.c:73
....

For fixing this, we need to call snd_card_free() instead of
azx_free(). Additionally, the device drvdata has to be cleared, as
the driver binding itself is still active. Then the PM and other
driver callbacks will ignore the procedure.

Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors")
Reported-and-tested-by: Scott Branden <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
sound/pci/hda/hda_intel.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2358,7 +2358,8 @@ static int azx_probe_continue(struct azx

out_free:
if (err < 0) {
- azx_free(chip);
+ pci_set_drvdata(pci, NULL);
+ snd_card_free(chip->card);
return err;
}

2021-11-16 01:52:13

by Greg KH

Subject: [PATCH 5.14 059/849] ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers

From: Davide Baldo <[email protected]>

[ Upstream commit d94befbb5ae379f6dfd4fa6d460eacc09fa7b9c3 ]

In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and
rear speakers are silent, this patch fixes that by overriding the pin
layout and by initializing the amplifier which needs a GPIO pin to be
set to 1 then 0, similar to the existing HP Spectre x360 14 model.

In order to have volume control, both front and rear speakers were
forced to use the DAC1.

This patch also correctly map the mute LED but since there is no
microphone on/off switch exposed by the alsa subsystem it never turns
on by itself.

There are still known audio issues in this laptop: headset microphone
doesn't work, the button to mute/unmute microphone is not yet mapped,
the LED of the mute/unmute speakers doesn't seems to be exposed via
GPIO and never turns on.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213953
Signed-off-by: Davide Baldo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++++++++
1 file changed, 46 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ae2974dfd83f6..752857908e466 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6430,6 +6430,44 @@ static void alc_fixup_no_int_mic(struct hda_codec *codec,
}
}

+/* GPIO1 = amplifier on/off
+ * GPIO3 = mic mute LED
+ */
+static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ static const hda_nid_t conn[] = { 0x02 };
+
+ struct alc_spec *spec = codec->spec;
+ static const struct hda_pintbl pincfgs[] = {
+ { 0x14, 0x90170110 }, /* front/high speakers */
+ { 0x17, 0x90170130 }, /* back/bass speakers */
+ { }
+ };
+
+ //enable micmute led
+ alc_fixup_hp_gpio_led(codec, action, 0x00, 0x04);
+
+ switch (action) {
+ case HDA_FIXUP_ACT_PRE_PROBE:
+ spec->micmute_led_polarity = 1;
+ /* needed for amp of back speakers */
+ spec->gpio_mask |= 0x01;
+ spec->gpio_dir |= 0x01;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ /* share DAC to have unified volume control */
+ snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn);
+ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn);
+ break;
+ case HDA_FIXUP_ACT_INIT:
+ /* need to toggle GPIO to enable the amp of back speakers */
+ alc_update_gpio_data(codec, 0x01, true);
+ msleep(100);
+ alc_update_gpio_data(codec, 0x01, false);
+ break;
+ }
+}
+
static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
@@ -6582,6 +6620,7 @@ enum {
ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
ALC280_FIXUP_HP_9480M,
ALC245_FIXUP_HP_X360_AMP,
+ ALC285_FIXUP_HP_SPECTRE_X360_EB1,
ALC288_FIXUP_DELL_HEADSET_MODE,
ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC288_FIXUP_DELL_XPS_13,
@@ -8279,6 +8318,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc285_fixup_hp_spectre_x360,
},
+ [ALC285_FIXUP_HP_SPECTRE_X360_EB1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_hp_spectre_x360_eb1
+ },
[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc285_fixup_ideapad_s740_coef,
@@ -8629,6 +8672,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
+ SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
@@ -9055,6 +9100,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
{.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"},
{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
{.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
+ {.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
{.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
--
2.33.0

2021-11-16 01:52:13

by Greg KH

Subject: [PATCH 5.14 127/849] wcn36xx: Fix (QoS) null data frame bitrate/modulation

From: Loic Poulain <[email protected]>

commit d3fd2c95c1c13ec217d43ebef3c61cfa00a6cd37 upstream.

We observe unexpected connection drops with some APs due to
non-acked mac80211 generated null data frames (keep-alive).
After debugging and capture, we noticed that null frames are
submitted at standard data bitrate and that the given APs are
in trouble with that.

After setting the null frame bitrate to control bitrate, all
null frames are acked as expected and connection is maintained.

Not sure if it's a requirement of the specification, but it seems
the right thing to do anyway, null frames are mostly used for control
purpose (power-saving, keep-alive...), and submitting them with
a slower/simpler bitrate/modulation is more robust.

Cc: [email protected]
Fixes: 512b191d9652 ("wcn36xx: Fix TX data path")
Signed-off-by: Loic Poulain <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/ath/wcn36xx/txrx.c | 1 +
1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -429,6 +429,7 @@ static void wcn36xx_set_tx_data(struct w
if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
/* Don't use a regular queue for null packet (no ampdu) */
bd->queue_id = WCN36XX_TX_U_WQ_ID;
+ bd->bd_rate = WCN36XX_BD_RATE_CTRL;
}

if (bcast) {