[ Upstream commit affc18fd ]

q->bands will be assigned to qopt->bands to execute subsequent code logic
after kmalloc. So the old q->bands should not be used in kmalloc.
Otherwise, an out-of-bounds write will occur.

Bug: 349777785
Fixes: c2999f7f ("net: sched: multiq: don't call qdisc_put() while holding tree lock")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 0f208fad86631e005754606c3ec80c0d44a11882)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iec8413c39878596795420ae58bbe6974890cf2de

Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.

Fixes: 6d98eb95 ("binder: avoid potential data leakage when copying txn")
Cc: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 352520660
Link: https://lore.kernel.org/all/20240822182353.2129600-1-cmllamas@google.com/


Change-Id: I1b2dd8403b63e5eeb58904558b7b542141c83fc2
Signed-off-by: Carlos Llamas <cmllamas@google.com>
(cherry picked from commit b42ed94769088450987f2b52f41a3fb274244827)
Signed-off-by: Lee Jones <joneslee@google.com>

[ Upstream commit f42c9702 ]

If the eeprom is not accessible, an nvmem device will be registered, the
read will fail, and the device will be torn down. If another driver
accesses the nvmem device after the teardown, it will reference
invalid memory.

Move the failure point before registering the nvmem device.

Bug: 359558663

Change-Id: If6368cf79172ca2d3e953e63e68ee4e7b3830512
Signed-off-by: Daniel Okazaki <dtokazaki@google.com>
Fixes: b20eb4c1 ("eeprom: at24: drop unnecessary label")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com


Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit c850f71fca09ea41800ed55905980063d17e01da)

[ Upstream commit caba40ec ]

The DDR3 SPD data structure advertises the presence of a thermal
sensor on a DDR3 module in byte 32, bit 7. Let's use this information
to explicitly instantiate the thermal sensor I2C client instead of
having to rely on class-based I2C probing.

The temp sensor i2c address can be derived from the SPD i2c address,
so we can directly instantiate the device and don't have to probe
for it. If the temp sensor has been instantiated already by other
means (e.g. class-based auto-detection), then the busy-check in
i2c_new_client_device will detect this.

Note: Thermal sensors on DDR4 DIMM's are instantiated from the
      ee1004 driver.

Bug: 359558663

Change-Id: I4dfb4969f7a5ae6c31bd96436c2773d16c9dcf81
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/68113672-3724-44d5-9ff8-313dd6628f8c@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f42c9702 ("eeprom: at24: fix memory corruption race condition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ec9dbddea26b38bd6b2827ddb763831564282295)

[ Upstream commit a3c10035 ]

When using nvmem layouts it is possible devm_nvmem_register returns
-EPROBE_DEFER, resulting in an 'empty' in
/sys/kernel/debug/devices_deferred. Use dev_err_probe for providing
additional information.

Bug: 359558663

Change-Id: I75c5d2437dbe4ee1dfe4f5eb88c8f892cb49ab4f
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Stable-dep-of: f42c9702 ("eeprom: at24: fix memory corruption race condition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit b2643d2532eee507d83e0a0055da8aac1bd1660a)

The "scmi_info->irq" get -22 (-EINVAL) when no "a2p" interrupt, keep to
use (scmi_info->irq > 0) as if condition to avoid BUG happen like this:

For cherry picked patch 18126b26 (UPSTREAM: firmware: arm_scmi: Fix chan_free cleanup on SMC),
it depends on below two patches from mainline to avoid the BUG we met.
f716cbd3 firmware: arm_scmi: Make smc transport use common completions
a690b7e6 firmware: arm_scmi: Add configurable polling mode for transports

These two patch can't apply directly now, quiet a lot of changes need to merge,
which is much higher risk than just apply this simple fix.

[ 0.199652][ T1] arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
[ 0.200296][ T1] list_add corruption. prev is NULL.
[ 0.200773][ T1] ------------[ cut here ]------------
[ 0.201242][ T1] kernel BUG at lib/list_debug.c:24!
[ 0.201696][ T1] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[ 0.202246][ T1] Modules linked in:
[ 0.202581][ T1] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.10.214-android13-4-00002-g4c868a6e89f5-ab12097184 #1
[ 0.203511][ T1] Hardware name: Rockchip RK3588S EVB8 LP4X V10 Board (DT)
[ 0.204137][ T1] pstate: 60800085 (nZCv daIf -PAN +UAO -TCO BTYPE=--)
[ 0.204735][ T1] pc : list_add_valid+0x80/0xc0
[ 0.205168][ T1] lr : __list_add_valid+0x80/0xc0
[ 0.205599][ T1] sp : ffffffc00b24b700
[ 0.205958][ T1] x29: ffffffc00b24b700 x28: 0000000000000002
[ 0.206494][ T1] x27: 00000000000000e0 x26: ffffff810019ca00
[ 0.207027][ T1] x25: 0000000000000000 x24: ffffff810122c1e0
[ 0.207560][ T1] x23: ffffff810122c1d8 x22: ffffffc00b24b728
[ 0.208097][ T1] x21: ffffff810122c1d0 x20: 0000000000000000
[ 0.208631][ T1] x19: 7fffffffffffffff x18: ffffffc00b2350b8
[ 0.209165][ T1] x17: ffffffffffffffff x16: 0000000000000000
[ 0.209697][ T1] x15: 0000000000000004 x14: ffffffc00af6d130
[ 0.210231][ T1] x13: 0000000000000fff x12: 0000000000000003
[ 0.210769][ T1] x11: 00000000ffffffff x10: c0000000ffffefff
[ 0.211300][ T1] x9 : 91b264ed20239600 x8 : 91b264ed20239600
[ 0.211834][ T1] x7 : 322e30202020205b x6 : ffffffc00b1873d8
[ 0.212365][ T1] x5 : ffffffc00b184fee x4 : 0000000000000000
[ 0.212896][ T1] x3 : 0000000000000000 x2 : 0000000000000000
[ 0.213426][ T1] x1 : ffffffc00b24b4d0 x0 : 0000000000000022
[ 0.213959][ T1] Call trace:
[ 0.214239][ T1] __list_add_valid+0x80/0xc0
[ 0.214645][ T1] wait_for_common+0x104/0x308
[ 0.215059][ T1] smc_send_message+0x100/0x2a8
[ 0.215477][ T1] do_xfer+0x128/0x858
[ 0.215826][ T1] version_get+0x88/0x20c
[ 0.216198][ T1] scmi_base_protocol_init+0x6c/0x720
[ 0.216663][ T1] scmi_get_protocol_instance+0x1f4/0x49c
[ 0.217156][ T1] scmi_probe+0x244/0x724
[ 0.217531][ T1] platform_drv_probe+0x60/0x17c
[ 0.217956][ T1] really_probe+0x310/0x974
[ 0.218342][ T1] driver_probe_device+0x74/0x298
[ 0.218776][ T1] device_driver_attach+0x158/0x208
[ 0.219224][ T1] __driver_attach+0x248/0x420
[ 0.219634][ T1] bus_add_driver+0x1d4/0x498
[ 0.220036][ T1] driver_register+0x84/0x17c
[ 0.220442][ T1] scmi_driver_init+0xb0/0xc0
[ 0.220846][ T1] __initstubkmod_scmi_module__425_1626_scmi_driver_init4.cfi+0x14/0x24
[ 0.221589][ T1] do_one_initcall+0x114/0x3b0
[ 0.221998][ T1] do_initcall_level+0xdc/0x1bc
[ 0.222415][ T1] do_initcalls+0x58/0x9c
[ 0.222785][ T1] do_basic_setup+0x28/0x38
[ 0.223172][ T1] kernel_init_freeable+0xfc/0x1bc
[ 0.223616][ T1] kernel_init+0x2c/0x304
[ 0.223988][ T1] ret_from_fork+0x10/0x30
[ 0.224369][ T1] Code: d4210000 d000c600 9118a800 97e0729d (d4210000)
[ 0.224974][ T1] ---[ end trace 6c77dafcd8f3982d ]---
[ 0.225881][ T1] Kernel panic - not syncing: Oops - BUG: Fatal exception

Bug: 357011632
Bug: 358529695
Fixes: 18126b26 ("UPSTREAM: firmware: arm_scmi: Fix chan_free cleanup on SMC")
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Change-Id: I9d9edb48a313b1e4277749082e41ea02ca5ec2a5
(cherry picked from commit fcc95b0adc7f1387fc638592ab284d69d96ef91b)

Bug: 347878754
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I655772a76591a402c934bb1d8189ee0d4dda3067

An android-only patch to work around frozen KMI for android14 kernels
allows a dependency between hid and uhid if both modules are enabled:

if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver)
    max_buffer_size = UHID_DATA_MAX;

For allmodconfig builds, both hid and uhid are modules so this creates
a cyclic dependancy and we see this error in kernelci tests:

    ERROR: Cycle detected: hid -> uhid -> hid

Fix by changeing to IS_BUILTIN() instead of IS_ENABLED() since Android
builds always build uhid into the core kernel.

Fixes: 7668cef28386 ("ANDROID: HID: Only utilise UHID provided exports if UHID is enabled")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I622466a42ad94e3606820cf506188bd679078cbf

This merges the 5.10.214 LTS kernel into the android13-5.10 branch.
Included in here are the following commits:

* a8e7f812 ANDROID: cpufreq: brcmstb-avs-cpufreq: fix build error
* 857c3acf Revert "remoteproc: Add new get_loaded_rsc_table() to rproc_ops"
* 03ec1765 Revert "remoteproc: stm32: Move resource table setup to rproc_ops"
* f12616df Revert "remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef"
* 2fa9d4f5 Revert "remoteproc: stm32: fix phys_addr_t format string"
* aa0f90d1 Revert "remoteproc: stm32: use correct format strings on 64-bit"
* 9739f8b1 Revert "remoteproc: stm32: Fix incorrect type in assignment for va"
* 9c618c05 Revert "block: add a new set_read_only method"
* 1ce9783e Revert "md: implement ->set_read_only to hook into BLKROSET processing"
* 36cc24f8 Revert "md: Don't clear MD_CLOSING when the raid is about to stop"
* d592f841 Revert "bpf: Defer the free of inner map when necessary"
* 85ee6cd9 Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
*   3f163fb7 Merge 5.10.214 into android13-5.10-lts
|\
| * dfa38259 Linux 5.10.214
| * 5148026b remoteproc: stm32: fix phys_addr_t format string
| * a943eb82 regmap: Add missing map->bus check
| * bcfcdf19 spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
| * 6c46d680 bpf: report RCU QS in cpumap kthread
| * aad6bb26 rcu: add a helper to report consolidated flavor QS
| * fcf32a5b netfilter: nf_tables: do not compare internal table flags on updates
| * 096245bb ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
| * f205ed8d scsi: fc: Update formal FPIN descriptor definitions
| * b36b8329 netfilter: nft_set_pipapo: release elements in clone only from destroy path
| * 766c2627 octeontx2-af: Use separate handlers for interrupts
| * 8eebff95 net/bnx2x: Prevent access to a freed page in page_pool
| * f6c6ca61 hsr: Handle failures in module init
| * 1e1e4316 rds: introduce acquire/release ordering in acquire/release_in_xmit()
| * f87884e0 wireguard: receive: annotate data-race around receiving_counter.counter
| * d0ab075e net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
| * 68e84120 packet: annotate data-races around ignore_outgoing
| * 7fb2d4d6 hsr: Fix uninit-value access in hsr_get_node()
| * cdff6144 soc: fsl: dpio: fix kcalloc() argument order
| * 76d1394d s390/vtime: fix average steal time calculation
| * ce061bf4 octeontx2-af: Use matching wake_up API variant in CGX command interface
| * 2ddc931c io_uring: don't save/restore iowait state
| * ed71e736 usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
| * 745c2718 staging: greybus: fix get_channel_from_mode() failure path
| * a4d50385 serial: 8250_exar: Don't remove GPIO device on suspend
| * 864f17c1 rtc: mt6397: select IRQ_DOMAIN instead of depending on it
| * 87ddba29 kconfig: fix infinite loop when expanding a macro at the end of file
| * 1639e9c7 tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
| * 1eb9ab1f serial: max310x: fix syntax error in IRQ error message
| * 6199e194 tty: vt: fix 20 vs 0x20 typo in EScsiignore
| * 40260d06 remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
| * 0dd5b63a remoteproc: stm32: Fix incorrect type in assignment for va
| * f0b0a4de remoteproc: stm32: use correct format strings on 64-bit
| * 9d057eac remoteproc: stm32: Move resource table setup to rproc_ops
| * 7b954720 remoteproc: Add new get_loaded_rsc_table() to rproc_ops
| * 1d7e9bc4 remoteproc: stm32: Constify st_rproc_ops
| * b94f434f afs: Revert "afs: Hide silly-rename files from userspace"
| * b8c52f7d NFS: Fix an off by one in root_nfs_cat()
| * 32903ecf watchdog: stm32_iwdg: initialize default timeout
| * 916ee6de NFSv4.2: fix listxattr maximum XDR buffer size
| * 4403438e NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
| * 84ec5c0a net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
| * a2b74f35 scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
| * 11adfabe RDMA/device: Fix a race between mad_client and cm_client init
| * 3ac85382 scsi: csiostor: Avoid function pointer casts
| * 6370d070 f2fs: compress: fix to check unreleased compressed cluster
| * bdd895e0 RDMA/srpt: Do not register event handler until srpt device is fully setup
| * 5cd46667 ALSA: usb-audio: Stop parsing channels bits when all channels are found.
| * 4266f6e7 ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
| * 23917453 clk: Fix clk_core_get NULL dereference
| * e55a6014 sparc32: Fix section mismatch in leon_pci_grpci
| * 6ec49d07 backlight: lp8788: Fully initialize backlight_properties during probe
| * ad70a788 backlight: lm3639: Fully initialize backlight_properties during probe
| * f3bd1e36 backlight: da9052: Fully initialize backlight_properties during probe
| * f58ce2be backlight: lm3630a: Don't set bl->props.brightness in get_brightness
| * fc43d668 backlight: lm3630a: Initialize backlight_properties on init
| * 97b397aa leds: sgm3140: Add missing timer cleanup and flash gpio control
| * b9040d57 leds: aw2013: Unlock mutex before destroying it
| * 72f9bf6d powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
| * cfb3a57e drm/msm/dpu: add division of drm_display_mode's hskew parameter
| * fd639cb8 powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
| * 4688be96 drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
| * 6c5a1562 media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
| * 91036347 media: ttpci: fix two memleaks in budget_av_attach
| * b49fe84c media: go7007: fix a memleak in go7007_load_encoder
| * fb07104a media: dvb-frontends: avoid stack overflow warnings with clang
| * ab896d93 media: pvrusb2: fix uaf in pvr2_context_set_notify
| * 1c5620f9 drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
| * 24d71c7e ASoC: meson: axg-tdm-interface: add frame rate constraint
| * 4bc8e7f3 ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
| * fe9796ed mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
| * 2c8a6d2b mtd: maps: physmap-core: fix flash size larger than 32-bit
| * 858839c6 drm/tidss: Fix initial plane zpos values
| * 9e42bebd crypto: arm/sha - fix function cast warnings
| * 9883ac68 mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
| * df692444 mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
| * bd5f2747 drm/tegra: put drm_gem_object ref on error in tegra_fb_create
| * 2d476959 clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
| * 7057b8fa PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
| * 792e6428 drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
| * 85e2d916 clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
| * 0680a58e media: pvrusb2: fix pvr2_stream_callback casts
| * 964f45a7 media: pvrusb2: remove redundant NULL check
| * 1f8d45cd media: go7007: add check of return value of go7007_read_addr()
| * 5d9fe604 media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
| * c753ca1e media: sun8i-di: Fix chroma difference threshold
| * 6b5791c5 media: sun8i-di: Fix power on/off sequences
| * d2f80666 media: sun8i-di: Fix coefficient writes
| * 47588154 ASoC: meson: t9015: fix function pointer type mismatch
| * 3df9cd61 ASoC: meson: aiu: fix function pointer type mismatch
| * ac85b842 ASoC: meson: Use dev_err_probe() helper
| * bae8577e perf stat: Avoid metric-only segv
| * eca94a4b ALSA: seq: fix function cast warnings
| * 33a44d87 drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
| * 89526d77 perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
| * 8a01335a crypto: xilinx - call finalize with bh disabled
| * 38e61b75 PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
| * ca1cd560 quota: Fix rcu annotations of inode dquot pointers
| * 61380537 quota: Fix potential NULL pointer dereference
| * 00684e93 quota: simplify drop_dquot_ref()
| * 2e005642 clk: qcom: reset: Ensure write completion on reset de/assertion
| * b3080046 clk: qcom: reset: Commonize the de/assert functions
| * 160095aa pinctrl: mediatek: Drop bogus slew rate register range for MT8192
| * 09623703 media: edia: dvbdev: fix a use-after-free
| * afd2a82f media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
| * 94303a06 media: v4l2-tpg: fix some memleaks in tpg_alloc
| * 19cb33fa media: em28xx: annotate unchecked call to media_device_register()
| * 892d955f perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
| * 330caa06 drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
| * ff28893c drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
| * 53dea95c HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
| * 7007354d perf record: Fix possible incorrect free in record__switch_output()
| * ed2be47b PCI/DPC: Print all TLP Prefixes, not just the first
| * 610f20e5 media: tc358743: register v4l2 async device only after successful setup
| * 2c58c4dd dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
| * f2e80ac9 drm/lima: fix a memleak in lima_heap_alloc
| * e0d4850e drm/rockchip: lvds: do not print scary message when probing defer
| * 375a60fc drm/rockchip: lvds: do not overwrite error code
| * 2cb88106 drm: Don't treat 0 as -1 in drm_fixp2int_ceil
| * fbb37b39 drm/rockchip: inno_hdmi: Fix video timing
| * b7a82cfb drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
| * f95401a5 drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
| * 317155c5 drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
| * 0e8c9283 drm/tegra: dsi: Make use of the helper function dev_err_probe()
| * 92003981 drm/tegra: dsi: Add missing check for of_find_device_by_node
| * f89bd277 dm: call the resume method on internal suspend
| * 94a6a9cf dm raid: fix false positive for requeue needed during reshape
| * 928705e3 nfp: flower: handle acti_netdevs allocation failure
| * e9b72f72 net/x25: fix incorrect parameter validation in the x25_getsockopt() function
| * 3627f21b net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
| * 03c74f54 udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
| * b42e5643 l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
| * 5a98fa33 ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
| * 8693e3cf bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
| * 415edd2d net/ipv4/ipv6: Replace one-element arraya with flexible-array members
| * 7394669d net/ipv4: Revert use of struct_size() helper
| * 1ebd0d89 net/ipv4: Replace one-element array with flexible-array member
| * c8059876 tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
| * 1f6244e9 OPP: debugfs: Fix warning around icc_get_name()
| * 6cf2e533 net: phy: dp83822: Fix RGMII TX delay configuration
| * c44a5aa4 net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
| * a352d039 net: hns3: fix port duplex configure error in IMP reset
| * 06dd2104 net: phy: fix phy_get_internal_delay accessing an empty array
| * 77fd5294 net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
| * edcec236 ipv6: fib6_rules: flush route cache when rule is changed
| * 15641007 bpf: Fix stackmap overflow check on 32-bit arches
| * 64f00b4d bpf: Fix hashtab overflow check on 32-bit arches
| * 225da02a bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
| * 70294d8b bpf: Eliminate rlimit-based memory accounting for devmap maps
| * 6b4a39ac sr9800: Add check for usbnet_get_endpoints
| * d47e6c19 Bluetooth: hci_core: Fix possible buffer overflow
| * 69d9425b Bluetooth: Remove superfluous call to hci_conn_check_pending()
| * cbe742db igb: Fix missing time sync events
| * 02cba676 igb: move PEROUT and EXTTS isr logic to separate functions
| * f873b85e iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
| * f858c084 PCI: Make pci_dev_is_disconnected() helper public for other drivers
| * 722c24cd wifi: rtw88: 8821c: Fix false alarm count
| * c55cc636 mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
| * bb336cd8 SUNRPC: fix some memleaks in gssx_dec_option_array
| * a4e7ff1a x86, relocs: Ignore relocations in .notes section
| * 47a429a5 ACPI: scan: Fix device check notification handling
| * 5f99b46d arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
| * 46792f9b ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
| * 2d1e5157 ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
| * 23d05494 ARM: dts: imx6dl-yapp4: Move phy reset into switch node
| * 229563e2 ARM: dts: arm: realview: Fix development chip ROM compatible value
| * 2478026f net: ena: Remove ena_select_queue
| * 98d186a1 wifi: brcmsmac: avoid function pointer casts
| * fb7601eb iommu/amd: Mark interrupt as managed
| * be8c5339 bus: tegra-aconnect: Update dependency to ARCH_TEGRA
| * c2a30c81 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
| * 5956f420 wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
| * 115252fc wireless: Remove redundant 'flush_workqueue()' calls
| * 23278c84 bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
| * c5f2076a bpf: Factor out bpf_spin_lock into helpers.
| * dfd8a62a arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
| * f0dd2731 wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
| * 7d4b47f2 net: blackhole_dev: fix build warning for ethh set but not used
| * 918d7f0d wifi: iwlwifi: fix EWRD table validity check
| * fabe2db7 wifi: iwlwifi: dbg-tlv: ensure NUL termination
| * 1bc5461a wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
| * bdaf08b4 af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
| * 1524f463 bpftool: Silence build warning about calloc()
| * 926d95eb inet_diag: annotate data-races around inet_diag_table[]
| * 78441224 sock_diag: annotate data-races around sock_diag_handlers[family]
| * 9127599c cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
| * 11824d6a wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
| * 5aa586bf wifi: wilc1000: fix multi-vif management when deleting a vif
| * dddedfa3 wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
| * b4bbf38c wifi: wilc1000: fix RCU usage in connect path
| * fd86efb8 wifi: wilc1000: fix declarations ordering
| * caa839d4 wifi: b43: Disable QoS for bcm4331
| * 39c915a3 wifi: b43: Stop correct queue in DMA worker when QoS is disabled
| * 87178899 wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
| * 49f06772 wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
| * e1dc7aa8 wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
| * c6fd906c timekeeping: Fix cross-timestamp interpolation for non-x86
| * 763a0092 timekeeping: Fix cross-timestamp interpolation corner case decision
| * fe908062 timekeeping: Fix cross-timestamp interpolation on counter wrap
| * faf0b4c5 aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
| * bb567cb5 md: Don't clear MD_CLOSING when the raid is about to stop
| * ab25f7cd md: implement ->set_read_only to hook into BLKROSET processing
| * 2a0f8202 block: add a new set_read_only method
| * a0bccba5 fs/select: rework stack allocation hack for clang
| * 4af837db nbd: null check for nla_nest_start
| * cde76b3a do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
| * cc6ddd6f x86/paravirt: Fix build due to __text_gen_insn() backport
| * 0344b12a ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
| * cd72f7de ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
| * 423d747f ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
| * 44286475 Input: gpio_keys_polled - suppress deferred probe error for gpio
| * 02060144 ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
| * 713eaf5c firewire: core: use long bus reset on gap count error
| * 81d7d920 Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
| * ba3a55d1 scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
| * e30b8525 dm-verity, dm-crypt: align "struct bvec_iter" correctly
| * 87221877 block: sed-opal: handle empty atoms when parsing response
| * d2e2cb52 parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
| * 3e0f73be net/iucv: fix the allocation size of iucv_path_table array
| * 6e4694e6 x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
| * aa64355c x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
| * 434a709d RDMA/mlx5: Relax DEVX access upon modify commands
| * d27c48dc RDMA/mlx5: Fix fortify source warning while accessing Eth segment
| * 0f9fa4e6 gen_compile_commands: fix invalid escape sequence warning
| * a8fee667 HID: multitouch: Add required quirk for Synaptics 0xcddc device
| * df14e946 MIPS: Clear Cause.BD in instruction_pointer_set
| * eb279074 x86/xen: Add some null pointer checking to smp.c
| * eddf7e95 ASoC: rt5645: Make LattePanda board DMI match more precise
| * 8e2113f6 selftests: tls: use exact comparison in recv_partial
| * 90c44579 bpf: Defer the free of inner map when necessary
| * 93c37f1c rcu-tasks: Provide rcu_trace_implies_rcu_gp()
| * a6771f34 io_uring: drop any code related to SCM_RIGHTS
| * 875f5fed io_uring/unix: drop usage of io_uring socket
* | 15b61bfa Revert "regmap: allow to define reg_update_bits for no bus configuration"
* | 0f0bcf2d Revert "regmap: Add bulk read/write callbacks into regmap_config"
* | 0d525b67 Revert "serial: max310x: make accessing revision id interface-agnostic"
* | d09c3a00 Revert "serial: max310x: implement I2C support"
* | e086f600 Revert "serial: max310x: fix IO data corruption in batched operations"
* | 7f1fc97f Revert "geneve: make sure to pull inner header in geneve_rx()"
* | 17eb54b8 Merge 5.10.213 into android13-5.10-lts
|\|
| * d35f3855 Linux 5.10.213
| * 738845b0 serial: max310x: fix IO data corruption in batched operations
| * 85d79478 serial: max310x: implement I2C support
| * 8082cc99 serial: max310x: make accessing revision id interface-agnostic
| * f36ef837 regmap: Add bulk read/write callbacks into regmap_config
| * 915848be regmap: allow to define reg_update_bits for no bus configuration
| * 82a62478 Drivers: hv: vmbus: Drop error message when 'No request id available'
| * 74d83d0f serial: max310x: Unprepare and disable clock in error path
| * f610023e getrusage: use sig->stats_lock rather than lock_task_sighand()
| * 9ca97868 getrusage: use __for_each_thread()
| * 21677f35 getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
| * 811415fe getrusage: add the "signal_struct *sig" local variable
| * 14136bed mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
| * 05edf434 mm/hugetlb: change hugetlb_reserve_pages() to type bool
| * 5b10a88f hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
| * 8f41b33d hv_netvsc: use netif_is_bond_master() instead of open code
| * 0d54d224 hv_netvsc: Make netvsc/VF binding check both MAC and serial number
| * 3cfee566 hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
| * 0db98ee0 hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
| * cdba0356 hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening
| * 2ce36635 Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening
| * 58bf67d5 ext4: convert to exclusive lock while inserting delalloc extents
| * 5b69dabd ext4: refactor ext4_da_map_blocks()
| * b3bca5e8 ext4: make ext4_es_insert_extent() return void
| * c09ffff2 lsm: fix default return value of the socket_getpeersec_*() hooks
| * ea6e87db lsm: make security_socket_getpeersec_stream() sockptr_t safe
| * a9482f3b bpf: net: Change sk_getsockopt() to take the sockptr_t argument
| * be155e94 net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
| * 518ec3da serial: max310x: prevent infinite while() loop in port startup
| * fe0d16b3 serial: max310x: use a separate regmap for each port
| * c1ecaadb serial: max310x: use regmap methods for SPI batch operations
| * 32e32ab1 serial: max310x: Make use of device properties
| * c7e9e6d5 serial: max310x: fail probe if clock crystal is unstable
| * c2b9cbf0 serial: max310x: Try to get crystal clock rate from property
| * 569154b2 serial: max310x: Use devm_clk_get_optional() to get the input clock
| * 696e4112 xhci: handle isoc Babble and Buffer Overrun events properly
| * fe2322ca xhci: process isoc TD properly when there was a transaction error mid TD.
| * fa5aaf31 xhci: prevent double-fetch of transfer and transfer event TRBs
| * 89ed7eba xhci: remove extra loop in interrupt context
| * 9c398afd um: allow not setting extra rpaths in the linux binary
| * c9c3cc6a selftests: mm: fix map_hugetlb failure on 64K page size systems
| * 1dee72c0 selftests/mm: switch to bash from sh
| * bbf950a6 netrom: Fix data-races around sysctl_net_busy_read
| * cfe0f73f netrom: Fix a data-race around sysctl_netrom_link_fails_count
| * b7d33e08 netrom: Fix a data-race around sysctl_netrom_routing_control
| * 01d4e3af netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
| * 652b0b35 netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
| * f3315a6e netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
| * 34c84e00 netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
| * 34a164d2 netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
| * 291d36d7 netrom: Fix a data-race around sysctl_netrom_transport_timeout
| * d1261bde netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
| * 18c95d11 netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
| * e041df5d netrom: Fix a data-race around sysctl_netrom_default_path_quality
| * ccd1108b netfilter: nf_conntrack_h323: Add protection for bmp length out of range
| * 2b4e7cb7 netfilter: nft_ct: fix l3num expectations with inet pseudo family
| * 9dfc15a1 net/rds: fix WARNING in rds_conn_connect_if_down
| * 5f4e51ab cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
| * 79ce2e54 net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
| * 37fe9901 net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
| * c7137900 geneve: make sure to pull inner header in geneve_rx()
| * fdb63c17 tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
| * 71e21eb1 i40e: disable NAPI right after disabling irqs when handling xsk_pool
| * ad91d5d1 ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
| * 336261af net: lan78xx: fix runtime PM count underflow on link stop
| * 11a3c9f4 lan78xx: Fix race conditions in suspend/resume handling
| * 69215f8e lan78xx: Fix partial packet errors on suspend/resume
| * e5d7f43c lan78xx: Add missing return code checks
| * 06133626 lan78xx: Fix white space and style issues
| * 0224cbc5 mmc: mmci: stm32: fix DMA API overlapping mappings warning
| * abda366e mmc: mmci: stm32: use a buffer for unaligned DMA requests
* | 287331ff Merge 5.10.212 into android13-5.10-lts
|\|
| * 7cfcd0ed Linux 5.10.212
| * f74362a0 mptcp: fix double-free on socket dismantle
| * 30d84d87 mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
| * 1805131d gpio: fix resource unwinding order in error path
| * 51f7044d gpiolib: Fix the error path order in gpiochip_add_data_with_key()
| * 947baae1 gpio: 74x164: Enable output pins after registers are reset
| * 80d85229 fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
| * 43eccc58 cachefiles: fix memory leak in cachefiles_add_cache()
| * 28717281 ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
| * 70e5b013 mptcp: fix possible deadlock in subflow diag
| * 36103f8c x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
| * 7a7cb526 pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
| * 36b02df0 mmc: sdhci-xenon: fix PHY init clock stability
| * d3c703c2 mmc: sdhci-xenon: add timeout for PHY init complete
| * 3fd14520 mmc: core: Fix eMMC initialization with 1-bit bus connection
| * 9579a21e dmaengine: fsl-qdma: init irq after reg initialization
| * bb3a06e9 dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
| * 2886fe30 btrfs: dev-replace: properly validate device names
| * 99eb2159 wifi: nl80211: reject iftype change with mesh ID change
| * e668b92a gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
| * a23ac178 tomoyo: fix UAF write bug in tomoyo_write_control()
| * 8af1c121 riscv: Sparse-Memory/vmemmap out-of-bounds fix
| * 96370ba3 afs: Fix endless loop in directory parsing
| * 14aacfcd ALSA: Drop leftover snd-rtctimer stuff from Makefile
| * d7acc4a5 power: supply: bq27xxx-i2c: Do not free non existing IRQ
| * 537e3f49 efi/capsule-loader: fix incorrect allocation size
| * 882a51a1 rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
| * 80fabcd5 netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
| * e24acaef Bluetooth: Enforce validation on max value of connection interval
| * df193568 Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
| * 0309b68a Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
| * 6dd0a9df Bluetooth: Avoid potential use-after-free in hci_error_reset
| * 6782a54e net: usb: dm9601: fix wrong return value in dm9601_mdio_read
| * c1c7396b lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
| * 810fa7d5 ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
| * 906986fe tun: Fix xdp_rxq_info's queue_index when detaching
| * 2e95350f net: ip_tunnel: prevent perpetual headroom growth
| * f19d1f98 netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
| * acd9f6d4 mtd: spinand: gigadevice: Fix the get ecc status issue
| * 8e3a8675 mtd: spinand: gigadevice: Support GD5F1GQ5UExxG
| * 37077ed1 crypto: virtio/akcipher - Fix stack overflow on memcpy
| * bf85def4 platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
* | cbf8e561 Revert "mptcp: fix lockless access in subflow ULP diag"
* | ad677e1f Revert "net: dev: Convert sa_data to flexible array in struct sockaddr"
* | 8ca8f588 Revert "arp: Prevent overflow in arp_req_get()."
* | dc68375e Revert "usb: roles: fix NULL pointer issue when put module's reference"
* | 048142f2 Revert "usb: roles: don't get/set_role() when usb_role_switch is unregistered"
* | ef7c62ce Merge 5.10.211 into android13-5.10-lts
|/
* 9985c44f Linux 5.10.211
* 94ebf71b ext4: regenerate buddy after block freeing failed if under fc replay
* dbc9b22d arp: Prevent overflow in arp_req_get().
* ea1cd64d fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
* bff0a065 block: ataflop: more blk-mq refactoring fixes
* b49b022f drm/amd/display: Fix memory leak in dm_sw_fini()
* c6551ff2 drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
* 144ec5e1 drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
* 31ea574a netfilter: nf_tables: set dormant flag on hook register failure
* 31e10d6c tls: stop recv() if initial process_rx_list gave us non-DATA
* 7c54eaa3 tls: rx: drop pointless else after goto
* 4820e84e tls: rx: jump to a more appropriate label
* 5d4e4eff s390: use the correct count for __iowrite64_copy()
* f6ce9056 net: dev: Convert sa_data to flexible array in struct sockaddr
* c1b447a2 packet: move from strlcpy with unused retval to strscpy
* 65c38f23 ipv6: sr: fix possible use-after-free and null-ptr-deref
* d9b5e2b7 afs: Increase buffer size in afs_update_volume_status()
* 2f56d712 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
* dcc1375d ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
* fc30793e nouveau: fix function cast warnings
* 49ef33a9 scsi: jazz_esp: Only build if SCSI core is builtin
* b42b801a bpf, scripts: Correct GPL license name
* a2d1e1f8 RDMA/srpt: fix function pointer cast warnings
* 905de68f arm64: dts: rockchip: set num-cs property for spi on px30
* 5639414a RDMA/qedr: Fix qedr_create_user_qp error flow
* 5a5c039d RDMA/srpt: Support specifying the srpt_service_guid parameter
* 179bb088 RDMA/bnxt_re: Return error for SRQ resize
* 3fa240bb IB/hfi1: Fix a memleak in init_credit_return
* 8affdbb3 mptcp: fix lockless access in subflow ULP diag
* eb369345 usb: roles: don't get/set_role() when usb_role_switch is unregistered
* e279bf8e usb: roles: fix NULL pointer issue when put module's reference
* 57ca0e16 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
* 1e204a8e usb: cdns3: fix memory double free when handle zero packet
* b40328ee usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
* 1dfe6393 x86/alternative: Make custom return thunk unconditional
* dd1a169b Revert "x86/alternative: Make custom return thunk unconditional"
* e8e9d1f6 x86/returnthunk: Allow different return thunks
* 4eb421fa x86/ftrace: Use alternative RET encoding
* b253061d x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
* e752912c x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
* c13d4260 Revert "x86/ftrace: Use alternative RET encoding"
* 70d92abb ARM: ep93xx: Add terminator to gpiod_lookup_table
* dcb4d142 l2tp: pass correct message length to ip6_append_data
* 03366ad1 PCI/MSI: Prevent MSI hardware interrupt number truncation
* 2e534fd1 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
* 6e5069b4 KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
* 615af9cb KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
* 3c652f6f dm-crypt: don't modify the data when using authenticated encryption
* f6a765a6 s390/cio: fix invalid -EBUSY on ccw_device_start
* 3f38d22e IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
* a0180e94 erofs: fix lz4 inplace decompression
* 841b9f6f x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
* 6360869c jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
* 69389d82 jbd2: recheck chechpointing non-dirty buffer
* cb1609ef jbd2: remove redundant buffer io error checks
* 52b9609b iwlwifi: mvm: write queue_sync_state only for sync
* f5e6da2c iwlwifi: mvm: do more useful queue sync accounting
* 87b7d049 platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
* 6c367739 lan743x: fix for potential NULL pointer dereference with bare card
* a1ccc4f4 btrfs: do not pin logs too early during renames
* 16b70511 btrfs: unify lookup return value when dir entry is missing
* fccb8a61 btrfs: introduce btrfs_lookup_match_dir
* aaf2d6b7 btrfs: tree-checker: check for overlapping extent items
* b8034ca2 task_stack, x86/cea: Force-inline stack helpers
* 68ffe3ec ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
* edeef1b4 ASoC: Intel: boards: get codec device with ACPI instead of bus search
* 151b360f ASoC: Intel: boards: harden codec property handling
* 877037ef mtd: spinand: macronix: Add support for MX35LFxGE4AD
* b6c4a44e cifs: add a warning when the in-flight count goes negative
* e410dfaa powerpc/watchpoints: Annotate atomic context in more places
* 2641aa3f powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions
* d021ba11 block: ataflop: fix breakage introduced at blk-mq refactoring
* 1dd3dc38 seccomp: Invalidate seccomp mode to catch death failures
* 7ab8a3ba x86/uaccess: Implement macros for CMPXCHG on user addresses
* 13f6937f hsr: Avoid double remove of a node.
* b2e72d88 hvc/xen: prevent concurrent accesses to the shared ring
* 86ba65e5 media: av7110: prevent underflow in write_ts_to_decoder()
* d6e60c53 ASoC: fsl_micfil: register platform component before registering cpu dai
* de899eda ARM: dts: imx: Set default tuning step for imx6sx usdhc
* 51582123 irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
* ef6128a1 ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
* a4c0234b pmdomain: renesas: r8a77980-sysc: CR7 must be always on
* 5fe446b2 virtio-blk: Ensure no requests in virtqueues before deleting vqs.
* 92a1090b firewire: core: send bus reset promptly on gap count error
* 6a375022 scsi: lpfc: Use unsigned type for num_sge
* 7fb19792 hwmon: (coretemp) Enlarge per package core count limit
* 988ae00e efi: Don't add memblocks for soft-reserved memory
* 4fff3d73 efi: runtime: Fix potential overflow of soft-reserved region size
* 865f99f6 Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
* 30a87845 ext4: correct the hole length returned by ext4_map_blocks()
* a72037da nvmet-fc: abort command when there is no binding
* a0fa157b nvmet-fc: release reference on target port
* 5da866be nvmet-fcloop: swap the list_add_tail arguments
* 4f2c9501 nvme-fc: do not wait in vain when unloading module
* f82ed69f netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
* da47fc8d spi: sh-msiof: avoid integer overflow in constants
* 0a840d79 ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
* 5b33bbee nvmet-tcp: fix nvme tcp ida memory leak
* d21c122d regulator: pwm-regulator: Add validity checks in continuous .get_voltage
* c432094a dmaengine: ti: edma: Add some null pointer checks to the edma_probe
* ffeb72a8 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
* 927794a0 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
* 2b39c1a0 ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
* 15bb22da ahci: asm1166: correct count of reported ports
* e94da8ac spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
* cd36da76 fbdev: sis: Error out if pixclock equals zero
* 512ee6d6 fbdev: savage: Error out if pixclock equals zero
* 5ffab99e wifi: mac80211: fix race condition on enabling fast-xmit
* 7e71fbc6 wifi: cfg80211: fix missing interfaces when dumping
* 17c976fe dmaengine: fsl-qdma: increase size of 'irq_name'
* d94a80da dmaengine: shdma: increase size of 'dev_id'
* 168ed591 scsi: target: core: Add TMF to tmr_list handling
* e4bc3117 sched/rt: Disallow writing invalid values to sched_rt_period_us
* 13c6bce7 sched/rt: Fix sysctl_sched_rr_timeslice intial value
* b1ba0651 zonefs: Improve error handling
* 19087d70 userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
* 18d88bf9 sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
* 94b06498 smb: client: fix parsing of SMB3.1.1 POSIX create context
* 13fb0fc4 smb: client: fix potential OOBs in smb2_parse_contexts()
* b03c8099 smb: client: fix OOB in receive_encrypted_standard()
* 3fa31e7a net/sched: Retire dsmark qdisc
* 71925d68 net/sched: Retire ATM qdisc
* 56a6720d net/sched: Retire CBQ qdisc

Change-Id: I26dd62610959a84f5965fc73cd9307555314830f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

[ Upstream commit 47d8ac01 ]

Garbage collector does not take into account the risk of embryo getting
enqueued during the garbage collection. If such embryo has a peer that
carries SCM_RIGHTS, two consecutive passes of scan_children() may see a
different set of children. Leading to an incorrectly elevated inflight
count, and then a dangling pointer within the gc_inflight_list.

sockets are AF_UNIX/SOCK_STREAM
S is an unconnected socket
L is a listening in-flight socket bound to addr, not in fdtable
V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr)	sendmsg(S, [V]); close(V)	__unix_gc()
----------------	-------------------------	-----------

NS = unix_create1()
skb1 = sock_wmalloc(NS)
L = unix_find_other(addr)
unix_state_lock(L)
unix_peer(S) = NS
			// V count=1 inflight=0

 			NS = unix_peer(S)
 			skb2 = sock_alloc()
			skb_queue_tail(NS, skb2[V])

			// V became in-flight
			// V count=2 inflight=1

			close(V)

			// V count=1 inflight=1
			// GC candidate condition met

						for u in gc_inflight_list:
						  if (total_refs == inflight_refs)
						    add u to gc_candidates

						// gc_candidates={L, V}

						for u in gc_candidates:
						  scan_children(u, dec_inflight)

						// embryo (skb1) was not
						// reachable from L yet, so V's
						// inflight remains unchanged
__skb_queue_tail(L, skb1)
unix_state_unlock(L)
						for u in gc_candidates:
						  if (u.inflight)
						    scan_children(u, inc_inflight_move_tail)

						// V count=1 inflight=2 (!)

If there is a GC-candidate listening socket, lock/unlock its state. This
makes GC wait until the end of any ongoing connect() to that socket. After
flipping the lock, a possibly SCM-laden embryo is already enqueued. And if
there is another embryo coming, it can not possibly carry SCM_RIGHTS. At
this point, unix_inflight() can not happen because unix_gc_lock is already
taken. Inflight graph remains unaffected.

Bug: 336226035
Fixes: 1fd05ba5 ("[AF_UNIX]: Rewrite garbage collector, fixes race.")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240409201047.1032217-1-mhal@rbox.co


Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 507cc232ffe53a352847893f8177d276c3b532a9)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If321f78b8b3220f5a1caea4b5e9450f1235b0770

Depending on the platform binary being executed, the linker
(interpreter) requested can be one of:

    1) /system/bin/bootstrap/linker64
    2) /system/bin/linker64
    3) /apex/com.android.runtime/bin/linker64

Relax the check to the basename (linker64), instead of the path.

Bug: 330767927
Bug: 335584973
Change-Id: I4a1f95b7cecd126f85ad8cefd9ff10d272947f9e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>

[ Upstream commit 97af84a6 ]

When touching unix_sk(sk)->inflight, we are always under
spin_lock(&unix_gc_lock).

Let's convert unix_sk(sk)->inflight to the normal unsigned long.

Bug: 336226035
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240123170856.41348-3-kuniyu@amazon.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 47d8ac01 ("af_unix: Fix garbage collector racing against connect()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 301fdbaa0bba4653570f07789909939f977a7620)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0d965d5f2a863d798c06de9f21d0467f256b538e

Pixel MM Metrics:
   add the missing symbol 'seq_put_decimal_ll' and re-do update list

Bug: 299190787
Test: local build
Change-Id: I005ccfa15cee8252bc51242460bbab9b7d0eb2ab
Signed-off-by: Robin Hsu <robinhsu@google.com>
(cherry-pick from d86f55a38edfefc37fedd356d10979d697c42eb5)
(amend: generate xml for 5.10 kernel)

udc device and gadget device are tightly coupled, yet there's no good
way to corelate the two. Add a sysfs link in udc that points to the
corresponding gadget device.
An example use case: userspace configures a f_midi configfs driver and
bind the udc device, then it tries to locate the corresponding midi
device, which is a child device of the gadget device. The gadget device
that's associated to the udc device has to be identified in order to
index the midi device. Having a sysfs link would make things much
easier.

Signed-off-by: Roy Luo <royluo@google.com>
Link: https://lore.kernel.org/r/20240307030922.3573161-1-royluo@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 333778731
Change-Id: I9e3f782543eba5e026a65031aaae754daafb69ab
(cherry picked from commit 0ef40f39)
[royluo: Resolved conflict in drivers/usb/gadget/udc/core.c ]
Signed-off-by: Roy Luo <royluo@google.com>

Resolve the CFI failure problem encountered
during the restoration of the hibernation snapshot image.

Bug: 340049585
Change-Id: I1f8f2c38e9d02a177c0cadb066419bf7edd66085
Signed-off-by: Mukesh Pilaniya <quic_mpilaniy@quicinc.com>
Signed-off-by: Auditya Bhattaram <quic_audityab@quicinc.com>
Signed-off-by: Kamati Srinivas <quic_kamasrin@quicinc.com>

In commit 92f1655a ("net: fix __dst_negative_advice() race") the
struct dst_ops callback negative_advice is callback changes function
parameters.  But as this pointer is part of a structure that is tracked
in the ABI checker, the tool triggers when this is changed.

However, the callback pointer is internal to the networking stack, so
changing the function type is safe, so needing to preserve this is not
required.  To do so, switch the function pointer type back to the old
one so that the checking tools pass, AND then do a hard cast of the
function pointer to the new type when assigning and calling the
function.

Bug: 343727534
Fixes: 92f1655a ("net: fix __dst_negative_advice() race")
Change-Id: I48d4ab4bbd29f8edc8fbd7923828b7f78a23e12e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

__dst_negative_advice() does not enforce proper RCU rules when
sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache,
then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly,
while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic
against RTF_CACHE, this means each of the three ->negative_advice()
existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in
__dst_negative_advice(), there is no need to duplicate
it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.

Bug: 343727534
Fixes: a87cb3e4 ("net: Facility to report route quality of connected sockets")
Reported-by: Clement Lecigne <clecigne@google.com>
Diagnosed-by: Clement Lecigne <clecigne@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <tom@herbertland.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 92f1655a)
[Lee: Trivial/unrelated conflict - no change to the patch]
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I293734dca1b81fcb712e1de294f51e96a405f7e4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

This catches the android13-5.10 branch up to the 5.10.210 LTS release.
Included in here are the following commits:

* 70b6ab09 Revert "hrtimer: Report offline hrtimer enqueue"
* 104f7749 Revert "scsi: core: Introduce enum scsi_disposition"
* 9ace6893 Revert "scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler"
* 80e82003 Revert "scsi: core: Move scsi_host_busy() out of host lock if it is for per-command"
* 17c44ed9 Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
* d3640168 Revert "drm/mipi-dsi: Fix detach call without attach"
* ff7fafe3 Revert "serial: Add rs485_supported to uart_port"
* 32186f0c Revert "serial: 8250_exar: Fill in rs485_supported"
* 3647b304 Revert "serial: 8250_exar: Set missing rs485_supported flag"
* 354be74b Revert "ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()"
*   46028d3c Merge 5.10.210 into android13-5.10-lts
|\
| * aa6ca808 Linux 5.10.210
| * cf5a69e3 PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
| * 9f53d248 net: bcmgenet: Fix EEE implementation
| * 9a865a11 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
| * 67f386f7 drm/msm/dsi: Enable runtime PM
| * 21b38d85 PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
| * ede393e1 PM: runtime: add devm_pm_runtime_enable helper
| * a891a062 dm: limit the number of targets and parameter size area
| * c90746c0 nilfs2: replace WARN_ONs for invalid DAT metadata block requests
| * f3e49635 nilfs2: fix potential bug in end_buffer_async_write
| * db896bbe sched/membarrier: reduce the ability to hammer on sys_membarrier
| * 8f8f1856 net: prevent mss overflow in skb_segment()
| * f7e0231e Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
| * 70ca0dba hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
| * c80ddc10 netfilter: ipset: Missing gc cancellations fixed
| * a24d5f2a netfilter: ipset: fix performance regression in swap operation
| * 583a6c76 scripts/decode_stacktrace.sh: optionally use LLVM utilities
| * 0f906882 scripts: decode_stacktrace: demangle Rust symbols
| * a3d71b6a scripts/decode_stacktrace.sh: support old bash version
| * ae992f14 scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
| * 00f09825 serial: 8250_exar: Set missing rs485_supported flag
| * 84bf7b87 serial: 8250_exar: Fill in rs485_supported
| * dfd8b9d2 serial: Add rs485_supported to uart_port
| * 0c368782 crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
| * e0d2eeec mips: Fix max_mapnr being uninitialized on early stages
| * 41a4bd51 PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
| * ff67f77f bus: moxtet: Add spi device table
| * 88ec9bbc Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
| * 6a42eb0d tracing: Inform kmemleak of saved_cmdlines allocation
| * 3a6e27db pmdomain: core: Move the unused cleanup to a _sync initcall
| * 978e50ef can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
| * e4a6d3ac of: property: fix typo in io-channels
| * 8180d0c2 ceph: prevent use-after-free in encode_cap_msg()
| * 2e9506c9 s390/qeth: Fix potential loss of L3-IP@ in case of network issues
| * 888679af irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
| * 2809645d irqchip/irq-brcmstb-l2: Add write memory barrier before exit
| * 45a3657c wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
| * c7fa9590 nfp: flower: prevent re-adding mac index for bonded port
| * 962091c4 nfp: use correct macro for LengthSelect in BAR config
| * 58054faf crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
| * 98a4026b nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
| * 364a66be nilfs2: fix data corruption in dsync block recovery for small block sizes
| * a643d8d1 ALSA: hda/conexant: Add quirk for SWS JS201D
| * ca0533fe mmc: slot-gpio: Allow non-sleeping GPIO ro
| * bdc29f9c x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
| * 09f21bee x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
| * 1a8a72ee serial: max310x: improve crystal stable clock detection
| * 6f248ee7 serial: max310x: set default value when reading clock ready bit
| * 92a0a5d6 ring-buffer: Clean ring_buffer_poll_wait() error return
| * 9ec807e7 hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
| * 93d8109b media: rc: bpf attach/detach requires write permission
| * a98ccbcd iio: accel: bma400: Fix a compilation problem
| * 36a49290 iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
| * fa5884dd staging: iio: ad5933: fix type mismatch regression
| * 8a744f92 tracing: Fix wasted memory in saved_cmdlines logic
| * d033a555 ext4: fix double-free of blocks due to wrong extents moved_len
| * f86e1241 misc: fastrpc: Mark all sessions as invalid in cb_remove
| * a4230420 binder: signal epoll threads of self-work
| * 6d11240d ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
| * cdaddb45 xen-netback: properly sync TX responses
| * 0d8011a8 net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
| * 2f6d16f0 nfc: nci: free rx_data_reassembly skb on NCI device cleanup
| * 5abf3e8a kbuild: Fix changing ELF file type for output of gen_btf for big endian
| * 6717c593 firewire: core: correct documentation of fw_csr_string() kernel API
| * 2dc1d93b lsm: fix the logic in security_inode_getsecctx()
| * 7d4e19f7 scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
| * ca188f25 modpost: trim leading spaces when processing source files list
| * 7a14b8a4 i2c: i801: Fix block process call transactions
| * 5e8a6140 i2c: i801: Remove i801_set_block_buffer_mode
| * 230e89b5 powerpc/kasan: Fix addr error caused by page alignment
| * 486a4176 media: ir_toy: fix a memleak in irtoy_tx
| * b8da59ad usb: f_mass_storage: forbid async queue when shutdown happen
| * 9a8ccbc6 USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
| * 9d07bdbf usb: ucsi_acpi: Fix command completion handling
| * f304eb48 HID: wacom: Do not register input devices until after hid_hw_start
| * 4f792731 HID: wacom: generic: Avoid reporting a serial of '0' to userspace
| * d51fc41e ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
| * 8da18c51 ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
| * 81e7d253 mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
| * 56cfbe60 tracing/trigger: Fix to return error if failed to alloc snapshot
| * 6d05659b i40e: Fix waiting for queues of all VSIs to be disabled
| * f026f238 MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
| * ed8c87ac net: sysfs: Fix /sys/class/net/<iface> path for statistics
| * 4a98bc73 ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
| * f8cd86c6 spi: ppc4xx: Drop write-only variable
| * 55cfccb6 net: openvswitch: limit the number of recursions from action sets
| * 3f9b9585 of: unittest: Fix compile in the non-dynamic case
| * dc8bce9c btrfs: send: return EOPNOTSUPP on unknown flags
| * 22965e4f btrfs: forbid deleting live subvol qgroup
| * 3f5d47eb btrfs: do not ASSERT() if the newly created subvolume already got read
| * d7247ce3 btrfs: forbid creating subvol qgroups
| * 4cee42fc netfilter: nft_set_rbtree: skip end interval element from gc
| * feace3c2 net: stmmac: xgmac: fix a typo of register name in DPP safety handling
| * 78115a34 net: stmmac: xgmac: use #define for string constants
| * 88681062 clocksource: Skip watchdog check for large watchdog intervals
| * cda4ca03 vhost: use kzalloc() instead of kmalloc() followed by memset()
| * 63d97c3a Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
| * 9a564a9a Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
| * b1f576be hrtimer: Report offline hrtimer enqueue
| * b87060b3 usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
| * 34fd6f44 USB: serial: cp210x: add ID for IMST iM871A-USB
| * 53479fcf USB: serial: option: add Fibocom FM101-GL variant
| * c537b88b USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
| * e800ef36 net/af_iucv: clean up a try_then_request_module()
| * 9f56f383 blk-iocost: Fix an UBSAN shift-out-of-bounds warning
| * 9878c660 scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
| * 1dd947c2 netfilter: nft_set_pipapo: remove scratch_aligned pointer
| * d6fcad0d netfilter: nft_set_pipapo: add helper to release pcpu scratch area
| * 1771e834 netfilter: nft_set_pipapo: store index in scratch maps
| * d1ec65c4 netfilter: nft_ct: reject direction for ct id
| * 730fce47 netfilter: nft_compat: restrict match/target protocol to u16
| * 78909916 netfilter: nft_compat: reject unused compat flag
| * b06e067e ppp_async: limit MRU to 64K
| * 19d7314f tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
| * 09e91f3e rxrpc: Fix response to PING RESPONSE ACKs to a dead call
| * 88081ba4 inet: read sk->sk_family once in inet_recv_error()
| * 7e42379d hwmon: (coretemp) Fix bogus core_id to attr name mapping
| * f0da068c hwmon: (coretemp) Fix out-of-bounds memory access
| * 9551de5c hwmon: (aspeed-pwm-tacho) mutex for tach reading
| * edfd328f atm: idt77252: fix a memleak in open_card_ubr0
| * e77bf828 tunnels: fix out of bounds access when building IPv6 PMTU error
| * fd473100 selftests: net: avoid just another constant wait
| * 2fc45a46 net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
| * 66c8243e drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
| * be3b82e4 phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
| * 784d3154 dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
| * 68459d2b phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
| * ae6769ba dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
| * fbe1c5c6 dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
| * 3496a1da dmaengine: ti: k3-udma: Report short packet errors
| * b7dbf411 dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
| * 6db18971 PM: sleep: Fix error handling in dpm_prepare()
| * 6388d0e3 uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
| * 2563e7c6 bonding: remove print in bond_verify_device_path
| * d1a9900e HID: apple: Add 2021 magic keyboard FN key mapping
| * b1e3ea7c HID: apple: Add support for the 2021 Magic Keyboard
| * e5eca795 net: sysfs: Fix /sys/class/net/<iface> path
| * f199018d af_unix: fix lockdep positive in sk_diag_dump_icons()
| * 9c9cab01 net: ipv4: fix a memleak in ip_setup_cork
| * 65ee90ef netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
| * 32fa7abb netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
| * d0b5b1f1 llc: call sock_orphan() at release time
| * e34c91e7 ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
| * b45fae96 ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
| * f8bccfa1 ixgbe: Refactor overtemp event handling
| * e16c254f ixgbe: Refactor returning internal error codes
| * 2499c066 ixgbe: Remove non-inclusive language
| * f48bf9a8 tcp: add sanity checks to rx zerocopy
| * 14690e41 net-zerocopy: Refactor frag-is-remappable test.
| * a9bc3287 ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
| * a57b114a ip6_tunnel: use dev_sw_netstats_rx_add()
| * f5944853 scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
| * 7efadce4 scsi: core: Introduce enum scsi_disposition
| * dca11bfa scsi: isci: Fix an error code problem in isci_io_request_build()
| * 948090f6 drm: using mul_u32_u32() requires linux/math64.h
| * 02161f62 wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
| * b54eecdc perf: Fix the nr_addr_filters fix
| * 73eda269 drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
| * feacc800 drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
| * e016e358 ceph: fix deadlock or deadcode of misusing dget()
| * 7610ba13 blk-mq: fix IO hang from sbitmap wakeup race
| * 27ae156e virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
| * 0079078f libsubcmd: Fix memory leak in uniq()
| * 32a82437 PCI/AER: Decode Requester ID when no error info found
| * feaf0752 fs/kernfs/dir: obey S_ISGID
| * 6f921430 tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
| * e962b59d usb: hub: Replace hardcoded quirk value with BIT() macro
| * 4a5d0528 PCI: switchtec: Fix stdev_release() crash after surprise hot remove
| * 385e49a4 PCI: Only override AMD USB controller if required
| * bb59b30a mfd: ti_am335x_tscadc: Fix TI SoC dependencies
| * e4fdf3b1 xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
| * 89bdf3a9 i3c: master: cdns: Update maximum prescaler value for i2c clock
| * b345f330 um: net: Fix return type of uml_net_start_xmit()
| * ef219846 um: Don't use vfprintf() for os_info()
| * e4cc5553 um: Fix naming clash between UML and scheduler
| * d47f5d41 leds: trigger: panic: Don't register panic notifier if creating the trigger failed
| * 8342ac4a drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
| * 48bb06f8 drm/amdgpu: Let KFD sync with VM fences
| * e90c8f97 watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
| * 6f59516a clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
| * 2cb60594 clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
| * 5fd28ab1 drm/msm/dpu: Ratelimit framedone timeout msgs
| * 179fe24b media: ddbridge: fix an error code problem in ddb_probe
| * ac2630fd IB/ipoib: Fix mcast list locking
| * 9503ce5f drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
| * 1eeca000 ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
| * 3841b8a6 ALSA: hda: Intel: add HDA_ARL PCI ID support
| * 56d717aa PCI: add INTEL_HDA_ARL to pci_ids.h
| * b68e373d media: rockchip: rga: fix swizzling for RGB formats
| * 32c5e3f8 media: stk1160: Fixed high volume of stk1160_dbg messages
| * 425a441c drm/mipi-dsi: Fix detach call without attach
| * 0ec29a0f drm/framebuffer: Fix use of uninitialized variable
| * d7b81afa drm/drm_file: fix use of uninitialized variable
| * 9a572fc1 f2fs: fix write pointers on zoned device after roll forward
| * 7fb8c132 drm/amd/display: Fix tiled display misalignment
| * 3a1da8ab RDMA/IPoIB: Fix error code return in ipoib_mcast_join
| * 13d20b2c fast_dput(): handle underflows gracefully
| * 706fb30d ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
| * 354785ab ALSA: hda: Refer to correct stream index at loops
| * 80c69f57 f2fs: fix to check return value of f2fs_reserve_new_block()
| * e474e7a7 i40e: Fix VF disable behavior to block all traffic
| * ed6de414 Bluetooth: L2CAP: Fix possible multiple reject send
| * e1bcd9a4 Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
| * 27575c2f wifi: cfg80211: free beacon_ies when overridden from hidden BSS
| * 40bcbf7d wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
| * 1632481a wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
| * 2131606a arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
| * 4668f3e6 arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
| * 82f6e7e6 md: Whenassemble the array, consult the superblock of the freshest device
| * 1746cd95 block: prevent an integer overflow in bvec_try_merge_hw_page
| * 1335310a net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
| * 9c51d26f ARM: dts: imx23/28: Fix the DMA controller node name
| * 6c22388d ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
| * fb9bdf84 ARM: dts: imx27-apf27dev: Fix LED name
| * 1dd3a379 ARM: dts: imx25/27: Pass timing0
| * 3c2bce89 ARM: dts: imx25: Fix the iim compatible string
| * 95bc866c block/rnbd-srv: Check for unlikely string overflow
| * 03ca1d3d ionic: pass opcode to devcmd_wait
| * ba108f3d ARM: dts: imx1: Fix sram node
| * 2f22ce55 ARM: dts: imx27: Fix sram node
| * e6c0ea05 ARM: dts: imx: Use flash@0,0 pattern
| * bfbaf155 ARM: dts: imx25/27-eukrea: Fix RTC node name
| * 24bb6b26 ARM: dts: rockchip: fix rk3036 hdmi ports node
| * 11c1fc73 bpf: Set uattr->batch.count as zero before batched update or deletion
| * 2e7f8d05 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
| * a72670f4 scsi: libfc: Don't schedule abort twice
| * 80700978 bpf: Add map and need_defer parameters to .map_fd_put_ptr()
| * 84770a99 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
| * c390b6a2 ARM: dts: imx7s: Fix nand-controller #size-cells
| * d7cb295b ARM: dts: imx7s: Fix lcdif compatible
| * 73ead7a3 ARM: dts: imx7d: Fix coresight funnel ports
| * 86781b3a scsi: arcmsr: Support new PCI device IDs 1883 and 1886
| * db516f60 bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
| * 4f87b8d9 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
| * 9bc7617a scsi: lpfc: Fix possible file string name overflow when updating firmware
| * 9b9bbba1 selftests/bpf: Fix pyperf180 compilation failure with clang18
| * 74783894 selftests/bpf: satisfy compiler by having explicit return in btf test
| * 69e905be wifi: rt2x00: restart beacon queue when hardware reset
| * cfbbb319 ext4: avoid online resizing failures due to oversized flex bg
| * e7b9fa6c ext4: remove unnecessary check from alloc_flex_gd()
| * b9601924 ext4: unify the type of flexbg_size to unsigned int
| * 64448275 ext4: fix inconsistent between segment fstrim and full fstrim
| * 5183595c ecryptfs: Reject casefold directory inodes
| * c430e6bb SUNRPC: Fix a suspicious RCU usage warning
| * 150a3a38 KVM: s390: fix setting of fpc register
| * 856caf27 s390/ptrace: handle setting of fpc register correctly
| * e2b77d10 jfs: fix array-index-out-of-bounds in diNewExt
| * 5f1f4595 rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
| * ae53c54e afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
| * a02356d9 afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
| * 108c4db0 crypto: stm32/crc32 - fix parsing list of devices
| * a63e48cd pstore/ram: Fix crash when setting number of cpus to an odd number
| * bc6ef64d jfs: fix uaf in jfs_evict_inode
| * 2037cb9d jfs: fix array-index-out-of-bounds in dbAdjTree
| * 1c40ca3d jfs: fix slab-out-of-bounds Read in dtSearch
| * 7aa33854 UBSAN: array-index-out-of-bounds in dtSplitRoot
| * de34de6e FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
| * 95c864c8 ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
| * 3399cc70 PM / devfreq: Synchronize devfreq_monitor_[start/stop]
| * b17a7143 ACPI: extlog: fix NULL pointer dereference check
| * c2615948 PNP: ACPI: fix fortify warning
| * 3a13ed62 ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
| * c74b2af2 audit: Send netlink ACK before setting connection in auditd_set
| * 37e00ed7 regulator: core: Only increment use_count when enable_count changes
| * 19c71322 debugobjects: Stop accessing objects after releasing hash bucket lock
| * c57cb397 perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
| * 5224b9db x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
| * beee482c powerpc/lib: Validate size for vector operations
| * 24a58abc powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
| * 02e5b2ff x86/boot: Ignore NMIs during very early boot
| * 9d06c199 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
| * 3928c063 powerpc: Fix build error due to is_valid_bugaddr()
| * 353496cb drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
| * aa28eecb powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
| * 4e806600 x86/entry/ia32: Ensure s32 is sign extended to s64
| * cdc01845 tick/sched: Preserve number of idle sleeps across CPU hotplug events
| * 3736a783 mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
| * 95a8a519 spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
| * f1ba5bf9 gpio: eic-sprd: Clear interrupt after set the interrupt type
| * 0924bcd2 drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
| * b6abe30d drm/exynos: fix accidental on-stack copy of exynos_drm_plane
| * 4e56c5a9 drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
| * e1c50b0c btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
| * d073f460 btrfs: remove err variable from btrfs_delete_subvolume
| * 90ad1757 mm/sparsemem: fix race in accessing memory_section->usage
| * 74a80f8d mm: use __pfn_to_section() instead of open coding it
| * 43872f44 media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
| * 9087d0c2 arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
| * 3de807b1 arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts
| * 8b2c7bb6 ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
| * 162ae0e7 pipe: wakeup wr_wait after setting max_usage
| * b6f27626 fs/pipe: move check to pipe_has_watch_queue()
| * f46eb832 PM: sleep: Fix possible deadlocks in core system-wide PM code
| * 8b604883 PM: core: Remove unnecessary (void *) conversions
| * 57df40f8 PM: sleep: Avoid calling put_device() under dpm_list_mtx
| * 2245a849 PM: sleep: Use dev_printk() when possible
| * 8a6a51b8 drm/bridge: nxp-ptn3460: simplify some error checking
| * bedbbdf0 drm/tidss: Fix atomic_flush check
| * ea192526 drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
| * f5526146 drm: Don't unref the same fb many times by mistake due to deadlock handling
| * bb575bc3 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
| * 55a60251 netfilter: nf_tables: reject QUEUE/DROP verdict parameters
| * 9489e214 netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
| * 05dd9fac wifi: iwlwifi: fix a memory corruption
| * c0760a5c exec: Fix error handling in begin_new_exec()
| * 30f38928 rbd: don't move requests to the running list on errors
| * 2bdf872b btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
| * 5d3687ba btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
| * f2793742 btrfs: don't warn if discard range is not aligned to sector
| * f8a7a51a btrfs: tree-checker: fix inline ref size in error messages
| * be90e258 btrfs: ref-verify: free ref cache before clearing mount opt
| * 7c3a572e net: fec: fix the unhandled context fault from smmu
| * a52b2faf fjes: fix memleaks in fjes_hw_setup
| * e1bf3ec9 selftests: netdevsim: fix the udp_tunnel_nic test
| * 83f99138 net: mvpp2: clear BM pool before initialization
| * 6a2e2d98 netfilter: nf_tables: validate NFPROTO_* family
| * 4fbdc3a1 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
| * cf116d9c net/mlx5e: fix a double-free in arfs_create_groups
| * 1123661a net/mlx5: DR, Use the right GVMI number for drop action
| * a3eba598 ipv6: init the accept_queue's spinlocks in inet6_create
| * be8d1f61 netlink: fix potential sleeping issue in mqueue_flush_file
| * 69ca75e0 tcp: Add memory barrier to tcp_push()
| * 8499e2f1 afs: Hide silly-rename files from userspace
| * ef70dfa0 tracing: Ensure visibility when inserting an element into tracing_map
| * 5ae8d500 net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
| * 9ccdef19 llc: Drop support for ETH_P_TR_802_2.
| * 04f2a74b llc: make llc_ui_sendmsg() more robust against bonding changes
| * ea4c3cb7 vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
| * fc74f86a bnxt_en: Wait for FLR to complete during probe
| * bc99dced tcp: make sure init the accept_queue's spinlocks once
| * 5fed92ca net/smc: fix illegal rmb_desc access in SMC-D connection dump
| * c71e1c1a KVM: use __vcalloc for very large allocations
| * 95670878 mm: vmalloc: introduce array allocation functions
| * 02f629bb smb3: Replace smb2pdu 1-element arrays with flex-arrays
| * 443b16ee stddef: Introduce DECLARE_FLEX_ARRAY() helper
| * bfc06477 block: Remove special-casing of compound pages
| * ff4332f1 rename(): fix the locking of subdirectories
| * d132010e ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
| * c6e66407 nouveau/vmm: don't set addr on the fail path to avoid warning
| * 83217f1b rtc: Adjust failure return code for cmos_set_alarm()
| * b51578bd mmc: mmc_spi: remove custom DMA mapped buffers
| * 59020bf0 mmc: core: Use mrq.sbc in close-ended ffu
| * 625cb3f3 scripts/get_abi: fix source path leak
| * 311dc5af lsm: new security_file_ioctl_compat() hook
* | 8d3bb9cb Merge f7266903 ("arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts") into android13-5.10-lts
|\|
| * f7266903 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
| * dfc2c685 arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
| * ac4dcccb async: Introduce async_schedule_dev_nocall()
| * 9ef68b58 async: Split async_schedule_node_domain()
| * 1dd8449e parisc/firmware: Fix F-extend for PDC addresses
| * 20a6dea2 bus: mhi: host: Drop chan lock before queuing buffers
* | c449d2a6 Merge 69ca89d8 ("rpmsg: virtio: Free driver_override when rpmsg_remove()") into android13-5.10-lts
|\|
| * 69ca89d8 rpmsg: virtio: Free driver_override when rpmsg_remove()
| * cd51e26a crypto: s390/aes - Fix buffer overread in CTR mode
| * c6a8111a hwrng: core - Fix page fault dead lock on mmap-ed hwrng
* | cedc53c6 Merge 981a31b7 ("PM: hibernate: Enforce ordering during image compression/decompression") into android13-5.10-lts
|\|
| * 981a31b7 PM: hibernate: Enforce ordering during image compression/decompression
* | 9f30cf15 Revert "crypto: api - Disallow identical driver names"
* | 7c6cdc23 Merge 462c383e ("crypto: api - Disallow identical driver names") into android13-5.10-lts
|\|
| * 462c383e crypto: api - Disallow identical driver names
* | 1d535cec Merge fa949122 ("ext4: allow for the last group to be marked as trimmed") into android13-5.10-lts
|\|
| * fa949122 ext4: allow for the last group to be marked as trimmed
* | 7530ef4a Merge d173ef12 ("iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.") into android13-5.10-lts
|\|
| * d173ef12 iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
* | d82f901b Merge 9de69732 ("dmaengine: fix NULL pointer in channel unregistration function") into android13-5.10-lts
|\|
| * 9de69732 dmaengine: fix NULL pointer in channel unregistration function
| * 653d2890 iio: adc: ad7091r: Enable internal vref if external vref is not supplied
| * 1eba6f7f iio: adc: ad7091r: Allow users to configure device events
| * 9ec7498a iio: adc: ad7091r: Set alert bit in config register
| * be5d6a29 serial: sc16is7xx: add check for unsupported SPI modes during probe
| * 8df2aec9 spi: introduce SPI_MODE_X_MASK macro
| * 6ec08ce3 serial: sc16is7xx: set safe default SPI clock frequency
| * e83f1149 units: add the HZ macros
| * 762217e9 units: change from 'L' to 'UL'
* | 3c981dac Merge f37f4a0c ("PCI: mediatek: Clear interrupt status before dispatching handler") into android13-5.10-lts
|\|
| * f37f4a0c PCI: mediatek: Clear interrupt status before dispatching handler
| * 490eaca8 usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
| * bf703214 usb: cdns3: fix iso transfer error when mult is not zero
| * 6aec2f08 usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
| * 2fdc98b0 usb: cdns3: fix uvc failure work since sg support enabled
| * 67d3c71c usb: cdns3: Fixes for sparse warnings
* 4e1bc8d8 Merge branch 'android13-5.10' into branch 'android13-5.10-lts'
* e7daca75 ANDROID: GKI: db845c: Update symbols list and ABI

Change-Id: Id4da30bdbee443883c82f6dece1214f29b4f5ee8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

[ Upstream commit 07636136 ]

The struct adjtimex freq field takes a signed value who's units are in
shifted (<<16) parts-per-million.

Unfortunately for negative adjustments, the straightforward use of:

  freq = ppm << 16 trips undefined behavior warnings with clang:

valid-adjtimex.c:66:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
        -499<<16,
        ~~~~^
valid-adjtimex.c:67:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value]
        -450<<16,
        ~~~~^
..

Fix it by using a multiply by (1 << 16) instead of shifting negative values
in the valid-adjtimex test case. Align the values for better readability.

Bug: 339526723
Reported-by: Lee Jones <joneslee@google.com>
Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Change-Id: Ied611c13a802acf9c7a2427f0a61eb358b571a3d
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/r/20240409202222.2830476-1-jstultz@google.com
Link: https://lore.kernel.org/lkml/0c6d4f0d-2064-4444-986b-1d1ed782135f@collabora.com/


Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 1f3484dec916a3c4f43c4c44bad398bc24373110)
Signed-off-by: Edward Liaw <edliaw@google.com>

The caller of the function freq_qos_add_request() checks again a non
zero value but freq_qos_add_request() can return '1' if the request
already exists. Therefore, the setup function fails while the QoS
request actually did not failed.

Fix that by changing the check against a negative value like all the
other callers of the function.

Bug: 254441685
Fixes: 0e8f68d7 ("Add CPU energy model based support")
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
(cherry picked from commit b50155cb)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If7620f9b32b6493e08cca43dc714c33be05cdbcd

Currently, the function update_port_device_state gets the usb_hub from
udev->parent by calling usb_hub_to_struct_hub.
However, in case the actconfig or the maxchild is 0, the usb_hub would
be NULL and upon further accessing to get port_dev would result in null
pointer dereference.

Fix this by introducing an if check after the usb_hub is populated.

Bug: 254441685
Fixes: 83cb2604 ("usb: core: add sysfs entry for usb device state")
Cc: stable@vger.kernel.org
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20240110095814.7626-1-quic_ugoswami@quicinc.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 12783c0b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8a6c942a6d14f2f4a79276dc11762c42f820dbf4

The shadow call stack implementation fails to build without CONFIG_MMU:

  ld.lld: error: undefined symbol: vfree_atomic
  >>> referenced by scs.c
  >>>               kernel/scs.o:(scs_free) in archive vmlinux.a

Bug: 254441685
Link: https://lkml.kernel.org/r/20240122175204.2371009-1-samuel.holland@sifive.com


Fixes: a2abe7cb ("scs: switch to vmapped shadow stacks")
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Cc: Will Deacon <will@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 6f9dc684)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I906b8ff918a3ab886af248da9362c0bed542e5d1

asm-generic/mman-common.h can be replaced by linux/mman.h and the file
will still build correctly.  It is an asm-generic file which should be
avoided if possible.

Bug: 254441685
Link: https://lkml.kernel.org/r/20231221-asmgenericvaddr-v1-1-742b170c914e@google.com


Fixes: 6dea8add ("mm/damon/vaddr: support DAMON-based Operation Schemes")
Signed-off-by: Tanzir Hasan <tanzirh@google.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 1ae41dff)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I366f846f5069b1921bdbf020c65bba8a62bac38b

etm4_platform_driver (which lives in ".data" contains a reference to
etm4_remove_platform_dev(). So the latter must not be marked with __exit
which results in the function being discarded for a build with
CONFIG_CORESIGHT_SOURCE_ETM4X=y which in turn makes the remove pointer
contain invalid data.

etm4x_amba_driver referencing etm4_remove_amba() has the same issue.

Drop the __exit annotations for the two affected functions and a third
one that is called by the other two.

For reasons I don't understand this isn't catched by building with
CONFIG_DEBUG_SECTION_MISMATCH=y.

Bug: 254441685
Fixes: c23bc382 ("coresight: etm4x: Refactor probing routine")
Fixes: 5214b563 ("coresight: etm4x: Add support for sysreg only devices")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: James Clark <james.clark@arm.com>
Link: https://lore.kernel.org/all/20230929081540.yija47lsj35xtj4v@pengutronix.de/
Link: https://lore.kernel.org/r/20230929081637.2377335-1-u.kleine-koenig@pengutronix.de


Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
(cherry picked from commit 348ddab8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic393a9e014f0438a4f3365ae1d287bd16ce020fd

The HDMI hotplug callback to the hdmi-codec is currently registered when
jack is set.

The hotplug not only serves to report the ASoC jack state but also to get
the ELD. It should be registered when the component probes instead, so it
does not depend on the card driver registering a jack for the HDMI to
properly report the ELD.

Bug: 254441685
Fixes: 25ce4f2b ("ASoC: hdmi-codec: Get ELD in before reporting plugged event")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20231106104013.704356-1-jbrunet@baylibre.com


Signed-off-by: Mark Brown <broonie@kernel.org>
(cherry picked from commit 15be353d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ifb81843ff4ae55c78d7f2635a8d577c48f02439d

It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as
shown below.

[91222.095236][  T319] typec port0: failed to register partner (-17)
...
[91225.061491][  T319] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000039f
[91225.274642][  T319] pc : tcpm_pd_data_request+0x310/0x13fc
[91225.274646][  T319] lr : tcpm_pd_data_request+0x298/0x13fc
[91225.308067][  T319] Call trace:
[91225.308070][  T319]  tcpm_pd_data_request+0x310/0x13fc
[91225.308073][  T319]  tcpm_pd_rx_handler+0x100/0x9e8
[91225.355900][  T319]  kthread_worker_fn+0x178/0x58c
[91225.355902][  T319]  kthread+0x150/0x200
[91225.355905][  T319]  ret_from_fork+0x10/0x30

Add a check for port->partner to avoid dereferencing a NULL pointer.

Bug: 254441685
Fixes: 5e1d4c49 ("usb: typec: tcpm: Determine common SVDM Version")
Cc: stable@vger.kernel.org
Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://lore.kernel.org/r/20231020012132.100960-1-hhhuuu@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4987daf8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ifb3355341cd4461019e0c2ed67d0801e54db320d

Since commit adad556e ("crypto: api - Fix built-in testing
dependency failures"), the following warning appears when booting an
x86_64 kernel that is configured with
CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y and CONFIG_CRYPTO_AES_NI_INTEL=y,
even when CONFIG_CRYPTO_XTS=y and CONFIG_CRYPTO_AES=y:

    alg: skcipher: skipping comparison tests for xts-aes-aesni because xts(ecb(aes-generic)) is unavailable

This is caused by an issue in the xts template where it allocates an
"aes" single-block cipher without declaring a dependency on it via the
crypto_spawn mechanism.  This issue was exposed by the above commit
because it reversed the order that the algorithms are tested in.

Specifically, when "xts(ecb(aes-generic))" is instantiated and tested
during the comparison tests for "xts-aes-aesni", the "xts" template
allocates an "aes" crypto_cipher for encrypting tweaks.  This resolves
to "aes-aesni".  (Getting "aes-aesni" instead of "aes-generic" here is a
bit weird, but it's apparently intended.)  Due to the above-mentioned
commit, the testing of "aes-aesni", and the finalization of its
registration, now happens at this point instead of before.  At the end
of that, crypto_remove_spawns() unregisters all algorithm instances that
depend on a lower-priority "aes" implementation such as "aes-generic"
but that do not depend on "aes-aesni".  However, because "xts" does not
use the crypto_spawn mechanism for its "aes", its dependency on
"aes-aesni" is not recognized by crypto_remove_spawns().  Thus,
crypto_remove_spawns() unexpectedly unregisters "xts(ecb(aes-generic))".

Fix this issue by making the "xts" template use the crypto_spawn
mechanism for its "aes" dependency, like what other templates do.

Note, this fix could be applied as far back as commit f1c131b4
("crypto: xts - Convert to skcipher").  However, the issue only got
exposed by the much more recent changes to how the crypto API runs the
self-tests, so there should be no need to backport this to very old
kernels.  Also, an alternative fix would be to flip the list iteration
order in crypto_start_tests() to restore the original testing order.
I'm thinking we should do that too, since the original order seems more
natural, but it shouldn't be relied on for correctness.

Bug: 254441685
Fixes: adad556e ("crypto: api - Fix built-in testing dependency failures")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit bb40d326)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ia38963ae6570182f4039041d1846cfcdd37fef57

The clear TM function error log status was inverted.

Bug: 254441685
Fixes: 4693fad7 ("scsi: ufs: core: Log error handler activity")
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
Link: https://lore.kernel.org/r/20231003022002.25578-1-peter.wang@mediatek.com


Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit a20c4350)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I777762dfbd9dc17048bbb2c3f2547504fcf47467

Commit 19b87664 ("firmware: arm_ffa: Fix FFA device names for logical
partitions") added an ID to the FFA device using ida_alloc() and append
the same to "arm-ffa" to make up a unique device name. However it missed
to stash the id value in ffa_dev to help freeing the ID later when the
device is destroyed.

Due to the missing/unassigned ID in FFA device, we get the following
warning when the FF-A device is unregistered.

  |   ida_free called for id=0 which is not allocated.
  |   WARNING: CPU: 7 PID: 1 at lib/idr.c:525 ida_free+0x114/0x164
  |   CPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.6.0-rc4 #209
  |   pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
  |   pc : ida_free+0x114/0x164
  |   lr : ida_free+0x114/0x164
  |   Call trace:
  |    ida_free+0x114/0x164
  |    ffa_release_device+0x24/0x3c
  |    device_release+0x34/0x8c
  |    kobject_put+0x94/0xf8
  |    put_device+0x18/0x24
  |    klist_devices_put+0x14/0x20
  |    klist_next+0xc8/0x114
  |    bus_for_each_dev+0xd8/0x144
  |    arm_ffa_bus_exit+0x30/0x54
  |    ffa_init+0x68/0x330
  |    do_one_initcall+0xdc/0x250
  |    do_initcall_level+0x8c/0xac
  |    do_initcalls+0x54/0x94
  |    do_basic_setup+0x1c/0x28
  |    kernel_init_freeable+0x104/0x170
  |    kernel_init+0x20/0x1a0
  |    ret_from_fork+0x10/0x20

Fix the same by actually assigning the ID in the FFA device this time
for real.

Bug: 254441685
Fixes: 19b87664 ("firmware: arm_ffa: Fix FFA device names for logical partitions")
Link: https://lore.kernel.org/r/20231003085932.3553985-1-sudeep.holla@arm.com


Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit 7d0bc636)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Id2b3639e41367def2b5d0e87c991490f5fcdeb08

When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y
and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak is detected.

Since commit 9f86d624 ("mm/damon/vaddr-test: remove unnecessary
variables"), the damon_destroy_ctx() is removed, but still call
damon_new_target() and damon_new_region(), the damon_region which is
allocated by kmem_cache_alloc() in damon_new_region() and the damon_target
which is allocated by kmalloc in damon_new_target() are not freed.  And
the damon_region which is allocated in damon_new_region() in
damon_set_regions() is also not freed.

So use damon_destroy_target to free all the damon_regions and damon_target.

    unreferenced object 0xffff888107c9a940 (size 64):
      comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b  ............kkkk
        60 c7 9c 07 81 88 ff ff f8 cb 9c 07 81 88 ff ff  `...............
      backtrace:
        [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
        [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
        [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
        [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff8881079cc740 (size 56):
      comm "kunit_try_catch", pid 1069, jiffies 4294670592 (age 732.761s)
      hex dump (first 32 bytes):
        05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00  ................
        6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b  kkkkkkkk....kkkk
      backtrace:
        [<ffffffff819bc492>] damon_new_region+0x22/0x1c0
        [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
        [<ffffffff819c82be>] damon_test_apply_three_regions1+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff888107c9ac40 (size 64):
      comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b  ............kkkk
        a0 cc 9c 07 81 88 ff ff 78 a1 76 07 81 88 ff ff  ........x.v.....
      backtrace:
        [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
        [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
        [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
        [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff8881079ccc80 (size 56):
      comm "kunit_try_catch", pid 1071, jiffies 4294670595 (age 732.843s)
      hex dump (first 32 bytes):
        05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00  ................
        6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b  kkkkkkkk....kkkk
      backtrace:
        [<ffffffff819bc492>] damon_new_region+0x22/0x1c0
        [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
        [<ffffffff819c851e>] damon_test_apply_three_regions2+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff888107c9af40 (size 64):
      comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 06 00 00 00 6b 6b 6b 6b  ............kkkk
        20 a2 76 07 81 88 ff ff b8 a6 76 07 81 88 ff ff   .v.......v.....
      backtrace:
        [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
        [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
        [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
        [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff88810776a200 (size 56):
      comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.011s)
      hex dump (first 32 bytes):
        05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00  ................
        6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b  kkkkkkkk....kkkk
      backtrace:
        [<ffffffff819bc492>] damon_new_region+0x22/0x1c0
        [<ffffffff819c7d91>] damon_do_test_apply_three_regions.constprop.0+0xd1/0x3e0
        [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff88810776a740 (size 56):
      comm "kunit_try_catch", pid 1073, jiffies 4294670597 (age 733.025s)
      hex dump (first 32 bytes):
        3d 00 00 00 00 00 00 00 3f 00 00 00 00 00 00 00  =.......?.......
        6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b  kkkkkkkk....kkkk
      backtrace:
        [<ffffffff819bc492>] damon_new_region+0x22/0x1c0
        [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0
        [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0
        [<ffffffff819c877e>] damon_test_apply_three_regions3+0x21e/0x260
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff888108038240 (size 64):
      comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 03 00 00 00 6b 6b 6b 6b  ............kkkk
        48 ad 76 07 81 88 ff ff 98 ae 76 07 81 88 ff ff  H.v.......v.....
      backtrace:
        [<ffffffff817e0167>] kmalloc_trace+0x27/0xa0
        [<ffffffff819c11cf>] damon_new_target+0x3f/0x1b0
        [<ffffffff819c7d55>] damon_do_test_apply_three_regions.constprop.0+0x95/0x3e0
        [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20
    unreferenced object 0xffff88810776ad28 (size 56):
      comm "kunit_try_catch", pid 1075, jiffies 4294670600 (age 733.022s)
      hex dump (first 32 bytes):
        05 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00  ................
        6b 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 6b 6b 6b 6b  kkkkkkkk....kkkk
      backtrace:
        [<ffffffff819bc492>] damon_new_region+0x22/0x1c0
        [<ffffffff819bfcc2>] damon_set_regions+0x4c2/0x8e0
        [<ffffffff819c7dbb>] damon_do_test_apply_three_regions.constprop.0+0xfb/0x3e0
        [<ffffffff819c898d>] damon_test_apply_three_regions4+0x1cd/0x210
        [<ffffffff829fce6a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
        [<ffffffff81237cf6>] kthread+0x2b6/0x380
        [<ffffffff81097add>] ret_from_fork+0x2d/0x70
        [<ffffffff81003791>] ret_from_fork_asm+0x11/0x20

Bug: 254441685
Link: https://lkml.kernel.org/r/20230925072100.3725620-1-ruanjinjie@huawei.com


Fixes: 9f86d624 ("mm/damon/vaddr-test: remove unnecessary variables")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 45120b15)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I13643159b95789a52064ca25509fc67f714be132

Commit 6aa0365a ("ata: libata-scsi: Avoid deadlock on rescan after
device resume") modified ata_scsi_dev_rescan() to check the scsi device
"is_suspended" power field to ensure that the scsi device associated
with an ATA device is fully resumed when scsi_rescan_device() is
executed. However, this fix is problematic as:
1) It relies on a PM internal field that should not be used without PM
   device locking protection.
2) The check for is_suspended and the call to scsi_rescan_device() are
   not atomic and a suspend PM event may be triggered between them,
   casuing scsi_rescan_device() to be called on a suspended device and
   in that function blocking while holding the scsi device lock. This
   would deadlock a following resume operation.
These problems can trigger PM deadlocks on resume, especially with
resume operations triggered quickly after or during suspend operations.
E.g., a simple bash script like:

for (( i=0; i<10; i++ )); do
	echo "+2 > /sys/class/rtc/rtc0/wakealarm
	echo mem > /sys/power/state
done

that triggers a resume 2 seconds after starting suspending a system can
quickly lead to a PM deadlock preventing the system from correctly
resuming.

Fix this by replacing the check on is_suspended with a check on the
return value given by scsi_rescan_device() as that function will fail if
called against a suspended device. Also make sure rescan tasks already
scheduled are first cancelled before suspending an ata port.

Bug: 254441685
Fixes: 6aa0365a ("ata: libata-scsi: Avoid deadlock on rescan after device resume")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit 8b4d9469)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ia9441dbd32116adea3c88df2a479b29f6a149ffd

As per the FF-A specification: section "Usage of other memory region
attributes", in a transaction to donate memory or lend memory to a single
borrower, if the receiver is a PE or Proxy endpoint, the owner must not
specify the attributes and the relayer will return INVALID_PARAMETERS
if the attributes are set.

Let us not set the memory region attributes for MEM_LEND.

Bug: 254441685
Fixes: 82a8daae ("firmware: arm_ffa: Add support for MEM_LEND")
Reported-by: Joao Alves <joao.alves@arm.com>
Reported-by: Olivier Deprez <olivier.deprez@arm.com>
Link: https://lore.kernel.org/r/20230919-ffa_v1-1_notif-v2-13-6f3a3ca3923c@arm.com


Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit 9dda1178)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If348b3729a8bf545c795cdc046fb1e91a35053cb

A previous commit changed the arguments to task_work_cancel_match(), but
didn't document all of them.

Bug: 254441685
Link: https://lkml.kernel.org/r/93938bff-baa3-4091-85f5-784aae297a07@kernel.dk


Fixes: c7aab1a7 ("task_work: add helper for more targeted task_work canceling")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202309120307.zis3yQGe-lkp@intel.com/


Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 4653e5dd)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I48b0978a9c1e285b8a683e0e5544c1b9558f64d2

export function for sysfs node formating

Bug: 299190787
Change-Id: I71e6a0815efa8df99d036bf457b8a0081999f3de
Signed-off-by: Robin Hsu <robinhsu@google.com>

1 function symbol(s) added
  'void kernel_power_off()'

Bug: 239396464
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Signed-off-by: Bian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: I2ceb58bcf3ba2b5a11b1163dff41ebe1a7f77f0d

The TEO governor takes CPU utilization into account by refining idle state
selection when the utilization is above a certain threshold.  This is done by
choosing an idle state shallower than the previously selected one.

However, when doing this, the idle duration estimate needs to be
adjusted so as to prevent the scheduler tick from being stopped when the
candidate idle state is shallow, which may lead to excessive energy
usage if the CPU is not woken up quickly enough going forward.
Moreover, if the scheduler tick has been stopped already and the new
idle duration estimate is too small, the replacement candidate state
cannot be used.

Modify the relevant code to take the above observations into account.

Bug: 254441685
Fixes: 9ce0f7c4 ("cpuidle: teo: Introduce util-awareness")
Link: https://lore.kernel.org/linux-pm/CAJZ5v0jJxHj65r2HXBTd3wfbZtsg=_StzwO1kA5STDnaPe_dWA@mail.gmail.com


Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-and-tested-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
(cherry picked from commit 3f0b0966)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic5784c6330d94310f5d3938d141b51c81be2f9d9

SCMI transport based on SMC can optionally use an additional IRQ to
signal message completion. The associated interrupt handler is currently
allocated using devres but on shutdown the core SCMI stack will call
.chan_free() well before any managed cleanup is invoked by devres.
As a consequence, the arrival of a late reply to an in-flight pending
transaction could still trigger the interrupt handler well after the
SCMI core has cleaned up the channels, with unpleasant results.

Inhibit further message processing on the IRQ path by explicitly freeing
the IRQ inside .chan_free() callback itself.

Bug: 254441685
Fixes: dd820ee2 ("firmware: arm_scmi: Augment SMC/HVC to allow optional interrupt")
Reported-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Link: https://lore.kernel.org/r/20230719173533.2739319-1-cristian.marussi@arm.com


Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit d1ff11d7)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I9996056d3dddd9b208de7e5afb5aa3d345325e01

devm_clk_notifier_register() allocates a devres resource for clk
notifier but didn't register that to the device, so the notifier didn't
get unregistered on device detach and the allocated resource was leaked.

Fix the issue by registering the resource through devres_add().

This issue was found with kmemleak on a Chromebook.

Bug: 254441685
Fixes: 6d30d50d ("clk: add devm variant of clk_notifier_register")
Signed-off-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid


Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
(cherry picked from commit 7fb933e5)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If7f84e9d2551dd5876deb867c807499138a2716c

Building and running the subsuite 'damon' of kselftest, shows the
following issues:
 selftests: damon: debugfs_attrs.sh
  /sys/kernel/debug/damon not found

By creating a config file enabling DAMON fragments in the
selftests/damon/ directory the tests pass.

Bug: 254441685
Link: https://lkml.kernel.org/r/20230412092854.3306197-1-anders.roxell@linaro.org


Fixes: b348eb7a ("mm/damon: add user space selftests")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7b1798ec)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I80ff280a1f586c660a9d1cb05c9ecaa665a6ff21

As described in the commit 111a833d ("firmware: arm_ffa: Set
reserved/MBZ fields to zero in the memory descriptors") some fields in
the memory descriptor have to be zeroed explicitly. The handle field is
one of these, but it was left out from that change, fix this now.

Bug: 254441685
Fixes: 111a833d ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors")
Reported-by: Imre Kis <imre.kis@arm.com>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Link: https://lore.kernel.org/r/20230601140749.93812-1-balint.dobszay@arm.com


Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
(cherry picked from commit 3aa0519a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ib0a28feca23b814b899bacc972bd8f1e80469047