- Mar 18, 2025
-
-
Jamal Hadi Salim authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3548021 Change-Id: Ic0edee0e263cec0d194a74e69fef36f8348eea86 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Quang Le authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3546154 Change-Id: I167c13ab186d57f1ea867ce69b7359e3e5637528 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Michal Luczaj authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3548162 Change-Id: I257c5d24ebb8aa204f31ec8001afccd2e9c6e9cc Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Michal Luczaj authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3548161 Change-Id: I4d0aad1a7190681b3903951eb6f7a9b587246252 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Michal Luczaj authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3548160 Change-Id: I7260daf97ec5f3759e3427646e4e2a5d87b88df7 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Jamal Hadi Salim authored
[ Upstream commit bc50835e ] Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Bug: 393266309 Joint work with Lion Ackermann <nnamrec@gmail.com> Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by:
Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Sasha Levin <sashal@kernel.org> (cherry picked from commit deda09c0) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: Id94e8dfb543643e489e33f79af990f23580b9121
-
Quang Le authored
commit 647cef20 upstream. Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifo_tail_enqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifo_tail_enqueue() return `NET_XMIT_CN` status code. Weird behaviour: In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by one and return `NET_XMIT_CN` status code. The problem is: Let's say we have two qdiscs: Qdisc_A and Qdisc_B. - Qdisc_A's type must have '->graft()' function to create parent/child relationship. Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`. - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`. - Qdisc_B is configured to have `sch->limit == 0`. - Qdisc_A is configured to route the enqueued's packet to Qdisc_B. Enqueue packet through Qdisc_A will lead to: - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) - Qdisc_B->q.qlen += 1 - pfifo_tail_enqueue() return `NET_XMIT_CN` - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A. The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen. Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable. Bug: 395539871 Fixes: 57dbb2d8 ("sched: add head drop fifo queue") Reported-by:
Quang Le <quanglex97@gmail.com> Signed-off-by:
Quang Le <quanglex97@gmail.com> Signed-off-by:
Cong Wang <cong.wang@bytedance.com> Link: https://patch.msgid.link/20250204005841.223511-2-xiyou.wangcong@gmail.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 79a955ea) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: I94a3851190671bc98666cb659e8419ab2767fb03
-
- Mar 17, 2025
-
-
Michal Luczaj authored
commit 78dafe1c upstream. During socket release, sock_orphan() is called without considering that it sets sk->sk_wq to NULL. Later, if SO_LINGER is enabled, this leads to a null pointer dereferenced in virtio_transport_wait_close(). Orphan the socket only after transport release. Partially reverts the 'Fixes:' commit. KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] lock_acquire+0x19e/0x500 _raw_spin_lock_irqsave+0x47/0x70 add_wait_queue+0x46/0x230 virtio_transport_release+0x4e7/0x7f0 __vsock_release+0xfd/0x490 vsock_release+0x90/0x120 __sock_release+0xa3/0x250 sock_close+0x14/0x20 __fput+0x35e/0xa90 __x64_sys_close+0x78/0xd0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Bug: 396331793 Reported-by:
<syzbot+9d55b199192a4be7d02c@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=9d55b199192a4be7d02c Fixes: fcdd2242 ("vsock: Keep the binding until socket destruction") Tested-by:
Luigi Leonardi <leonardi@redhat.com> Reviewed-by:
Luigi Leonardi <leonardi@redhat.com> Signed-off-by:
Michal Luczaj <mhal@rbox.co> Link: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-1-ef6244d02b54@rbox.co Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Luigi Leonardi <leonardi@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 631e00fd) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: I61ef914e5f706ee1c9dd2b9f95cbc69020fe8f00
-
Michal Luczaj authored
commit fcdd2242 upstream. Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). Prevents socket unbinding during a transport reassignment, which fixes a use-after-free: 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) 2. transport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsock_bind() assumes sk is in unbound list and before __vsock_insert_bound(vsock_bound_sockets()) calls __vsock_remove_bound() which does: list_del_init(&vsk->bound_table); // nop sock_put(&vsk->sk); // refcnt=0 BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 __vsock_bind+0x62e/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 __vsock_create.constprop.0+0x2e/0xb60 vsock_create+0xe4/0x420 __sock_create+0x241/0x650 __sys_socket+0xf2/0x1a0 __x64_sys_socket+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 __vsock_bind+0x5e1/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 RIP: 0010:refcount_warn_saturate+0xce/0x150 __vsock_bind+0x66d/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 RIP: 0010:refcount_warn_saturate+0xee/0x150 vsock_remove_bound+0x187/0x1e0 __vsock_release+0x383/0x4a0 vsock_release+0x90/0x120 __sock_release+0xa3/0x250 sock_close+0x14/0x20 __fput+0x359/0xa80 task_work_run+0x107/0x1d0 do_exit+0x847/0x2560 do_group_exit+0xb8/0x250 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0xfec/0x14f0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Bug: 396331793 Fixes: c0cfa2d8 ("vsock: add multi-transports support") Reviewed-by:
Stefano Garzarella <sgarzare@redhat.com> Signed-off-by:
Michal Luczaj <mhal@rbox.co> Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-1-1cf57065b770@rbox.co Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Luigi Leonardi <leonardi@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 42b33381) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: Ia6e19299e44641fcd178000349e0da94012f659e
-
Michal Luczaj authored
commit 135ffc7b upstream. vsock defines a BPF callback to be invoked when close() is called. However, this callback is never actually executed. As a result, a closed vsock socket is not automatically removed from the sockmap/sockhash. Introduce a dummy vsock_close() and make vsock_release() call proto::close. Note: changes in __vsock_release() look messy, but it's only due to indent level reduction and variables xmas tree reorder. Bug: 396331793 Fixes: 634f1a71 ("vsock: support sockmap") Signed-off-by:
Michal Luczaj <mhal@rbox.co> Reviewed-by:
Stefano Garzarella <sgarzare@redhat.com> Reviewed-by:
Luigi Leonardi <leonardi@redhat.com> Link: https://lore.kernel.org/r/20241118-vsock-bpf-poll-close-v1-3-f1b9669cacdc@rbox.co Signed-off-by:
Alexei Starovoitov <ast@kernel.org> Acked-by:
John Fastabend <john.fastabend@gmail.com> [LL: There is no sockmap support for this kernel version. This patch has been backported because it helps reduce conflicts on future backports] Signed-off-by:
Luigi Leonardi <leonardi@redhat.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e11d808f) Signed-off-by:
Lee Jones <joneslee@google.com> Change-Id: I8aefa411aa1ef317743deb600aaa4a9cdd52abd3
-
- Mar 14, 2025
-
-
Qi Han authored
BACKPORT: f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks am: 6a9e785f Original change: https://android-review.googlesource.com/c/kernel/common/+/3538982 Change-Id: I0de5a84e474eeebd10c6ccef96e635d347235113 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
- Mar 13, 2025
-
-
Qi Han authored
BACKPORT: f2fs: compress: fix inconsistent update of i_blocks in release_compress_blocks and reserve_compress_blocks After release a file and subsequently reserve it, the FSCK flag is set when the file is deleted, as shown in the following backtrace: F2FS-fs (dm-48): Inconsistent i_blocks, ino:401231, iblocks:1448, sectors:1472 fs_rec_info_write_type+0x58/0x274 f2fs_rec_info_write+0x1c/0x2c set_sbi_flag+0x74/0x98 dec_valid_block_count+0x150/0x190 f2fs_truncate_data_blocks_range+0x2d4/0x3cc f2fs_do_truncate_blocks+0x2fc/0x5f0 f2fs_truncate_blocks+0x68/0x100 f2fs_truncate+0x80/0x128 f2fs_evict_inode+0x1a4/0x794 evict+0xd4/0x280 iput+0x238/0x284 do_unlinkat+0x1ac/0x298 __arm64_sys_unlinkat+0x48/0x68 invoke_syscall+0x58/0x11c For clusters of the following type, i_blocks are decremented by 1 and i_compr_blocks are incremented by 7 in release_compress_blocks, while updates to i_blocks and i_compr_blocks are skipped in reserve_compress_blocks. raw node: D D D D D D D D after compress: C D D D D D D D after reserve: C D D D D D D D Let's update i_blocks and i_compr_blocks properly in reserve_compress_blocks. Bug: 403145794 Fixes: eb8fbaa5 ("f2fs: compress: fix to check unreleased compressed cluster") Change-Id: I596af62bbd54941bfc77f30e182db94e81cba59b Signed-off-by:
Qi Han <hanqi@vivo.com> Reviewed-by:
Chao Yu <chao@kernel.org> Signed-off-by:
Jaegeuk Kim <jaegeuk@kernel.org> (cherry picked from commit 26413ce1) (cherry picked from commit 90d49524)
-
- Mar 11, 2025
-
-
Kalesh Singh authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3534859 Change-Id: Ia308fd8dc1711a0b2a59602e00849b78c8df30be Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Kalesh Singh authored
pte_unmap_same() and pte_offset_map_lock() in do_swap_page() do not check that the original faulting pmd_t is still the same before attempting to take the ptl lock for the page table, nor do they check the mm_struct’s sequence number. This is problematic if a concurrent fast-mremap happens where the pmd_t entry has been moved as now the vmf->pmd is pointing to the wrong page table. This incorrect page table may not be allocated which will cause the kernel to panic when attempting to take the ptl lock on it. Reinstate the vma refcount trylock since this will prevent a concurrent mremap on the VMA on which the speculative fault is happening. Note fast-mremap still needs to take the page table ptl lock (pte level) to avoid SPF races due to VMA splitting. Bug: 398054290 Bug: 400153677 Change-Id: I447f6f1b57bf1e7dd677e3aec47721702c6e6b88 Signed-off-by:
Kalesh Singh <kaleshsingh@google.com> (cherry picked from commit 5a07ad10)
-
- Feb 22, 2025
-
-
Greg Kroah-Hartman authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3494541 Change-Id: I3b692e16f4ba8e0f9eb8a4401fb278aa16aa5af7 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Greg Kroah-Hartman authored
This merges the android12-5.10.234_r00 tag into the android12-5.10 branch, catching it up with the latest LTS releases. It contains the following commits: * 1caf81977768 Revert "net: net_namespace: Optimize the code" * cad4c9d8b86a Revert "net: add exit_batch_rtnl() method" * 460a2ef91ee6 Revert "gtp: use exit_batch_rtnl() method" * 539048dea84a Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()." * 88dc1ccb48e3 Revert "gtp: Destroy device along with udp socket's netns dismantle." * b9ad2a18059d Revert "fs: fix missing declaration of init_files" * 873986062588 Revert "loop: let set_capacity_revalidate_and_notify update the bdev size" * a05d7b6a75cd Revert "nvme: let set_capacity_revalidate_and_notify update the bdev size" * a362201198a1 Revert "sd: update the bdev size in sd_revalidate_disk" * f40d71e41d9f Revert "block: remove the update_bdev parameter to set_capacity_revalidate_and_notify" * fc74821cbc61 Merge 5.10.234 into android12-5.10-lts |\ | * f0a53361993a Linux 5.10.234 | * c762b76981fc Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals | * 664760c49d98 xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals | * 1f66a3a1a516 drm/v3d: Assign job pointer to NULL before signaling the fence | * d2b550208155 Input: xpad - add support for wooting two he (arm) | * 098b8808e2e6 Input: xpad - add unofficial Xbox 360 wireless receiver clone | * 5e9fed31adc8 Input: atkbd - map F23 key to support default copilot shortcut | * 99c866bea85e Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" | * 94770cf7c512 USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() | * 354aef2ec80a wifi: iwlwifi: add a few rate index validity checks | * 31bd7378c6fe ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() | * d072ea247481 Bluetooth: RFCOMM: Fix not validating setsockopt user input | * d19a8650fd3d vfio/platform: check the bounds of read/write syscalls | * 553df82a8c73 signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die | * f70103a4355c m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal | * 03c56665dab1 net: sched: fix ets qdisc OOB Indexing | * 8c41abc11aa8 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag | * 09f698656628 ASoC: samsung: Add missing depends on I2C | * 20019b1f0040 irqchip/sunxi-nmi: Add missing SKIP_WAKE flag | * 3ff6ce057622 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request | * d5bd48f16d4a seccomp: Stub for !CONFIG_SECCOMP | * c269af144a79 ASoC: samsung: Add missing selects for MFD_WM8994 | * 771f8a8a6995 ASoC: wm8994: Add depends on MFD core | * fe2c0bd6d1e2 net: fix data-races around sk->sk_forward_alloc | * 285ce1f89f8d scsi: sg: Fix slab-use-after-free read in sg_release() | * 7ffaf1a16f65 x86/xen: fix SLS mitigation in xen_hypercall_iret() | * daeac89cdb03 vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] | * 18a7fc371d1d vsock/virtio: discard packets if the transport changes | * a925a200299a fou: remove warn in gue_gro_receive on unsupported protocol | * f9f76ff74dae nfsd: add list_head nf_gc to struct nfsd_file | * 8a8b83016f06 ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() | * 83f5a87ee8ca blk-cgroup: Fix UAF in blkcg_unpin_online() | * 605889754ee6 RDMA/hns: Fix deadlock on SRQ async events. | * 461091c27f55 vmalloc: fix accounting with i915 | * e8d3c53c6f1c drm/radeon: check bo_va->bo is non-NULL before using it | * 85a9c98a5e0f iio: adc: rockchip_saradc: fix information leak in triggered buffer | * 031538ff9c32 iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on | * 641b4041cb4e iio: imu: inv_icm42600: fix spi burst write not supported | * da55e7622580 Revert "PCI: Use preserve_config in place of pci_flags" | * 14984139f1f2 hrtimers: Handle CPU state correctly on hotplug | * d1099ad23596 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly | * 2dfbb920a89b gpiolib: cdev: Fix use after free in lineinfo_changed_notify | * 80da29deb88a fs/proc: fix softlockup in __read_vmcore (part 2) | * ae527bd2b537 vsock: reset socket state when de-assigning the transport | * 3cde51df39c3 vsock/virtio: cancel close work in the destructor | * f9710a5cbd99 net: ethernet: xgbe: re-add aneg to supported features in PHY quirks | * 17dcfc0f54b7 x86/asm: Make serialize() always_inline | * a722df501ba3 nvmet: propagate npwg topology | * 3f8b360ce0e0 poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() | * 99db426762e1 kheaders: Ignore silly-rename files | * 95597be4806d fs: fix missing declaration of init_files | * 2cf7601e1295 hfs: Sanity check the root record | * 98ea165a2ac2 mac802154: check local interfaces before deleting sdata list | * 3eb329978997 i2c: rcar: fix NACK handling when being a target | * 8d037f34385a i2c: mux: demux-pinctrl: check initial mux selection, too | * a34050f70e79 drm/v3d: Ensure job pointer is set to NULL after job completion | * 72dc13457e67 net/mlx5: Fix RDMA TX steering prio | * 47166d31e531 net/mlx5: Refactor mlx5_get_flow_namespace | * 9f07d9fd6181 net/mlx5: Add priorities for counters in RDMA namespaces | * faf64fe8915d nfp: bpf: prevent integer overflow in nfp_bpf_event_output() | * 5f1678346109 gtp: Destroy device along with udp socket's netns dismantle. | * 66f1864cd0b1 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). | * 320a0dea3b28 gtp: use exit_batch_rtnl() method | * fae8bd0b07f9 net: add exit_batch_rtnl() method | * 37fdbeb0e293 net: net_namespace: Optimize the code | * bb36838dac7b bpf: Fix bpf_sk_select_reuseport() memory leak | * 9f7ad4eb839d net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() | * a13d640d8c8e phy: usb: Fix clock imbalance for suspend/resume | * 3bc29a491192 phy: usb: Use slow clock for wake enabled suspend | * 246428bfb9e7 sctp: sysctl: rto_min/max: avoid using current->nsproxy | * acec80d9f126 drm: adv7511: Fix use-after-free in adv7533_attach_dsi() | * 49881fcef3d4 drm: bridge: adv7511: use dev_err_probe in probe function | * 3747465c5da7 drm: bridge: adv7511: unregister cec i2c device after cec adapter | * 09a817549036 drm/bridge: adv7533: Switch to devm MIPI-DSI helpers | * 2c0106fdd35c drm/mipi-dsi: Create devm device attachment | * 5ad24956a20e drm/mipi-dsi: Create devm device registration | * cb3a64b6b449 drm: bridge: adv7511: Remove redundant null check before clk_disable_unprepare | * 8ff6f635a08c ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv | * af45819b29bf ocfs2: correct return value of ocfs2_local_free_info() | * a8d08d9f5e12 phy: usb: Toggle the PHY power during init | * 5917962b5196 phy: usb: Add "wake on" functionality for newer Synopsis XHCI controllers | * 5330de58f70d block: remove the update_bdev parameter to set_capacity_revalidate_and_notify | * afa920d411e9 sd: update the bdev size in sd_revalidate_disk | * 72224a75c5f6 nvme: let set_capacity_revalidate_and_notify update the bdev size | * dddf71505857 loop: let set_capacity_revalidate_and_notify update the bdev size | * 5601c261bbc5 arm64: dts: rockchip: add hevc power domain clock to rk3328 | * 00360f3f3962 arm64: dts: rockchip: add #power-domain-cells to power domain nodes | * 3528099673ba iio: inkern: call iio_device_put() only on mapped devices | * ac8d932e3214 iio: adc: at91: call input_free_device() on allocated iio_dev | * 1b7b9084fad8 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() | * 2d72fc4a1ca6 iio: gyro: fxas21002c: Fix missing data update in trigger handler | * 3bf8d1e87939 iio: adc: ti-ads8688: fix information leak in triggered buffer | * a386d9d2dc66 iio: imu: kmx61: fix information leak in triggered buffer | * b0e9c11c762e iio: light: vcnl4035: fix information leak in triggered buffer | * e1c1e8c05010 iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer | * d25f1fc27367 iio: pressure: zpa2326: fix information leak in triggered buffer | * 3e4d32cc1459 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind | * 209b72d3c4e1 usb: fix reference leak in usb_new_device() | * d9f78c900648 USB: core: Disable LPM only for non-suspended ports | * ee63cb2262e3 USB: usblp: return error when setting unsupported protocol | * 1062b648bff6 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null | * 4c51407cb8a4 usb: dwc3: gadget: fix writing NYET threshold | * 258b3530cfdf USB: serial: cp210x: add Phoenix Contact UPS Device | * 09d4072aabee usb-storage: Add max sectors quirk for Nokia 208 | * 717b7360ccc1 staging: iio: ad9832: Correct phase range check | * 38da4bab433c staging: iio: ad9834: Correct phase range check | * e764b4e18789 USB: serial: option: add Neoway N723-EA support | * dad372177818 USB: serial: option: add MeiG Smart SRM815 | * 66de7a2541d8 md/raid5: fix atomicity violation in raid5_cache_count | * 08765d4e44d4 scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity | * 88136f799f33 drm/amd/display: increase MAX_SURFACES to the value supported by hw | * 2f8067b3425c ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] | * 522ddfb1fb62 ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] | * 8c38baa03ac8 riscv: Fix sleeping in invalid context in die() | * 497471baf53b drm/amd/display: Add check for granularity in dml ceil/floor helpers | * dc583e7e5f85 sctp: sysctl: auth_enable: avoid using current->nsproxy | * 03ca51faba2b sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy | * 2c1a42fbd98e dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY | * cd30a3960433 dm thin: make get_first_thin use rcu-safe list first function | * 9340385468d0 afs: Fix the maximum cell name length | * a965f7f0ea3a netfilter: conntrack: clamp maximum hashtable size to INT_MAX | * 208929266386 netfilter: nf_tables: imbalance in flowtable binding | * 72e6ca38ca66 tls: Fix tls_sw_sendmsg error handling | * 53b7a6762483 cxgb4: Avoid removal of uninserted tid | * 43658e4a5f27 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute | * 22e3f5ee7317 tcp/dccp: allow a connection when sk_max_ack_backlog is zero | * 9261b8252473 tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog | * c9c0471e29f0 net: 802: LLC+SNAP OID:PID lookup on start of skb data | * c2da454712f2 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() | * 4a6167ae75ad netfilter: nft_dynset: honor stateful expressions in set definition | * 01c4e22c260d ASoC: mediatek: disable buffer pre-allocation | * d8cfbb8723bd exfat: fix the infinite loop in exfat_readdir() | * 5c10baed458e dm array: fix cursor index when skipping across block boundaries | * cb223d9606a3 dm array: fix unreleased btree blocks on closing a faulty array cursor | * fc1ef07c3522 dm array: fix releasing a faulty array block twice in dm_array_cursor_end | * 359abf6ca962 jbd2: flush filesystem device before updating tail sequence | * 0f2b2d9e881c ceph: give up on paths longer than PATH_MAX * 55bef3bc89d9 Merge branch 'android12-5.10' into android12-5.10-lts Change-Id: If10d8d4e12593ccafb9b92541ca277b6165a375a Signed-off-by:
Greg Kroah-Hartman <gregkh@google.com>
-
- Feb 19, 2025
-
-
Tvrtko Ursulin authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3499832 Change-Id: I7949c1a9186f7b091c9c5272f7fb8b66e6980507 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Dan Carpenter authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3499831 Change-Id: I1fb9588186a70a37ca700180b1c3eef9bf752c93 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496923 Change-Id: Icc11cab4655265003495daf1e187ee65379353c4 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Danilo Krummrich authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3499830 Change-Id: Ia54b40bc50fa10a71bbe995261250947b627a653 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Arvind Yadav authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496922 Change-Id: Ic0cc91fd3980f51eae42cbc748eb40a833d45c03 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Arvind Yadav authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497466 Change-Id: I22cce586a106c0b8bcd31c9d5599b04f40d0e545 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
UPSTREAM: dma-buf: revert "return only unsignaled fences in dma_fence_unwrap_for_each v3" am: 351db61d Original change: https://android-review.googlesource.com/c/kernel/common/+/3497465 Change-Id: I3189d928a39ce179644b31a8abde2dd554ba41cd Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496921 Change-Id: Ibf8d9a0f96bd2b2f42555f129f9350ad7bae85a8 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497463 Change-Id: I269614c04c5b1e8137f3b3a325c44260503a58a4 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496920 Change-Id: I98b78bcb182c3a9165e92643b9f4a1a598fa61a8 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496919 Change-Id: I7201e85b1aef5b194040b219b0af006c5a52cdf4 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497460 Change-Id: I9cc96a643011ce10be05e9d50128522c81fbed01 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497459 Change-Id: I8e6d5eac02b3b012bb396706345c549552ea3d51 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496918 Change-Id: Iaeb733cbbca416ad6d666e4a4f305cd2ca761175 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497457 Change-Id: I77d665d7c337916acd0a2d85fb96cc893cb42644 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497456 Change-Id: Ieff59212d3f6ccb4edf920ccaa737aa221829292 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496926 Change-Id: I69a0beab10afd6470ac494350c7c00a70b008012 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496925 Change-Id: I198fead59e033897f7795f50a750e628f70b26ac Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496924 Change-Id: I721683f3bce7c21a9b04d4109c9b8dbb1415fb2b Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497451 Change-Id: Ia4af30ae85591ada669cc8f8b9254699e3f66389 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Christian König authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3497450 Change-Id: Ifa59ad3a56ff6eb96cb684aa73f208afcede7209 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
David Stevens authored
Original change: https://android-review.googlesource.com/c/kernel/common/+/3496408 Change-Id: I023f12ab8bdbd614a4f9134e904f210d1d439a06 Signed-off-by:
Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-
Tvrtko Ursulin authored
Release all fence references if the output dma-fence-array could not be allocated. Change-Id: I9d60f6f8b37e15926a40038b0278b70f4653ce51 Signed-off-by:
Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: 245a4a7b ("dma-buf: generalize dma_fence unwrap & merging v3") Cc: Christian König <christian.koenig@amd.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Friedrich Vock <friedrich.vock@gmx.de> Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Cc: <stable@vger.kernel.org> # v6.0+ Reviewed-by:
Christian König <christian.koenig@amd.com> Signed-off-by:
Christian König <christian.koenig@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241115102153.1980-2-tursulin@igalia.com (cherry picked from commit 949291c5) Bug: 394776841 Signed-off-by:
T.J. Mercier <tjmercier@google.com>
-
Dan Carpenter authored
Smatch detected potential error pointer dereference. drivers/gpu/drm/drm_syncobj.c:888 drm_syncobj_transfer_to_timeline() error: 'fence' dereferencing possible ERR_PTR() The error pointer comes from dma_fence_allocate_private_stub(). One caller expected error pointers and one expected NULL pointers. Change it to return NULL and update the caller which expected error pointers, drm_syncobj_assign_null_handle(), to check for NULL instead. Fixes: f781f661 ("dma-buf: keep the signaling time of merged fences v3") Change-Id: Iedc77bd8dcd22735f344bc90c7560a399d2e2690 Signed-off-by:
Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by:
Christian König <christian.koenig@amd.com> Reviewed-by:
Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by:
Sumit Semwal <sumit.semwal@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/b09f1996-3838-4fa2-9193-832b68262e43@moroto.mountain (cherry picked from commit 00ae1491) Bug: 394776841 Signed-off-by:
T.J. Mercier <tjmercier@google.com>
-