Skip to content
Snippets Groups Projects
Select Git revision
0 results
Search by author
  • Any Author
  • 72162444 72162444 72162444 72162444 gaochangning
  • Aakash Dave Aakash Dave aakash.dave
  • Aaron Kim Aaron Kim akim
  • Aaron Kloc Aaron Kloc akloc
  • Aaron Lan Aaron Lan aaron.lan
  • Aaron Nabil Aaron Nabil aaronna
  • Aaron Pohle Aaron Pohle aaron.pohle
  • Abbott Chung Abbott Chung chung.abbott
  • Abdallah Omar Abdallah Omar abdallah_omar
  • Abdessamii Chalbi Abdessamii Chalbi abdessamii.chalbi
  • Abdul Hussain Sirajudeen Abdul Hussain Sirajudeen abdul.hussain
  • Abdullah Alghamdi Abdullah Alghamdi a.alghamdi
  • Abdullah Elmarghany Abdullah Elmarghany abdullah_elmarghany
  • Abel Fang Abel Fang abel_fang
  • Abhijeet Badurkar Abhijeet Badurkar abhijeet.badurkar
  • Abhijit Adsule Abhijit Adsule adsule
  • Abhijit Murthy Abhijit Murthy abhijit
  • Abhi Khanal Abhi Khanal akhanal
  • Abhilash Sahoo Abhilash Sahoo abhilashsahoo
  • Abhimanyu Raj Abhimanyu Raj abhimanyu.raj
20 authors
  1. Mar 13, 2025
    • gy niu's avatar
      ANDROID: GKI: Add KMI symbol list for zebra · 70d032fb
      gy niu authored 
      
These symbols are required to third part ethernet driver
pegasus.ko and smsc95xx.ko

INFO: 2 function symbol(s) added
  'void mii_ethtool_get_link_ksettings(struct mii_if_info*, struct ethtool_link_ksettings*)'
  'int mii_ethtool_set_link_ksettings(struct mii_if_info*, const struct ethtool_link_ksettings*)'

Bug: 403203480
Change-Id: Idfb8fad289516d5cbbe6235bca6c87bd24406ca0
Signed-off-by: default avatargy niu <gyniu1024@gmail.com>
      70d032fb
  3. Mar 12, 2025
    • Bian Jin chen's avatar
      ANDROID: GKI: Update rockchip symbols for drm driver. · efd0bedd
      Bian Jin chen authored 
      
INFO: 4 function symbol(s) added
  'bool drm_bridge_is_panel(const struct drm_bridge*)'
  'int drm_panel_bridge_set_orientation(struct drm_connector*, struct drm_bridge*)'
  'struct drm_bridge* drmm_of_get_bridge(struct drm_device*, struct device_node*, u32, u32)'
  'struct drm_bridge* drmm_panel_bridge_add(struct drm_device*, struct drm_panel*)'

Bug: 300024866
Signed-off-by: default avatarBian Jin chen <kenjc.bian@rock-chips.com>
Change-Id: I256402894b3a19be401c27113c0fe52647d43531
      efd0bedd
    • Seiya Wang's avatar
      ANDROID: GKI: Update symbol list for mtk · 69a6dfc9
      Seiya Wang authored 
      
7 function symbol(s) added
  'int nfnetlink_subsys_register(const struct nfnetlink_subsystem*)'
  'int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem*)'
  'int nfnetlink_unicast(struct sk_buff*, struct net*, u32)'
  'void nfnl_lock(__u8)'
  'void nfnl_unlock(__u8)'
  'int xt_register_matches(struct xt_match*, unsigned int)'
  'void xt_unregister_matches(struct xt_match*, unsigned int)'

Bug: 402616138
Change-Id: Ic3eaedb9ea04389141704e72e46e15e0936c0a78
Signed-off-by: default avatarSeiya Wang <seiya.wang@mediatek.com>
      69a6dfc9
  5. Mar 11, 2025
    • Lokesh Gidra's avatar
      ANDROID: userfaultfd: add MOVE ioctl mode to confirm bug-fixes · 9bcabbda
      Lokesh Gidra authored 
      Following issues were reported in the MOVE ioctl:
1. Panic when trying to move a source page which is in swap-cache [1]
2. Livelock when multiple threads try to move the same source page [2]

Three patches have been upstreamed to fix these issues [3, 4, 5]

MOVE ioctl was backported to ACK 6.1 and 6.6 for ART GC to use it [6].
Therefore, on these kernels in order to be able to identify in the
userspace if the fixes are included, this mode is added.

NOTE: UFFDIO_MOVE_MODE_CONFIRM_FIXED mode is only for 6.1 and 6.6
kernels, and will go away afterwards.

[1] https://lore.kernel.org/linux-mm/20250219112519.92853-1-21cnbao@gmail.com/
[2] https://github.com/lokeshgidra/uffd_move_ioctl_deadlock
[3] https://web.git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/commit/?h=mm-hotfixes-stable&id=c50f8e6053b0503375c2975bf47f182445aebb4c
[4] https://web.git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/commit/?h=mm-hotfixes-stable&id=37b338eed10581784e854d4262da05c8d960c748
[5] https://web.git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/commit/?h=mm-hotfixes-stable&id=927e926d72d9155fde3264459fe9bfd7b5e40d28


[6] b/274911254

Bug: 401790618
Change-Id: Ibd854ec7ac9ae6a2ca416767d032b6c71f1bc688
Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
      9bcabbda
    • Suren Baghdasaryan's avatar
      FROMGIT: userfaultfd: fix PTE unmapping stack-allocated PTE copies · 8d8d44ff
      Suren Baghdasaryan authored 
      Current implementation of move_pages_pte() copies source and destination
PTEs in order to detect concurrent changes to PTEs involved in the move.
However these copies are also used to unmap the PTEs, which will fail if
CONFIG_HIGHPTE is enabled because the copies are allocated on the stack.
Fix this by using the actual PTEs which were kmap()ed.

Link: https://lkml.kernel.org/r/20250226185510.2732648-3-surenb@google.com


Fixes: adef4406 ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: default avatarSuren Baghdasaryan <surenb@google.com>
Reported-by: default avatarPeter Xu <peterx@redhat.com>
Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Barry Song <21cnbao@gmail.com>
Cc: Barry Song <v-songbaohua@oppo.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>

Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
(cherry-picked from commit 927e926d https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-stable)
Change-Id: I0ee6c1b509ea7c4fa68056d6e512d4ac167c9234
Bug: 401790618
      8d8d44ff
    • Suren Baghdasaryan's avatar
      FROMGIT: userfaultfd: do not block on locking a large folio with raised refcount · af439acc
      Suren Baghdasaryan authored 
      Lokesh recently raised an issue about UFFDIO_MOVE getting into a deadlock
state when it goes into split_folio() with raised folio refcount.
split_folio() expects the reference count to be exactly mapcount +
num_pages_in_folio + 1 (see can_split_folio()) and fails with EAGAIN
otherwise.

If multiple processes are trying to move the same large folio, they raise
the refcount (all tasks succeed in that) then one of them succeeds in
locking the folio, while others will block in folio_lock() while keeping
the refcount raised.  The winner of this race will proceed with calling
split_folio() and will fail returning EAGAIN to the caller and unlocking
the folio.  The next competing process will get the folio locked and will
go through the same flow.  In the meantime the original winner will be
retried and will block in folio_lock(), getting into the queue of waiting
processes only to repeat the same path.  All this results in a livelock.

An easy fix would be to avoid waiting for the folio lock while holding
folio refcount, similar to madvise_free_huge_pmd() where folio lock is
acquired before raising the folio refcount.  Since we lock and take a
refcount of the folio while holding the PTE lock, changing the order of
these operations should not break anything.

Modify move_pages_pte() to try locking the folio first and if that fails
and the folio is large then return EAGAIN without touching the folio
refcount.  If the folio is single-page then split_folio() is not called,
so we don't have this issue.  Lokesh has a reproducer [1] and I verified
that this change fixes the issue.

[1] https://github.com/lokeshgidra/uffd_move_ioctl_deadlock

[akpm@linux-foundation.org: reflow comment to 80 cols, s/end/end up/]
Link: https://lkml.kernel.org/r/20250226185510.2732648-2-surenb@google.com


Fixes: adef4406 ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: default avatarSuren Baghdasaryan <surenb@google.com>
Reported-by: default avatarLokesh Gidra <lokeshgidra@google.com>
Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
Acked-by: default avatarLiam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Barry Song <21cnbao@gmail.com>
Cc: Barry Song <v-songbaohua@oppo.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>

Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
(cherry-picked from commit 37b338ee https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-stable)
Change-Id: I71b307add9707ad3518a44623aea2e2ca417b95a
Bug: 401790618
      af439acc
    • Barry Song's avatar
      FROMGIT: BACKPORT: mm: fix kernel BUG when userfaultfd_move encounters swapcache · 7d6124b6
      Barry Song authored 
      userfaultfd_move() checks whether the PTE entry is present or a
swap entry.

- If the PTE entry is present, move_present_pte() handles folio
  migration by setting:

  src_folio->index = linear_page_index(dst_vma, dst_addr);

- If the PTE entry is a swap entry, move_swap_pte() simply copies
  the PTE to the new dst_addr.

This approach is incorrect because, even if the PTE is a swap entry,
it can still reference a folio that remains in the swap cache.

This creates a race window between steps 2 and 4.
 1. add_to_swap: The folio is added to the swapcache.
 2. try_to_unmap: PTEs are converted to swap entries.
 3. pageout: The folio is written back.
 4. Swapcache is cleared.
If userfaultfd_move() occurs in the window between steps 2 and 4,
after the swap PTE has been moved to the destination, accessing the
destination triggers do_swap_page(), which may locate the folio in
the swapcache. However, since the folio's index has not been updated
to match the destination VMA, do_swap_page() will detect a mismatch.

This can result in two critical issues depending on the system
configuration.

If KSM is disabled, both small and large folios can trigger a BUG
during the add_rmap operation due to:

 page_pgoff(folio, page) != linear_page_index(vma, address)

[   13.336953] page: refcount:6 mapcount:1 mapping:00000000f43db19c index:0xffffaf150 pfn:0x4667c
[   13.337520] head: order:2 mapcount:1 entire_mapcount:0 nr_pages_mapped:1 pincount:0
[   13.337716] memcg:ffff00000405f000
[   13.337849] anon flags: 0x3fffc0000020459(locked|uptodate|dirty|owner_priv_1|head|swapbacked|node=0|zone=0|lastcpupid=0xffff)
[   13.338630] raw: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361
[   13.338831] raw: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000
[   13.339031] head: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361
[   13.339204] head: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000
[   13.339375] head: 03fffc0000000202 fffffdffc0199f01 ffffffff00000000 0000000000000001
[   13.339546] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
[   13.339736] page dumped because: VM_BUG_ON_PAGE(page_pgoff(folio, page) != linear_page_index(vma, address))
[   13.340190] ------------[ cut here ]------------
[   13.340316] kernel BUG at mm/rmap.c:1380!
[   13.340683] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
[   13.340969] Modules linked in:
[   13.341257] CPU: 1 UID: 0 PID: 107 Comm: a.out Not tainted 6.14.0-rc3-gcf42737e247a-dirty #299
[   13.341470] Hardware name: linux,dummy-virt (DT)
[   13.341671] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   13.341815] pc : __page_check_anon_rmap+0xa0/0xb0
[   13.341920] lr : __page_check_anon_rmap+0xa0/0xb0
[   13.342018] sp : ffff80008752bb20
[   13.342093] x29: ffff80008752bb20 x28: fffffdffc0199f00 x27: 0000000000000001
[   13.342404] x26: 0000000000000000 x25: 0000000000000001 x24: 0000000000000001
[   13.342575] x23: 0000ffffaf0d0000 x22: 0000ffffaf0d0000 x21: fffffdffc0199f00
[   13.342731] x20: fffffdffc0199f00 x19: ffff000006210700 x18: 00000000ffffffff
[   13.342881] x17: 6c203d2120296567 x16: 6170202c6f696c6f x15: 662866666f67705f
[   13.343033] x14: 6567617028454741 x13: 2929737365726464 x12: ffff800083728ab0
[   13.343183] x11: ffff800082996bf8 x10: 0000000000000fd7 x9 : ffff80008011bc40
[   13.343351] x8 : 0000000000017fe8 x7 : 00000000fffff000 x6 : ffff8000829eebf8
[   13.343498] x5 : c0000000fffff000 x4 : 0000000000000000 x3 : 0000000000000000
[   13.343645] x2 : 0000000000000000 x1 : ffff0000062db980 x0 : 000000000000005f
[   13.343876] Call trace:
[   13.344045]  __page_check_anon_rmap+0xa0/0xb0 (P)
[   13.344234]  folio_add_anon_rmap_ptes+0x22c/0x320
[   13.344333]  do_swap_page+0x1060/0x1400
[   13.344417]  __handle_mm_fault+0x61c/0xbc8
[   13.344504]  handle_mm_fault+0xd8/0x2e8
[   13.344586]  do_page_fault+0x20c/0x770
[   13.344673]  do_translation_fault+0xb4/0xf0
[   13.344759]  do_mem_abort+0x48/0xa0
[   13.344842]  el0_da+0x58/0x130
[   13.344914]  el0t_64_sync_handler+0xc4/0x138
[   13.345002]  el0t_64_sync+0x1ac/0x1b0
[   13.345208] Code: aa1503e0 f000f801 910f6021 97ff5779 (d4210000)
[   13.345504] ---[ end trace 0000000000000000 ]---
[   13.345715] note: a.out[107] exited with irqs disabled
[   13.345954] note: a.out[107] exited with preempt_count 2

If KSM is enabled, Peter Xu also discovered that do_swap_page() may
trigger an unexpected CoW operation for small folios because
ksm_might_need_to_copy() allocates a new folio when the folio index
does not match linear_page_index(vma, addr).

This patch also checks the swapcache when handling swap entries. If a
match is found in the swapcache, it processes it similarly to a present
PTE.
However, there are some differences. For example, the folio is no longer
exclusive because folio_try_share_anon_rmap_pte() is performed during
unmapping.
Furthermore, in the case of swapcache, the folio has already been
unmapped, eliminating the risk of concurrent rmap walks and removing the
need to acquire src_folio's anon_vma or lock.

Note that for large folios, in the swapcache handling path, we directly
return -EBUSY since split_folio() will return -EBUSY regardless if
the folio is under writeback or unmapped. This is not an urgent issue,
so a follow-up patch may address it separately.

[v-songbaohua@oppo.com: minor cleanup according to Peter Xu]
  Link: https://lkml.kernel.org/r/20250226024411.47092-1-21cnbao@gmail.com
Link: https://lkml.kernel.org/r/20250226001400.9129-1-21cnbao@gmail.com


Fixes: adef4406 ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: default avatarBarry Song <v-songbaohua@oppo.com>
Acked-by: default avatarPeter Xu <peterx@redhat.com>
Reviewed-by: default avatarSuren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport (IBM) <rppt@kernel.org>
Cc: Nicolas Geoffray <ngeoffray@google.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: ZhangPeng <zhangpeng362@huawei.com>
Cc: Tangquan Zheng <zhengtangquan@oppo.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>

Conflicts:
1. mm/userfaultfd.c
[Removed pmd arguments being passed to move_swap_pte() to resolve conflicts - Lokesh Gidra]
[Replaced swap_cache_index() with swp_offset() as the former doesn't exist - Lokesh Gidra]
[Replaced folio_move_anon_rmap() with page_move_anon_rmap() as the
 former doesn't exist - Lokesh Gidra]

Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
(cherry-picked from commit c50f8e60 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-stable)
Change-Id: I94caeac5bf78add4d78650929303a25d54d8a638
Bug: 401790618
      7d6124b6
  7. Mar 07, 2025
  9. Mar 06, 2025
  11. Mar 01, 2025
  13. Feb 28, 2025
    • zhanghui's avatar
      ANDROID: GKI: Update symbol list for xiaomi · 6b227a1f
      zhanghui authored 
      
1 function symbol(s) added
  'int __traceiter_android_vh_filemap_map_pages_range(void*, struct file*, unsigned long, unsigned long, vm_fault_t)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_filemap_map_pages_range'

Bug: 398130226
Change-Id: I789a16f5d0bc3d11b9518c548276b2ce19514ead
Signed-off-by: default avatarzhanghui <zhanghui31@xiaomi.com>
      6b227a1f
    • zhanghui's avatar
      ANDROID: mm: add a new vendor hook in filemap_map_pages · eaffa3e3
      zhanghui authored 
      
In the current vendor hook, if next_uptodate_folio returns NULL, the
first_pgoff is set to zero, and the last_pgoff is set to start_pgoff.
Therefore, the collection range is from 0 to the start_pgoff.

|-----------|------------|-------------|------------------|
0      start_pgoff  first_pgoff    last_pgoff         end_pgoff

We want to collect the first_pgoff to last_pgoff, so we have to add a
new vendor hook.

Bug: 398130226
Change-Id: I19d54c601e2ffc5de5ec2dafcd43fbdcdc84b0d2
Signed-off-by: default avatarzhanghui <zhanghui31@xiaomi.com>
      eaffa3e3
  15. Feb 26, 2025
  17. Feb 25, 2025
  19. Feb 24, 2025
  21. Feb 22, 2025
    • Greg Kroah-Hartman's avatar
      Merge tag 'android14-6.1.128_r00' into android14-6.1 · a624f97c
      Greg Kroah-Hartman authored 
      
This merges the android14-6.1.128_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 8ae119f6 ANDROID: hrtimers: revert mismerged commit in 6.1.127 LTS merge
*   e6d1ba54 Merge 6.1.128 into android14-6.1-lts
|\
| * 0cbb5f65 Linux 6.1.128
| * a9401cd5 drm/v3d: Assign job pointer to NULL before signaling the fence
| * 7d06d97e ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
| * 44c49581 smb: client: fix NULL ptr deref in crypto_aead_setkey()
| * 4982cc83 Input: xpad - add support for wooting two he (arm)
| * b336f583 Input: xpad - add unofficial Xbox 360 wireless receiver clone
| * dd000518 Input: atkbd - map F23 key to support default copilot shortcut
| * 4631653d ALSA: usb-audio: Add delay quirk for USB Audio Device
| * 33233b06 Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
| * 4b9b41fa USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
| * bce96653 smb: client: fix UAF in async decryption
| * 49a27ee4 wifi: iwlwifi: add a few rate index validity checks
| * 182a4b7c scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
| * ce114240 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
| * 13ea9547 ext4: fix access to uninitialised lock in fc replay path
| * 6bcb8a5b vfio/platform: check the bounds of read/write syscalls
| * 1a1b2b8c Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
| * 8476f842 block: fix integer overflow in BLKSECDISCARD
| * 1332c6ed net: sched: fix ets qdisc OOB Indexing
| * 74a37ce6 io_uring: fix waiters missing wake ups
| * 2a40a140 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
| * 754df8c9 xfs: respect the stable writes flag on the RT device
| * bc4ad699 xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
| * 7880b1f0 xfs: dquot recovery does not validate the recovered dquot
| * df716416 xfs: clean up dqblk extraction
| * 318cac2b xfs: inode recovery does not validate the recovered inode
| * 6e782627 xfs: fix internal error from AGFL exhaustion
| * 323a7079 xfs: up(ic_sema) if flushing data device fails
| * 67c362b8 xfs: only remap the written blocks in xfs_reflink_end_cow_extent
| * b655ee7d xfs: abort intent items when recovery intents fail
| * 16cf312b xfs: factor out xfs_defer_pending_abort
| * 6685b885 xfs: allow read IO and FICLONE to run concurrently
| * 4eb3b579 xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
| * feb30fe4 xfs: introduce protection for drop nlink
| * 4d607041 xfs: make sure maxlen is still congruent with prod when rounding down
| * 34167d02 xfs: fix units conversion error in xfs_bmap_del_extent_delay
| * 91536449 xfs: rt stubs should return negative errnos when rt disabled
| * 9670abd1 xfs: prevent rt growfs when quota is enabled
| * 8ee604ac xfs: hoist freeing of rt data fork extent mappings
| * 79bdab54 xfs: bump max fsgeom struct version
| * f1bc5706 softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
| * d0ec61c9 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
| * 9fdec478 regmap: detach regmap from dev on regmap_exit
| * 87d69690 ASoC: samsung: Add missing depends on I2C
| * 656100f6 ASoC: samsung: midas_wm1811: Map missing jack kcontrols
| * d2b4b39b irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
| * b7d24618 drm/amd/display: Use HW lock mgr for PSR1
| * 2104ad71 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
| * 18cb5798 seccomp: Stub for !CONFIG_SECCOMP
| * b873c88b ASoC: samsung: Add missing selects for MFD_WM8994
| * 8cf587aa ASoC: wm8994: Add depends on MFD core
* | 979fb1d6 Revert "fs: fix missing declaration of init_files"
* | 42cbb802 Revert "net: add exit_batch_rtnl() method"
* | 5b18fc7e Revert "gtp: use exit_batch_rtnl() method"
* | da69d668 Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()."
* | f3dfa826 Revert "gtp: Destroy device along with udp socket's netns dismantle."
* | 79f1b689 Merge 6.1.127 into android14-6.1-lts
|\|
| * 75cefdf1 Linux 6.1.127
| * be7c61ea net: fix data-races around sk->sk_forward_alloc
| * 060de371 x86/xen: fix SLS mitigation in xen_hypercall_iret()
| * 400fb0e9 nfsd: add list_head nf_gc to struct nfsd_file
| * 75a0a6dd erofs: handle NONHEAD !delta[1] lclusters gracefully
| * 6326a3dc erofs: tidy up EROFS on-disk naming
| * 6e5dbd1c wifi: ath10k: avoid NULL pointer error during sdio remove
| * cd862903 Revert "regmap: detach regmap from dev on regmap_exit"
| * 275b8347 scsi: sg: Fix slab-use-after-free read in sg_release()
| * 9e95518e RDMA/rxe: Fix the qp flush warnings in req
| * e7736037 Revert "drm/amdgpu: rework resume handling for display (v2)"
| * 1921fe7d block: fix uaf for flush rq while iterating tags
| * 05b1b339 drm/amdgpu: fix usage slab after free
| * 5bd410c2 drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
| * 64b79afd iio: adc: rockchip_saradc: fix information leak in triggered buffer
| * d3e25180 iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
| * f2e4823b iio: imu: inv_icm42600: fix spi burst write not supported
| * 479a42ee Revert "PCI: Use preserve_config in place of pci_flags"
| * 6603aca9 drm/i915/fb: Relax clear color alignment to 64 bytes
| * 3d41dbf8 hrtimers: Handle CPU state correctly on hotplug
| * d7b0e896 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
| * e64612f8 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
| * e1994d0f irqchip: Plug a OF node reference leak in platform_irqchip_probe()
| * 699cc10c pmdomain: imx8mp-blk-ctrl: add missing loop break condition
| * d38c49f7 gpiolib: cdev: Fix use after free in lineinfo_changed_notify
| * 65c367bd fs/proc: fix softlockup in __read_vmcore (part 2)
| * 80fc836f filemap: avoid truncating 64-bit offset to 32 bits
| * b52e50dd vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
| * cc586af3 vsock: reset socket state when de-assigning the transport
| * a3c9390f vsock/virtio: cancel close work in the destructor
| * 88244163 vsock/virtio: discard packets if the transport changes
| * 435349d4 net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
| * 9e1f5094 selftests: mptcp: avoid spurious errors on disconnect
| * 73411e09 mptcp: be sure to send ack when mptcp-level window re-opens
| * fe3de867 zram: fix potential UAF of zram table
| * f9830994 ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
| * 0b30238c x86/asm: Make serialize() always_inline
| * 3375bdf8 poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
| * 7ca4bd6b iomap: avoid avoid truncating 64-bit offset to 32 bits
| * a5045ca6 ACPI: resource: acpi_dev_irq_override(): Check DMI match last
| * bea2a4cf selftests: tc-testing: reduce rshift value
| * 435df80d scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
| * f937130b cachefiles: Parse the "secctx" immediately
| * d8680dad kheaders: Ignore silly-rename files
| * bb00b119 fs: fix missing declaration of init_files
| * 19021857 hfs: Sanity check the root record
| * 41e4ca8a mac802154: check local interfaces before deleting sdata list
| * cce9254a nvmet: propagate npwg topology
| * 75505de0 i2c: rcar: fix NACK handling when being a target
| * 53336f33 i2c: mux: demux-pinctrl: check initial mux selection, too
| * 4c833c36 Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
| * 79fe53ed hwmon: (tmp513) Fix division of negative numbers
| * 2a1c88f7 drm/v3d: Ensure job pointer is set to NULL after job completion
| * efc92a26 net/mlx5: Clear port select structure when fail to create
| * edb43b46 net/mlx5: Fix RDMA TX steering prio
| * 207c81e2 net: xilinx: axienet: Fix IRQ coalescing packet count overflow
| * c385389a nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
| * efec287c gtp: Destroy device along with udp socket's netns dismantle.
| * c91e6946 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
| * a3fdd5f3 gtp: use exit_batch_rtnl() method
| * 760f415e net: add exit_batch_rtnl() method
| * e5d24a70 pktgen: Avoid out-of-bounds access in get_imix_entries
| * ea9e9903 openvswitch: fix lockup on tx to unregistering netdev with carrier
| * d0a3b3d1 bpf: Fix bpf_sk_select_reuseport() memory leak
| * 07524817 net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
* | 766d61c1 Merge branch 'android14-6.1' into android14-6.1-lts
* | 12fe4482 Merge 6.1.126 into android14-6.1-lts
|\|
| * f4f67728 Linux 6.1.126
| * f6247d3e Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
* | 3ad3cca3 Merge 6.1.125 into android14-6.1-lts
|\|
| * 60ceadf9 Linux 6.1.125
| * 9734fd7a xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
| * d2085719 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
| * 90d4d271 drm: bridge: adv7511: use dev_err_probe in probe function
| * 2d431192 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
| * 18a1cd92 ocfs2: correct return value of ocfs2_local_free_info()
| * ad9ec26a of: address: Preserve the flags portion on 1:1 dma-ranges mapping
| * 007662f7 of: address: Store number of bus flag cells rather than bool
| * 7eb954ec of: address: Remove duplicated functions
| * 30eb1123 of: address: Fix address translation when address-size is greater than 2
| * 46dfdb0f of/address: Add support for 3 address cell bus
| * 57e3220c of: unittest: Add bus address range parsing tests
| * 40153aae arm64: dts: rockchip: add hevc power domain clock to rk3328
| * 2550149f block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
| * 64b0aebe ARM: dts: imxrt1050: Fix clocks for mmc
| * 6b63308c io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
| * 3e871c1d iio: adc: ad7124: Disable all channels at probe time
| * 6c92d6f2 iio: inkern: call iio_device_put() only on mapped devices
| * 25ef52f1 iio: adc: at91: call input_free_device() on allocated iio_dev
| * 26016d08 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
| * 7bc7e9d6 iio: gyro: fxas21002c: Fix missing data update in trigger handler
| * ebe2672b iio: adc: ti-ads8688: fix information leak in triggered buffer
| * 6985ba44 iio: imu: kmx61: fix information leak in triggered buffer
| * 47d245be iio: light: vcnl4035: fix information leak in triggered buffer
| * b0642d9c iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
| * b7849f62 iio: pressure: zpa2326: fix information leak in triggered buffer
| * 82f60f36 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
| * 9981c33a usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
| * dc51b66e usb: fix reference leak in usb_new_device()
| * c6f763b5 USB: core: Disable LPM only for non-suspended ports
| * 39219c26 USB: usblp: return error when setting unsupported protocol
| * 92a185bf usb: dwc3-am62: Disable autosuspend during remove
| * 3d730e87 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
| * d26b9f0b misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
| * 79aef618 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
| * ca47e933 topology: Keep the cpumask unchanged when printing cpumap
| * 20a57256 usb: dwc3: gadget: fix writing NYET threshold
| * 32af3bcc USB: serial: cp210x: add Phoenix Contact UPS Device
| * 65cb57b9 usb-storage: Add max sectors quirk for Nokia 208
| * 78e8abbd staging: iio: ad9832: Correct phase range check
| * 331e6e9f staging: iio: ad9834: Correct phase range check
| * c712fa61 USB: serial: option: add Neoway N723-EA support
| * fb946212 USB: serial: option: add MeiG Smart SRM815
* | afc952d5 Merge 43f4df33 ("bpf: Fix overloading of MEM_UNINIT's meaning") into android14-6.1-lts
|\|
| * 43f4df33 bpf: Fix overloading of MEM_UNINIT's meaning
* | 22d4625e Merge 2a72b2ce ("bpf: Add MEM_WRITE attribute") into android14-6.1-lts
|\|
| * 2a72b2ce bpf: Add MEM_WRITE attribute
* | b3b3e04d Merge 6bc6ee31 ("dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)") into android14-6.1-lts
|\|
| * 6bc6ee31 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
| * e3ce913a drm/amd/display: increase MAX_SURFACES to the value supported by hw
| * abe587a4 ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
| * 88b9cf8f ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
| * c21df31f riscv: Fix sleeping in invalid context in die()
| * d0645e11 thermal: of: fix OF node leak in of_thermal_zone_find()
| * f3d1e406 drm/amd/display: Add check for granularity in dml ceil/floor helpers
| * 44ee8635 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
| * e919197f sctp: sysctl: udp_port: avoid using current->nsproxy
| * 1b67030d sctp: sysctl: auth_enable: avoid using current->nsproxy
| * 4059507e sctp: sysctl: rto_min/max: avoid using current->nsproxy
| * 3cd0659d sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
* | c0e24516 Merge c0dde4a5 ("dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY") into android14-6.1-lts
|/
* c0dde4a5 dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
* 12771050 dm thin: make get_first_thin use rcu-safe list first function
* bb87b494 cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
* 13e41c58 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
* aabe47cf afs: Fix the maximum cell name length
* ee7e40f7 ksmbd: fix a missing return value check bug
* f05f5ab5 drm/mediatek: Add return value check when reading DPCD
* 4e674923 drm/mediatek: Fix mode valid issue for dp
* e0ad4b01 drm/mediatek: Fix YCbCr422 color format issue for DP
* 21c501e6 drm/mediatek: stop selecting foreign drivers
* f0a28087 net/mlx5: Fix variable not being completed when function returns
* a777e06d sched: sch_cake: add bounds checks to host bulk flow fairness counts
* 5552b4fd netfilter: conntrack: clamp maximum hashtable size to INT_MAX
* d470b925 netfilter: nf_tables: imbalance in flowtable binding
* 636d7b95 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
* faa8a33e Bluetooth: hci_sync: Fix not setting Random Address when required
* ecb1356a tls: Fix tls_sw_sendmsg error handling
* 657a87c2 ice: fix incorrect PHY settings for 100 GB/s
* 8a7b73f1 cxgb4: Avoid removal of uninserted tid
* b9582838 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
* 2011749c net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
* 2d230410 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
* c0b0d9ae tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
* 0a5026be net: 802: LLC+SNAP OID:PID lookup on start of skb data
* 4589abf8 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
* f6dce4dc ASoC: mediatek: disable buffer pre-allocation
* 939d239f scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
* d23f2621 exfat: fix the infinite loop in __exfat_free_cluster()
* 31beabd0 exfat: fix the infinite loop in exfat_readdir()
* 43c38c3b dm array: fix cursor index when skipping across block boundaries
* 956a74b2 dm array: fix unreleased btree blocks on closing a faulty array cursor
* e477021d dm array: fix releasing a faulty array block twice in dm_array_cursor_end
* 5af095cb jbd2: flush filesystem device before updating tail sequence
* 62834f5b jbd2: increase IO priority for writing revoke records
* 397383db sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
* b79a0d1e bpf, sockmap: Fix race between element replace and close()
* e4b168c6 ceph: give up on paths longer than PATH_MAX

Change-Id: Ia18514bdd4d67e9850b55a4637d0fbe4a138658f
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
      a624f97c
  23. Feb 21, 2025
  25. Feb 14, 2025
  27. Feb 13, 2025
  29. Feb 10, 2025