Commits · 9c3241c2874afaafabfb77dd8b86619d4a0ed9df · CodeLinaro / la / kernel / msm

Dec 16, 2024

Merge branch 'android12-5.10' into android12-5.10-lts · 9c3241c2

Greg Kroah-Hartman authored 4 months ago


Catch the -lts branch up with some commits that are in android12-5.10.
Changes in here include the following:

* d0d935fb Merge tag 'android12-5.10.230_r00' into android12-5.10
* f1e8560e UPSTREAM: usb: xhci: Implement xhci_handshake_check_state() helper
* 16ec1f44 Revert "UPSTREAM: unicode: Don't special case ignorable code points"
* 5f6a8581 Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
* 420c4810 Revert "UPSTREAM: unicode: Don't special case ignorable code points"
* 122661c6 ANDROID: fix kernelci build break: redefinition of 'kallsyms_on_each_symbol'
* 1530d11f UPSTREAM: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
* 7d7b7d02 UPSTREAM: f2fs: modify f2fs_is_checkpoint_ready logic to allow more data to be written with the CP disable
* 556f793a BACKPORT: f2fs: introduce get_available_block_count() for cleanup
* 7c627b9b ANDROID: ABI: update symbol list for honor
* 5f45a7ef ANDROID: fs: add vendor hook to collect IO statistics
* 35fae484 ANDROID: tools/objtool: Pass CFLAGS to libsubcmd build via EXTRA_CFLAGS
* b6f4fd26 UPSTREAM: HID: core: zero-initialize the report buffer
* b0e9b554 Merge tag 'android12-5.10.228_r00' into android12-5.10
* 7098f838 ANDROID: libsubcmd: Hoist iterator variable declarations in parse_options_subcommand()
* 1fed2de8 ANDROID: mm: Fix SPF-aware fast-mremap
* b396c229 UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
* a8339e7f UPSTREAM: f2fs: support SEEK_DATA and SEEK_HOLE for compression files
* 894861d6 ANDROID: add file for recording allowed ABI breaks
* 2936e6a8 ANDROID: GKI: update symbol list for honor
* e05e6574 ANDROID: Allow vendor modules perform more operations on memleak detect
* 900cb56f UPSTREAM: drm/omap: fix misleading indentation in pixinc()
* ef536a1d UPSTREAM: bitfield: build kunit tests without structleak plugin
* db11e829 BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output
* a204f3aa BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze
* 5a884658 FROMGIT: binder: allow freeze notification for dead nodes
* f357f2a8 FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
* 4e4b2cf3 FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
* 2bd6b2ab BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work()
* df183ec3 FROMGIT: binder: fix OOB in binder_add_freeze_work()
* 8f52d7a1 FROMGIT: binder: fix node UAF in binder_add_freeze_work()
* e733b347 ANDROID: GKI: Update symbols to symbol list
* ee2e0e62 BACKPORT: f2fs: compress: fix to update i_compr_blocks correctly
* de373c69 UPSTREAM: cfg80211: add VHT rate entries for MCS-10 and MCS-11
* b6e11f91 UPSTREAM: USB: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Change-Id: I777eb297a34360d98ccbb9384f0368d17da004aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

9c3241c2

Merge tag 'android12-5.10.230_r00' into android12-5.10 · d0d935fb

Greg Kroah-Hartman authored 4 months ago


This merges up to the 5.10.230 LTS release into the android12-5.10
branch.  Changes included in here are:

* d8d2f8af Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
* 15cc9c0f Revert "spi: fix use-after-free of the add_lock mutex"
*   c7f25f3f Merge 5.10.230 into android12-5.10-lts
|\
| * 711d99f8 Linux 5.10.230
| * 91832699 9p: fix slab cache name creation for real
| * d0249286 mm: krealloc: Fix MTE false alarm in __do_krealloc
| * b17397a0 io_uring: fix possible deadlock in io_register_iowq_max_workers()
| * dd7a728d md/raid10: improve code of mrdev in raid10_sync_request
| * 8ea0b8e3 net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
| * 9db25c2b fs: Fix uninitialized value issue in from_kuid and from_kgid
| * 35b4795a vDPA/ifcvf: Fix pci_read_config_byte() return code handling
| * 7e222d2c powerpc/powernv: Free name on error in opal_event_init()
| * b718f717 sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
| * dc834af6 crypto: marvell/cesa - Disable hash algorithms
| * 4d8f6679 bpf: use kvzmalloc to allocate BPF verifier environment
| * 0bf6971b HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
| * 2bc339b0 9p: Avoid creating multiple slab caches with the same name
| * 2f4bfcc4 net: phy: ti: take into account all possible interrupt sources
| * 16a8ebc8 ALSA: usb-audio: Add endianness annotations
| * eb1bdcb7 vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
| * 414476c4 hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
| * 0d71863c ALSA: usb-audio: Add quirks for Dell WD19 dock
| * 4dc9c1e8 ALSA: usb-audio: Support jack detection on Dell dock
| * 6a7e6dcf ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
| * e068a87c irqchip/gic-v3: Force propagation of the active state with a read-back
| * bb17f421 USB: serial: option: add Quectel RG650V
| * 6d5bd4bc USB: serial: option: add Fibocom FG132 0x0112 composition
| * c5748d95 USB: serial: qcserial: add support for Sierra Wireless EM86xx
| * e567fc8f USB: serial: io_edgeport: fix use after free in debug printk
| * d7692316 usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
| * 6e2848d1 usb: musb: sunxi: Fix accessing an released usb phy
| * 5dd3f5a9 fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
| * faff5bbb media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
| * 54708730 net: do not delay dst_entries_add() in dst_release()
| * 83aa0c99 perf session: Add missing evlist__delete when deleting a session
| * 2297d80a Revert "perf hist: Add missing puts to hist__account_cycles"
| * 82090f94 net: bridge: xmit: make sure we have at least eth header len bytes
| * 11eab327 spi: fix use-after-free of the add_lock mutex
| * c8dce228 spi: Fix deadlock when adding SPI controllers on SPI buses
| * 982a2757 splice: don't generate zero-len segement bvecs
| * bf0b0c6d btrfs: reinitialize delayed ref list after deleting it from the list
| * 8fc5ea92 nfs: Fix KMSAN warning in decode_getfattr_attrs()
| * 485d9232 io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
| * f3366228 io_uring: use kiocb_{start,end}_write() helpers
| * f83a3235 fs: create kiocb_{start,end}_write() helpers
| * 955089c2 io_uring: rename kiocb_end_write() local helper
| * 6f383f65 dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
| * 483b7261 dm cache: fix potential out-of-bounds access on the first resume
| * f136d8d3 dm cache: optimize dirty bit checking with find_next_bit when resizing
| * ee1f7492 dm cache: fix out-of-bounds access to the dirty bitset when resizing
| * 5b975f14 dm cache: correct the number of origin blocks to match the target length
| * 2ac7f253 drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
| * 17f5f180 drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
| * 1829c36f pwm: imx-tpm: Use correct MODULO value for EPWM mode
| * 054931ca media: v4l2-tpg: prevent the risk of a division by zero
| * 5a9bd375 media: pulse8-cec: fix data timestamp at pulse8_setup()
| * 828047c7 media: cx24116: prevent overflows on SNR calculus
| * f54e8e1e media: s5p-jpeg: prevent buffer overflows
| * 3a977b55 ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
| * ac40b9df ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
| * c1eba9f0 scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
| * 8e823ce9 media: adv7604: prevent underflow condition when reporting colorspace
| * e351002b media: dvb_frontend: don't play tricks with underflow values
| * a4a17210 media: dvbdev: prevent the risk of out of memory access
| * ae6fd157 media: stb0899_algo: initialize cfr before using it
| * 63b122f5 Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
| * 30606ea3 net: arc: fix the device for dma_map_single/dma_unmap_single
| * 71d08334 net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
| * d3f517f9 net: phy: ti: implement generic .handle_interrupt() callback
| * f398d0a5 net: phy: export phy_error and phy_trigger_machine
| * 590a4b2d net: hns3: fix kernel crash when uninstalling driver
| * cf6bae33 can: c_can: fix {rx,tx}_errors statistics
| * 40b283ba sctp: properly validate chunk size in sctp_sf_ootb()
| * 22f4e2f8 net: enetc: set MAC address to the VF net_device
| * 1e433258 security/keys: fix slab-out-of-bounds in key_task_permission
| * d7dc68d8 HID: core: zero-initialize the report buffer
| * 7830bfc3 ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
| * 92f5b697 ARM: dts: rockchip: Fix the spi controller on rk3036
| * c34f7b90 ARM: dts: rockchip: drop grf reference from rk3036 hdmi
| * db87a9fb ARM: dts: rockchip: fix rk3036 acodec node
| * 7ddbc813 arm64: dts: imx8mp: correct sdhc ipg clk
| * e38f91b7 arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
| * fbccf964 arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
| * 752c5bfb arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
| * ebb427d5 arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
| * 9d0d15f2 arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
* | 979670a6 ANDROID: GKI: fix up crc symbols for some drm functions.
* | 021786a0 Merge 5.10.229 into android12-5.10-lts
|\|
| * b874a7e6 Linux 5.10.229
| * 7948c22c mac80211: always have ieee80211_sta_restart()
| * 1e5a17dc vt: prevent kernel-infoleak in con_font_get()
| * a508a102 drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
| * 1d0d406b Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"
| * bda1a99a mm: shmem: fix data-race in shmem_getattr()
| * aa0cee46 nilfs2: fix kernel bug due to missing clearing of checked flag
| * bfd1d223 x86/bugs: Use code segment selector for VERW operand
| * 70767689 ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
| * d592b2e9 riscv: Remove duplicated GET_RM
| * 170ad7e7 riscv: Remove unused GENERATING_ASM_OFFSETS
| * 7e6bb344 riscv: Use '%u' to format the output of 'cpu'
| * 1e617230 riscv: efi: Set NX compat flag in PE/COFF header
| * c3457286 riscv: vdso: Prevent the compiler from inserting calls to memset()
| * 35770ca6 mm: avoid leaving partial pfn mappings around in error case
| * 69d4e1ce mm: add remap_pfn_range_notrack
| * c72e0df0 nilfs2: fix potential deadlock with newly created symlinks
| * edc84c1c iio: light: veml6030: fix microlux value calculation
| * 442f786c staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
| * d0231f43 wifi: iwlegacy: Clear stale interrupts before resuming device
| * 4112450d wifi: ath10k: Fix memory leak in management tx
| * c21efba8 wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
| * 1cfc3293 Revert "driver core: Fix uevent_show() vs driver detach race"
| * 796df8d6 xhci: Use pm_runtime_get to prevent RPM on unsupported systems
| * 06578989 xhci: Fix Link TRB DMA in command ring stopped completion event
| * efefde4d usb: phy: Fix API devm_usb_put_phy() can not release the phy
| * 2d4650d2 usbip: tools: Fix detach_port() invalid port error path
| * 603342ab misc: sgi-gru: Don't disable preemption in GRU driver
| * aae9c5b4 NFS: remove revoked delegation from server's delegation list
| * 8395b609 net: amd: mvme147: Fix probe banner message
| * 0cac4a27 firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
| * 422f1b66 kasan: Fix Software Tag-Based KASAN with GCC
| * 8e99d418 compiler-gcc: remove attribute support check for `__no_sanitize_address__`
| * 4336f120 compiler-gcc: be consistent with underscores use for `no_sanitize`
| * e3e608cb netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
| * a27a5c40 net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
| * b88262c9 net: support ip generic csum processing in skb_csum_hwoffload_help
| * 590976f9 bpf: Fix out-of-bounds write in trie_get_next_key()
| * ce691c81 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
| * 9cab53f0 gtp: allow -1 to be specified as file description from userspace
| * e2742758 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
| * 465d3a8e ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
| * 45a62891 wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
| * 66e35e42 wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
| * 02b121be mac80211: Add support to trigger sta disconnect on hardware restart
| * 89e25a2e mac80211: do drv_reconfig_complete() before restarting all
| * 1ac988c6 RDMA/bnxt_re: synchronize the qp-handle table array
| * 8256f616 RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
| * f121dee2 RDMA/cxgb4: Dump vendor specific QP details
| * 935ca968 wifi: brcm80211: BRCM_TRACING should depend on TRACING
| * fd3b3687 wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
| * e38ccb22 mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
| * ffbb1f15 cgroup: Fix potential overflow issue when checking max_depth
| * 5b1e461f selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
| * 8df5cd51 xfrm: validate new SA's prefixlen using SA family when sel.family is unset
| * 4abbba71 arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
| * 03c9c2c2 ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
| * f4b6a649 net: phy: dp83822: Fix reset pin definitions
| * 2fe399bb serial: protect uart_port_dtr_rts() in uart_shutdown() too
| * 066314b0 selinux: improve error checking in sel_write_load()
| * 3eb6aa87 hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
| * 631330f5 ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
| * 76ce386f KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
| * 0f0374d0 openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
| * 9f2ab983 nilfs2: fix kernel bug due to missing clearing of buffer delay flag
| * 1f440403 ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
| * 59a1b38d ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
| * 23468291 drm/amd: Guard against bad data for ATIF ACPI method
| * c9085e24 ALSA: hda/realtek: Update default depop procedure
| * 5e431f85 ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
| * c7fcfdba posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
| * 0da93d67 r8169: avoid unsolicited interrupts
| * 8a283a19 net: sched: fix use-after-free in taprio_change()
| * 95b3f3ed net: usb: usbnet: fix name regression
| * 77bc881d be2net: fix potential memory leak in be_xmit()
| * db755e55 net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
* | 9e7d6535 Merge 9f95de15 ("xfrm: respect ip protocols rules criteria when performing dst lookups") into android12-5.10-lts
|/
* 9f95de15 xfrm: respect ip protocols rules criteria when performing dst lookups
* 6ba07c4a xfrm: extract dst lookup parameters into a struct

Change-Id: I229e0a994eb790287beed88465d6e06e4380d534
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

d0d935fb

Dec 12, 2024

UPSTREAM: usb: xhci: Implement xhci_handshake_check_state() helper · f1e8560e

Udipto Goswami authored 1 year ago


In some situations where xhci removal happens parallel to xhci_handshake,
we encounter a scenario where the xhci_handshake can't succeed, and it
polls until timeout.

If xhci_handshake runs until timeout it can on some platforms result in
a long wait which might lead to a watchdog timeout.

Add a helper that checks xhci status during the handshake, and exits if
set state is entered. Use this helper in places where xhci_handshake is
called unlocked and has a long timeout. For example  xhci command timeout
and xhci reset.

[commit message and code comment rewording -Mathias]

Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20231019102924.2797346-18-mathias.nyman@linux.intel.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 383443034
Change-Id: Iec54af32dcf6b07075e3f084dba914fc43635ee6
(cherry picked from commit 6ccb83d6)
Signed-off-by: Faisal Hassan <quic_faisalh@quicinc.com>

f1e8560e

Dec 11, 2024

Revert "UPSTREAM: unicode: Don't special case ignorable code points" · 16ec1f44

Todd Kjos authored 4 months ago


This reverts commit 62bbb08a.

Reason for revert: b/382800956

Bug: 382800956
Change-Id: Ic7a0cdbb060c12c1628a5859d795e78cd6b9341d
Signed-off-by: Todd Kjos <tkjos@google.com>
(cherry picked from commit c3766284)
Signed-off-by: Lee Jones <joneslee@google.com>

16ec1f44

Reapply "UPSTREAM: unicode: Don't special case ignorable code points" · 5f6a8581

Todd Kjos authored 4 months ago


This reverts commit e1ba9002.

Reapplying only to re-revert with the correct Change-Id

Bug: 382800956
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Icdd08040f04ed7e85d31b7f8551ee2ef1d0b95b0

5f6a8581

Revert "UPSTREAM: unicode: Don't special case ignorable code points" · 420c4810

Todd Kjos authored 4 months ago


This reverts commit 51b9e859.

Reason for revert: b/382800956

Change-Id: Ifdfd1b309c801d0ed5801faf3120c26c3f6c0814
Signed-off-by: Todd Kjos <tkjos@google.com>

420c4810

Dec 09, 2024

ANDROID: fix kernelci build break: redefinition of 'kallsyms_on_each_symbol' · 122661c6

Todd Kjos authored 4 months ago


An extra definition of the function 'kallsyms_on_each_symbol' crept in
for the !KALLSYMS case as a result of the revert of the 5.10.220 merge
combined with the subsequent merge of 5.10.226.

kbuild.compiler.error ./include/linux/kallsyms.h:167:19: error: redefinition
of 'kallsyms_on_each_symbol' in arch/x86/kernel/asm-offsets.s (arch/x86/kernel/asm-offsets.c)

Removed obsolete declaration.

Fixes: 88eb084d ("Revert "Merge 5.10.220 into android12-5.10-lts"")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Ieb332a4693aa3f1123e74a719d46fc9e1d083eda

122661c6

UPSTREAM: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans · 1530d11f

Hyunwoo Kim authored 6 months ago


commit 6ca57537 upstream.

During loopback communication, a dangling pointer can be created in
vsk->trans, potentially leading to a Use-After-Free condition.  This
issue is resolved by initializing vsk->trans to NULL.

Bug: 378870958
Cc: stable <stable@kernel.org>
Fixes: 06a8fc78 ("VSOCK: Introduce virtio_vsock_common.ko")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Wongi Lee <qwerty@theori.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Message-Id: <2024102245-strive-crib-c8d3@gregkh>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b110196f)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5eb7b5ccf7f0d96644cc4313548c0114e8836149

1530d11f

Dec 05, 2024

UPSTREAM: f2fs: modify f2fs_is_checkpoint_ready logic to allow more data to be... · 7d7b7d02

Qi Han authored 6 months ago

UPSTREAM: f2fs: modify f2fs_is_checkpoint_ready logic to allow more data to be written with the CP disable

When the free segment is used up during CP disable, many write or
ioctl operations will get ENOSPC error codes, even if there are
still many blocks available. We can reproduce it in the following
steps:

dd if=/dev/zero of=f2fs.img bs=1M count=65
mkfs.f2fs -f f2fs.img
mount f2fs.img f2fs_dir -o checkpoint=disable:10%
cd f2fs_dir
i=1 ; while [[ $i -lt 50 ]] ; do (file_name=./2M_file$i ; dd \
if=/dev/random of=$file_name bs=1M count=2); i=$((i+1)); done
sync
i=1 ; while [[ $i -lt 50 ]] ; do (file_name=./2M_file$i ; truncate \
-s 1K $file_name); i=$((i+1)); done
sync
dd if=/dev/zero of=./file bs=1M count=20

In f2fs_need_SSR() function, it is allowed to use SSR to allocate
blocks when CP is disabled, so in f2fs_is_checkpoint_ready function,
can we judge the number of invalid blocks when free segment is not
enough, and return ENOSPC only if the number of invalid blocks is
also not enough.

Signed-off-by: Qi Han <hanqi@vivo.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 84b5bb8b)
Signed-off-by: Daniel Rosenberg <drosen@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:225caf3bdf7a4977ae50ba9b5c5470a16d480100)
Merged-In: I41ad315f603cd764d0e9b8ef984447e7116b1514
Change-Id: I41ad315f603cd764d0e9b8ef984447e7116b1514

7d7b7d02

BACKPORT: f2fs: introduce get_available_block_count() for cleanup · 556f793a

Chao Yu authored 1 year ago


There are very similar codes in inc_valid_block_count() and
inc_valid_node_count() which is used for available user block
count calculation.

This patch introduces a new helper get_available_block_count()
to include those common codes, and used it to clean up codes.

Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 0f1c6ede)
[Added line for F2FS_IO_ALIGNED, which was removed in later kernels]
Signed-off-by: Daniel Rosenberg <drosen@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:a87d130248adf95c218c461a15f08b983aac74be)
Merged-In: Ie2ce55bdac091bc4880478eeba2a76e1608726e3
Change-Id: Ie2ce55bdac091bc4880478eeba2a76e1608726e3

556f793a

Dec 02, 2024

ANDROID: ABI: update symbol list for honor · 7c627b9b

Rui Chen authored 4 months ago


Update symbol list for honor in android/abi_gki_aarch64_honor

Bug: 380502059
Change-Id: I2b1a67fc7cb827c354894c117f74d35af3a2ce0c
Signed-off-by: Rui Chen <chenrui9@honor.com>

7c627b9b

ANDROID: fs: add vendor hook to collect IO statistics · 5f45a7ef

Rui Chen authored 4 months ago


Add vendor hook to get metainfo of direct/buffered read and write.
Determine hot files in each performance-sensitive user scenario.

Bug: 380502059
Change-Id: Ie7604852df637d6664afd72e87bd6d4b14bbc2a2
Signed-off-by: Rui Chen <chenrui9@honor.com>

5f45a7ef

ANDROID: tools/objtool: Pass CFLAGS to libsubcmd build via EXTRA_CFLAGS · 35fae484

Tao Wu authored 9 months ago

The upstream fix is too invasive to backport so we take a similar
fix like http://aosp/2755768

Bug: 355379840
Change-Id: I50258052fbf0c4f8ace7007427037122b4fd02b0
Link: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=cd955bdd


Signed-off-by: Tao Wu <lepton@google.com>
(cherry picked from commit 42e503e2)

35fae484

UPSTREAM: HID: core: zero-initialize the report buffer · b6f4fd26

Jiri Kosina authored 5 months ago


[ Upstream commit 177f25d1 ]

Since the report buffer is used by all kinds of drivers in various ways, let's
zero-initialize it during allocation to make sure that it can't be ever used
to leak kernel memory via specially-crafted report.

Bug: 380395346
Fixes: 27ce4050 ("HID: fix data access in implement()")
Reported-by: Benoît Sevens <bsevens@google.com>
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 9d9f5c75)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I31f64f2745347137bbc415eb35b7fab5761867f3

b6f4fd26

Nov 29, 2024

Revert "spi: Fix deadlock when adding SPI controllers on SPI buses" · d8d2f8af

Greg Kroah-Hartman authored 4 months ago


This reverts commit c8dce228 which is
commit 6098475d upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I5a575970ce7e3cae46b9b3d9373777fbcc48061e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

d8d2f8af

Revert "spi: fix use-after-free of the add_lock mutex" · 15cc9c0f

Greg Kroah-Hartman authored 4 months ago


This reverts commit 11eab327 which is
commit 6c53b45c upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I12195be6d1212c00e0d1a80aa3feddcb01bb7dbe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

15cc9c0f

Merge 5.10.230 into android12-5.10-lts · c7f25f3f

Greg Kroah-Hartman authored 4 months ago


Changes in 5.10.230
	arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
	arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
	arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
	arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
	arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
	arm64: dts: imx8mp: correct sdhc ipg clk
	ARM: dts: rockchip: fix rk3036 acodec node
	ARM: dts: rockchip: drop grf reference from rk3036 hdmi
	ARM: dts: rockchip: Fix the spi controller on rk3036
	ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
	HID: core: zero-initialize the report buffer
	security/keys: fix slab-out-of-bounds in key_task_permission
	net: enetc: set MAC address to the VF net_device
	sctp: properly validate chunk size in sctp_sf_ootb()
	can: c_can: fix {rx,tx}_errors statistics
	net: hns3: fix kernel crash when uninstalling driver
	net: phy: export phy_error and phy_trigger_machine
	net: phy: ti: implement generic .handle_interrupt() callback
	net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
	net: arc: fix the device for dma_map_single/dma_unmap_single
	Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown"
	media: stb0899_algo: initialize cfr before using it
	media: dvbdev: prevent the risk of out of memory access
	media: dvb_frontend: don't play tricks with underflow values
	media: adv7604: prevent underflow condition when reporting colorspace
	scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer
	ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
	ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
	media: s5p-jpeg: prevent buffer overflows
	media: cx24116: prevent overflows on SNR calculus
	media: pulse8-cec: fix data timestamp at pulse8_setup()
	media: v4l2-tpg: prevent the risk of a division by zero
	pwm: imx-tpm: Use correct MODULO value for EPWM mode
	drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
	drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
	dm cache: correct the number of origin blocks to match the target length
	dm cache: fix out-of-bounds access to the dirty bitset when resizing
	dm cache: optimize dirty bit checking with find_next_bit when resizing
	dm cache: fix potential out-of-bounds access on the first resume
	dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
	io_uring: rename kiocb_end_write() local helper
	fs: create kiocb_{start,end}_write() helpers
	io_uring: use kiocb_{start,end}_write() helpers
	io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
	nfs: Fix KMSAN warning in decode_getfattr_attrs()
	btrfs: reinitialize delayed ref list after deleting it from the list
	splice: don't generate zero-len segement bvecs
	spi: Fix deadlock when adding SPI controllers on SPI buses
	spi: fix use-after-free of the add_lock mutex
	net: bridge: xmit: make sure we have at least eth header len bytes
	Revert "perf hist: Add missing puts to hist__account_cycles"
	perf session: Add missing evlist__delete when deleting a session
	net: do not delay dst_entries_add() in dst_release()
	media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
	fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
	usb: musb: sunxi: Fix accessing an released usb phy
	usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
	USB: serial: io_edgeport: fix use after free in debug printk
	USB: serial: qcserial: add support for Sierra Wireless EM86xx
	USB: serial: option: add Fibocom FG132 0x0112 composition
	USB: serial: option: add Quectel RG650V
	irqchip/gic-v3: Force propagation of the active state with a read-back
	ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
	ALSA: usb-audio: Support jack detection on Dell dock
	ALSA: usb-audio: Add quirks for Dell WD19 dock
	hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
	vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
	ALSA: usb-audio: Add endianness annotations
	net: phy: ti: take into account all possible interrupt sources
	9p: Avoid creating multiple slab caches with the same name
	HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
	bpf: use kvzmalloc to allocate BPF verifier environment
	crypto: marvell/cesa - Disable hash algorithms
	sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
	powerpc/powernv: Free name on error in opal_event_init()
	vDPA/ifcvf: Fix pci_read_config_byte() return code handling
	fs: Fix uninitialized value issue in from_kuid and from_kgid
	net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
	md/raid10: improve code of mrdev in raid10_sync_request
	io_uring: fix possible deadlock in io_register_iowq_max_workers()
	mm: krealloc: Fix MTE false alarm in __do_krealloc
	9p: fix slab cache name creation for real
	Linux 5.10.230

Change-Id: Iab7f4e856cdd3f5214caff5ddd16db3fc8e75a3e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

c7f25f3f

ANDROID: GKI: fix up crc symbols for some drm functions. · 979670a6

Greg Kroah-Hartman authored 4 months ago

In commit a508a102 ("drm/shmem-helper: Fix BUG_ON() on
mmap(PROT_WRITE, MAP_PRIVATE)"), a new .h file is included which ends up
messing with the crc for some drm functions. Properly exclude this from
the crc calculations so that all is preserved

Fixes: a508a102 ("drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)")
Change-Id: I2e822dce8a1f7af1bb1425533fddc5d414d3a1e7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

979670a6

Nov 28, 2024

Merge 5.10.229 into android12-5.10-lts · 021786a0

Greg Kroah-Hartman authored 4 months ago


Changes in 5.10.229
	RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
	RDMA/bnxt_re: Add a check for memory allocation
	ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
	RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
	ipv4: give an IPv4 dev to blackhole_netdev
	RDMA/bnxt_re: Return more meaningful error
	RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
	drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
	macsec: don't increment counters for an unrelated SA
	net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
	net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
	net: systemport: fix potential memory leak in bcm_sysport_xmit()
	genetlink: hold RCU in genlmsg_mcast()
	scsi: target: core: Fix null-ptr-deref in target_alloc_device()
	smb: client: fix OOBs when building SMB2_IOCTL request
	usb: typec: altmode should keep reference to parent
	s390: Initialize psw mask in perf_arch_fetch_caller_regs()
	Bluetooth: bnep: fix wild-memory-access in proto_unregister
	arm64:uprobe fix the uprobe SWBP_INSN in big-endian
	arm64: probes: Fix uprobes for big-endian kernels
	KVM: s390: gaccess: Refactor gpa and length calculation
	KVM: s390: gaccess: Refactor access address range check
	KVM: s390: gaccess: Cleanup access to guest pages
	KVM: s390: gaccess: Check if guest address is in memslot
	block, bfq: fix procress reference leakage for bfqq in merge chain
	exec: don't WARN for racy path_noexec check
	iomap: update ki_pos a little later in iomap_dio_complete
	drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
	ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
	arm64: Force position-independent veneers
	jfs: Fix sanity check in dbMount
	tracing: Consider the NULL character when validating the event length
	xfrm: extract dst lookup parameters into a struct
	xfrm: respect ip protocols rules criteria when performing dst lookups
	net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
	be2net: fix potential memory leak in be_xmit()
	net: usb: usbnet: fix name regression
	net: sched: fix use-after-free in taprio_change()
	r8169: avoid unsolicited interrupts
	posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
	ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
	ALSA: hda/realtek: Update default depop procedure
	drm/amd: Guard against bad data for ATIF ACPI method
	ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
	ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
	nilfs2: fix kernel bug due to missing clearing of buffer delay flag
	openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)
	KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
	ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
	hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
	selinux: improve error checking in sel_write_load()
	serial: protect uart_port_dtr_rts() in uart_shutdown() too
	net: phy: dp83822: Fix reset pin definitions
	ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
	arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
	xfrm: validate new SA's prefixlen using SA family when sel.family is unset
	selftests/mm: fix incorrect buffer->mirror size in hmm2 double_map test
	cgroup: Fix potential overflow issue when checking max_depth
	mac80211: MAC80211_MESSAGE_TRACING should depend on TRACING
	wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
	wifi: brcm80211: BRCM_TRACING should depend on TRACING
	RDMA/cxgb4: Dump vendor specific QP details
	RDMA/mlx5: Round max_rd_atomic/max_dest_rd_atomic up instead of down
	RDMA/bnxt_re: synchronize the qp-handle table array
	mac80211: do drv_reconfig_complete() before restarting all
	mac80211: Add support to trigger sta disconnect on hardware restart
	wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
	wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
	ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
	ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()
	gtp: allow -1 to be specified as file description from userspace
	net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
	bpf: Fix out-of-bounds write in trie_get_next_key()
	net: support ip generic csum processing in skb_csum_hwoffload_help
	net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
	netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
	compiler-gcc: be consistent with underscores use for `no_sanitize`
	compiler-gcc: remove attribute support check for `__no_sanitize_address__`
	kasan: Fix Software Tag-Based KASAN with GCC
	firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
	net: amd: mvme147: Fix probe banner message
	NFS: remove revoked delegation from server's delegation list
	misc: sgi-gru: Don't disable preemption in GRU driver
	usbip: tools: Fix detach_port() invalid port error path
	usb: phy: Fix API devm_usb_put_phy() can not release the phy
	xhci: Fix Link TRB DMA in command ring stopped completion event
	xhci: Use pm_runtime_get to prevent RPM on unsupported systems
	Revert "driver core: Fix uevent_show() vs driver detach race"
	wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
	wifi: ath10k: Fix memory leak in management tx
	wifi: iwlegacy: Clear stale interrupts before resuming device
	staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
	iio: light: veml6030: fix microlux value calculation
	nilfs2: fix potential deadlock with newly created symlinks
	mm: add remap_pfn_range_notrack
	mm: avoid leaving partial pfn mappings around in error case
	riscv: vdso: Prevent the compiler from inserting calls to memset()
	riscv: efi: Set NX compat flag in PE/COFF header
	riscv: Use '%u' to format the output of 'cpu'
	riscv: Remove unused GENERATING_ASM_OFFSETS
	riscv: Remove duplicated GET_RM
	ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
	x86/bugs: Use code segment selector for VERW operand
	nilfs2: fix kernel bug due to missing clearing of checked flag
	mm: shmem: fix data-race in shmem_getattr()
	Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"
	drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
	vt: prevent kernel-infoleak in con_font_get()
	mac80211: always have ieee80211_sta_restart()
	Linux 5.10.229

Change-Id: I20fc6363b9e4a7f26d878c68e99ae917ecada19a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

021786a0

Merge tag 'android12-5.10.228_r00' into android12-5.10 · b0e9b554

Greg Kroah-Hartman authored 4 months ago


This merges up to the 5.10.228 LTS release into the android12-5.10
branch.  Changes included in here are:

* 38dc270ca093 Revert "genetlink: hold RCU in genlmsg_mcast()"
*   c515597aecb7 Merge 02874ca52df2 ("tracing: Consider the NULL character when validating the event length") into android12-5.10-lts
|\
| * 02874ca52df2 tracing: Consider the NULL character when validating the event length
| * df848523d6b4 jfs: Fix sanity check in dbMount
| * 8605ca4bd0f4 arm64: Force position-independent veneers
| * 0329056e0730 ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit
| * 75f828e944da drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
| * 649d64650623 iomap: update ki_pos a little later in iomap_dio_complete
| * c9b77438077d exec: don't WARN for racy path_noexec check
| * 20e27c773945 block, bfq: fix procress reference leakage for bfqq in merge chain
| * bf83ba3c55d4 KVM: s390: gaccess: Check if guest address is in memslot
| * 6e1659b674b6 KVM: s390: gaccess: Cleanup access to guest pages
| * 472088ffb1cc KVM: s390: gaccess: Refactor access address range check
| * 511ca935092a KVM: s390: gaccess: Refactor gpa and length calculation
| * cf9ddf9ed94c arm64: probes: Fix uprobes for big-endian kernels
| * 7f1ef59185d2 arm64:uprobe fix the uprobe SWBP_INSN in big-endian
| * 6c151aeb6dc4 Bluetooth: bnep: fix wild-memory-access in proto_unregister
| * 5c345c47e884 s390: Initialize psw mask in perf_arch_fetch_caller_regs()
| * 6af43ec3bf40 usb: typec: altmode should keep reference to parent
| * ed31aba8ce93 smb: client: fix OOBs when building SMB2_IOCTL request
| * 8c1e6717f60d scsi: target: core: Fix null-ptr-deref in target_alloc_device()
| * 4af714e82379 genetlink: hold RCU in genlmsg_mcast()
| * b6321146773d net: systemport: fix potential memory leak in bcm_sysport_xmit()
| * f48eaf4e88c3 net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid
| * aacf6e28aeda net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
| * 56dbb74b6a4b macsec: don't increment counters for an unrelated SA
| * 2c7dd3ca6be9 drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
| * df6fed0a2a1a RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
| * 78aaf54ad5d7 RDMA/bnxt_re: Return more meaningful error
| * 718609f51866 ipv4: give an IPv4 dev to blackhole_netdev
| * 59df170bdec9 RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
| * 9076d449e77b ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
| * dbe51dd516e6 RDMA/bnxt_re: Add a check for memory allocation
| * c17e5cbbb180 RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
* | 012423e6bd9b Merge 5.10.228 into android12-5.10-lts
|\|
| * 5a8fa04b2a4d Linux 5.10.228
| * 2abe57d62a45 ALSA: hda/conexant - Use cached pin control for Node 0x1d on HP EliteOne 1000 G2
| * 25e86fb0aeec powerpc/mm: Always update max/min_low_pfn in mem_topology_setup()
| * c1d0476885d7 nilfs2: propagate directory read errors from nilfs_find_entry()
| * c38add9ac0e4 tcp: fix mptcp DSS corruption due to large pmtu xmit
| * fde99e972b8f mptcp: handle consistently DSS corruption
| * 609937aa962a mptcp: track and update contiguous data status
| * b7d7b7fc876f irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
| * 6f44a5fc15b5 x86/entry_32: Clear CPU buffers after register restore in NMI return
| * 9ab38a1cdb66 x86/entry_32: Do not clobber user EFLAGS.ZF
| * 846280578855 x86/apic: Always explicitly disarm TSC-deadline timer
| * e475220d64be x86/resctrl: Annotate get_mem_config() functions as __init
| * 1826b6d69bbb parport: Proper fix for array out-of-bounds access
| * 9f8ddf14fa79 USB: serial: option: add Telit FN920C04 MBIM compositions
| * 0fc55ec9fcac USB: serial: option: add support for Quectel EG916Q-GL
| * 608b626f710d xhci: Fix incorrect stream context type macro
| * fc2cb5e3af53 Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
| * 63d6a3b07838 Bluetooth: Remove debugfs directory on module init failure
| * 516655749a01 iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * f80375f275fb iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * dc99dfa2ba66 iio: light: opt3001: add missing full-scale range value
| * bf3ab8e1c28f iio: light: veml6030: fix IIO device retrieval from embedded device
| * 2d06787b70d8 iio: light: veml6030: fix ALS sensor resolution
| * ffc4174309a9 iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()
| * 9504153a480f iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * c27133637aba iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
| * c4c2211b1202 iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
| * 3abc1ebea3fb iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
| * 0782809c019b drm/vmwgfx: Handle surface check failure correctly
| * df75c78bfeff drm/radeon: Fix encoder->possible_clones
| * 6ddcaee244ff io_uring/sqpoll: close race on waiting for sqring entries
| * 3bc6d0f8b70a blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
| * eca3edf87679 x86/bugs: Do not use UNTRAIN_RET with IBPB on entry
| * e7c0f8ca3bdd x86/bugs: Skip RSB fill at VMEXIT
| * 0ab77a47e3ff x86/entry: Have entry_ibpb() invalidate return predictions
| * c5e57863d790 x86/cpufeatures: Add a IBPB_NO_RET BUG flag
| * 77fa26062032 x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
| * dfa4b5d4ba1c KVM: s390: Change virtual to physical address access in diag 0x258 handler
| * d04709509594 s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
| * b12ef2d4dfee io_uring/sqpoll: do not put cpumask on stack
| * 66b98c4f18b0 io_uring/sqpoll: retain test for whether the CPU is valid
| * 54a987b41db3 io_uring/sqpoll: do not allow pinning outside of cpuset
| * 71fbc3af3dac KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
| * e8e599a63506 wifi: mac80211: fix potential key use-after-free
| * 417d5838ca73 mm/swapfile: skip HugeTLB pages for unuse_vma
| * 043f05526163 fat: fix uninitialized variable
| * bf1a0222229d irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1
| * cafa5942bd2d net: macb: Avoid 20s boot delay by skipping MDIO bus registration for fixed-link PHY
| * ce43c48cdc4d arm64: probes: Fix simulate_ldr*_literal()
| * 3728b4eb2791 arm64: probes: Remove broken LDR (literal) uprobe support
| * 673a1c5a2998 posix-clock: Fix missing timespec64 check in pc_clock_settime()
| * dbe055567af8 net: enetc: add missing static descriptor and inline keyword
| * 5f47cdeeefd9 ALSA: hda/conexant - Fix audio routing for HP EliteOne 1000 G2
* | af2f7573ea00 Revert "xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup"
* | 705b09104298 Revert "net: Handle l3mdev in ip_tunnel_init_flow"
* | 0ba465371084 Merge 5.10.227 into android12-5.10-lts
|\|
| * eac1c5bfc13c Linux 5.10.227
| * 9350016415b6 net: dsa: microchip: fix build warning
| * 9f76a9d1849d RDMA/hns: Fix uninitialized variable
* | 7ad1ad5a5547 Merge 4911610c7a1f ("ext4: fix warning in ext4_dio_write_end_io()") into android12-5.10-lts
|\|
| * 4911610c7a1f ext4: fix warning in ext4_dio_write_end_io()
* | b585ecc2c985 Merge 05cc42d601e7 ("netfilter: ip6t_rpfilter: Fix regression with VRF interfaces") into android12-5.10-lts
|\|
| * 05cc42d601e7 netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
| * 95f62e5a783d net: vrf: determine the dst using the original ifindex for multicast
| * 3adb1be04f6c net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev
| * ab6c9463b137 net: Handle l3mdev in ip_tunnel_init_flow
| * 0825c5ff246c xfrm: Pass flowi_oif or l3mdev as oif to xfrm_dst_lookup
| * 4bf1bd3ffff6 net: geneve: add missing netlink policy and size for IFLA_GENEVE_INNER_PROTO_INHERIT
| * 73f75d2b5aee nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
| * 548d0102dc5c net: dsa: lan9303: ensure chip reset and wait for READY status
| * 68ad5da6ca63 net: Fix an unsafe loop on the list
| * fcda074c98de hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
| * e7a1d51b3910 usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
| * 1d7fc802a725 usb: xhci: Fix problem with xhci resume from suspend
| * f8dea2fede79 usb: dwc3: core: Stop processing of pending events if controller is halted
* | 9b1caf055036 Merge a7564b160692 ("Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"") into android12-5.10-lts
|\|
| * a7564b160692 Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
| * 8669bca53fe6 HID: plantronics: Workaround for an unexcepted opposite volume key
| * 799a06ca7f6a hwmon: (adm9240) Add missing dependency on REGMAP_I2C
| * ab6bc15e99d7 hwmon: (tmp513) Add missing dependency on REGMAP_I2C
| * 1d5f85f1b7db resource: fix region_intersects() vs add_memory_driver_managed()
| * 36b054324d18 slip: make slhc_remember() more robust against malicious packets
| * 30d91a478d58 ppp: fix ppp_async_encode() illegal access
* | 4098b6910200 Revert "net: Add l3mdev index to flow struct and avoid oif reset for port devices"
* | 5cb5d1575509 Revert "netfilter: rpfilter/fib: Populate flowic_l3mdev field"
* | 6fc602a28ce5 Revert "netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces."
* | 725352903999 Revert "netfilter: fib: check correct rtable in vrf setups"
* | 81d8cb7a3e8a Merge 3502b1a29720 ("netfilter: fib: check correct rtable in vrf setups") into android12-5.10-lts
|\|
| * 3502b1a29720 netfilter: fib: check correct rtable in vrf setups
| * 037145e2a214 netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.
| * d98558fe2699 netfilter: rpfilter/fib: Populate flowic_l3mdev field
| * 740de1987766 net: Add l3mdev index to flow struct and avoid oif reset for port devices
* | ff0e27a0f974 Merge 265bf63e2471 ("sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start") into android12-5.10-lts
|\|
| * 265bf63e2471 sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
| * 23e139f90b25 net: ibm: emac: mal: fix wrong goto
| * adbc3eef43fc net/sched: accept TCA_STAB only for root qdisc
| * d79af3af2f49 igb: Do not bring the device up after non-fatal error
| * c70e05b929b4 gpio: aspeed: Use devm_clk api to manage clock source
| * 36fd66cb5178 gpio: aspeed: Add the flush write to ensure the write complete.
* | ca21e0d3a8d0 Merge 0e91c4b48445 ("net: dsa: b53: fix jumbo frames on 10/100 ports") into android12-5.10-lts
|\|
| * 0e91c4b48445 net: dsa: b53: fix jumbo frames on 10/100 ports
| * a7c9402bbc4a net: dsa: b53: allow lower MTUs on BCM5325/5365
| * 9f3407aa6cba net: dsa: b53: fix max MTU for BCM5325/BCM5365
| * 0109267c1ec4 net: dsa: b53: fix max MTU for 1g switches
| * a625acf221c1 net: dsa: b53: fix jumbo frame mtu check
| * e13ffbf5fdf5 net: phy: bcm84881: Fix some error handling paths
| * ef44274dae9b Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
| * cce8419b8168 netfilter: br_netfilter: fix panic with metadata_dst skb
| * 8a517d184549 tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
| * fe238ddf8576 tcp: fix to allow timestamp undo if no retransmits were sent
* | 6c71f56f4fc9 Merge 21b5af7f0c99 ("net: phy: dp83869: fix memory corruption when enabling fiber") into android12-5.10-lts
|\|
| * 21b5af7f0c99 net: phy: dp83869: fix memory corruption when enabling fiber
| * f892165c564e NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()
| * 64f1b4922b6e SUNRPC: Fix integer overflow in decode_rc_list()
| * 1fc13f6a4166 ice: fix VLAN replay after reset
| * 993ce09fe622 NFSD: Mark filecache "down" if init fails
* | e22e091f950e Merge de5a059e3665 ("RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt") into android12-5.10-lts
|\|
| * de5a059e3665 RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
| * 252f147b1826 fbdev: sisfb: Fix strbuf array overflow
| * f4149eec9601 drm/amd/display: Check null pointer before dereferencing se
| * 56452dbc0a2c driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
| * d8ac7378bc79 tools/iio: Add memory allocation failure check for trigger_name
| * 4ce662fe4be6 virtio_pmem: Check device status before requesting flush
| * 30ea38665dbf usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
| * 4c83143fc65c usb: chipidea: udc: enable suspend interrupt after usb reset
| * b677b94a9193 clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
| * 37c181e389f0 media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
| * b65018968782 ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
| * 63047187a516 PCI: Mark Creative Labs EMU20k2 INTx masking as broken
| * a28703d4d406 i2c: i801: Use a different adapter-name for IDF adapters
| * e4f218455cef PCI: Add ACS quirk for Qualcomm SA8775P
| * f3e0a8b7d4a5 clk: bcm: bcm53573: fix OF node leak in init
| * b10c1ca941c2 PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
| * 713adaf0ecfc RDMA/mad: Improve handling of timed out WRs of mad agent
| * 24318116c485 ktest.pl: Avoid false positives with grub2 skip regex
| * 345d3c0bf2bd s390/cpum_sf: Remove WARN_ON_ONCE statements
| * c2097d5efb19 ext4: nested locking for xattr inode
| * dced2c9d661e s390/mm: Add cond_resched() to cmm_alloc/free_pages()
| * 1cd197813eb8 s390/facility: Disable compile time optimization for decompressor code
| * 029aa36ba332 bpf: Check percpu map value size first
| * 4f4a6d70d78e Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
| * 546fb43a2e4b tracing/kprobes: Fix symbol counting logic by looking at modules as well
| * 90a6a070a80a tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
* | 2a22a03caef8 Merge 2622c805abe7 ("kallsyms: Make module_kallsyms_on_each_symbol generally available") into android12-5.10-lts
|\|
| * 2622c805abe7 kallsyms: Make module_kallsyms_on_each_symbol generally available
| * 2aa861ec7290 kallsyms: Make kallsyms_on_each_symbol generally available
| * 9b82d737d261 virtio_console: fix misc probe bugs
| * f2fd1a9597d6 tracing: Have saved_cmdlines arrays all in one allocation
| * 25b00216206b s390/zcore: release dump save area on restart or power down
| * 0b4dc46f87c3 s390/zcore: no need to check return value of debugfs_create functions
| * 421795b06430 drm/crtc: fix uninitialized variable use even harder
| * a009e88cc976 tracing: Remove precision vsnprintf() check from print event
| * 6063d72b61ca net: ethernet: cortina: Drop TSO support
| * 39fffca57284 unicode: Don't special case ignorable code points
| * 6592347f06e2 vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
| * 2f6da71e9de8 ext4: fix inode tree inconsistency caused by ENOMEM
| * da964de4c181 ACPI: battery: Fix possible crash when unregistering a battery hook
| * 20557232c91a ACPI: battery: Simplify battery hook locking
| * 991e8b0bab66 r8169: add tally counter fields added with RTL8125
| * 238d5c541e7f r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
| * 281edfa1cdef clk: qcom: dispcc-sm8250: use CLK_SET_RATE_PARENT for branch clocks
* | 96a51395263e Merge 570e257621be ("drm/rockchip: vop: clear DMA stop bit on RK3066") into android12-5.10-lts
|\|
| * 570e257621be drm/rockchip: vop: clear DMA stop bit on RK3066
| * 411e2e1d0132 drm/rockchip: support gamma control on RK3399
| * 1aeaa7e8d859 drm/rockchip: define gamma registers for RK3399
| * f561b48d633a uprobes: fix kernel info leak via "[uprobes]" vma
* | 042d3e267644 Merge 24afda0421af ("arm64: errata: Expand speculative SSBS workaround once more") into android12-5.10-lts
|\|
| * 24afda0421af arm64: errata: Expand speculative SSBS workaround once more
| * 9df353ca1301 arm64: cputype: Add Neoverse-N3 definitions
| * c45edd5942cc arm64: Add Cortex-715 CPU part definition
* | ce691439c069 Revert "ext4: properly sync file size update after O_SYNC direct IO"
* | f46870ab3db7 Revert "ext4: dax: fix overflowing extents beyond inode size when partially writing"
* | 5d9c84863f19 Merge f8a7c342326f ("ext4: dax: fix overflowing extents beyond inode size when partially writing") into android12-5.10-lts
|\|
| * f8a7c342326f ext4: dax: fix overflowing extents beyond inode size when partially writing
* | 8fb88ba5de3b Merge dde4c1e1663b ("ext4: properly sync file size update after O_SYNC direct IO") into android12-5.10-lts
|\|
| * dde4c1e1663b ext4: properly sync file size update after O_SYNC direct IO
* | e62d85f9bae3 Merge 6ff56ef7f724 ("i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled") into android12-5.10-lts
|\|
| * 6ff56ef7f724 i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
* | b5e0cda16029 Merge d223126bb0ac ("i2c: xiic: Use devm_clk_get_enabled()") into android12-5.10-lts
|\|
| * d223126bb0ac i2c: xiic: Use devm_clk_get_enabled()
* | ed3c35894306 Merge 9bd3443e34e6 ("i2c: xiic: Simplify with dev_err_probe()") into android12-5.10-lts
|\|
| * 9bd3443e34e6 i2c: xiic: Simplify with dev_err_probe()
* | 93d28c0f5a08 Merge 8b55076b7bd4 ("kconfig: qconf: fix buffer overflow in debug links") into android12-5.10-lts
|\|
| * 8b55076b7bd4 kconfig: qconf: fix buffer overflow in debug links
* | 6e988ae353d2 Merge bfab5fbc12c5 ("drm/sched: Add locking to drm_sched_entity_modify_sched") into android12-5.10-lts
|\|
| * bfab5fbc12c5 drm/sched: Add locking to drm_sched_entity_modify_sched
* | 25d36c65fb7f Merge c54aa7d75055 ("gpio: davinci: fix lazy disable") into android12-5.10-lts
|\|
| * c54aa7d75055 gpio: davinci: fix lazy disable
* | 9fbdcfe7bb97 Merge 70b60c8d9b42 ("btrfs: wait for fixup workers before stopping cleaner kthread during umount") into android12-5.10-lts
|\|
| * 70b60c8d9b42 btrfs: wait for fixup workers before stopping cleaner kthread during umount
* | d476e18cbfa0 Merge d73d48acf36f ("btrfs: fix a NULL pointer dereference when failed to start a new trasacntion") into android12-5.10-lts
|\|
| * d73d48acf36f btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
* | 657f07546b73 Merge 67db431b8520 ("ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]") into android12-5.10-lts
|\|
| * 67db431b8520 ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
* | 17c42250e8b9 Merge 1a819c7f857e ("ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]") into android12-5.10-lts
|\|
| * 1a819c7f857e ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
* | c53240428e16 Revert "clk: qcom: clk-rpmh: Fix overflow in BCM vote"
* | 509ddbb2b8b9 Merge f976d964a64c ("Input: adp5589-keys - fix adp5589_gpio_get_value()") into android12-5.10-lts
|\|
| * f976d964a64c Input: adp5589-keys - fix adp5589_gpio_get_value()
| * bf8363e46fba rtc: at91sam9: fix OF node leak in probe() error path
| * e33fe25b1efe net: stmmac: Fix zero-division error when disabling tc cbs
| * 68e579316cbf tomoyo: fallback to realpath if symlink's pathname does not exist
| * 68c77a70e33c iio: magnetometer: ak8975: Fix reading for ak099xx sensors
| * 1d108095d5e5 clk: qcom: gcc-sm8250: Do not turn off PCIe GDSCs during gdsc_disable()
| * 60b6968341a6 media: venus: fix use after free bug in venus_remove due to race condition
| * 4445bc6e9f2b clk: qcom: clk-rpmh: Fix overflow in BCM vote
| * 3f73da56af91 media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
| * 5443e70fb7fc media: sun4i_csi: Implement link validate for sun4i_csi subdev
| * ed0d5103f9ef clk: rockchip: fix error for unknown clocks
| * f63461af2c1a aoe: fix the potential use-after-free problem in more places
| * 7ae7ada29a6f NFSD: Fix NFSv4's PUTPUBFH operation
| * 0ea4333c679f nfsd: map the EBADMSG to nfserr_io to avoid warning
| * 96cad5da791e nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
| * f692160d3e1e exfat: fix memory leak in exfat_load_bitmap()
| * e01e9ae43e64 riscv: define ILLEGAL_POINTER_VALUE for 64bit
| * 61b84013e560 ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
| * bf605ae98dab ocfs2: fix null-ptr-deref when journal load failed.
| * 3f1ca6ba5452 ocfs2: remove unreasonable unlock in ocfs2_read_blocks
| * 14114d8148db ocfs2: cancel dqi_sync_work before freeing oinfo
| * aac31d654a0a ocfs2: reserve space for inline xattr before attaching reflink tree
| * 8e3bf366368e ocfs2: fix uninit-value in ocfs2_get_block()
| * ff1500fe2649 ocfs2: fix the la space leak when unmounting an ocfs2 volume
| * a54378585624 mm: krealloc: consider spare memory for __GFP_ZERO
| * 7fabacb337f0 jbd2: correctly compare tids with tid_geq function in jbd2_fc_begin_commit
| * 481e8f18a290 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
| * 2bda89735199 drm: omapdrm: Add missing check for alloc_ordered_workqueue
| * 3e8862875f8b of/irq: Support #msi-cells=<0> in of_msi_get_domain
| * a63fdf20cc26 parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
| * ea7dead20420 parisc: Fix 64-bit userspace syscall path
| * 25ec5c873c45 ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
| * 6766937d0327 ext4: update orig_path in ext4_find_extent()
| * b6c29c8f3d7c ext4: fix double brelse() the buffer of the extents path
| * 5e811066c5ab ext4: aovid use-after-free in ext4_ext_insert_extent()
| * 8c26d9e53e5f ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
| * 4286a0418369 ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
| * 7bcdef04d071 ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
| * e52f933598b7 ext4: fix slab-use-after-free in ext4_split_extent_at()
| * 133ff0d78f1b ext4: no need to continue when the number of entries is 1
* | 6a00671aec63 Merge 2c08dfc99fc4 ("ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9") into android12-5.10-lts
|\|
| * 2c08dfc99fc4 ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
| * c36ff6948c00 ALSA: line6: add hw monitor volume control to POD HD500X
| * 64d315aeec57 ALSA: core: add isascii() check to card ID generator
| * b078a7eee12c drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
| * afa999052393 parisc: Fix itlb miss handler for 64-bit programs
| * d6b22a2d5563 perf/core: Fix small negative period being ignored
| * 8ab638bb498a spi: bcm63xx: Fix module autoloading
| * f53c2b55d0e2 firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
| * 2c1effc2255c i2c: xiic: Wait for TX empty to avoid missed TX NAKs
| * 46c72b01397f i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
| * 9b8bc33ad641 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
| * 10dde0c1fb1b selftests/mm: fix charge_reserved_hugetlb.sh test
| * e45803c71fc4 selftests: vDSO: fix vDSO symbols lookup for powerpc64
| * 76242231557f selftests: breakpoints: use remaining time to check if suspend succeed
| * eda94fc74b84 spi: s3c64xx: fix timeout counters in flush_fifo
| * e3b57186f457 spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
| * 53b1999cfd2c ext4: fix i_data_sem unlock order in ext4_ind_migrate()
| * b0cb4561fc42 ext4: avoid use-after-free in ext4_ext_show_leaf()
| * a34416ec269e ext4: ext4_search_dir should return a proper error
| * e82df17e5f32 of/irq: Refer to actual buffer size in of_irq_parse_one()
| * 29f388945770 drm/amd/pm: ensure the fw_info is not null before using it
| * 0a377fcacefd drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
| * aec72bfbc198 scsi: aacraid: Rearrange order of struct aac_srb_unit
| * cf387300b819 drm/printer: Allow NULL data in devcoredump printer
| * f921335123f6 drm/amd/display: Initialize get_bytes_per_element's default to 1
| * 7ab69af56a23 drm/amd/display: Fix index out of bounds in DCN30 color transformation
| * c130a3c09e37 drm/amd/display: Fix index out of bounds in degamma hardware format translation
| * ad89f83343a5 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
| * 0167d570f6a0 drm/amd/display: Check stream before comparing them
| * e2743d0a03b2 platform/x86: touchscreen_dmi: add nanote-next quirk
| * 831e8a816e09 drm/amdgpu: enable gfxoff quirk on HP 705G4
| * e407715e7a8d drm/amdgpu: add raven1 gfxoff quirk
| * 8b1dcf25c26d jfs: Fix uninit-value access of new_ea in ea_buffer
| * 2451e5917c56 jfs: check if leafidx greater than num leaves per dmap tree
| * fd026b6b6758 jfs: Fix uaf in dbFreeBits
| * f9db7bb112c4 jfs: UBSAN: shift-out-of-bounds in dbFindBits
| * 8d54001f8dcc drm/amd/display: Check null pointers before using dc->clk_mgr
| * 49ded709540b ata: sata_sil: Rename sil_blacklist to sil_quirks
* | b48eba851f3a Merge 1ebfa6663807 ("drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream") into android12-5.10-lts
|\|
| * 1ebfa6663807 drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
| * de9e7f687625 iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
| * 5652c448da39 iommu/vt-d: Always reserve a domain ID for identity setup
| * 9e493f002d52 power: reset: brcmstb: Do not go into infinite loop if reset fails
| * d9245b9296fd iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
| * ceff6f5e7173 rcuscale: Provide clear error when async specified without primitives
| * e6897e299f57 fbdev: pxafb: Fix possible use after free in pxafb_task()
| * 79681036a336 x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
| * 98111af33849 ALSA: hdsp: Break infinite MIDI input flush loop
| * 219587bca267 ALSA: asihpi: Fix potential OOB array access
| * e2b200c50230 ALSA: usb-audio: Add logitech Audio profile quirk
| * 35733d1a6057 ALSA: usb-audio: Define macros for quirk table entries
| * 6ee6835f8288 signal: Replace BUG_ON()s
| * aa4e9056dfbc nfp: Use IRQF_NO_AUTOEN flag in request_irq()
| * 1756918f51e9 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
| * 47be40b698b9 proc: add config & param to block forcing mem writes
| * 02c1725eb2ad ACPICA: iasl: handle empty connection_node
| * 95a91802e4ef tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
| * b7cbdd6b1bcd net: atlantic: Avoid warning about potential string truncation
| * a479b653d5e4 ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
| * 669d337aa1f6 ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
| * bf60b4f58796 net: mvpp2: Increase size of queue_name buffer
| * e2b2558971e0 tipc: guard against string buffer overrun
| * cbb67e245dac ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
| * a40e7a2b805e ACPI: EC: Do not release locks during operation region accesses
| * 7cd004102b7d wifi: rtw88: select WANT_DEV_COREDUMP
| * 0f26f2694403 wifi: ath11k: fix array out-of-bound access in SoC stats
| * 1f61d509257d blk_iocost: fix more out of bound shifts
| * 62b8a46ba8bb net: sched: consistently use rcu_replace_pointer() in taprio_change()
* | baa474b07810 Merge 74c63fd016bc ("ACPICA: Fix memory leak if acpi_ps_get_next_field() fails") into android12-5.10-lts
|\|
| * 74c63fd016bc ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
| * 30cd2158f249 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
| * 4440bac6f0ca net: hisilicon: hns_mdio: fix OF node leak in probe()
| * 124554285680 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
| * ac6e862b8deb net: hisilicon: hip04: fix OF node leak in probe()
| * a7f0073fcd12 net/xen-netback: prevent UAF in xenvif_flush_hash()
| * ed418cad8386 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
| * b02eb7c86ff2 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
| * 2171e1d75001 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
| * 000bab8753ae f2fs: Require FMODE_WRITE for atomic write ioctls
| * b820cb910f98 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
| * f7785c449868 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
| * f10d29b108bd ALSA: hda/realtek: Fix the push button function for the ALC257
| * 7c93044298a4 ALSA: mixer_oss: Remove some incorrect kfree_const() usages
| * f13b04cf65a8 Bluetooth: L2CAP: Fix not validating setsockopt user input
| * 4ec4641df57c media: usbtv: Remove useless locks in usbtv_video_free()
| * a73d99643621 i2c: xiic: Try re-initialization on bus busy timeout
| * c9668503e4e1 i2c: xiic: improve error message when transfer fails to start
| * 2d320d9de7d3 i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
| * 148fdc3c7df3 i2c: xiic: Fix RX IRQ busy check
| * 30def367fa20 i2c: xiic: Switch from waitqueue to completion
| * 6da4bbeb16cf i2c: xiic: Fix broken locking on tx_msg
| * dd70c8a89ef9 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
| * 16b66c46b69b ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
| * 566a931a1436 net: add more sanity checks to qdisc_pkt_len_init()
| * ba26060a29d3 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
| * 185df159843d net: ethernet: lantiq_etop: fix memory disclosure
| * c8bb4e2d5fae Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
* | 6f91c0260d2b Merge 531754952f5d ("netfilter: nf_tables: prevent nf_skb_duplicated corruption") into android12-5.10-lts
|\|
| * 531754952f5d netfilter: nf_tables: prevent nf_skb_duplicated corruption
| * 7675fe977be5 net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
| * 181fbbdd46c0 netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
* | 6136b834d621 Merge cdd86fb75f1f ("net/mlx5: Added cond_resched() to crdump collection") into android12-5.10-lts
|\|
| * cdd86fb75f1f net/mlx5: Added cond_resched() to crdump collection
| * ca36d6c1a49b net/mlx5: Fix error path in multi-packet WQE transmit
| * fd7fcd802edb ieee802154: Fix build error
| * f55e003d261b ceph: remove the incorrect Fw reference check when dirtying pages
| * 32ee78823dea mailbox: bcm2835: Fix timeout during suspend mode
| * 3948c73c9295 mailbox: rockchip: fix a typo in module autoloading
| * 6b9a551b836e spi: lpspi: Simplify some error message
| * 767b71f29207 usb: yurex: Fix inconsistent locking bug in yurex_read()
| * 9f1c4edee8c8 i2c: isch: Add missed 'else'
| * 742a1b69c003 i2c: aspeed: Update the stop sw state when the bus recovery occurs
| * 52f7cab29039 mm: only enforce minimum stack gap size if it's sensible
| * 1472dd897fab lockdep: fix deadlock issue between lockdep and rcu
| * 118a0c3e55e3 xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.
| * cc1de44135ca usb: renesas-xhci: Remove renesas_xhci_pci_exit()
| * 0f8e74a061cf pps: add an error check in parport_attach
| * 0e508348148a pps: remove usage of the deprecated ida_simple_xx() API
| * 47a632e5c6a1 USB: misc: yurex: fix race between read and write
| * bf509ca62fea usb: yurex: Replace snprintf() with the safer scnprintf() variant
| * 6ea76e19d6df soc: versatile: realview: fix soc_dev leak during device remove
| * 6b3b25311d3e soc: versatile: realview: fix memory leak during device remove
| * 263d04df0644 PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
| * 6dacc0b667a9 PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
| * 46c4079460f4 padata: use integer wrap around to prevent deadlock on seq_nr overflow
| * 7d0079d64442 nfs: fix memory leak in error path of nfs4_do_reclaim
| * a239ff33c512 fs: Fix file_set_fowner LSM hook inconsistencies
| * 47a68c75052a vfs: fix race between evice_inodes() and find_inode()&iput()
| * 0eecd2ee23af arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity
| * b2cb101b9b72 arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency
| * d41d66534637 hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume
| * 1b2137f6c9bd hwrng: mtk - Use devm_pm_runtime_enable
| * cef1056ee6fc f2fs: avoid potential int overflow in sanity_check_area_boundary()
| * 85c2f7bd573d f2fs: prevent possible int overflow in dir_block_index()
| * 5e3a031dfa5a debugobjects: Fix conditions in fill_pool()
| * dbffe7be554c wifi: rtw88: 8822c: Fix reported RX band width
| * 44f18167492b perf/x86/intel/pt: Fix sampling synchronization
| * f76b69ab9cf0 efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
| * 45a765f4ba4c ACPI: resource: Add another DMI match for the TongFang GMxXGxx
| * 4b081991c436 ACPI: sysfs: validate return type of _STR method
| * 2e20b69b86c8 drbd: Add NULL check for net_conf to prevent dereference in state validation
| * 62720f2daab9 drbd: Fix atomicity violation in drbd_uuid_set_bm()
| * a295fa38dcbb crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure
| * c7148bf45da1 tty: rp2: Fix reset with non forgiving PCIe host bridges
| * c30558e6c5c9 firmware_loader: Block path traversal
| * e89f925093a3 bus: integrator-lm: fix OF node leak in probe()
| * 61c12c72b1ab USB: class: CDC-ACM: fix race between get_serial and set_serial
| * fa83e1df43f1 USB: misc: cypress_cy7c63: check for short transfer
| * 1c5cd41b4b50 USB: appledisplay: close race between probe and completion handler
| * 84f4d44703d9 drm/amd/display: Round calculated vtotal
| * 60aadf84bef0 Input: i8042 - add another board name for TUXEDO Stellaris Gen5 AMD line
| * 13175be789b5 Input: i8042 - add TUXEDO Stellaris 15 Slim Gen6 AMD to i8042 quirk table
| * bf3f1affba62 Input: i8042 - add TUXEDO Stellaris 16 Gen5 AMD to i8042 quirk table
| * cb9897b94608 soc: versatile: integrator: fix OF node leak in probe() error path
| * c55ebcb21656 ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer the error
| * aaaf3cd0a734 Remove *.orig pattern from .gitignore
| * f291dc4cbc65 mptcp: fix sometimes-uninitialized warning
| * 2dbc4b7bac60 selinux,smack: don't bypass permissions check in inode_setsecctx hook
| * 4b81a9f92b36 bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
| * 0e6378dd9bbc Revert "bpf: Eliminate rlimit-based memory accounting for devmap maps"
| * bfe249c15122 Revert "bpf: Fix DEVMAP_HASH overflow check on 32-bit arches"
| * 892620144757 x86/mm: Switch to new Intel CPU model defines
| * 089aece01a10 powercap: RAPL: fix invalid initialization for pl4_supported field
| * ba624f656a8b Input: goodix - use the new soc_intel_is_byt() helper
| * 50460579fe87 drm/amd/display: Fix Synaptics Cascaded Panamera DSC Determination
* | f6317d304f2d Merge e0dbda9f26e2 ("netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS") into android12-5.10-lts
|\|
| * e0dbda9f26e2 netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
* | 0e233e78a88a Merge db9c5f08eea3 ("netfilter: nf_tables: Keep deleted flowtable hooks until after RCU") into android12-5.10-lts
|\|
| * db9c5f08eea3 netfilter: nf_tables: Keep deleted flowtable hooks until after RCU
* | e45c637aa574 Merge 6c36857fe564 ("net: qrtr: Update packets cloning when broadcasting") into android12-5.10-lts
|\|
| * 6c36857fe564 net: qrtr: Update packets cloning when broadcasting
* | 8acb71185146 Merge ec31cf42fc4e ("tcp: check skb is non-NULL in tcp_rto_delta_us()") into android12-5.10-lts
|\|
| * ec31cf42fc4e tcp: check skb is non-NULL in tcp_rto_delta_us()
* | 69acbd579547 Merge 98d14164c0a7 ("net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL") into android12-5.10-lts
|\|
| * 98d14164c0a7 net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL
* | 13cdfa4cd3f6 Merge 338a0582b28e ("net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition") into android12-5.10-lts
|\|
| * 338a0582b28e net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
* | 973b583bb894 Merge dcf48ab3ca2c ("netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()") into android12-5.10-lts
|\|
| * dcf48ab3ca2c netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
* | 0407f5e40e91 Merge 1429a9260fed ("Revert "dm: requeue IO if mapping table not yet available"") into android12-5.10-lts
|\|
| * 1429a9260fed Revert "dm: requeue IO if mapping table not yet available"
| * 0c170b1e918b vhost_vdpa: assign irq bypass producer token correctly
| * 10348fb6feae vdpa: Add eventfd for the vdpa callback
| * 64add9aaf78a interconnect: qcom: sm8250: Enable sync_state
| * d4951dd16e9f coresight: tmc: sg: Do not leak sg_table
| * cf0674248ddb iio: adc: ad7606: fix standby gpio state to match the documentation
| * 1ea56cd9a651 iio: adc: ad7606: fix oversampling gpio array
| * b7413dbc6341 spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
| * 0ed35dd547ec spi: lpspi: release requested DMA channels
| * d612d419a579 spi: lpspi: Silence error message upon deferred probe
| * 6f2eeba7c3e4 f2fs: reduce expensive checkpoint trigger frequency
| * 3dc483f0e6d0 f2fs: remove unneeded check condition in __f2fs_setxattr()
| * 87aceb1ce66a f2fs: fix to update i_ctime in __f2fs_setxattr()
| * db930da94792 f2fs: fix typo
| * 7b5476f06154 f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
| * 0f1d007bbea3 nfsd: return -EINVAL when namelen is 0
| * 9f03f0016ff7 nfsd: call cache_put if xdr_reserve_space returns NULL
| * 40d578735499 ntb_perf: Fix printk format
| * ef7e34237e26 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
| * dd598ac57dca RDMA/cxgb4: Added NULL check for lookup_atid
| * 502dac909ee9 riscv: Fix fp alignment bug in perf_callchain_user()
| * 322911a2e666 RDMA/hns: Optimize hem allocation performance
| * 07f0f643d7e5 RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
| * 1e6195dc7aca RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()
| * 6258c4fb8d33 RDMA/hns: Refactor root BT allocation for MTR
| * d06fbe0b8703 RDMA/hns: Add mapped page count checking for MTR
| * 2a2894e90cec watchdog: imx_sc_wdt: Don't disable WDT in suspend
| * 5353f8ec59f7 pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
| * d8c75b8a91fd pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
| * 600735914369 nfsd: fix refcount leak when file is unhashed after being found
| * 6fcb4bbbecb4 nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire
* | da5751e56b2a Revert "device property: Add const qualifier to device_get_match_data() parameter"
* | 47d930c2c7d5 Revert "i2c: Add i2c_get_match_data()"
* | a99e4337ab83 Revert "hwmon: (max16065) Remove use of i2c_match_id()"
* | 9c428fa32825 Revert "hwmon: (max16065) Fix alarm attributes"
* | 246d613c2035 Revert "cgroup: Make operations on the cgroup root_list RCU safe"
* | 77867ef6d4d7 Revert "cgroup: Move rcu_head up near the top of cgroup_root"
* | 8cf71990eabf Revert "inet: inet_defrag: prevent sk release while still in use"
* | 3ce453209973 Revert "bareudp: Pull inner IP header in bareudp_udp_encap_recv()."
* | 9e57ad4546fc Merge 0ce9d89343c2 ("clk: ti: dra7-atl: Fix leak of of_nodes") into android12-5.10-lts
|\|
| * 0ce9d89343c2 clk: ti: dra7-atl: Fix leak of of_nodes
| * 88ba7cd9f482 pinctrl: single: fix missing error code in pcs_probe()
| * 2efe8da2ddbf RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
| * f29951897a30 PCI: xilinx-nwl: Fix register misspelling
| * c289903b7a21 PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
| * badbd736e664 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
| * 6ae3b9aee426 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
| * 45f826f6c827 clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
| * ca34aa37820a clk: imx: imx8mp: fix clock tree update of TF-A managed clocks
| * 11396ba4f820 perf time-utils: Fix 32-bit nsec parsing
| * a10a7d6d171b perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
| * 727660723ea7 perf sched timehist: Fix missing free of session in perf_sched__timehist()
| * ea837ae511aa bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
| * d20674f31626 nilfs2: fix potential oob read in nilfs_btree_check_delete()
| * e2290906bb24 nilfs2: determine empty node blocks as corrupted
| * 24bf40740a3d nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
| * 7fc22c3b3ffc ext4: avoid OOB when system.data xattr changes underneath the filesystem
| * e65f698736b0 ext4: return error on ext4_find_inline_entry
| * 2e073a579f71 ext4: avoid negative min_clusters in find_group_orlov()
| * 22d591d916b4 ext4: avoid potential buffer_head leak in __ext4_new_inode()
| * 08c63b79624c ext4: avoid buffer_head leak in ext4_mark_inode_used()
| * c4227a38ab88 smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
| * 4766ba108b83 ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
| * 3a1a31a38fcc kthread: fix task state in kthread worker if being frozen
| * 28fbbd0ce7ab kthread: add kthread_work tracepoints
| * dd417529c063 xz: cleanup CRC32 edits from 2018
| * 4e1c8c12cac1 selftests/bpf: Fix C++ compile error from missing _Bool type
| * 9374068b3690 selftests/bpf: Fix error compiling test_lru_map.c
| * c2db6acd8cc3 selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc
| * 3467a9412610 selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
| * 5ad69f5a0458 selftests/bpf: Fix compiling flow_dissector.c with musl-libc
| * 306efef84bbf selftests/bpf: Fix compiling kfree_skb.c with musl-libc
| * cc52d5282a14 selftests/bpf: Fix missing ARRAY_SIZE() definition in bench.c
| * 04eb60af431d selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
| * 2c9b228938e9 tpm: Clean up TPM space after command failure
| * a0a8b7bebe1b xen/swiotlb: add alignment check for dma buffers
| * cb9134aa0998 xen: use correct end address of kernel for conflict checking
| * 86da3c79b889 drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
| * 02657ced604d drm/msm: fix %s null argument error
| * 72fa5f700e76 ipmi: docs: don't advertise deprecated sysfs entries
| * e9e482e1e5da drm/msm/a5xx: workaround early ring-buffer emptiness check
| * d041301f304c drm/msm: Drop priv->lastctx
| * 9dffbbd7b84f drm/msm: Add priv->mm_lock to protect active/inactive lists
| * 5ce4075ddea0 drm/msm/a5xx: fix races in preemption evaluation stage
| * cfca8b26a9f5 drm/msm/a5xx: properly clear preemption records on resume
| * fe93cd663518 drm/msm/a5xx: disable preemption in submits by default
| * 14531e3b82ce drm/msm: Fix incorrect file name output in adreno_request_fw()
| * 0338e66cba27 jfs: fix out-of-bounds in dbNextAG() and diAlloc()
| * 36820265a009 drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
| * 6b38aedfdcd9 drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
| * 5f37e8c41526 drm/rockchip: vop: Allow 4096px width scaling
| * e37fead06a45 drm/radeon: properly handle vbios fake edid sizing
| * af2fb608e95f drm/radeon: Replace one-element array with flexible-array member
| * 5f943045ecd0 drm/amdgpu: properly handle vbios fake edid sizing
| * cd8810561601 drm/amdgpu: Replace one-element array with flexible-array member
| * 65f9be03482a drm/stm: Fix an error handling path in stm_drm_platform_probe()
| * 278ec2595281 mtd: powernv: Add check devm_kasprintf() returned value
| * 7661e90a60fb fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
| * 9fb482fdf3a9 power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
| * 5c1997f7ad4e power: supply: axp20x_battery: Remove design from min and max voltage
| * c59f57f3f1bd power: supply: axp20x_battery: allow disabling battery charging
| * 8202306e9fc1 hwmon: (ntc_thermistor) fix module autoloading
| * 9efa58381ae1 mtd: slram: insert break after errors in parsing the map
| * d7a7dd2966d5 hwmon: (max16065) Fix alarm attributes
| * 932559f25a7c hwmon: (max16065) Remove use of i2c_match_id()
| * 514a1508c3fe i2c: Add i2c_get_match_data()
| * 167e4371ef92 device property: Add const qualifier to device_get_match_data() parameter
| * aeed49dd2b89 hwmon: (max16065) Fix overflows seen when writing limits
| * cdb20b703e0e m68k: Fix kernel_clone_args.flags in m68k_clone()
| * 42a9899e56de clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
| * 97586fbd6998 reset: berlin: fix OF node leak in probe() error path
| * ad0b53e4b5d0 ARM: versatile: fix OF node leak in CPUs prepare
| * 06ceed8eff02 ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
| * fb3cd974fb82 ARM: dts: microchip: sam9x60: Fix rtc/rtt clocks
| * 5f19060ab0ac spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
| * 63c7417ad463 spi: ppc4xx: handle irq_of_parse_and_map() errors
| * 4bc4272e2506 block: fix potential invalid pointer dereference in blk_add_partition
| * 4d2760df0f3d block: print symbolic error name instead of error code
| * 3630a18846c7 block, bfq: don't break merge chain in bfq_split_bfqq()
| * a819a496d2f2 block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
| * e1277ae780cc block, bfq: fix possible UAF for bfqq->bic with merge chain
| * cab9ff7fe83f net: tipc: avoid possible garbage value
| * 207503742caf net: ipv6: rpl_iptunnel: Fix memory leak in rpl_input
| * 3df68f37c567 r8169: disable ALDPS per default for RTL8125
| * 5755eabda22c net: enetc: Use IRQF_NO_AUTOEN flag in request_irq()
| * e296245ca85a bareudp: Pull inner IP header on xmit.
| * b48fae6788b3 geneve: Fix incorrect inner network header offset when innerprotoinherit is set
| * 3b84799ea26e net: geneve: support IPv4/IPv6 as inner protocol
| * 76851c70a5cf bareudp: Pull inner IP header in bareudp_udp_encap_recv().
| * cb1f7ef1f415 bareudp: allow redirecting bareudp packets to eth devices
| * 2accdb38c1c1 Bluetooth: btusb: Fix not handling ZPL/short-transfer
| * 3703e18a910f can: m_can: m_can_close(): stop clocks after device has been shut down
| * b6dce5b5a823 can: m_can: Add support for transceiver as phy
| * 5cc00913c1fd can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
| * 1a11a1a53255 sock_map: Add a cond_resched() in sock_hash_free()
| * 557418e17046 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
| * f232916fab67 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
| * 793e01f99666 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
| * f8e0ca304996 wifi: mt76: mt7915: fix rx filter setting for bfee functionality
| * 635ccdcd9840 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
| * 7b0724f7a927 cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately
| * 0723ddb2d161 netfilter: nf_tables: reject expiration higher than timeout
| * 39c1012f5f78 netfilter: nf_tables: reject element expiration with no timeout
| * 1c0c097ded94 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
| * 4bb459040d3d can: j1939: use correct function name in comment
| * b0947eca2a5f padata: Honor the caller's alignment in case of chunk_size 0
| * 60da25076f38 mount: handle OOM on mnt_warn_timestamp_expiry
| * f0a39ba6e05e fs/namespace: fnic: Switch to use %ptTd
| * 396e9c5cbf8f mount: warn only once about timestamp range expiration
| * 9722aa53fa23 fs: explicitly unregister per-superblock BDIs
| * 005dcd6bc4b4 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
| * a0c1e2da652c wifi: rtw88: always wait for both firmware loading attempts
| * 16e0ab9ed3ae USB: usbtmc: prevent kernel-usb-infoleak
| * 50cff34deed4 USB: serial: pl2303: add device id for Macrosilicon MS3020
| * 31292316c5fe usb: dwc3: Fix a typo in field name
| * 4abf1841680f cgroup: Move rcu_head up near the top of cgroup_root
| * 65fd90e354c7 gpiolib: cdev: Ignore reconfiguration without direction
| * 1880a324af1c ftrace: Fix possible use-after-free issue in ftrace_location()
| * e6be2e1ebc77 x86/ibt,ftrace: Search for __fentry__ location
| * 9705f447bf9a inet: inet_defrag: prevent sk release while still in use
| * 0e7814b028cd mptcp: pm: Fix uaf in __timer_delete_sync
| * 6a53e5def7a8 mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
| * a684b45a7770 mptcp: export lookup_anno_list_by_saddr
| * 9d682e89c44b gpio: prevent potential speculation leaks in gpio_device_get_desc()
| * 5badd0ae8b7d netfilter: nf_tables: missing iterator type in lookup walk
| * ff89db14c63a netfilter: nft_set_pipapo: walk over current view on netlink dump
| * 45a81667e0e8 cgroup: Make operations on the cgroup root_list RCU safe
| * 57a3d89831fc ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
| * 34759b7e4493 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
| * d5624db2326c x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
| * bbd11db41be6 spi: bcm63xx: Enable module autoloading
| * 040511d9f282 drm: komeda: Fix an issue related to normalized zpos
| * 3d39061b7b92 ASoC: tda7419: fix module autoloading
| * 9c6d4649f2dc ASoC: intel: fix module autoloading
| * de46b1d24f5f wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
| * db81677f4b6c wifi: iwlwifi: lower message level for FW buffer destination
| * dd34ef88d58c net: ftgmac100: Ensure tx descriptor updates are visible
| * 1a8e85289e29 microblaze: don't treat zero reserved memory regions as error
| * 2e5052143c28 pinctrl: at91: make it work with current gpiolib
| * 9f08d024eda5 ALSA: hda/realtek - FIxed ALC285 headphone no sound
| * fff183aa3c83 ALSA: hda/realtek - Fixed ALC256 headphone no sound
| * 0f4da063a1c6 ASoC: allow module autoloading for table db1200_pids
| * 007180fcb6cc dma-buf: heaps: Fix off-by-one in CMA heap fault handler
| * 5a2cc2bb8139 ASoC: meson: axg-card: fix 'use-after-free'
* | 1f05cd743b4e Merge ae96b02b9deb ("soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"") into android12-5.10-lts
|\|
| * ae96b02b9deb soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
| * 609260542cf8 spi: nxp-fspi: fix the KASAN report out-of-bounds bug
| * 1f31f51bfc82 net: dpaa: Pad packets to ETH_ZLEN
| * f2b13ec20854 net: ftgmac100: Enable TX interrupt to avoid TX timeout
| * 392f6a97fcbe fou: fix initialization of grc
| * b9063702a048 net/mlx5e: Add missing link modes to ptys2ethtool_map
| * 097cc80396b7 net/mlx5: Update the list of the PCI supported devices
| * e7a9cca35ead ice: fix accounting for filters shared by multiple VSIs
| * a38c552abfa9 hwmon: (pmbus) Conditionally clear individual status bits for pmbus rev >= 1.2
| * b9d15b50b279 hwmon: (pmbus) Introduce and use write_byte_data callback
| * e829dbaf7669 minmax: reduce min/max macro expansion in atomisp driver
| * 78078862f0a8 arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
| * 14341f28a3a9 NFS: Avoid unnecessary rescanning of the per-server delegation list
| * 4f0e491644b7 Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
| * 00d54431b0ed drm/msm/adreno: Fix error return if missing firmware-name
| * 44eb665889e3 scripts: kconfig: merge_config: config files: add a trailing newline
| * 9deecde63714 Input: synaptics - enable SMBus for HP Elitebook 840 G2
| * 3f7183e28fa3 Input: ads7846 - ratelimit the spi_sync error message
| * f08589057f32 btrfs: update target inode's ctime on unlink
| * 43662ba6ca86 powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
| * acb4baa4846d net: phy: vitesse: repair vsc73xx autonegotiation
| * 3b9ca0230077 net: ethernet: use ip_hdrlen() instead of bit shift
| * b06bb81ef940 usbnet: ipheth: fix carrier detection in modes 1 and 4
* | 844132795402 Revert "Merge 8a30bee7f534 ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts"
* | 18eef3d55a1d Merge 8a30bee7f534 ("usb: dwc3: core: update LC timer as per USB Spec V3.2") into android12-5.10-lts
|\|
| * 8a30bee7f534 usb: dwc3: core: update LC timer as per USB Spec V3.2
| * 1ac066765826 usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
| * 6b3af2ad53cf usb: dwc3: Decouple USB 2.0 L1 & L2 events
* e477d44e5f3e Merge branch 'android12-5.10' into android12-5.10-lts

Change-Id: I8bacb03dd3c3b30729c5ec54bdd57a03f6ff7fe1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

b0e9b554

Merge ("xfrm: respect ip protocols rules criteria when performing... · 9e7d6535

Greg Kroah-Hartman authored 5 months ago

Merge 9f95de15 ("xfrm: respect ip protocols rules criteria when performing dst lookups") into android12-5.10-lts

Steps on the way to 5.10.229

Merges away the changes here as they need to be reverted due to previous
reverts breaking Android abi definitions.  If needed, these can be
brought back later.

Resolves merge conflicts in:
	net/ipv4/xfrm4_policy.c
	net/ipv6/xfrm6_policy.c

Change-Id: I12bf6a283757094dea1a683aa1159998beea498c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

9e7d6535

Nov 27, 2024

ANDROID: libsubcmd: Hoist iterator variable declarations in parse_options_subcommand() · 7098f838

Nathan Chancellor authored 1 year ago

When applying HOSTCFLAGS to the libsubcmd build to resolve a separate
issue, which contain '-std=gnu89' prior to commit 1e240781 ("Kbuild:
use -std=gnu11 for KBUILD_USERCFLAGS"), the following warning/error
occurs:

  parse-options.c:643:8: error: GCC does not allow variable declarations in for loop initializers before C99 [-Werror,-Wgcc-compat]
                  for (int i = 0; subcommands[i]; i++) {
                       ^
  parse-options.c:669:9: error: GCC does not allow variable declarations in for loop initializers before C99 [-Werror,-Wgcc-compat]
                          for (int i = 0; subcommands[i]; i++)
                               ^

This issue was never visible upstream, as commit 1e240781 ("Kbuild:
use -std=gnu11 for KBUILD_USERCFLAGS") was applied before
commit 13e07691 ("tools/resolve_btfids: Alter how HOSTCC is
forced"). Prior to the latter change, there was no '-std=' flag passed
to the libsubcmd build, so the default standard value was used, which
may be newer than C99.

To resolve this issue to unblock applying HOSTCFLAGS to libsubcmd, just
hoist the declarations out of the for loops.

Bug: 301145081
Link: https://github.com/ClangBuiltLinux/linux/issues/1929


Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Change-Id: I41f17964f3d0822b026f6ae8f06a4d49bc7f15a9
(cherry picked from https://android-review.googlesource.com/q/commit:8f75dab19c30be65c740bd4abf9587714b3305dc)

7098f838

Nov 26, 2024

ANDROID: mm: Fix SPF-aware fast-mremap · 1fed2de8

Kalesh Singh authored 5 months ago


Fast-mremap tries to detect concerrent SPF's by checking if
vma->file_ref_count is 1 and setting it to -1 to prevent concurrent
SPF's from happening after a fast-mremap has started. This check
doesn't account for the cases where the VMA has been split/merged
after the check has happened in the SPF or fast-remap paths; which
can lead to the PMD/PUD level page table being changed from under
a concurrent SPF if certain race conditions are met.

Currently SPF takes the PTL lock at the lowest level of the
page table hierarchy (i.e. the page table page covering a 2MB extent).

Fast mremap at the PMD level only takes the PTL lock for the
page table pages (old and new) containing the PMD entries to be
updated (i.e the page table pages covering 1GB extents)

Remove the vma_ref_count trylock, and disable fast-mremap at the PUD
level if SPF is enabled.

At the PMD level take the pte ptl lock on the source address,
to avoid races with concurrent SPF.

NOTE: The additional lock, means that there are now 2 levels of
      nested spinlocks. However we forego adding a new lockdep
      subclass as Android doesn't enable lockdep in production.

    old_ptl (pmd_lock)
        new_ptl (pmd_lock)
            old_pte_ptl (pte ptl lock)

Bug: 377672115
Change-Id: Ie634806115ce86a05477dfe45806487c856c3759
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>

1fed2de8

UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT · b396c229

Pedro Tammela authored 6 months ago


[ Upstream commit 2e95c438 ]

In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed
to be either root or ingress. This assumption is bogus since it's valid
to create egress qdiscs with major handle ffff:
Budimir Markovic found that for qdiscs like DRR that maintain an active
class list, it will cause a UAF with a dangling class pointer.

In 066a3b5b, the concern was to avoid iterating over the ingress
qdisc since its parent is itself. The proper fix is to stop when parent
TC_H_ROOT is reached because the only way to retrieve ingress is when a
hierarchy which does not contain a ffff: major handle call into
qdisc_lookup with TC_H_MAJ(TC_H_ROOT).

In the scenario where major ffff: is an egress qdisc in any of the tree
levels, the updates will also propagate to TC_H_ROOT, which then the
iteration must stop.

Fixes: 066a3b5b ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Suggested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

 net/sched/sch_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Simon Horman <horms@kernel.org>

Bug: 377197048
Link: https://patch.msgid.link/20241024165547.418570-1-jhs@mojatatu.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 597cf974)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4ef8bee1095f7c51e4d458b25cd331018188b3d6

b396c229

Nov 23, 2024

UPSTREAM: f2fs: support SEEK_DATA and SEEK_HOLE for compression files · a8339e7f

Daeho Jeong authored 1 year ago


Fix to support SEEK_DATA and SEEK_HOLE for compression files

Bug: 325092012
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit a94c7fde)
(cherry picked from https://android-review.googlesource.com/q/commit:268f1fed504a7bc9cfba291fe994ad767eda7a70)
Merged-In: Iba62c53e634682205f84c8dc3566ab8df9079158
Change-Id: Iba62c53e634682205f84c8dc3566ab8df9079158

a8339e7f

Nov 21, 2024

Revert "genetlink: hold RCU in genlmsg_mcast()" · 38dc270c

Greg Kroah-Hartman authored 5 months ago


This reverts commit 4af714e8 which is
commit 56440d7e upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I812d261d139e7f73a135c3445b7733b7611c23e0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

38dc270c

Merge ("tracing: Consider the NULL character when validating the... · c515597a

Greg Kroah-Hartman authored 5 months ago

Merge 02874ca5 ("tracing: Consider the NULL character when validating the event length") into android12-5.10-lts

Steps on the way to 5.10.229

Resolves conflicts in:
	drivers/net/macsec.c

Change-Id: Ibc2583ddd810808fa9ce619e71935aeb5f97805a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

c515597a

ANDROID: add file for recording allowed ABI breaks · 894861d6

Aleksei Vetrov authored 5 months ago


The tooling is configured to block any changes that has a chance to
break ABI, including the possibly safe:

* replacement of ANDROID_KABI_RESERVE with ANDROID_KABI_USE
* changes to internal structures that are not accessible to modules
* addition of enumerators

These changes are difficult for the tooling to identify as definitively
non-breaking, therefore, a human reviewer must check the change and
approve it as non-breaking.

This change adds a file to record the approval with the change that was
marked as breaking. This allows the tooling to:

* unblock presubmits for the change
* don't block presubmits when it is cherry-picked to another branch
* filter compatibility reports between a release branch and a tip of the
  development branch it was forked from

The file is prefilled with all breaks that happened from the KMI freeze.

Bug: 365521273
Change-Id: I63fbed5c364cb8c7bd149bf40d084d3d87533bf7
Signed-off-by: Aleksei Vetrov <vvvvvv@google.com>

894861d6

ANDROID: GKI: update symbol list for honor · 2936e6a8

zhengwei authored 5 months ago


Leaf changes summary: 4 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 4 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

4 Added functions:

  [A] 'function spinlock_t* __pmd_trans_huge_lock(pmd_t*, vm_area_struct*)'
  [A] 'function page* _vm_normal_page(vm_area_struct*, unsigned long int, pte_t, unsigned long int)'
  [A] 'function const char* arch_vma_name(vm_area_struct*)'
  [A] 'function void pmd_clear_bad(pmd_t*)'

Bug: 379962310
Change-Id: Id4e8195820d68b890936ca972b03d864305ae52b
Signed-off-by: zhengwei <zhengwei2@honor.com>

2936e6a8

ANDROID: Allow vendor modules perform more operations on memleak detect · e05e6574

Dezhi Huang authored 11 months ago


Export arch_vma_name, _vm_normal_page, pmd_clear_bad,
__pmd_trans_huge_lock functions. Allow vendor modules perform more
operations on memleak detect and debug. It can detect multiple types
of memleak,such as Native,ION,Slub and Vmalloc. Shows detail size of
memleak, and shows the stack.

Bug: 379962310
Bug: 365506692
Bug: 342305999
Change-Id: I118efa570e660d0696bf081d00b670760d01bec1
Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com>
(cherry picked from commit 21e76b82)
(cherry picked from commit ce0653fd)

e05e6574

UPSTREAM: drm/omap: fix misleading indentation in pixinc() · 900cb56f

Arnd Bergmann authored 4 years ago


An old patch added a 'return' statement after each BUG() in this driver,
which was necessary at the time, but has become redundant after the BUG()
definition was updated to handle this properly.

gcc-11 now warns about one such instance, where the 'return' statement
was incorrectly indented:

drivers/gpu/drm/omapdrm/dss/dispc.c: In function ‘pixinc’:
drivers/gpu/drm/omapdrm/dss/dispc.c:2093:9: error: this ‘else’ clause does not guard... [-Werror=misleading-indentation]
 2093 |         else
      |         ^~~~
drivers/gpu/drm/omapdrm/dss/dispc.c:2095:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘else’
 2095 |                 return 0;
      |                 ^~~~~~

Address this by removing the return again and changing the BUG()
to be unconditional to make this more intuitive.

Fixes: c6eee968 ("OMAPDSS: remove compiler warnings when CONFIG_BUG=n")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210322164203.827324-1-arnd@kernel.org
(cherry picked from commit 417fc612)
Change-Id: Idaa0fbd215f5b71a498a8486bbf533878bede5f1

900cb56f

Nov 20, 2024

UPSTREAM: bitfield: build kunit tests without structleak plugin · ef536a1d

Arnd Bergmann authored 3 years ago


The structleak plugin causes the stack frame size to grow immensely:

lib/bitfield_kunit.c: In function 'test_bitfields_constants':
lib/bitfield_kunit.c:93:1: error: the frame size of 7440 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]

Turn it off in this file.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
(cherry picked from commit a8cf9033)
Change-Id: Iafc6cac194dd798fdc5e12c75373a4df59e48116

ef536a1d

BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output · db11e829

Carlos Llamas authored 6 months ago


Add the pending proc->delivered_freeze work to the debugfs output. This
information was omitted in the original implementation of the freeze
notification and can be valuable for debugging issues.

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-9-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit cb2aeb2e
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: Ifc9a22b52e38c35af661732486fa1f154adb34de
[cmllamas: fix KMI break with proc_wrapper()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>

db11e829

BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze · a204f3aa

Carlos Llamas authored 6 months ago


If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:

  unreferenced object 0xffff38e8cfa36180 (size 64):
    comm "binder-util", pid 655, jiffies 4294936641
    hex dump (first 32 bytes):
      b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff  .....8.......8..
      0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00  ........<.K.....
    backtrace (crc 95983b32):
      [<000000000d0582cf>] kmemleak_alloc+0x34/0x40
      [<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280
      [<00000000313b1704>] binder_thread_write+0xdec/0x439c
      [<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc
      [<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190
      [<00000000b439adee>] invoke_syscall+0x6c/0x254
      [<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230
      [<0000000084f72311>] do_el0_svc+0x40/0x58
      [<000000008b872457>] el0_svc+0x38/0x78
      [<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c
      [<00000000a8ec61bf>] el0t_64_sync+0x190/0x194

This patch fixes the leak by ensuring that any pending entries in
proc->delivered_freeze are freed during binder_deferred_release().

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-8-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 1db76ec2
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: Iafdec3421c521b4b591b94455deba7ee5102c8ca
[cmllamas: drop BINDER_STAT_FREEZE and use proc_wrapper()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>

a204f3aa

FROMGIT: binder: allow freeze notification for dead nodes · 5a884658

Carlos Llamas authored 6 months ago


Alice points out that binder_request_freeze_notification() should not
return EINVAL when the relevant node is dead [1]. The node can die at
any point even if the user input is valid. Instead, allow the request
to be allocated but skip the initial notification for dead nodes. This
avoids propagating unnecessary errors back to userspace.

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/all/CAH5fLghapZJ4PbbkC8V5A6Zay-_sgTzwVpwqk6RWWUNKKyJC_Q@mail.gmail.com/

 [1]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-7-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit ca63c669
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: I03af1eedfeb194f5a775388cbb4e7487e4a5dfc0
Signed-off-by: Carlos Llamas <cmllamas@google.com>

5a884658

FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs · f357f2a8

Carlos Llamas authored 6 months ago


proc 699
context binder-test
  thread 699: l 00 need_return 0 tr 0
  ref 25: desc 1 node 20 s 1 w 0 d 00000000c03e09a3
  unknown work: type 11

proc 640
context binder-test
  thread 640: l 00 need_return 0 tr 0
  ref 8: desc 1 node 3 s 1 w 0 d 000000002bb493e1
  has cleared freeze notification

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-6-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 595ea72e
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: Ic6311aaea2040aaf4534cdaa4cbfa378afe31869
Signed-off-by: Carlos Llamas <cmllamas@google.com>

f357f2a8

FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs · 4e4b2cf3

Carlos Llamas authored 6 months ago


The BINDER_WORK_FROZEN_BINDER type is not handled in the binder_logs
entries and it shows up as "unknown work" when logged:

  proc 649
  context binder-test
    thread 649: l 00 need_return 0 tr 0
    ref 13: desc 1 node 8 s 1 w 0 d 0000000053c4c0c3
    unknown work: type 10

This patch add the freeze work type and is now logged as such:

  proc 637
  context binder-test
    thread 637: l 00 need_return 0 tr 0
    ref 8: desc 1 node 3 s 1 w 0 d 00000000dc39e9c6
    has frozen binder

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-5-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 830d7db7
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: I06f888aa5218db19eeda79e315385506af09d9d5
Signed-off-by: Carlos Llamas <cmllamas@google.com>

4e4b2cf3

BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() · 2bd6b2ab

Carlos Llamas authored 6 months ago


When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
  Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211

  CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   binder_release_work+0x398/0x3d0
   binder_deferred_func+0xb60/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8

  Allocated by task 703:
   __kmalloc_cache_noprof+0x130/0x280
   binder_thread_write+0xdb4/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190
   invoke_syscall+0x6c/0x254

  Freed by task 211:
   kfree+0xc4/0x230
   binder_deferred_func+0xae8/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8
  ==================================================================

This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@android.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-4-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 7e20434c
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: Icc40e7dd6157981f4adbea7243e55be118552321
[cmllamas: drop BINDER_STAT_FREEZE as it's not supported here]
Signed-off-by: Carlos Llamas <cmllamas@google.com>

2bd6b2ab

FROMGIT: binder: fix OOB in binder_add_freeze_work() · df183ec3

Carlos Llamas authored 6 months ago


In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:

  ==================================================================
  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
  Read of size 8 at addr ffffcb84285f7170 by task freeze/660

  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   rb_next+0xfc/0x124
   binder_add_freeze_work+0x344/0x534
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  The buggy address belongs to the variable:
   binder_dead_nodes+0x10/0x40
  [...]
  ==================================================================

This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:

	struct binder_node {
	[...]
		union {
			struct rb_node rb_node;
			struct hlist_node dead_node;
		};

Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-3-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 011e69a1
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: I5ec9d49277a23b864862665b52213460750c535e
Signed-off-by: Carlos Llamas <cmllamas@google.com>

df183ec3

FROMGIT: binder: fix node UAF in binder_add_freeze_work() · 8f52d7a1

Carlos Llamas authored 6 months ago


In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_add_freeze_work+0x148/0x478
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Allocated by task 637:
   __kmalloc_cache_noprof+0x12c/0x27c
   binder_new_node+0x50/0x700
   binder_transaction+0x35ac/0x6f74
   binder_thread_write+0xfb8/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Freed by task 637:
   kfree+0xf0/0x330
   binder_thread_read+0x1e88/0x3a68
   binder_ioctl+0x16d8/0x25ac
   __arm64_sys_ioctl+0x124/0x190
  ==================================================================

Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.

Fixes: d579b04a ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-2-cmllamas@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit dc8aea47
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git


 char-misc-next)
Change-Id: I47b053532dd4cd3424d35d6f254ca4d00c426411
Signed-off-by: Carlos Llamas <cmllamas@google.com>

8f52d7a1