5.15.46-rc1 review

This is the start of the stable review cycle for the 5.15.46 release. There are 667 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 09 Jun 2022 16:48:02 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.46-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.15.46-rc1

Jia-Ju Bai <[email protected]>
md: bcache: check the return value of kzalloc() in detached_dev_do_request()

Xiao Ni <[email protected]>
md: fix double free of io_acct_set bioset

Xiao Ni <[email protected]>

    md: Don't set mddev private to NULL in raid0 pers->free

Namjae Jeon <[email protected]>
fs/ntfs3: Fix invalid free in log_replay

Christian Brauner <[email protected]>
exportfs: support idmapped mounts

Christian Brauner <[email protected]>
fs: add two trivial lookup helpers

Mike Tipton <[email protected]>
interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate

Stephen Boyd <[email protected]>
interconnect: qcom: sc7180: Drop IP0 interconnects

Eric Biggers <[email protected]>
ext4: only allow test_dummy_encryption when supported

Maciej W. Rozycki <[email protected]>
MIPS: IP30: Remove incorrect `cpu_has_fpu' override

Maciej W. Rozycki <[email protected]>
MIPS: IP27: Remove incorrect `cpu_has_fpu' override

Xiao Yang <[email protected]>
RDMA/rxe: Generate a completion for unsupported/invalid opcode

Yixing Liu <[email protected]>
RDMA/hns: Remove the num_cqc_timer variable

Dan Carpenter <[email protected]>

    staging: r8188eu: delete rtw_wx_read/write32()

Jason A. Donenfeld <[email protected]>
Revert "random: use static branch for crng_ready()"

David Gow <[email protected]>
list: test: Add a test for list_is_head()

Waiman Long <[email protected]>
kseltest/cgroup: Make test_stress.sh work if run interactively

Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_replenish_one()

Alex Elder <[email protected]>
net: ipa: fix page free in ipa_endpoint_trans_release()

Johan Hovold <[email protected]>
phy: qcom-qmp: fix reset-controller leak on probe errors

Mao Jinlong <[email protected]>
coresight: core: Fix coresight device probe failure issue

Tejun Heo <[email protected]>
blk-iolatency: Fix inflight count imbalances and IO hangs on offline

Eugenio Pérez <[email protected]>
vdpasim: allow to enable a vq repeatedly

Dinh Nguyen <[email protected]>
dt-bindings: gpio: altera: correct interrupt-cells

Akira Yokosawa <[email protected]>
docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0

Steve French <[email protected]>
SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op

Arnd Bergmann <[email protected]>
ARM: pxa: maybe fix gpio lookup tables

Jonathan Bakker <[email protected]>
ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries

Johan Hovold <[email protected]>
phy: qcom-qmp: fix struct clk leak on probe errors

Diogo Ivo <[email protected]>
clk: tegra: Add missing reset deassertion

Diogo Ivo <[email protected]>
arm64: tegra: Add missing DFLL reset on Tegra210

Kathiravan T <[email protected]>
arm64: dts: qcom: ipq8074: fix the sleep clock frequency

Xiaomeng Tong <[email protected]>
gma500: fix an incorrect NULL check on list iterator

Xiaomeng Tong <[email protected]>
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator

Jiri Slaby <[email protected]>

    serial: pch: don't overwrite xmit->buf[0] by x_char

Coly Li <[email protected]>
bcache: avoid journal no-space deadlock by reserving 1 journal bucket

Coly Li <[email protected]>
bcache: remove incremental dirty sector counting for bch_sectors_dirty_init()

Coly Li <[email protected]>
bcache: improve multithreaded bch_sectors_dirty_init()

Coly Li <[email protected]>
bcache: improve multithreaded bch_btree_check()

Xiaomeng Tong <[email protected]>
stm: ltdc: fix two incorrect NULL checks on list iterator

Xiaomeng Tong <[email protected]>
carl9170: tx: fix an incorrect use of list iterator

Mark Brown <[email protected]>
ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control

Alexander Wetzel <[email protected]>
rtl818x: Prevent using not initialized queues

Yi Yang <[email protected]>
xtensa/simdisk: fix proc_read_simdisk()

Miaohe Lin <[email protected]>
mm/memremap: fix missing call to untrack_pfn() in pagemap_range()

Mike Kravetz <[email protected]>
hugetlb: fix huge_pmd_unshare address update

Christophe de Dinechin <[email protected]>
nodemask.h: fix compilation error with GCC12

Mel Gorman <[email protected]>
mm/page_alloc: always attempt to allocate at least one page during bulk allocation

Dong Aisheng <[email protected]>
Revert "mm/cma.c: remove redundant cma_mutex lock"

Yunfei Wang <[email protected]>
iommu/dma: Fix iova map result check bug

Xiaomeng Tong <[email protected]>
iommu/msm: Fix an incorrect NULL check on list iterator

Hyunchul Lee <[email protected]>
ksmbd: fix outstanding credits related bugs

Song Liu <[email protected]>
ftrace: Clean up hash direct_functions on register failures

Naveen N. Rao <[email protected]>
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]

Vincent Whitchurch <[email protected]>
um: Fix out-of-bounds read in LDT setup

Johannes Berg <[email protected]>
um: chan_user: Fix winch_tramp() return value

Johannes Berg <[email protected]>
um: Use asm-generic/dma-mapping.h

Felix Fietkau <[email protected]>
mac80211: upgrade passive scan to active scan on DFS channels after beacon rx

Dimitri John Ledkov <[email protected]>
cfg80211: declare MODULE_FIRMWARE for regulatory.db

Kant Fan <[email protected]>
thermal: devfreq_cooling: use local ops instead of global ops

Max Filippov <[email protected]>
irqchip: irq-xtensa-mx: fix initial IRQ affinity

Pali Rohár <[email protected]>
irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x

Guo Ren <[email protected]>
csky: patch_text: Fixup last cpu should be master

Bean Huo <[email protected]>
mmc: core: Allows to override the timeout value for ioctl() path

Dennis Dalessandro <[email protected]>
RDMA/hfi1: Fix potential integer multiplication overflow errors

Sean Christopherson <[email protected]>
Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug

GUO Zihua <[email protected]>
ima: remove the IMA_TEMPLATE Kconfig option

Nicolas Dufresne <[email protected]>
media: coda: Add more H264 levels for CODA960

Nicolas Dufresne <[email protected]>
media: coda: Fix reported H264 profile

Tokunori Ikegami <[email protected]>

    mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N

Tokunori Ikegami <[email protected]>
mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write

Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in md_reload_sb

Xiaomeng Tong <[email protected]>
md: fix an incorrect NULL check in does_sb_need_changing

Jani Nikula <[email protected]>
drm/i915/dsi: fix VBT send packet port selection for ICL+

Brian Norris <[email protected]>
drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX

Xiaomeng Tong <[email protected]>
drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator

Xiaomeng Tong <[email protected]>
drm/nouveau/clk: Fix an incorrect NULL check on list iterator

Lucas Stach <[email protected]>
drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem

Lyude Paul <[email protected]>
drm/nouveau/subdev/bus: Ratelimit logging for fault errors

Dave Airlie <[email protected]>
drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

Mickaël Salaün <[email protected]>
landlock: Fix same-layer rule unions

Mickaël Salaün <[email protected]>
landlock: Create find_rule() from unmask_layers()

Mickaël Salaün <[email protected]>
landlock: Reduce the maximum number of layers to 16

Mickaël Salaün <[email protected]>
landlock: Define access_mask_t to enforce a consistent access mask size

Mickaël Salaün <[email protected]>
selftests/landlock: Test landlock_create_ruleset(2) argument check ordering

Mickaël Salaün <[email protected]>
landlock: Change landlock_restrict_self(2) check ordering

Mickaël Salaün <[email protected]>
landlock: Change landlock_add_rule(2) argument check ordering

Mickaël Salaün <[email protected]>
selftests/landlock: Add tests for O_PATH

Mickaël Salaün <[email protected]>
selftests/landlock: Fully test file rename with "remove" access

Mickaël Salaün <[email protected]>
selftests/landlock: Extend access right tests to directories

Mickaël Salaün <[email protected]>
selftests/landlock: Add tests for unknown access rights

Mickaël Salaün <[email protected]>
selftests/landlock: Extend tests for minimal valid attribute size

Mickaël Salaün <[email protected]>
selftests/landlock: Make tests build with old libc

Mickaël Salaün <[email protected]>
landlock: Fix landlock_add_rule(2) documentation

Mickaël Salaün <[email protected]>
samples/landlock: Format with clang-format

Mickaël Salaün <[email protected]>
samples/landlock: Add clang-format exceptions

Mickaël Salaün <[email protected]>
selftests/landlock: Format with clang-format

Mickaël Salaün <[email protected]>
selftests/landlock: Normalize array assignment

Mickaël Salaün <[email protected]>
selftests/landlock: Add clang-format exceptions

Mickaël Salaün <[email protected]>
landlock: Format with clang-format

Mickaël Salaün <[email protected]>
landlock: Add clang-format exceptions

Manivannan Sadhasivam <[email protected]>
scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled

Xiaomeng Tong <[email protected]>
scsi: dc395x: Fix a missing check on list iterator

Junxiao Bi via Ocfs2-devel <[email protected]>
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock

Alexander Aring <[email protected]>
dlm: fix missing lkb refcount handling

Dan Carpenter <[email protected]>
dlm: uninitialized variable on error in dlm_listen_for_all()

Alexander Aring <[email protected]>
dlm: fix plock invalid read

Sven Schnelle <[email protected]>
s390/stp: clock_delta should be signed

Nico Boehr <[email protected]>
s390/perf: obtain sie_block from the right address

Rei Yamamoto <[email protected]>
mm, compaction: fast_find_migrateblock() should return pfn in the target zone

Denis Efremov <[email protected]>

    staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan()

Johan Hovold <[email protected]>
PCI: qcom: Fix unbalanced PHY init on probe errors

Johan Hovold <[email protected]>
PCI: qcom: Fix runtime PM imbalance on probe errors

Bjorn Helgaas <[email protected]>

    PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299

Alex Deucher <[email protected]>
drm/amdgpu: add beige goby PCI ID

Gautam Menghani <[email protected]>
tracing: Initialize integer variable to prevent garbage return value

Keita Suzuki <[email protected]>
tracing: Fix potential double free in create_var_ref()

Laurent Vivier <[email protected]>
tty: goldfish: Introduce gf_ioread32()/gf_iowrite32()

Sakari Ailus <[email protected]>
ACPI: property: Release subnode properties with data nodes

Jan Kara <[email protected]>
ext4: avoid cycles in directory h-tree

Jan Kara <[email protected]>
ext4: verify dir block before splitting it

Baokun Li <[email protected]>
ext4: fix bug_on in __es_tree_search

Theodore Ts'o <[email protected]>
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state

Ye Bin <[email protected]>
ext4: fix bug_on in ext4_writepages

Ye Bin <[email protected]>
ext4: fix warning in ext4_handle_inode_extension

Baokun Li <[email protected]>
ext4: fix race condition between ext4_write and ext4_convert_inline_data

Ye Bin <[email protected]>
ext4: fix use-after-free in ext4_rename_dir_prepare

Dmitry Monakhov <[email protected]>
ext4: mark group as trimmed only if it was fully scanned

Jan Kara <[email protected]>
bfq: Make sure bfqg for which we are queueing requests is online

Jan Kara <[email protected]>
bfq: Get rid of __bio_blkcg() usage

Jan Kara <[email protected]>
bfq: Track whether bfq_group is still online

Jan Kara <[email protected]>
bfq: Remove pointless bfq_init_rq() calls

Jan Kara <[email protected]>
bfq: Drop pointless unlock-lock pair

Jan Kara <[email protected]>
bfq: Update cgroup information before merging bio

Jan Kara <[email protected]>
bfq: Split shared queues on move between cgroups

Jan Kara <[email protected]>
bfq: Avoid merging queues with different parents

Jan Kara <[email protected]>
bfq: Avoid false marking of bic as stably merged

Aditya Garg <[email protected]>
efi: Do not import certificates from UEFI Secure Boot for T2 Macs

Zhihao Cheng <[email protected]>
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages

Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix assert 1F04 upon reconfig

Johannes Berg <[email protected]>
wifi: mac80211: fix use-after-free in chanctx code

Peter Zijlstra <[email protected]>
objtool: Fix symbol creation

Mikulas Patocka <[email protected]>
objtool: Fix objtool regression on x32 systems

Chao Yu <[email protected]>
f2fs: fix to do sanity check for inline inode

Chao Yu <[email protected]>
f2fs: fix fallocate to use file_modified to update permissions consistently

Eric Biggers <[email protected]>
f2fs: don't use casefolded comparison for "." and ".."

Chao Yu <[email protected]>
f2fs: fix to do sanity check on total_data_blocks

Jaegeuk Kim <[email protected]>
f2fs: don't need inode lock for system hidden quota

Chao Yu <[email protected]>
f2fs: fix deadloop in foreground GC

Chao Yu <[email protected]>
f2fs: fix to clear dirty inode in f2fs_evict_inode()

Chao Yu <[email protected]>
f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

Chao Yu <[email protected]>
f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count()

Olga Kornievskaia <[email protected]>
NFSv4.1 mark qualified async operations as MOVEABLE tasks

Trond Myklebust <[email protected]>
NFS: Convert GFP_NOFS to GFP_KERNEL

Anna Schumaker <[email protected]>
NFS: Create a new nfs_alloc_fattr_with_label() function

Trond Myklebust <[email protected]>

    NFS: Always initialise fattr->label in nfs_fattr_alloc()

Javier Martinez Canillas <[email protected]>
video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

Zhengjun Xing <[email protected]>
perf jevents: Fix event syntax error caused by ExtSel

Leo Yan <[email protected]>
perf c2c: Use stdio interface if slang is not supported

Jiri Olsa <[email protected]>
perf build: Fix btf__load_from_kernel_by_id() feature check

Kuninori Morimoto <[email protected]>
i2c: rcar: fix PM ref counts in probe error paths

Tali Perry <[email protected]>
i2c: npcm: Handle spurious interrupts

Tyrone Ting <[email protected]>
i2c: npcm: Correct register access width

Tali Perry <[email protected]>
i2c: npcm: Fix timeout calculation

Joerg Roedel <[email protected]>
iommu/amd: Increase timeout waiting for GA log enablement

Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()

Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: remove GISR1 register

Miaoqian Lin <[email protected]>
video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup

Trond Myklebust <[email protected]>
NFS: Further fixes to the writeback error handling

Trond Myklebust <[email protected]>
NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout

Trond Myklebust <[email protected]>
NFS: Don't report errors from nfs_pageio_complete() more than once

Trond Myklebust <[email protected]>
NFS: Do not report flush errors in nfs_write_end()

Trond Myklebust <[email protected]>
NFS: Don't report ENOSPC write errors twice

Trond Myklebust <[email protected]>
NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS

Trond Myklebust <[email protected]>
NFS: Do not report EINTR/ERESTARTSYS as mapping errors

Christophe JAILLET <[email protected]>
dmaengine: idxd: Fix the error handling path in idxd_cdev_register()

Nathan Chancellor <[email protected]>
i2c: at91: Initialize dma_buf in at91_twi_xfer()

Miles Chen <[email protected]>
iommu/mediatek: Fix NULL pointer dereference when printing dev_name

Guenter Roeck <[email protected]>
MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon

Jean-Philippe Brucker <[email protected]>
iommu/arm-smmu-v3-sva: Fix mm use-after-free

Rex-BC Chen <[email protected]>
cpufreq: mediatek: Unregister platform device on exit

Jia-Wei Chang <[email protected]>
cpufreq: mediatek: Use module_init and add module_exit

Michael Walle <[email protected]>
i2c: at91: use dma safe buffers

Yong Wu <[email protected]>
iommu/mediatek: Add mutex for m4u_group and m4u_dom in data

Yong Wu <[email protected]>
iommu/mediatek: Remove clk_disable in mtk_iommu_remove

Yong Wu <[email protected]>
iommu/mediatek: Add list_del in mtk_iommu_remove

Yong Wu <[email protected]>
iommu/mediatek: Fix 2 HW sharing pgtable issue

Mario Limonciello <[email protected]>
iommu/amd: Enable swiotlb in all cases

Jakob Koschel <[email protected]>
f2fs: fix dereference of stale list iterator after loop body

Chao Yu <[email protected]>
f2fs: fix to do sanity check on inline_dots inode

Chao Yu <[email protected]>
f2fs: support fault injection for dquot_initialize()

Dan Carpenter <[email protected]>
OPP: call of_node_put() on error path in _bandwidth_supported()

Dmitry Torokhov <[email protected]>
Input: stmfts - do not leave device disabled in stmfts_input_open

Wanpeng Li <[email protected]>
KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer

Douglas Miller <[email protected]>
RDMA/hfi1: Prevent use of lock before it is initialized

Björn Ardö <[email protected]>
mailbox: forward the hrtimer if not queued and under a lock

Julian Schroeder <[email protected]>
nfsd: destroy percpu stats counters after reply cache shutdown

Yang Yingliang <[email protected]>
mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe()

Miaoqian Lin <[email protected]>
powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup

Miaoqian Lin <[email protected]>
powerpc/xive: Fix refcount leak in xive_spapr_init

Christophe JAILLET <[email protected]>
powerpc/xive: Add some error handling code to 'xive_spapr_init()'

Randy Dunlap <[email protected]>
macintosh: via-pmu and via-cuda need RTC_LIB

Kajol Jain <[email protected]>
powerpc/perf: Fix the threshold compare group constraint for power9

Kajol Jain <[email protected]>
powerpc/perf: Fix the threshold compare group constraint for power10

Michael Ellerman <[email protected]>
powerpc/64: Only WARN if __pa()/__va() called with bad addresses

Yang Yingliang <[email protected]>
hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume()

Daire McNamara <[email protected]>
PCI: microchip: Fix potential race in interrupt handling

Kuppuswamy Sathyanarayanan <[email protected]>
PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits

Miaoqian Lin <[email protected]>
Input: sparcspkr - fix refcount leak in bbc_beep_probe

Mina Almasry <[email protected]>
hugetlbfs: fix hugetlbfs_statfs() locking

Eugen Hristev <[email protected]>
ARM: dts: at91: sama7g5: remove interrupt-parent from gic node

Sebastian Andrzej Siewior <[email protected]>
crypto: cryptd - Protect per-CPU resource by disabling BH.

Corentin Labbe <[email protected]>
crypto: sun8i-ss - handle zero sized sg

Corentin Labbe <[email protected]>
crypto: sun8i-ss - rework handling of IV

Qi Zheng <[email protected]>

    tty: fix deadlock caused by calling printk() under tty_port->lock

Francesco Dolcini <[email protected]>
PCI: imx6: Fix PERST# start-up sequence

Waiman Long <[email protected]>
ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()

Alexey Dobriyan <[email protected]>

    proc: fix dentry/inode overinstantiating under /proc/${pid}/net

Charles Keepax <[email protected]>
ASoC: atmel-classd: Remove endianness flag on class d component

Charles Keepax <[email protected]>
ASoC: atmel-pdmic: Remove endianness flag on pdmic component

Robert Marko <[email protected]>
arm64: dts: marvell: espressobin-ultra: enable front USB3 port

Robert Marko <[email protected]>
arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config

Yangyang Li <[email protected]>
RDMA/hns: Add the detection for CMDQ status in the device initialization process

Randy Dunlap <[email protected]>
powerpc/4xx/cpm: Fix return value of __setup() handler

Randy Dunlap <[email protected]>
powerpc/idle: Fix return value of __setup() handler

Yang Yingliang <[email protected]>
pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()

Geert Uytterhoeven <[email protected]>
pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins

Randy Dunlap <[email protected]>
powerpc/8xx: export 'cpm_setbrg' for modules

Lv Ruyi <[email protected]>
drm/msm/dpu: fix error check return value of irq_of_parse_and_map()

Kuniyuki Iwashima <[email protected]>

    list: fix a data-race around ep->rdllist

Andy Shevchenko <[email protected]>
list: introduce list_is_head() helper and re-use it in list.h

Sudeep Holla <[email protected]>
firmware: arm_ffa: Remove incorrect assignment of driver_data

Sudeep Holla <[email protected]>
firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe

Christophe JAILLET <[email protected]>
drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block()

Muchun Song <[email protected]>
dax: fix cache flush on PMD-mapped pages

Miaohe Lin <[email protected]>
drivers/base/node.c: fix compaction sysfs file leak

Krzysztof Kozlowski <[email protected]>
pinctrl: mvebu: Fix irq_of_parse_and_map() return value

Dan Williams <[email protected]>
nvdimm: Allow overwrite in the presence of disabled dimms

Dan Williams <[email protected]>
nvdimm: Fix firmware activation deadlock scenarios

Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix list protocols enumeration in the base protocol

Lad Prabhakar <[email protected]>
ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path

Lad Prabhakar <[email protected]>
ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname()

Heiner Kallweit <[email protected]>
ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get()

Matthias Schiffer <[email protected]>
arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates

QintaoShen <[email protected]>
soc: bcm: Check for NULL return of devm_kzalloc()

Gustavo A. R. Silva <[email protected]>
scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()

Lv Ruyi <[email protected]>
mfd: ipaq-micro: Fix error check return value of platform_get_irq()

Hari Bathini <[email protected]>
powerpc/fadump: fix PT_LOAD segment for boot memory area

Andrea Parri (Microsoft) <[email protected]>
Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero

Vinod Koul <[email protected]>
arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name

Fabien Parent <[email protected]>
pinctrl: mediatek: mt8195: enable driver on mtk platforms

Caleb Connolly <[email protected]>
pinctrl/rockchip: support deferring other gpio params

Chuanhong Guo <[email protected]>
arm: mediatek: select arch timer for mt7629

Stefan Wahren <[email protected]>
pinctrl: bcm2835: implement hook for missing gpio-ranges

Stefan Wahren <[email protected]>
gpiolib: of: Introduce hook for missing gpio-ranges

Corentin Labbe <[email protected]>
crypto: marvell/cesa - ECB does not IV

Hangyu Hua <[email protected]>
misc: ocxl: fix possible double free in ocxl_file_register_afu

Stefan Wahren <[email protected]>
ARM: dts: bcm2835-rpi-b: Fix GPIO line names

Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED

Phil Elwell <[email protected]>
ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C

Phil Elwell <[email protected]>
ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT

Marek Vasut <[email protected]>
ARM: dts: stm32: Fix PHY post-reset delay on Avenger96

Marc Kleine-Budde <[email protected]>
can: xilinx_can: mark bit timing constants as const

Guenter Roeck <[email protected]>
platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls

Max Krummenacher <[email protected]>
ARM: dts: imx6dl-colibri: Fix I2C pinmuxing

Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec: fix error handling in cros_ec_register()

Giovanni Cabiddu <[email protected]>
crypto: qat - set COMPRESSION capability for DH895XCC

Giovanni Cabiddu <[email protected]>
crypto: qat - set CIPHER capability for DH895XCC

Giovanni Cabiddu <[email protected]>
crypto: qat - set COMPRESSION capability for QAT GEN2

Giovanni Cabiddu <[email protected]>
crypto: qat - set CIPHER capability for QAT GEN2

Sean Christopherson <[email protected]>
KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault

Sean Christopherson <[email protected]>
KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry

Bjorn Andersson <[email protected]>
soc: qcom: llcc: Add MODULE_DEVICE_TABLE()

Thorsten Scherer <[email protected]>
ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks

Jiantao Zhang <[email protected]>
PCI: dwc: Fix setting error return on MSI DMA mapping failure

Miaoqian Lin <[email protected]>
PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()

Dan Carpenter <[email protected]>
PCI: rockchip: Fix find_first_zero_bit() limit

Dan Carpenter <[email protected]>
PCI: cadence: Fix find_first_zero_bit() limit

Miaoqian Lin <[email protected]>
soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc

Miaoqian Lin <[email protected]>
soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc

Andre Przywara <[email protected]>
ARM: dts: suniv: F1C100: fix watchdog compatible

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: Update pin controller node name

Rafał Miłecki <[email protected]>
ARM: dts: BCM5301X: update CRU block description

Christophe JAILLET <[email protected]>
memory: samsung: exynos5422-dmc: Avoid some over memory allocation

Mario Limonciello <[email protected]>
PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3

Allen-KH Cheng <[email protected]>
arm64: dts: mt8192: Fix nor_flash status disable typo

Shawn Lin <[email protected]>
arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399

Robin Murphy <[email protected]>
dma-direct: don't over-decrypt memory

Christoph Hellwig <[email protected]>
dma-direct: always leak memory that can't be re-encrypted

Christoph Hellwig <[email protected]>
dma-direct: don't call dma_set_decrypted for remapped allocations

Christoph Hellwig <[email protected]>
dma-direct: factor out dma_set_{de,en}crypted helpers

liuyacan <[email protected]>
net/smc: postpone sk_refcnt increment in connect()

Randy Dunlap <[email protected]>
net: dsa: restrict SMSC_LAN9303_I2C kconfig

Christophe JAILLET <[email protected]>
hinic: Avoid some over memory allocation

Gustavo A. R. Silva <[email protected]>
net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc()

David Howells <[email protected]>
rxrpc: Fix decision on when to generate an IDLE ACK

David Howells <[email protected]>
rxrpc: Don't let ack.previousPacket regress

David Howells <[email protected]>
rxrpc: Fix overlapping ACK accounting

David Howells <[email protected]>
rxrpc: Don't try to resend the request if we're receiving the reply

David Howells <[email protected]>
rxrpc: Fix listen() setting the bar too high for the prealloc rings

Adam Wujek <[email protected]>
hwmon: (pmbus) Check PEC support before reading other registers

Yongzhi Liu <[email protected]>
hv_netvsc: Fix potential dereference of NULL pointer

Jakub Kicinski <[email protected]>
net: stmmac: fix out-of-bounds access in a selftest

Gustavo A. R. Silva <[email protected]>
net: stmmac: selftests: Use kcalloc() instead of kzalloc()

Alexey Khoroshilov <[email protected]>
ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv()

Duoming Zhou <[email protected]>
NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx

Harini Katakam <[email protected]>
net: macb: Fix PTP one step sync support

Ulf Hansson <[email protected]>
PM: domains: Fix initialization of genpd's next_wakeup

Yang Yingliang <[email protected]>
ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()

Jan Kara <[email protected]>
bfq: Allow current waker to defend against a tentative one

Jan Kara <[email protected]>
bfq: Relax waker detection for shared queues

Miaoqian Lin <[email protected]>
thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe

Yang Yingliang <[email protected]>
thermal/core: Fix memory leak in __thermal_cooling_device_register()

Zheng Yongjun <[email protected]>
thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe

Stefan Wahren <[email protected]>
thermal/drivers/bcm2711: Don't clamp temperature at zero

Nathan Chancellor <[email protected]>
drm/i915: Fix CFI violation with show_dynamic_id()

Abhinav Kumar <[email protected]>
drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path

Hangbin Liu <[email protected]>
selftests/bpf: Add missed ima_setup.sh in Makefile

Dmitry Baryshkov <[email protected]>
drm/msm: don't free the IRQ if it was not requested

Lai Jiangshan <[email protected]>
x86/sev: Annotate stack change in the #VC handler

Hangyu Hua <[email protected]>
drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

Miaoqian Lin <[email protected]>
drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init

Eric Biggers <[email protected]>
ext4: reject the 'commit' option on ext2 filesystems

Miaoqian Lin <[email protected]>
regulator: scmi: Fix refcount leak in scmi_regulator_probe

Jonas Karlman <[email protected]>
media: rkvdec: h264: Fix bit depth wrap in pps packet

Nicolas Dufresne <[email protected]>
media: rkvdec: h264: Fix dpb_valid implementation

Nicolas Dufresne <[email protected]>
media: rkvdec: Stop overclocking the decoder

Cai Huoqing <[email protected]>
media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource()

Yang Yingliang <[email protected]>
media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR()

Dongliang Mu <[email protected]>

    media: ov7670: remove ov7670_power_off from ov7670_remove

Andre Przywara <[email protected]>
kselftest/arm64: bti: force static linking

Miaoqian Lin <[email protected]>
ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*

Zheng Bin <[email protected]>
net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init

Eric Dumazet <[email protected]>

    sctp: read sk->sk_bound_dev_if once in sctp_rcv()

Geert Uytterhoeven <[email protected]>
m68k: math-emu: Fix dependencies of math emulation support

Keith Busch <[email protected]>
nvme: set dma alignment to dword

Niels Dossche <[email protected]>
Bluetooth: use hdev lock for accept_list and reject_list in conn req

Niels Dossche <[email protected]>
Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring

Ying Hsu <[email protected]>
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout

Benjamin Gaignard <[email protected]>
media: hantro: HEVC: Fix tile info buffer value computation

Eugen Hristev <[email protected]>
media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check

Michael Rodin <[email protected]>
media: vsp1: Fix offset calculation for plane cropping

Pavel Skripkin <[email protected]>
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init

Miaoqian Lin <[email protected]>
media: exynos4-is: Change clk_disable to clk_disable_unprepare

Laurentiu Palcu <[email protected]>
media: i2c: rdacm2x: properly set subdev entity function

Miaoqian Lin <[email protected]>
media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe

Miaoqian Lin <[email protected]>
media: st-delta: Fix PM disable depth imbalance in delta_probe

Felix Fietkau <[email protected]>
mt76: do not attempt to reorder received 802.3 packets without agg session

Christophe JAILLET <[email protected]>

    mt76: mt7921: Fix the error handling path of mt7921_pci_probe()

Miaoqian Lin <[email protected]>
media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe

Christophe JAILLET <[email protected]>
media: aspeed: Fix an error handling path in aspeed_video_probe()

Josh Poimboeuf <[email protected]>
scripts/faddr2line: Fix overlapping text section failures

Phil Auld <[email protected]>
kselftest/cgroup: fix test_stress.sh to use OUTPUT dir

Bart Van Assche <[email protected]>
block: Fix the bio.bi_opf comment

Miaoqian Lin <[email protected]>
ASoC: samsung: Fix refcount leak in aries_audio_probe

Kuninori Morimoto <[email protected]>
ASoC: samsung: Use dev_err_probe() helper

Christoph Hellwig <[email protected]>
dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages

Christoph Hellwig <[email protected]>
dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations

Miaoqian Lin <[email protected]>
regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt

Miaoqian Lin <[email protected]>
ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe

Miaoqian Lin <[email protected]>
ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe

Miaoqian Lin <[email protected]>
ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe

Kuninori Morimoto <[email protected]>
ASoC: fsl: Use dev_err_probe() helper

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Modify the hid name

Basavaraj Natikar <[email protected]>
HID: amd_sfh: Modify the bus name

Ajay Singh <[email protected]>
wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice()

Baochen Qiang <[email protected]>

    ath11k: Don't check arvif->is_started before sending management frames

Ravi Bangoria <[email protected]>
perf/amd/ibs: Use interrupt regs ip for stack unwinding

Jerome Marchand <[email protected]>
samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is provided

Konrad Dybcio <[email protected]>
regulator: qcom_smd: Fix up PM8950 regulator configuration

Viresh Kumar <[email protected]>
Revert "cpufreq: Fix possible race in cpufreq online error path"

Yang Yingliang <[email protected]>
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()

Andreas Gruenbacher <[email protected]>
iomap: iomap_write_failed fix

Mark Rutland <[email protected]>
arm64: stackleak: fix current_top_of_stack()

Xiaomeng Tong <[email protected]>
media: uvcvideo: Fix missing check to determine if element is found in list

Dan Carpenter <[email protected]>
drm/msm: return an error pointer in msm_gem_prime_get_sg_table()

Jessica Zhang <[email protected]>
drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected

Jessica Zhang <[email protected]>
drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected

Kuogee Hsieh <[email protected]>
drm/msm/dp: fix event thread stuck in wait_event after kthread_stop()

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: fix address for second DSI PHY on SDM660

Zev Weiss <[email protected]>
regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET

Tong Tiangen <[email protected]>
arm64: fix types in copy_highpage()

Randy Dunlap <[email protected]>
x86/mm: Cleanup the control_va_addr_alignment() __setup handler

Krzysztof Kozlowski <[email protected]>
irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value

Krzysztof Kozlowski <[email protected]>
irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value

Daniel Thompson <[email protected]>
irqchip/exiu: Fix acknowledgment of edge triggered interrupts

Randy Dunlap <[email protected]>
x86: Fix return value of __setup handlers

Johannes Berg <[email protected]>
nl80211: don't hold RTNL in color change request

Christoph Hellwig <[email protected]>
virtio_blk: fix the discard_granularity and discard_alignment queue limits

James Clark <[email protected]>
perf tools: Use Python devtools for version autodetection rather than runtime

Ian Abbott <[email protected]>
spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA

Yang Yingliang <[email protected]>
drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()

Daniel Latypov <[email protected]>
kunit: fix debugfs code to use enum kunit_status, not bool

Jagan Teki <[email protected]>
drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H

Dmitry Baryshkov <[email protected]>
drm/msm: add missing include to msm_drv.c

Lv Ruyi <[email protected]>
drm/msm/hdmi: fix error check return value of irq_of_parse_and_map()

Yang Yingliang <[email protected]>
drm/msm/hdmi: check return value after calling platform_get_resource_byname()

Dmitry Baryshkov <[email protected]>
drm/msm/dsi: fix error checks and return values for DSI xmit functions

Kuogee Hsieh <[email protected]>
drm/msm/dp: do not stop transmitting phy test pattern during DP phy compliance test

Kuogee Hsieh <[email protected]>
drm/msm/dp: reset DP controller before transmit phy test pattern

Lv Ruyi <[email protected]>
drm/msm/dp: fix error check return value of irq_of_parse_and_map()

Kuogee Hsieh <[email protected]>
drm/msm/dp: stop event kernel thread when DP unbind

Vinod Polimera <[email protected]>
drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

Yang Jihong <[email protected]>
perf tools: Add missing headers needed by util/data.h

Nicolas Frattaroli <[email protected]>
ASoC: rk3328: fix disabling mclk on pclk probe failure

Josh Poimboeuf <[email protected]>
x86/speculation: Add missing prototype for unpriv_ebpf_notify()

Yang Yingliang <[email protected]>
mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe()

Yang Yingliang <[email protected]>
mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()

Matthieu Baerts <[email protected]>
x86/pm: Fix false positive kmemleak report in msr_build_context()

Chen-Tsung Hsieh <[email protected]>
mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check()

Andrii Nakryiko <[email protected]>
libbpf: Fix logic for finding matching program for CO-RE relocation

Colin Ian King <[email protected]>
selftests/resctrl: Fix null pointer dereference on open failed

Colin Ian King <[email protected]>
drm/v3d: Fix null pointer dereference of pointer perfmon

Kiwoong Kim <[email protected]>
scsi: ufs: core: Exclude UECxx from SFR dump list

Bart Van Assche <[email protected]>
scsi: ufs: qcom: Fix ufs_qcom_resume()

Dan Carpenter <[email protected]>
scsi: iscsi: Fix harmless double shift bug

Kuogee Hsieh <[email protected]>
drm/msm/dpu: adjust display_v_end for eDP and DP

Dmitry Baryshkov <[email protected]>
drm/msm/hdmi: switch to drm_bridge_connector

Bjorn Andersson <[email protected]>
drm/msm/dp: Modify prototype of encoder based API

Yuanchu Xie <[email protected]>
selftests/damon: add damon to selftests root Makefile

Nuno Sá <[email protected]>

    of: overlay: do not break notify on NOTIFY_{OK|STOP}

Luca Ceresoli <[email protected]>
spi: rockchip: fix missing error on unsupported SPI_CS_HIGH

Jon Lin <[email protected]>
spi: rockchip: Preset cs-high and clk polarity in setup progress

Jon Lin <[email protected]>
spi: rockchip: Stop spi slave dma receiver when cs inactive

Amir Goldstein <[email protected]>
fsnotify: fix wrong lockdep annotations

Amir Goldstein <[email protected]>
inotify: show inotify mask flags in proc fdinfo

Bjørn Mork <[email protected]>
mtdblock: warn if opened on NAND

Colin Ian King <[email protected]>
ALSA: pcm: Check for null pointer of pointer substream before dereferencing it

Marek Vasut <[email protected]>
drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01

Chen-Yu Tsai <[email protected]>
media: hantro: Empty encoder capture buffers by default

Laurentiu Palcu <[email protected]>
media: i2c: max9286: fix kernel oops when removing module

Jacopo Mondi <[email protected]>
media: i2c: max9286: Use "maxim,gpio-poc" property

Niklas Söderlund <[email protected]>

    media: i2c: max9286: Use dev_err_probe() helper

Dan Carpenter <[email protected]>

    ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix

John Ogness <[email protected]>
printk: wake waiters for safe and NMI contexts

John Ogness <[email protected]>
printk: add missing memory barrier to wake_up_klogd()

John Ogness <[email protected]>
printk: use atomic updates for klogd work

Schspa Shi <[email protected]>
cpufreq: Fix possible race in cpufreq online error path

Zheng Yongjun <[email protected]>
spi: img-spfi: Fix pm_runtime_get_sync() error checking

Chengming Zhou <[email protected]>
sched/psi: report zeroes for CPU full at the system level

Chengming Zhou <[email protected]>
sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq

Marco Elver <[email protected]>
signal: Deliver SIGTRAP on perf event asynchronously if blocked

Nícolas F. R. A. Prado <[email protected]>
drm/mediatek: dpi: Use mt8183 output formats for mt8192

Wei Yongjun <[email protected]>
regulator: da9121: Fix uninit-value in da9121_assign_chip_model()

Miaoqian Lin <[email protected]>
drm/bridge: Fix error handling in analogix_dp_probe

Miaoqian Lin <[email protected]>
HID: elan: Fix potential double free in elan_input_configured

Jonathan Teh <[email protected]>
HID: hid-led: fix maximum brightness for Dream Cheeky

Zheyu Ma <[email protected]>
mtd: rawnand: denali: Use managed device resources

Tyler Hicks <[email protected]>
EDAC/dmc520: Don't print an error for each unconfigured interrupt line

Arnd Bergmann <[email protected]>
drbd: fix duplicate array initializer

Christoph Hellwig <[email protected]>
target: remove an incorrect unmap zeroes data deduction

Andy Shevchenko <[email protected]>
device property: Allow error pointer to be passed to fwnode APIs

Daniel Scally <[email protected]>

    device property: Check fwnode->secondary when finding properties

Jan Kiszka <[email protected]>
efi: Add missing prototype for efi_capsule_setup_info

Lin Ma <[email protected]>

    NFC: NULL out the dev->rfkill to prevent UAF

Lv Ruyi <[email protected]>
ixp4xx_eth: fix error check return value of platform_get_irq()

Russell King (Oracle) <[email protected]>
net: dsa: mt7530: 1G can also support 1000BASE-X link mode

Paul E. McKenney <[email protected]>
scftorture: Fix distribution of short handler delays

Miaoqian Lin <[email protected]>
spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout

Jiasheng Jiang <[email protected]>
drm: mali-dp: potential dereference of null pointer

Zhou Qingyang <[email protected]>
drm/komeda: Fix an undefined behavior bug in komeda_plane_add()

Johannes Berg <[email protected]>
nl80211: show SSID for P2P_GO interfaces

Paolo Abeni <[email protected]>
mptcp: reset the packet scheduler on PRIO change

Maciej W. Rozycki <[email protected]>
x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation

Andrii Nakryiko <[email protected]>
libbpf: Don't error out on CO-RE relos for overriden weak subprogs

Maxime Ripard <[email protected]>

    drm/vc4: txp: Force alpha to be 0xff if it's disabled

Maxime Ripard <[email protected]>
drm/vc4: txp: Don't set TXP_VSTART_AT_EOF

Maxime Ripard <[email protected]>
drm/vc4: hvs: Reset muxes at probe time

Miles Chen <[email protected]>
drm/mediatek: Fix mtk_cec_mask()

Maxime Ripard <[email protected]>
drm/vc4: hvs: Fix frame count register readout

Ammar Faizi <[email protected]>
x86/delay: Fix the wrong asm constraint in delay_loop()

Miaoqian Lin <[email protected]>
ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe

Miaoqian Lin <[email protected]>
ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe

Kuldeep Singh <[email protected]>
spi: qcom-qspi: Add minItems to interconnect-names

Chuanhong Guo <[email protected]>
mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG

Marek Vasut <[email protected]>
drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling

Marek Vasut <[email protected]>
drm: bridge: icn6211: Fix register layout

Lucas Stach <[email protected]>
drm/bridge: adv7511: clean up CEC adapter when probe fails

Jani Nikula <[email protected]>
drm/edid: fix invalid EDID extension block filtering

Wenli Looi <[email protected]>

    ath9k: fix ar9003_get_eepmisc

Nicolas Belin <[email protected]>
drm: bridge: it66121: Fix the register page length

Niels Dossche <[email protected]>

    ath11k: acquire ab->base_lock in unassign when finding the peer by addr

Zack Rusin <[email protected]>
drm/vmwgfx: Fix an invalid read

Noralf Trønnes <[email protected]>
dt-bindings: display: sitronix, st7735r: Fix backlight in example

Nikita Yushchenko <[email protected]>
drm/bridge_connector: enable HPD by default if supported

Linus Torvalds <[email protected]>
drm: fix EDID struct for old ARM OABI format

Lad Prabhakar <[email protected]>
Input: gpio-keys - cancel delayed work only in case of GPIO

Douglas Miller <[email protected]>
RDMA/hfi1: Prevent panic when SDMA is disabled

Steve French <[email protected]>
smb3: check for null tcon

Peng Wu <[email protected]>
powerpc/iommu: Add missing of_node_put in iommu_init_early_dart

Finn Thain <[email protected]>
macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled

Lv Ruyi <[email protected]>
powerpc/powernv: fix missing of_node_put in uv_init()

Lv Ruyi <[email protected]>
powerpc/xics: fix refcount leak in icp_opal_init()

Haren Myneni <[email protected]>
powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr

Vasily Averin <[email protected]>
tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate

Matthew Wilcox (Oracle) <[email protected]>
alpha: fix alloc_zeroed_user_highpage_movable()

Nicholas Piggin <[email protected]>
KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting

Yicong Yang <[email protected]>
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

Laurent Dufour <[email protected]>
powerpc/rtas: Keep MSR[RI] set when calling RTAS

Viresh Kumar <[email protected]>
cpufreq: Avoid unnecessary frequency updates due to mismatch

Peng Wu <[email protected]>
ARM: hisi: Add missing of_node_put after of_find_compatible_node

Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM

Peng Wu <[email protected]>
ARM: versatile: Add missing of_node_put in dcscb_init

Yang Yingliang <[email protected]>
pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()

OGAWA Hirofumi <[email protected]>
fat: add ratelimit to fat*_ent_bread()

Hari Bathini <[email protected]>
powerpc/fadump: Fix fadump to work with a different endian capture kernel

Janusz Krzysztofik <[email protected]>
ARM: OMAP1: clock: Fix UART rate reporting algorithm

Takashi Iwai <[email protected]>
ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c

Takashi Iwai <[email protected]>
ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb

Joel Selvaraj <[email protected]>
arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's vddio-supply property

Zixuan Fu <[email protected]>
fs: jfs: fix possible NULL pointer dereference in dbFree()

QintaoShen <[email protected]>
soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc

Gilad Ben-Yossef <[email protected]>
crypto: ccree - use fine grained DMA mapping dir

Brian Norris <[email protected]>
PM / devfreq: rk3399_dmc: Disable edev on remove()

Konrad Dybcio <[email protected]>

    arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count

Konrad Dybcio <[email protected]>
arm64: dts: qcom: msm8994: Fix the cont_splash_mem address

Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: align DMA channels with dtschema

Krzysztof Kozlowski <[email protected]>
ARM: dts: socfpga: align interrupt controller node name with dtschema

Krzysztof Kozlowski <[email protected]>
ARM: dts: ox820: align interrupt controller node name with dtschema

Niels Dossche <[email protected]>
IB/rdmavt: add missing locks in rvt_ruc_loopback

Bodo Stroesser <[email protected]>
scsi: target: tcmu: Avoid holding XArray lock when calling lock_page

Bob Peterson <[email protected]>
gfs2: use i_lock spin_lock for inode qadata

Yonghong Song <[email protected]>
selftests/bpf: fix btf_dump/btf_dump due to recent clang change

Uwe Kleine-König <[email protected]>
char: tpm: cr50_i2c: Suppress duplicated error message in .remove()

Jakub Kicinski <[email protected]>
eth: tg3: silence the GCC 12 array-bounds warning

David Howells <[email protected]>
afs: Adjust ACK interpretation to try and cope with NAT

David Howells <[email protected]>
rxrpc, afs: Fix selection of abort codes

David Howells <[email protected]>
rxrpc: Return an error to sendmsg if call failed

Geert Uytterhoeven <[email protected]>
m68k: atari: Make Atari ROM port I/O write macros return void

Alex Elder <[email protected]>
net: ipa: ignore endianness if there is no header

Borislav Petkov <[email protected]>
x86/microcode: Add explicit CPU vendor dependency

Vincent Mailhol <[email protected]>
can: mcp251xfd: silence clang's -Wunaligned-access warning

Chaitanya Kulkarni <[email protected]>
nvme: set non-mdts limits in nvme_scan_work

Pierre Gondois <[email protected]>
ACPI: CPPC: Assume no transition latency if no PCCT

Pierre-Louis Bossart <[email protected]>
ASoC: rt1015p: remove dependency on GPIOLIB

Pierre-Louis Bossart <[email protected]>
ASoC: max98357a: remove dependency on GPIOLIB

Nicolas Dufresne <[email protected]>
media: hantro: Stop using H.264 parameter pic_num

Kwanghoon Son <[email protected]>
media: exynos4-is: Fix compile warning

Fabio Estevam <[email protected]>
net: phy: micrel: Allow probing without .driver_data

Sathishkumar S <[email protected]>
drm/amd/pm: update smartshift powerboost calc for smu13

Sathishkumar S <[email protected]>
drm/amd/pm: update smartshift powerboost calc for smu12

Xie Yongji <[email protected]>
nbd: Fix hung on disconnect request if socket is closed before

Lin Ma <[email protected]>
ASoC: rt5645: Fix errorenous cleanup order

Smith, Kyle Miller (Nimble Kernel) <[email protected]>
nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags

Jason A. Donenfeld <[email protected]>
openrisc: start CPU timer early in boot

Lukas Wunner <[email protected]>
usbnet: Run unregister_netdev() before unbind() again

Hans Verkuil <[email protected]>
media: cec-adap.c: fix is_configuring state

Tetsuo Handa <[email protected]>
media: imon: reorganize serialization

Hans Verkuil <[email protected]>
media: ccs-core.c: fix failure to call clk_disable_unprepare

Benjamin Gaignard <[email protected]>
media: hantro: HEVC: unconditionnaly set pps_{cb/cr}_qp_offset values

Philipp Zabel <[email protected]>
media: coda: limit frame interval enumeration to supported encoder frame sizes

Hangyu Hua <[email protected]>
media: rga: fix possible memory leak in rga_probe

Felix Fietkau <[email protected]>
mt76: fix encap offload ethernet type check

Felix Fietkau <[email protected]>
mt76: mt7921: accept rx frames with non-standard VHT MCS10-11

Dongliang Mu <[email protected]>
rtlwifi: Use pr_warn instead of WARN_ONCE

Corey Minyard <[email protected]>
ipmi: Fix pr_fmt to avoid compilation issues

Corey Minyard <[email protected]>
ipmi:ssif: Check for NULL msg when handling events and messages

Mario Limonciello <[email protected]>
ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default

Mikulas Patocka <[email protected]>
dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC

Patrice Chotard <[email protected]>
spi: stm32-qspi: Fix wait_cmd timeout in APM mode

Hao Jia <[email protected]>
sched/core: Avoid obvious double update_rq_clock warning

Ravi Bangoria <[email protected]>
perf/amd/ibs: Cascade pmu init functions' return value

Heiko Carstens <[email protected]>
s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES

Eric Dumazet <[email protected]>
net: remove two BUG() from skb_checksum_help()

James Smart <[email protected]>
scsi: lpfc: Alter FPIN stat accounting logic

Charles Keepax <[email protected]>
ASoC: tscs454: Add endianness flag in snd_soc_component_driver

Zhen Lei <[email protected]>
of: Support more than one crash kernel regions for kexec -s

Dongliang Mu <[email protected]>
HID: bigben: fix slab-out-of-bounds Write in bigben_probe

Nícolas F. R. A. Prado <[email protected]>
regulator: mt6315: Enforce regulator-compatible, not name

Alice Wong <[email protected]>
drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo

Alex Deucher <[email protected]>
drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init

Petr Machata <[email protected]>
mlxsw: Treat LLDP packets as control

Petr Machata <[email protected]>
mlxsw: spectrum_dcb: Do not warn about priority changes

Mark Brown <[email protected]>
ASoC: dapm: Don't fold register value changes into notifications

Mark Bloch <[email protected]>
net/mlx5: fs, delete the FTE when there are no rules attached to it

jianghaoran <[email protected]>
ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL

Xiaoguang Wang <[email protected]>
scsi: target: tcmu: Fix possible data corruption

Lv Ruyi <[email protected]>
drm: msm: fix error check return value of irq_of_parse_and_map()

Alexandru Elisei <[email protected]>
arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall

Abhishek Kumar <[email protected]>
ath10k: skip ath10k_halt during suspend for driver state RESTARTING

Evan Quan <[email protected]>
drm/amd/pm: fix the compile warning

Steven Price <[email protected]>
drm/plane: Move range check for format_count earlier

Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408

Hari Chandrakanthan <[email protected]>
ath11k: disable spectral scan during spectral deinit

James Smart <[email protected]>
scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()

Minghao Chi <[email protected]>
scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync()

Haohui Mai <[email protected]>
drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the doorbells

Lv Ruyi <[email protected]>
scsi: megaraid: Fix error check return value of register_chrdev()

Vignesh Raghavendra <[email protected]>
drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit

Aidan MacDonald <[email protected]>
mmc: jz4740: Apply DMA engine limits to maximum segment size

Heming Zhao <[email protected]>
md/bitmap: don't set sb values if can't pass sanity check

Zheyu Ma <[email protected]>
media: cx25821: Fix the warning when removing the module

Zheyu Ma <[email protected]>
media: pci: cx23885: Fix the error handling in cx23885_initdev()

Luca Weiss <[email protected]>
media: venus: hfi: avoid null dereference in deinit

Thibaut VARÈNE <[email protected]>
ath9k: fix QCA9561 PA bias level

Kuninori Morimoto <[email protected]>
ASoC: rsnd: care return value from rsnd_node_fixed_index()

Kuninori Morimoto <[email protected]>
ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear()

Keita Suzuki <[email protected]>
drm/amd/pm: fix double free in si_parse_power_table()

Ulf Hansson <[email protected]>
cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode

James Smart <[email protected]>
scsi: lpfc: Fix call trace observed during I/O with CMF enabled

James Smart <[email protected]>
scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock

James Smart <[email protected]>
scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg()

Len Brown <[email protected]>
tools/power turbostat: fix ICX DRAM power numbers

Biju Das <[email protected]>
spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction

Po-Hao Huang <[email protected]>
rtw88: 8821c: fix debugfs rssi value

Amadeusz Sławiński <[email protected]>
ALSA: jack: Access input_dev under mutex

Haowen Bai <[email protected]>
sfc: ef10: Fix assigning negative value to unsigned variable

Paul E. McKenney <[email protected]>
rcu: Make TASKS_RUDE_RCU select IRQ_WORK

Padmanabha Srinivasaiah <[email protected]>
rcu-tasks: Fix race in schedule and flush work

Saaem Rizvi <[email protected]>
drm/amd/display: Disabling Z10 on DCN31

Liviu Dudau <[email protected]>
drm/komeda: return early if drm_universal_plane_init() fails.

Peter Seiderer <[email protected]>
mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output)

Kirill A. Shutemov <[email protected]>
ACPICA: Avoid cache flush inside virtual machines

Mike Travis <[email protected]>
x86/platform/uv: Update TSC sync state for UV5

Daniel Vetter <[email protected]>
fbcon: Consistently protect deferred_takeover with console_lock()

Niels Dossche <[email protected]>

    ipv6: fix locking issues with loops over idev->addr_list

Haowen Bai <[email protected]>
ipw2x00: Fix potential NULL dereference in libipw_xmit()

Haowen Bai <[email protected]>
b43: Fix assigning negative value to unsigned variable

Haowen Bai <[email protected]>
b43legacy: Fix assigning negative value to unsigned variable

Niels Dossche <[email protected]>
mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue

Quentin Monnet <[email protected]>
selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync

Nikolay Borisov <[email protected]>
selftests/bpf: Fix vfs_link kprobe definition

Liu Zixian <[email protected]>
drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes

Zack Rusin <[email protected]>
drm/vmwgfx: validate the screen formats

Tejas Upadhyay <[email protected]>
iommu/vt-d: Add RPLS to quirk list to skip TE disabling

Qu Wenruo <[email protected]>
btrfs: fix the error handling for submit_extent_page() for btrfs_do_readpage()

Qu Wenruo <[email protected]>
btrfs: repair super block num_devices automatically

Qu Wenruo <[email protected]>
btrfs: return correct error number for __extent_writepage_io()

Qu Wenruo <[email protected]>

    btrfs: add "0x" prefix for unsupported optional features

Eric W. Biederman <[email protected]>
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL

Eric W. Biederman <[email protected]>
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP

Eric W. Biederman <[email protected]>
ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP

Kristen Carlson Accardi <[email protected]>
x86/sgx: Set active memcg prior to shmem allocation

Baoquan He <[email protected]>
x86/kexec: fix memory leak of elf header buffer

Kan Liang <[email protected]>
perf/x86/intel: Fix event constraints for ICL

Ammar Faizi <[email protected]>
x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails

Michael Niewöhner <[email protected]>
platform/x86: intel-hid: fix _DSM function index handling

Mathias Nyman <[email protected]>
xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI

Ronnie Sahlberg <[email protected]>
cifs: when extending a file with falloc we should make files not-sparse

Ronnie Sahlberg <[email protected]>
cifs: fix potential double free during failed mount

Konstantin Komarov <[email protected]>
fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions

Konstantin Komarov <[email protected]>
fs/ntfs3: Update i_ctime when xattr is added

Christophe JAILLET <[email protected]>
fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'

Konstantin Komarov <[email protected]>

    fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if called from function ntfs_init_acl

Konstantin Komarov <[email protected]>
fs/ntfs3: Check new size for limits

Konstantin Komarov <[email protected]>
fs/ntfs3: Keep preallocated only if option prealloc enabled

Konstantin Komarov <[email protected]>
fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space)

Konstantin Komarov <[email protected]>
fs/ntfs3: Update valid size if -EIOCBQUEUED

Kishon Vijay Abraham I <[email protected]>
usb: core: hcd: Add support for deferring roothub registration

Albert Wang <[email protected]>
usb: dwc3: gadget: Move null pinter check to proper place

Linus Walleij <[email protected]>
usb: isp1760: Fix out-of-bounds array access

Monish Kumar R <[email protected]>
USB: new quirk for Dell Gen 2 devices

Carl Yin(殷张成) <[email protected]>
USB: serial: option: add Quectel BG95 modem

Johan Hovold <[email protected]>
USB: serial: pl2303: fix type detection for odd device

Takashi Iwai <[email protected]>
ALSA: usb-audio: Cancel pending work at closing a MIDI substream

Marios Levogiannis <[email protected]>
ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS

Rik van der Kemp <[email protected]>
ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop

Kailang Yang <[email protected]>
ALSA: hda/realtek - Add new type for ALC245

Nathan Chancellor <[email protected]>
riscv: Move alternative length validation into subsection

Tobias Klauser <[email protected]>
riscv: Wire up memfd_secret in UAPI header

Samuel Holland <[email protected]>
riscv: Fix irq_work when SMP is disabled

Alexandre Ghiti <[email protected]>
riscv: Initialize thread pointer before calling C functions

Xianting Tian <[email protected]>
RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY

Helge Deller <[email protected]>
parisc/stifb: Keep track of hardware path of graphics card

Helge Deller <[email protected]>
parisc/stifb: Implement fb_is_primary_device()

Niklas Cassel <[email protected]>
binfmt_flat: do not stop relocating GOT entries prematurely on riscv

Stephen Boyd <[email protected]>
arm64: Initialize jump labels before setup_machine_fdt()

-------------

Diffstat:

 Documentation/accounting/psi.rst                   |   9 +-
 Documentation/conf.py                              |   2 +-
 .../bindings/display/sitronix,st7735r.yaml         |   1 +
 .../devicetree/bindings/gpio/gpio-altera.txt       |   5 +-
 .../bindings/regulator/mt6315-regulator.yaml       |   2 +-
 .../bindings/spi/qcom,spi-qcom-qspi.yaml           |   1 +
 Documentation/filesystems/f2fs.rst                 |   1 +
 Documentation/sound/alsa-configuration.rst         |   4 +-
 Documentation/userspace-api/landlock.rst           |   4 +-
 Makefile                                           |   4 +-
 arch/alpha/include/asm/page.h                      |   2 +-
 arch/arm/boot/dts/bcm2835-rpi-b.dts                |  13 +-
 arch/arm/boot/dts/bcm2835-rpi-zero-w.dts           |  22 +-
 arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts         |   2 +-
 arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts          |   4 +-
 arch/arm/boot/dts/bcm5301x.dtsi                    |  15 +-
 arch/arm/boot/dts/exynos5250-smdk5250.dts          |   4 +-
 arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts      |   6 +-
 arch/arm/boot/dts/imx6qdl-colibri.dtsi             |   6 +-
 arch/arm/boot/dts/ox820.dtsi                       |   2 +-
 arch/arm/boot/dts/s5pv210-aries.dtsi               |   3 +-
 arch/arm/boot/dts/s5pv210.dtsi                     |  12 +-
 arch/arm/boot/dts/sama7g5.dtsi                     |   1 -
 arch/arm/boot/dts/socfpga.dtsi                     |   2 +-
 arch/arm/boot/dts/socfpga_arria10.dtsi             |   2 +-
 arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi |   1 +
 arch/arm/boot/dts/suniv-f1c100s.dtsi               |   4 +-
 arch/arm/kernel/signal.c                           |   1 +
 arch/arm/mach-hisi/platsmp.c                       |   4 +
 arch/arm/mach-mediatek/Kconfig                     |   1 +
 arch/arm/mach-omap1/clock.c                        |   2 +-
 arch/arm/mach-pxa/cm-x300.c                        |   8 +-
 arch/arm/mach-pxa/magician.c                       |   2 +-
 arch/arm/mach-pxa/tosa.c                           |   4 +-
 arch/arm/mach-vexpress/dcscb.c                     |   1 +
 arch/arm64/Kconfig.platforms                       |   1 +
 .../dts/marvell/armada-3720-espressobin-ultra.dts  |   5 -
 arch/arm64/boot/dts/mediatek/mt8192.dtsi           |   2 +-
 arch/arm64/boot/dts/nvidia/tegra210.dtsi           |   5 +-
 arch/arm64/boot/dts/qcom/ipq8074.dtsi              |   2 +-
 arch/arm64/boot/dts/qcom/msm8994.dtsi              |   8 +-
 arch/arm64/boot/dts/qcom/qrb5165-rb5.dts           |   2 +-
 .../boot/dts/qcom/sdm845-xiaomi-beryllium.dts      |   2 +-
 arch/arm64/boot/dts/rockchip/rk3399.dtsi           |   2 +-
 arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi            |   2 -
 arch/arm64/include/asm/processor.h                 |  10 +-
 arch/arm64/kernel/setup.c                          |   7 +-
 arch/arm64/kernel/signal.c                         |   1 +
 arch/arm64/kernel/signal32.c                       |   1 +
 arch/arm64/kernel/sys_compat.c                     |   2 +-
 arch/arm64/mm/copypage.c                           |   4 +-
 arch/csky/kernel/probes/kprobes.c                  |   2 +-
 arch/m68k/Kconfig.cpu                              |   2 +-
 arch/m68k/include/asm/raw_io.h                     |   6 +-
 arch/m68k/kernel/signal.c                          |   1 +
 .../include/asm/mach-ip27/cpu-feature-overrides.h  |   1 -
 .../include/asm/mach-ip30/cpu-feature-overrides.h  |   1 -
 arch/openrisc/include/asm/timex.h                  |   1 +
 arch/openrisc/kernel/head.S                        |   9 +
 arch/parisc/include/asm/fb.h                       |   4 +
 arch/powerpc/include/asm/page.h                    |   7 +-
 arch/powerpc/include/asm/vas.h                     |   2 +-
 arch/powerpc/kernel/entry_64.S                     |  24 +-
 arch/powerpc/kernel/fadump.c                       |   8 +-
 arch/powerpc/kernel/idle.c                         |   2 +-
 arch/powerpc/kernel/rtas.c                         |   9 +
 arch/powerpc/kvm/book3s_hv.c                       |   4 +
 arch/powerpc/kvm/book3s_hv_nested.c                |   3 +-
 arch/powerpc/perf/isa207-common.c                  |  12 +-
 arch/powerpc/platforms/4xx/cpm.c                   |   2 +-
 arch/powerpc/platforms/8xx/cpm1.c                  |   1 +
 arch/powerpc/platforms/powernv/opal-fadump.c       |  94 +--
 arch/powerpc/platforms/powernv/opal-fadump.h       |  10 +-
 arch/powerpc/platforms/powernv/ultravisor.c        |   1 +
 arch/powerpc/platforms/powernv/vas-fault.c         |   2 +-
 arch/powerpc/platforms/powernv/vas-window.c        |   4 +-
 arch/powerpc/platforms/powernv/vas.h               |   2 +-
 arch/powerpc/sysdev/dart_iommu.c                   |   6 +-
 arch/powerpc/sysdev/fsl_rio.c                      |   2 +
 arch/powerpc/sysdev/xics/icp-opal.c                |   1 +
 arch/powerpc/sysdev/xive/spapr.c                   |  43 +-
 arch/riscv/include/asm/alternative-macros.h        |   4 +-
 arch/riscv/include/asm/irq_work.h                  |   2 +-
 arch/riscv/include/asm/unistd.h                    |   1 -
 arch/riscv/include/uapi/asm/unistd.h               |   1 +
 arch/riscv/kernel/head.S                           |   1 +
 arch/riscv/kernel/setup.c                          |   4 +-
 arch/s390/include/asm/cio.h                        |   2 +-
 arch/s390/include/asm/kexec.h                      |  10 +
 arch/s390/include/asm/preempt.h                    |  15 +-
 arch/s390/kernel/perf_event.c                      |   2 +-
 arch/s390/kernel/time.c                            |   8 +-
 arch/sparc/kernel/signal32.c                       |   1 +
 arch/sparc/kernel/signal_64.c                      |   1 +
 arch/um/drivers/chan_user.c                        |   9 +-
 arch/um/include/asm/Kbuild                         |   1 +
 arch/um/include/asm/thread_info.h                  |   2 +
 arch/um/kernel/exec.c                              |   2 +-
 arch/um/kernel/process.c                           |   2 +-
 arch/um/kernel/ptrace.c                            |   8 +-
 arch/um/kernel/signal.c                            |   4 +-
 arch/x86/Kconfig                                   |   4 +-
 arch/x86/entry/entry_64.S                          |   1 +
 arch/x86/entry/vdso/vma.c                          |   2 +-
 arch/x86/events/amd/ibs.c                          |  55 +-
 arch/x86/events/intel/core.c                       |   2 +-
 arch/x86/include/asm/acenv.h                       |  14 +-
 arch/x86/include/asm/kexec.h                       |   8 +
 arch/x86/include/asm/suspend_32.h                  |   2 +-
 arch/x86/include/asm/suspend_64.h                  |  12 +-
 arch/x86/kernel/apic/apic.c                        |   2 +-
 arch/x86/kernel/apic/x2apic_uv_x.c                 |   8 +-
 arch/x86/kernel/cpu/intel.c                        |   2 +-
 arch/x86/kernel/cpu/mce/amd.c                      |  32 +-
 arch/x86/kernel/cpu/sgx/encl.c                     | 105 ++-
 arch/x86/kernel/cpu/sgx/encl.h                     |   7 +-
 arch/x86/kernel/cpu/sgx/main.c                     |   9 +-
 arch/x86/kernel/machine_kexec_64.c                 |  12 +-
 arch/x86/kernel/signal_compat.c                    |   2 +
 arch/x86/kernel/step.c                             |   3 +-
 arch/x86/kernel/sys_x86_64.c                       |   7 +-
 arch/x86/kvm/lapic.c                               |   1 +
 arch/x86/kvm/vmx/nested.c                          |  45 +-
 arch/x86/kvm/vmx/vmcs.h                            |   5 +
 arch/x86/lib/delay.c                               |   4 +-
 arch/x86/mm/pat/memtype.c                          |   2 +-
 arch/x86/pci/irq.c                                 |  19 +-
 arch/x86/um/ldt.c                                  |   6 +-
 arch/xtensa/kernel/ptrace.c                        |   4 +-
 arch/xtensa/kernel/signal.c                        |   4 +-
 arch/xtensa/platforms/iss/simdisk.c                |  18 +-
 block/bfq-cgroup.c                                 | 111 +--
 block/bfq-iosched.c                                |  64 +-
 block/bfq-iosched.h                                |   7 +-
 block/blk-iolatency.c                              | 122 ++--
 crypto/cryptd.c                                    |  23 +-
 drivers/acpi/cppc_acpi.c                           |  17 +-
 drivers/acpi/property.c                            |  18 +-
 drivers/acpi/sleep.c                               |  12 +
 drivers/base/memory.c                              |   5 +-
 drivers/base/node.c                                |   1 +
 drivers/base/power/domain.c                        |   1 +
 drivers/base/property.c                            |  90 ++-
 drivers/block/drbd/drbd_main.c                     |  11 +-
 drivers/block/nbd.c                                |  13 +-
 drivers/block/virtio_blk.c                         |   7 +-
 drivers/char/hw_random/omap3-rom-rng.c             |   2 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   4 +-
 drivers/char/ipmi/ipmi_ssif.c                      |  23 +
 drivers/char/random.c                              |  12 +-
 drivers/char/tpm/tpm_tis_i2c_cr50.c                |   4 +-
 drivers/clk/tegra/clk-dfll.c                       |  12 +
 drivers/cpufreq/cpufreq.c                          |  11 +
 drivers/cpufreq/mediatek-cpufreq.c                 |  18 +-
 drivers/cpuidle/cpuidle-psci.c                     |  46 ++
 .../crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c    | 115 ++--
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c  |  30 +-
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c  |  10 +-
 drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h       |  14 +-
 drivers/crypto/ccree/cc_buffer_mgr.c               |  27 +-
 drivers/crypto/marvell/cesa/cipher.c               |   1 -
 drivers/crypto/nx/nx-common-powernv.c              |   2 +-
 drivers/crypto/qat/qat_common/adf_gen2_hw_data.c   |  18 +-
 drivers/crypto/qat/qat_common/adf_gen2_hw_data.h   |   1 +
 .../crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c |  15 +-
 drivers/devfreq/rk3399_dmc.c                       |   2 +
 drivers/dma/idxd/cdev.c                            |   8 +-
 drivers/dma/stm32-mdma.c                           |  23 +-
 drivers/edac/dmc520_edac.c                         |   2 +-
 drivers/firmware/arm_ffa/driver.c                  |   4 +-
 drivers/firmware/arm_scmi/base.c                   |   2 +-
 drivers/gpio/gpio-rockchip.c                       |  24 +-
 drivers/gpio/gpiolib-of.c                          |   5 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c            |  95 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c          |   3 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |   8 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |   8 +-
 .../gpu/drm/amd/display/dc/dcn31/dcn31_resource.c  |   1 +
 drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c          |  14 +-
 drivers/gpu/drm/amd/pm/powerplay/si_dpm.c          |   8 +-
 drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c    |  60 +-
 .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c   |  62 +-
 drivers/gpu/drm/arm/display/komeda/komeda_plane.c  |  10 +-
 drivers/gpu/drm/arm/malidp_crtc.c                  |   5 +-
 drivers/gpu/drm/bridge/adv7511/adv7511_drv.c       |   1 +
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c |  31 +-
 drivers/gpu/drm/bridge/chipone-icn6211.c           | 155 ++++-
 drivers/gpu/drm/bridge/ite-it66121.c               |   2 +-
 drivers/gpu/drm/drm_bridge_connector.c             |   4 +-
 drivers/gpu/drm/drm_edid.c                         |   6 +-
 drivers/gpu/drm/drm_plane.c                        |  14 +-
 drivers/gpu/drm/etnaviv/etnaviv_mmu.c              |   6 +
 drivers/gpu/drm/gma500/psb_intel_display.c         |   7 +-
 drivers/gpu/drm/i915/display/intel_dsi_vbt.c       |  33 +-
 drivers/gpu/drm/i915/i915_perf.c                   |   4 +-
 drivers/gpu/drm/i915/i915_perf_types.h             |   2 +-
 drivers/gpu/drm/mediatek/mtk_cec.c                 |   2 +-
 drivers/gpu/drm/mediatek/mtk_dpi.c                 |   4 +-
 drivers/gpu/drm/msm/Makefile                       |   2 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c              |   1 +
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c        |  23 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c        |   1 +
 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c            |  10 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c          |  14 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c           |   6 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c         |  15 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h         |   4 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c          |  15 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h          |   2 +-
 drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c         |  20 +-
 drivers/gpu/drm/msm/dp/dp_ctrl.c                   |  16 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |  55 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |  21 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c         |   2 +-
 drivers/gpu/drm/msm/hdmi/hdmi.c                    |  22 +-
 drivers/gpu/drm/msm/hdmi/hdmi.h                    |  19 +-
 drivers/gpu/drm/msm/hdmi/hdmi_bridge.c             |  81 ++-
 .../drm/msm/hdmi/{hdmi_connector.c => hdmi_hpd.c}  | 154 +----
 drivers/gpu/drm/msm/msm_drv.c                      |   8 +-
 drivers/gpu/drm/msm/msm_gem_prime.c                |   2 +-
 drivers/gpu/drm/msm/msm_kms.h                      |   1 +
 drivers/gpu/drm/nouveau/dispnv50/atom.h            |   6 +-
 drivers/gpu/drm/nouveau/dispnv50/crc.c             |  27 +-
 drivers/gpu/drm/nouveau/include/nvkm/core/subdev.h |   2 +
 drivers/gpu/drm/nouveau/nvkm/subdev/bus/gf100.c    |  14 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv31.c     |   6 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/bus/nv50.c     |   6 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c     |   6 +-
 drivers/gpu/drm/panel/panel-simple.c               |   3 +-
 drivers/gpu/drm/rockchip/rockchip_drm_vop.c        |   2 +-
 drivers/gpu/drm/stm/ltdc.c                         |  16 +-
 drivers/gpu/drm/tilcdc/tilcdc_external.c           |   8 +-
 drivers/gpu/drm/v3d/v3d_perfmon.c                  |   3 +-
 drivers/gpu/drm/vc4/vc4_crtc.c                     |   2 +-
 drivers/gpu/drm/vc4/vc4_drv.h                      |   1 +
 drivers/gpu/drm/vc4/vc4_hvs.c                      |  49 +-
 drivers/gpu/drm/vc4/vc4_regs.h                     |  12 +-
 drivers/gpu/drm/vc4/vc4_txp.c                      |   8 +-
 drivers/gpu/drm/virtio/virtgpu_display.c           |   2 +
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c                |  30 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.h                |   1 -
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c           |  14 +-
 drivers/hid/amd-sfh-hid/amd_sfh_hid.c              |   4 +-
 drivers/hid/amd-sfh-hid/amd_sfh_hid.h              |   2 +-
 drivers/hid/hid-bigbenff.c                         |   6 +
 drivers/hid/hid-elan.c                             |   2 -
 drivers/hid/hid-led.c                              |   2 +-
 drivers/hv/channel.c                               |   6 +-
 drivers/hwmon/pmbus/pmbus_core.c                   |  28 +-
 drivers/hwtracing/coresight/coresight-core.c       |  33 +-
 drivers/i2c/busses/i2c-at91-master.c               |  11 +
 drivers/i2c/busses/i2c-npcm7xx.c                   | 103 ++-
 drivers/i2c/busses/i2c-rcar.c                      |  15 +-
 drivers/infiniband/hw/hfi1/file_ops.c              |   2 +
 drivers/infiniband/hw/hfi1/init.c                  |   2 +-
 drivers/infiniband/hw/hfi1/sdma.c                  |  12 +-
 drivers/infiniband/hw/hns/hns_roce_device.h        |   7 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  24 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h         |   2 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   2 +-
 drivers/infiniband/sw/rdmavt/qp.c                  |   6 +-
 drivers/infiniband/sw/rxe/rxe_req.c                |   2 +-
 drivers/input/keyboard/gpio_keys.c                 |   2 +-
 drivers/input/misc/sparcspkr.c                     |   1 +
 drivers/input/touchscreen/stmfts.c                 |  16 +-
 drivers/interconnect/qcom/icc-rpmh.c               |  10 +-
 drivers/interconnect/qcom/sc7180.c                 |  21 -
 drivers/interconnect/qcom/sm8150.c                 |   1 -
 drivers/interconnect/qcom/sm8250.c                 |   1 -
 drivers/interconnect/qcom/sm8350.c                 |   1 -
 drivers/iommu/amd/init.c                           |   2 +-
 drivers/iommu/amd/iommu.c                          |   7 -
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c    |  13 +-
 drivers/iommu/dma-iommu.c                          |   7 +-
 drivers/iommu/intel/iommu.c                        |   2 +-
 drivers/iommu/msm_iommu.c                          |  11 +-
 drivers/iommu/mtk_iommu.c                          |  30 +-
 drivers/iommu/mtk_iommu.h                          |   2 +
 drivers/iommu/mtk_iommu_v1.c                       |   7 +
 drivers/irqchip/irq-armada-370-xp.c                |  11 +-
 drivers/irqchip/irq-aspeed-i2c-ic.c                |   4 +-
 drivers/irqchip/irq-aspeed-scu-ic.c                |   4 +-
 drivers/irqchip/irq-sni-exiu.c                     |  25 +-
 drivers/irqchip/irq-xtensa-mx.c                    |  18 +-
 drivers/macintosh/Kconfig                          |   6 +
 drivers/macintosh/Makefile                         |   3 +-
 drivers/macintosh/via-pmu.c                        |   2 +-
 drivers/mailbox/mailbox.c                          |  19 +-
 drivers/md/bcache/btree.c                          |  58 +-
 drivers/md/bcache/btree.h                          |   2 +-
 drivers/md/bcache/journal.c                        |  31 +-
 drivers/md/bcache/journal.h                        |   2 +
 drivers/md/bcache/request.c                        |   6 +
 drivers/md/bcache/super.c                          |   1 +
 drivers/md/bcache/writeback.c                      | 101 +--
 drivers/md/bcache/writeback.h                      |   2 +-
 drivers/md/md-bitmap.c                             |  44 +-
 drivers/md/md.c                                    |  22 +-
 drivers/md/raid0.c                                 |   1 -
 drivers/media/cec/core/cec-adap.c                  |   6 +-
 drivers/media/i2c/ccs/ccs-core.c                   |   7 +-
 drivers/media/i2c/max9286.c                        | 139 ++--
 drivers/media/i2c/ov5648.c                         |   4 +-
 drivers/media/i2c/ov7670.c                         |   1 -
 drivers/media/i2c/rdacm20.c                        |   2 +-
 drivers/media/i2c/rdacm21.c                        |   2 +-
 drivers/media/pci/cx23885/cx23885-core.c           |   6 +-
 drivers/media/pci/cx25821/cx25821-core.c           |   2 +-
 drivers/media/platform/aspeed-video.c              |   4 +-
 drivers/media/platform/atmel/atmel-sama5d2-isc.c   |   7 +-
 drivers/media/platform/coda/coda-common.c          |  35 +-
 drivers/media/platform/exynos4-is/fimc-is.c        |   6 +-
 drivers/media/platform/exynos4-is/fimc-isp-video.h |   2 +-
 drivers/media/platform/qcom/venus/hfi.c            |   3 +
 drivers/media/platform/rockchip/rga/rga.c          |   6 +-
 drivers/media/platform/sti/delta/delta-v4l2.c      |   6 +-
 drivers/media/platform/vsp1/vsp1_rpf.c             |   6 +-
 drivers/media/rc/imon.c                            |  99 ++-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c            |   7 +-
 drivers/media/usb/uvc/uvc_v4l2.c                   |  20 +-
 drivers/memory/samsung/exynos5422-dmc.c            |   5 +-
 drivers/mfd/davinci_voicecodec.c                   |   6 +-
 drivers/mfd/ipaq-micro.c                           |   2 +-
 drivers/misc/ocxl/file.c                           |   2 +
 drivers/mmc/core/block.c                           |   8 +-
 drivers/mmc/host/jz4740_mmc.c                      |  20 +
 drivers/mmc/host/sdhci_am654.c                     |  23 +-
 drivers/mtd/chips/cfi_cmdset_0002.c                | 103 ++-
 drivers/mtd/mtdblock.c                             |   8 +-
 drivers/mtd/nand/raw/cadence-nand-controller.c     |   5 +-
 drivers/mtd/nand/raw/denali_pci.c                  |  15 +-
 drivers/mtd/nand/raw/intel-nand-controller.c       |   2 +-
 drivers/mtd/nand/spi/gigadevice.c                  |  10 +-
 drivers/mtd/spi-nor/core.c                         |   9 +
 drivers/net/can/spi/mcp251xfd/mcp251xfd.h          |   2 +-
 drivers/net/can/xilinx_can.c                       |   4 +-
 drivers/net/dsa/Kconfig                            |   3 +-
 drivers/net/dsa/mt7530.c                           |  14 +-
 drivers/net/ethernet/broadcom/Makefile             |   5 +
 drivers/net/ethernet/cadence/macb_main.c           |  40 +-
 drivers/net/ethernet/cadence/macb_ptp.c            |   4 +-
 .../net/ethernet/huawei/hinic/hinic_hw_api_cmd.c   |   5 +-
 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c  |  10 +-
 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c   |   5 +-
 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c   |   9 +-
 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c  |   2 +
 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c    |  23 +-
 drivers/net/ethernet/huawei/hinic/hinic_main.c     |  10 +-
 drivers/net/ethernet/huawei/hinic/hinic_tx.c       |   9 +-
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c  |  10 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c |  13 -
 .../net/ethernet/mellanox/mlxsw/spectrum_trap.c    |   2 +-
 drivers/net/ethernet/sfc/ef10.c                    |   2 +-
 .../net/ethernet/stmicro/stmmac/stmmac_selftests.c |  15 +-
 drivers/net/ethernet/xscale/ptp_ixp46x.c           |   2 +-
 drivers/net/hyperv/netvsc_drv.c                    |   5 +-
 drivers/net/ipa/ipa_endpoint.c                     |  36 +-
 drivers/net/phy/micrel.c                           |  11 +-
 drivers/net/usb/asix_devices.c                     |   6 +-
 drivers/net/usb/smsc95xx.c                         |   3 +-
 drivers/net/usb/usbnet.c                           |   6 +-
 drivers/net/wireless/ath/ath10k/mac.c              |  20 +-
 drivers/net/wireless/ath/ath11k/mac.c              |  16 +-
 drivers/net/wireless/ath/ath11k/spectral.c         |  17 +-
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c     |   2 +-
 drivers/net/wireless/ath/ath9k/ar9003_phy.h        |   2 +-
 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c      |   8 +
 drivers/net/wireless/ath/carl9170/tx.c             |   3 +
 drivers/net/wireless/broadcom/b43/phy_n.c          |   2 +-
 drivers/net/wireless/broadcom/b43legacy/phy.c      |   2 +-
 drivers/net/wireless/intel/ipw2x00/libipw_tx.c     |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/power.c     |   3 +
 drivers/net/wireless/marvell/mwifiex/11h.c         |   2 +
 drivers/net/wireless/mediatek/mt76/agg-rx.c        |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7921/pci.c    |   8 +-
 drivers/net/wireless/microchip/wilc1000/mon.c      |   4 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   8 +-
 drivers/net/wireless/realtek/rtlwifi/usb.c         |   2 +-
 drivers/net/wireless/realtek/rtw88/rtw8821c.c      |   4 +
 drivers/nfc/st21nfca/se.c                          |  17 +-
 drivers/nfc/st21nfca/st21nfca.h                    |   1 +
 drivers/nvdimm/core.c                              |   9 -
 drivers/nvdimm/security.c                          |   5 -
 drivers/nvme/host/core.c                           |  21 +-
 drivers/nvme/host/pci.c                            |   1 +
 drivers/of/kexec.c                                 |   9 +
 drivers/of/overlay.c                               |   4 +-
 drivers/opp/of.c                                   |   2 +-
 drivers/pci/controller/cadence/pcie-cadence-ep.c   |   3 +-
 drivers/pci/controller/dwc/pci-imx6.c              |  23 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |   3 +-
 drivers/pci/controller/dwc/pcie-qcom.c             |   9 +-
 drivers/pci/controller/pcie-mediatek.c             |   1 +
 drivers/pci/controller/pcie-microchip-host.c       |   6 +-
 drivers/pci/controller/pcie-rockchip-ep.c          |   3 +-
 drivers/pci/pci-acpi.c                             |  41 +-
 drivers/pci/pci.c                                  |  12 +-
 drivers/pci/pcie/aer.c                             |   7 +-
 drivers/phy/qualcomm/phy-qcom-qmp.c                |  11 +-
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |  18 +
 drivers/pinctrl/mediatek/Kconfig                   |   1 +
 drivers/pinctrl/mvebu/pinctrl-armada-37xx.c        |   2 +-
 drivers/pinctrl/pinctrl-rockchip.c                 |  54 +-
 drivers/pinctrl/pinctrl-rockchip.h                 |   7 +-
 drivers/pinctrl/renesas/core.c                     |   7 +-
 drivers/pinctrl/renesas/pfc-r8a779a0.c             |  29 +
 drivers/pinctrl/renesas/pinctrl-rzn1.c             |  10 +-
 drivers/platform/chrome/cros_ec.c                  |  16 +-
 drivers/platform/chrome/cros_ec_chardev.c          |   2 +-
 drivers/platform/chrome/cros_ec_proto.c            |  50 +-
 drivers/platform/mips/cpu_hwmon.c                  | 127 ++--
 drivers/platform/x86/intel/hid.c                   |   2 +-
 drivers/regulator/core.c                           |   7 +-
 drivers/regulator/da9121-regulator.c               |   2 +
 drivers/regulator/pfuze100-regulator.c             |   2 +
 drivers/regulator/qcom_smd-regulator.c             |  35 +-
 drivers/regulator/scmi-regulator.c                 |   2 +-
 drivers/s390/cio/chsc.c                            |   4 +-
 drivers/scsi/dc395x.c                              |  15 +-
 drivers/scsi/fcoe/fcoe_ctlr.c                      |   2 +-
 drivers/scsi/lpfc/lpfc_els.c                       |  49 +-
 drivers/scsi/lpfc/lpfc_init.c                      |  51 +-
 drivers/scsi/lpfc/lpfc_logmsg.h                    |   6 +-
 drivers/scsi/lpfc/lpfc_scsi.c                      |  37 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |   6 +-
 drivers/scsi/megaraid.c                            |   2 +-
 drivers/scsi/ufs/ti-j721e-ufs.c                    |   6 +-
 drivers/scsi/ufs/ufs-qcom.c                        |  14 +-
 drivers/scsi/ufs/ufshcd.c                          |   7 +-
 drivers/soc/bcm/bcm63xx/bcm-pmb.c                  |   3 +
 drivers/soc/qcom/llcc-qcom.c                       |   1 +
 drivers/soc/qcom/smp2p.c                           |   1 +
 drivers/soc/qcom/smsm.c                            |   1 +
 drivers/soc/ti/ti_sci_pm_domains.c                 |   2 +
 drivers/spi/spi-cadence-quadspi.c                  |   2 +-
 drivers/spi/spi-fsl-qspi.c                         |   4 +
 drivers/spi/spi-img-spfi.c                         |   2 +-
 drivers/spi/spi-rockchip.c                         | 113 +++-
 drivers/spi/spi-rspi.c                             |  15 +-
 drivers/spi/spi-stm32-qspi.c                       |   3 +-
 drivers/spi/spi-ti-qspi.c                          |   5 +-
 drivers/staging/media/hantro/hantro_g2_hevc_dec.c  |  11 +-
 drivers/staging/media/hantro/hantro_h264.c         |   2 -
 drivers/staging/media/hantro/hantro_v4l2.c         |   8 +-
 drivers/staging/media/rkvdec/rkvdec-h264.c         |  37 +-
 drivers/staging/media/rkvdec/rkvdec.c              |  10 +-
 drivers/staging/r8188eu/os_dep/ioctl_linux.c       | 103 +--
 drivers/target/target_core_device.c                |   1 -
 drivers/target/target_core_user.c                  |  50 +-
 drivers/thermal/broadcom/bcm2711_thermal.c         |   5 +-
 drivers/thermal/broadcom/sr-thermal.c              |   3 +
 drivers/thermal/devfreq_cooling.c                  |  25 +-
 drivers/thermal/imx_sc_thermal.c                   |   6 +-
 drivers/thermal/thermal_core.c                     |   1 +
 drivers/tty/goldfish.c                             |  20 +-
 drivers/tty/serial/pch_uart.c                      |  27 +-
 drivers/tty/tty_buffer.c                           |   3 +-
 drivers/usb/core/hcd.c                             |  29 +-
 drivers/usb/core/quirks.c                          |   3 +
 drivers/usb/dwc3/gadget.c                          |   6 +-
 drivers/usb/host/xhci-pci.c                        |   2 +
 drivers/usb/isp1760/isp1760-core.c                 |   8 +
 drivers/usb/serial/option.c                        |   2 +
 drivers/usb/serial/pl2303.c                        |   3 +
 drivers/vdpa/vdpa_sim/vdpa_sim.c                   |   5 +-
 drivers/video/console/sticon.c                     |   5 +-
 drivers/video/console/sticore.c                    |  32 +-
 drivers/video/fbdev/amba-clcd.c                    |   5 +-
 drivers/video/fbdev/core/fbcon.c                   |   5 +-
 drivers/video/fbdev/sticore.h                      |   3 +
 drivers/video/fbdev/stifb.c                        |   4 +-
 drivers/video/fbdev/vesafb.c                       |   5 +-
 fs/afs/misc.c                                      |   5 +-
 fs/afs/rotate.c                                    |   4 +
 fs/afs/rxrpc.c                                     |   8 +-
 fs/afs/write.c                                     |   1 +
 fs/binfmt_flat.c                                   |  27 +-
 fs/btrfs/disk-io.c                                 |   4 +-
 fs/btrfs/extent_io.c                               |  21 +-
 fs/btrfs/volumes.c                                 |   8 +-
 fs/cifs/cifsfs.c                                   |  10 +-
 fs/cifs/smb2inode.c                                |   2 -
 fs/cifs/smb2ops.c                                  |   9 +-
 fs/dax.c                                           |   3 +-
 fs/dlm/lock.c                                      |  11 +-
 fs/dlm/lowcomms.c                                  |   2 +-
 fs/dlm/plock.c                                     |  12 +-
 fs/exportfs/expfs.c                                |   5 +-
 fs/ext4/ext4.h                                     |   6 -
 fs/ext4/extents.c                                  |  20 +-
 fs/ext4/inline.c                                   |  12 +
 fs/ext4/inode.c                                    |  13 +-
 fs/ext4/mballoc.c                                  |  18 +-
 fs/ext4/namei.c                                    |  84 ++-
 fs/ext4/super.c                                    |  24 +-
 fs/f2fs/checkpoint.c                               |   2 +-
 fs/f2fs/dir.c                                      |   3 +-
 fs/f2fs/f2fs.h                                     |  31 +-
 fs/f2fs/file.c                                     |  26 +-
 fs/f2fs/hash.c                                     |  11 +-
 fs/f2fs/inline.c                                   |  31 +-
 fs/f2fs/inode.c                                    |  21 +-
 fs/f2fs/namei.c                                    |  37 +-
 fs/f2fs/recovery.c                                 |   6 +-
 fs/f2fs/segment.c                                  |  42 +-
 fs/f2fs/segment.h                                  |  33 +-
 fs/f2fs/super.c                                    |  22 +-
 fs/f2fs/verity.c                                   |   2 +-
 fs/f2fs/xattr.c                                    |   2 +-
 fs/fat/fatent.c                                    |   7 +-
 fs/fs-writeback.c                                  |  13 +-
 fs/gfs2/quota.c                                    |  32 +-
 fs/hugetlbfs/inode.c                               |   4 +-
 fs/iomap/buffered-io.c                             |   3 +-
 fs/jfs/jfs_dmap.c                                  |   3 +-
 fs/ksmbd/connection.c                              |   2 +-
 fs/ksmbd/smb2misc.c                                |   2 +-
 fs/ksmbd/smb_common.c                              |   4 +-
 fs/namei.c                                         |  70 +-
 fs/nfs/file.c                                      |  50 +-
 fs/nfs/getroot.c                                   |  17 +-
 fs/nfs/inode.c                                     |  25 +-
 fs/nfs/internal.h                                  |   9 -
 fs/nfs/nfs4proc.c                                  |  41 +-
 fs/nfs/nfs4state.c                                 |   2 +-
 fs/nfs/pagelist.c                                  |   3 +
 fs/nfs/pnfs.c                                      |   6 +-
 fs/nfs/unlink.c                                    |   8 +
 fs/nfs/write.c                                     |  54 +-
 fs/nfsd/nfscache.c                                 |   2 +-
 fs/notify/fdinfo.c                                 |  11 +-
 fs/notify/inotify/inotify.h                        |  12 +
 fs/notify/inotify/inotify_user.c                   |   2 +-
 fs/notify/mark.c                                   |   6 +-
 fs/ntfs3/file.c                                    |  12 +-
 fs/ntfs3/frecord.c                                 |  10 +-
 fs/ntfs3/fslog.c                                   |  12 +-
 fs/ntfs3/inode.c                                   |   8 +-
 fs/ntfs3/xattr.c                                   | 112 ++-
 fs/ocfs2/dlmfs/userdlm.c                           |  16 +-
 fs/proc/generic.c                                  |   3 +
 fs/proc/proc_net.c                                 |   3 +
 include/drm/drm_edid.h                             |   6 +-
 include/linux/blk_types.h                          |   5 +-
 include/linux/bpf.h                                |   2 +
 include/linux/compat.h                             |   1 +
 include/linux/efi.h                                |   2 +
 include/linux/fwnode.h                             |  10 +-
 include/linux/goldfish.h                           |  15 +-
 include/linux/gpio/driver.h                        |  12 +
 include/linux/kexec.h                              |  46 +-
 include/linux/list.h                               |  40 +-
 include/linux/mailbox_controller.h                 |   1 +
 include/linux/mtd/cfi.h                            |   1 +
 include/linux/namei.h                              |   6 +
 include/linux/nfs_fs.h                             |  13 +
 include/linux/nfs_fs_sb.h                          |   1 +
 include/linux/nodemask.h                           |  13 +-
 include/linux/platform_data/cros_ec_proto.h        |   3 +
 include/linux/ptp_classify.h                       |   3 +
 include/linux/ptrace.h                             |   7 -
 include/linux/sched/signal.h                       |   2 +-
 include/linux/usb/hcd.h                            |   2 +
 include/net/if_inet6.h                             |   8 +
 include/scsi/libfcoe.h                             |   3 +-
 include/scsi/libiscsi.h                            |   6 +-
 include/sound/jack.h                               |   1 +
 include/trace/events/rxrpc.h                       |   2 +-
 include/trace/events/vmscan.h                      |   4 +-
 include/uapi/asm-generic/siginfo.h                 |   7 +
 include/uapi/linux/landlock.h                      |   9 +-
 init/Kconfig                                       |   5 +
 ipc/mqueue.c                                       |  14 +
 kernel/dma/debug.c                                 |   2 +-
 kernel/dma/direct.c                                | 125 ++--
 kernel/events/core.c                               |   4 +-
 kernel/kexec_file.c                                |  34 -
 kernel/printk/printk.c                             |  63 +-
 kernel/ptrace.c                                    |   5 +-
 kernel/rcu/Kconfig                                 |   1 +
 kernel/rcu/tasks.h                                 |   3 +
 kernel/scftorture.c                                |   5 +-
 kernel/sched/core.c                                |   6 +-
 kernel/sched/deadline.c                            |   5 +-
 kernel/sched/fair.c                                |   8 +-
 kernel/sched/pelt.h                                |   4 +-
 kernel/sched/psi.c                                 |  15 +-
 kernel/sched/rt.c                                  |   5 +-
 kernel/sched/sched.h                               |  32 +-
 kernel/signal.c                                    |  18 +-
 kernel/trace/ftrace.c                              |   5 +-
 kernel/trace/trace_boot.c                          |   2 +-
 kernel/trace/trace_events_hist.c                   |   3 +
 lib/kunit/debugfs.c                                |   2 +-
 lib/list-test.c                                    |  19 +
 mm/cma.c                                           |   4 +-
 mm/compaction.c                                    |   2 +
 mm/hugetlb.c                                       |   9 +-
 mm/memremap.c                                      |   2 +-
 mm/page_alloc.c                                    |   4 +-
 net/bluetooth/hci_event.c                          |  15 +-
 net/bluetooth/hci_request.c                        |   2 +
 net/bluetooth/sco.c                                |  21 +-
 net/core/dev.c                                     |   8 +-
 net/ipv6/addrconf.c                                |  33 +-
 net/mac80211/chan.c                                |   7 +-
 net/mac80211/ieee80211_i.h                         |   5 +
 net/mac80211/rc80211_minstrel_ht.c                 |   3 +
 net/mac80211/scan.c                                |  20 +
 net/mptcp/pm_netlink.c                             |   2 +
 net/nfc/core.c                                     |   1 +
 net/rxrpc/ar-internal.h                            |  13 +-
 net/rxrpc/call_event.c                             |   7 +-
 net/rxrpc/conn_object.c                            |   2 +-
 net/rxrpc/input.c                                  |  58 +-
 net/rxrpc/output.c                                 |  20 +-
 net/rxrpc/recvmsg.c                                |   8 +-
 net/rxrpc/sendmsg.c                                |   6 +
 net/rxrpc/sysctl.c                                 |   4 +-
 net/sctp/input.c                                   |   4 +-
 net/smc/af_smc.c                                   |   2 +-
 net/wireless/nl80211.c                             |   4 +-
 net/wireless/reg.c                                 |   4 +
 samples/bpf/Makefile                               |   9 +-
 samples/landlock/sandboxer.c                       | 104 +--
 scripts/faddr2line                                 | 150 ++--
 security/integrity/ima/Kconfig                     |  14 +-
 .../integrity/platform_certs/keyring_handler.h     |   8 +
 security/integrity/platform_certs/load_uefi.c      |  33 +
 security/landlock/cred.c                           |   4 +-
 security/landlock/cred.h                           |   8 +-
 security/landlock/fs.c                             | 191 ++++--
 security/landlock/fs.h                             |  11 +-
 security/landlock/limits.h                         |   8 +-
 security/landlock/object.c                         |   6 +-
 security/landlock/object.h                         |   6 +-
 security/landlock/ptrace.c                         |  10 +-
 security/landlock/ruleset.c                        |  84 +--
 security/landlock/ruleset.h                        |  35 +-
 security/landlock/syscalls.c                       |  95 +--
 sound/core/jack.c                                  |  34 +-
 sound/core/pcm_memory.c                            |   3 +-
 sound/pci/hda/patch_realtek.c                      |  21 +-
 sound/soc/atmel/atmel-classd.c                     |   1 -
 sound/soc/atmel/atmel-pdmic.c                      |   1 -
 sound/soc/codecs/Kconfig                           |   2 -
 sound/soc/codecs/max98090.c                        |   6 +-
 sound/soc/codecs/rk3328_codec.c                    |   2 +-
 sound/soc/codecs/rt5514.c                          |   2 +-
 sound/soc/codecs/rt5645.c                          |   7 +-
 sound/soc/codecs/tscs454.c                         |  12 +-
 sound/soc/codecs/wm2000.c                          |   6 +-
 sound/soc/fsl/fsl-asoc-card.c                      |   3 +-
 sound/soc/fsl/imx-card.c                           |  17 +-
 sound/soc/fsl/imx-hdmi.c                           |   1 +
 sound/soc/fsl/imx-sgtl5000.c                       |  18 +-
 sound/soc/fsl/imx-spdif.c                          |   4 +-
 sound/soc/intel/boards/bytcr_rt5640.c              |  12 +
 sound/soc/mediatek/mt2701/mt2701-wm8960.c          |   9 +-
 sound/soc/mediatek/mt8173/mt8173-max98090.c        |   5 +-
 sound/soc/mxs/mxs-saif.c                           |   1 +
 sound/soc/samsung/aries_wm8994.c                   |  17 +-
 sound/soc/samsung/arndale.c                        |   5 +-
 sound/soc/samsung/littlemill.c                     |   5 +-
 sound/soc/samsung/lowland.c                        |   5 +-
 sound/soc/samsung/odroid.c                         |   4 +-
 sound/soc/samsung/smdk_wm8994.c                    |   4 +-
 sound/soc/samsung/smdk_wm8994pcm.c                 |   4 +-
 sound/soc/samsung/snow.c                           |   9 +-
 sound/soc/samsung/speyside.c                       |   5 +-
 sound/soc/samsung/tm2_wm5110.c                     |   3 +-
 sound/soc/samsung/tobermory.c                      |   5 +-
 sound/soc/sh/rcar/core.c                           |  15 +-
 sound/soc/sh/rcar/dma.c                            |   9 +-
 sound/soc/sh/rcar/rsnd.h                           |   2 +-
 sound/soc/sh/rcar/src.c                            |   7 +-
 sound/soc/sh/rcar/ssi.c                            |  14 +-
 sound/soc/sh/rcar/ssiu.c                           |  11 +-
 sound/soc/sh/rz-ssi.c                              |  29 +-
 sound/soc/soc-dapm.c                               |   2 -
 sound/soc/ti/j721e-evm.c                           |  44 +-
 sound/usb/implicit.c                               |  10 +-
 sound/usb/midi.c                                   |   3 +
 sound/usb/quirks.c                                 |   6 +
 sound/usb/usbaudio.h                               |   6 +
 .../test-libbpf-btf__load_from_kernel_by_id.c      |   5 +-
 tools/lib/bpf/libbpf.c                             |  20 +-
 tools/objtool/check.c                              |   9 +-
 tools/objtool/elf.c                                | 198 ++++--
 tools/objtool/include/objtool/elf.h                |   4 +-
 tools/perf/Makefile.config                         |  39 +-
 tools/perf/builtin-c2c.c                           |   6 +-
 tools/perf/pmu-events/jevents.c                    |   2 +-
 tools/perf/util/data.h                             |   1 +
 tools/power/x86/turbostat/turbostat.c              |   1 +
 tools/testing/selftests/Makefile                   |   1 +
 tools/testing/selftests/arm64/bti/Makefile         |   4 +-
 tools/testing/selftests/bpf/Makefile               |   2 +-
 .../bpf/progs/btf_dump_test_case_syntax.c          |   2 +-
 tools/testing/selftests/bpf/progs/profiler.inc.h   |   5 +-
 .../selftests/bpf/test_bpftool_synctypes.py        |   2 +-
 tools/testing/selftests/cgroup/test_stress.sh      |   2 +-
 tools/testing/selftests/landlock/base_test.c       | 177 +++--
 tools/testing/selftests/landlock/common.h          |  66 +-
 tools/testing/selftests/landlock/fs_test.c         | 753 ++++++++++++++-------
 tools/testing/selftests/landlock/ptrace_test.c     |  40 +-
 tools/testing/selftests/resctrl/fill_buf.c         |   4 +-
 712 files changed, 6875 insertions(+), 3892 deletions(-)

From: Stephen Boyd <[email protected]>

commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae upstream.

A static key warning splat appears during early boot on arm64 systems that credit randomness from devicetrees that contain an "rng-seed" property. This is because setup_machine_fdt() is called before jump_label_init() during setup_arch(). Let's swap the order of these two calls so that jump labels are initialized before the devicetree is unflattened and the rng seed is credited.

static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init()

 WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8
 Modules linked in:
 CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff
 pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : static_key_enable_cpuslocked+0xb0/0xb8
 lr : static_key_enable_cpuslocked+0xb0/0xb8
 sp : ffffffe51c393cf0
 x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10
 x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000
 x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000
 x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020
 x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708
 x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000
 x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000
 x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027
 x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05
 x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065
 Call trace:
  static_key_enable_cpuslocked+0xb0/0xb8
  static_key_enable+0x2c/0x40
  crng_set_ready+0x24/0x30
  execute_in_process_context+0x80/0x90
  _credit_init_bits+0x100/0x154
  add_bootloader_randomness+0x64/0x78
  early_init_dt_scan_chosen+0x140/0x184
  early_init_dt_scan_nodes+0x28/0x4c
  early_init_dt_scan+0x40/0x44
  setup_machine_fdt+0x7c/0x120
  setup_arch+0x74/0x1d8
  start_kernel+0x84/0x44c
  __primary_switched+0xc0/0xc8
 ---[ end trace 0000000000000000 ]---
 random: crng init done
 Machine model: Google Lazor (rev1 - 2) with LTE

---
 arch/arm64/kernel/setup.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -307,13 +307,14 @@ void __init __no_sanitize_address setup_
 	early_fixmap_init();
 	early_ioremap_init();
 
-	setup_machine_fdt(__fdt_pointer);
-
 	/*
 	 * Initialise the static keys early as they may be enabled by the
-	 * cpufeature code and early parameters.
+	 * cpufeature code, early parameters, and DT setup.
 	 */
 	jump_label_init();
+
+	setup_machine_fdt(__fdt_pointer);
+
 	parse_early_param();
 
 	/*

Same as with the others, please also drop it from 5.15.

Thanks.

Catalin

From: Niklas Cassel <[email protected]>

commit 6045ab5fea4c849153ebeb0acb532da5f29d69c4 upstream.

bFLT binaries are usually created using elf2flt.

The linker script used by elf2flt has defined the .data section like the following for the last 19 years:

.data : {
	_sdata = . ;
	__data_start = . ;
	data_start = . ;
	*(.got.plt)
	*(.got)
	FILL(0) ;
	. = ALIGN(0x20) ;
	LONG(-1)
	. = ALIGN(0x20) ;
	...
}

It places the .got.plt input section before the .got input section. The same is true for the default linker script (ld --verbose) on most architectures except x86/x86-64.

The binfmt_flat loader should relocate all GOT entries until it encounters a -1 (the LONG(-1) in the linker script).

The problem is that the .got.plt input section starts with a GOTPLT header (which has size 16 bytes on elf64-riscv and 8 bytes on elf32-riscv), where the first word is set to -1. See the binutils implementation for riscv [1].

This causes the binfmt_flat loader to stop relocating GOT entries prematurely and thus causes the application to crash when running.

Fix this by skipping the whole GOTPLT header, since the whole GOTPLT header is reserved for the dynamic linker.

The GOTPLT header will only be skipped for bFLT binaries with flag FLAT_FLAG_GOTPIC set. This flag is unconditionally set by elf2flt if the supplied ELF binary has the symbol _GLOBAL_OFFSET_TABLE_ defined. ELF binaries without a .got input section should thus remain unaffected.

Tested on RISC-V Canaan Kendryte K210 and RISC-V QEMU nommu_virt_defconfig.

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-riscv.c;hb=binutils-2_38#l3275

---
 fs/binfmt_flat.c |   27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

@@ -433,6 +433,30 @@ static void old_reloc(unsigned long rl)
 
 /****************************************************************************/
 
+static inline u32 __user *skip_got_header(u32 __user *rp)
+{
+	if (IS_ENABLED(CONFIG_RISCV)) {
+		/*
+		 * RISC-V has a 16 byte GOT PLT header for elf64-riscv
+		 * and 8 byte GOT PLT header for elf32-riscv.
+		 * Skip the whole GOT PLT header, since it is reserved
+		 * for the dynamic linker (ld.so).
+		 */
+		u32 rp_val0, rp_val1;
+
+		if (get_user(rp_val0, rp))
+			return rp;
+		if (get_user(rp_val1, rp + 1))
+			return rp;
+
+		if (rp_val0 == 0xffffffff && rp_val1 == 0xffffffff)
+			rp += 4;
+		else if (rp_val0 == 0xffffffff)
+			rp += 2;
+	}
+	return rp;
+}
+
 static int load_flat_file(struct linux_binprm *bprm,
 		struct lib_info *libinfo, int id, unsigned long *extra_stack)
 {

@@ -782,7 +806,8 @@ static int load_flat_file(struct linux_b
 	 * image.
 	 */
 	if (flags & FLAT_FLAG_GOTPIC) {
-		for (rp = (u32 __user *)datapos; ; rp++) {
+		rp = skip_got_header((u32 __user *) datapos);
+		for (; ; rp++) {
 			u32 addr, rp_val;
 			if (get_user(rp_val, rp))
 				return -EFAULT;

From: Helge Deller <[email protected]>

commit cf936af790a3ef5f41ff687ec91bfbffee141278 upstream.

Implement fb_is_primary_device() function, so that fbcon detects if this framebuffer belongs to the default graphics card which was used to start the system.

---
 arch/parisc/include/asm/fb.h    |    4 ++++
 drivers/video/console/sticore.c |   17 +++++++++++++++++
 drivers/video/fbdev/stifb.c     |    4 ++--
 3 files changed, 23 insertions(+), 2 deletions(-)

@@ -12,9 +12,13 @@ static inline void fb_pgprotect(struct f
 	pgprot_val(vma->vm_page_prot) |= _PAGE_NO_CACHE;
 }
 
+#if defined(CONFIG_STI_CONSOLE) || defined(CONFIG_FB_STI)
+int fb_is_primary_device(struct fb_info *info);
+#else
 static inline int fb_is_primary_device(struct fb_info *info)
 {
 	return 0;
 }
+#endif
 
 #endif /* _ASM_FB_H_ */

@@ -30,6 +30,7 @@
 #include <asm/pdc.h>
 #include <asm/cacheflush.h>
 #include <asm/grfioctl.h>
+#include <asm/fb.h>
 
 #include "../fbdev/sticore.h"
 

@@ -1127,6 +1128,22 @@ int sti_call(const struct sti_struct *st
 	return ret;
 }
 
+/* check if given fb_info is the primary device */
+int fb_is_primary_device(struct fb_info *info)
+{
+	struct sti_struct *sti;
+
+	sti = sti_get_rom(0);
+
+	/* if no built-in graphics card found, allow any fb driver as default */
+	if (!sti)
+		return true;
+
+	/* return true if it's the default built-in framebuffer driver */
+	return (sti->info == info);
+}
+EXPORT_SYMBOL(fb_is_primary_device);
+
 MODULE_AUTHOR("Philipp Rumpf, Helge Deller, Thomas Bogendoerfer");
 MODULE_DESCRIPTION("Core STI driver for HP's NGLE series graphics cards in HP PARISC machines");
 MODULE_LICENSE("GPL v2");

@@ -1317,11 +1317,11 @@ static int __init stifb_init_fb(struct s
 		goto out_err3;
 	}
 
+	/* save for primary gfx device detection & unregister_framebuffer() */
+	sti->info = info;
 	if (register_framebuffer(&fb->info) < 0)
 		goto out_err4;
 
-	sti->info = info; /* save for unregister_framebuffer() */
-
 	fb_info(&fb->info, "%s %dx%d-%d frame buffer device, %s, id: %04x, mmio: 0x%04lx\n",
 		fix->id,
 		var->xres, 

From: Helge Deller <[email protected]>

commit b046f984814af7985f444150ec28716d42d00d9a upstream.

Keep the pa_path (hardware path) of the graphics card in sti_struct and use this info to give more useful info which card is currently being used.

---
 drivers/video/console/sticon.c  |    5 ++++-
 drivers/video/console/sticore.c |   15 +++++++--------
 drivers/video/fbdev/sticore.h   |    3 +++
 3 files changed, 14 insertions(+), 9 deletions(-)

@@ -46,6 +46,7 @@
 #include <linux/slab.h>
 #include <linux/font.h>
 #include <linux/crc32.h>
+#include <linux/fb.h>
 
 #include <asm/io.h>
 

@@ -392,7 +393,9 @@ static int __init sticonsole_init(void)
     for (i = 0; i < MAX_NR_CONSOLES; i++)
 	font_data[i] = STI_DEF_FONT;
 
-    pr_info("sticon: Initializing STI text console.\n");
+    pr_info("sticon: Initializing STI text console on %s at [%s]\n",
+	sticon_sti->sti_data->inq_outptr.dev_name,
+	sticon_sti->pa_path);
     console_lock();
     err = do_take_over_console(&sti_con, 0, MAX_NR_CONSOLES - 1,
 		PAGE0->mem_cons.cl_class != CL_DUPLEX);

@@ -34,7 +34,7 @@
 
 #include "../fbdev/sticore.h"
 
-#define STI_DRIVERVERSION "Version 0.9b"
+#define STI_DRIVERVERSION "Version 0.9c"
 
 static struct sti_struct *default_sti __read_mostly;
 

@@ -503,7 +503,7 @@ sti_select_fbfont(struct sti_cooked_rom
 	if (!fbfont)
 		return NULL;
 
-	pr_info("STI selected %ux%u framebuffer font %s for sticon\n",
+	pr_info("    using %ux%u framebuffer font %s\n",
 			fbfont->width, fbfont->height, fbfont->name);
 			
 	bpc = ((fbfont->width+7)/8) * fbfont->height; 

@@ -947,6 +947,7 @@ out_err:
 
 static void sticore_check_for_default_sti(struct sti_struct *sti, char *path)
 {
+	pr_info("    located at [%s]\n", sti->pa_path);
 	if (strcmp (path, default_sti_path) == 0)
 		default_sti = sti;
 }

@@ -958,7 +959,6 @@ static void sticore_check_for_default_st
  */
 static int __init sticore_pa_init(struct parisc_device *dev)
 {
-	char pa_path[21];
 	struct sti_struct *sti = NULL;
 	int hpa = dev->hpa.start;
 

@@ -971,8 +971,8 @@ static int __init sticore_pa_init(struct
 	if (!sti)
 		return 1;
 
-	print_pa_hwpath(dev, pa_path);
-	sticore_check_for_default_sti(sti, pa_path);
+	print_pa_hwpath(dev, sti->pa_path);
+	sticore_check_for_default_sti(sti, sti->pa_path);
 	return 0;
 }
 

@@ -1008,9 +1008,8 @@ static int sticore_pci_init(struct pci_d
 
 	sti = sti_try_rom_generic(rom_base, fb_base, pd);
 	if (sti) {
-		char pa_path[30];
-		print_pci_hwpath(pd, pa_path);
-		sticore_check_for_default_sti(sti, pa_path);
+		print_pci_hwpath(pd, sti->pa_path);
+		sticore_check_for_default_sti(sti, sti->pa_path);
 	}
 	
 	if (!sti) {

@@ -370,6 +370,9 @@ struct sti_struct {
 
 	/* pointer to all internal data */
 	struct sti_all_data *sti_data;
+
+	/* pa_path of this device */
+	char pa_path[24];
 };
 
 

From: Xianting Tian <[email protected]>

commit e61bf5c071148c80d091f8e7220b3b9130780ae3 upstream.

Commit 00ab027a3b82 ("RISC-V: Add kernel image sections to the resource tree") marked IORESOURCE_BUSY for reserved memory, which caused resource map failed in subsequent operations of related driver, so remove the IORESOURCE_BUSY flag. In order to prohibit userland mapping reserved memory, mark IORESOURCE_EXCLUSIVE for it.

The code to reproduce the issue,
dts:

        mem0: memory@a0000000 {
                reg = <0x0 0xa0000000 0 0x1000000>;
                no-map;
        };

        &test {
                status = "okay";
                memory-region = <&mem0>;
        };

code:

        np = of_parse_phandle(pdev->dev.of_node, "memory-region", 0);
        ret = of_address_to_resource(np, 0, &r);
        base = devm_ioremap_resource(&pdev->dev, &r);
        // base = -EBUSY

---
 arch/riscv/kernel/setup.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -199,7 +199,7 @@ static void __init init_resources(void)
 		res = &mem_res[res_idx--];
 
 		res->name = "Reserved";
-		res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+		res->flags = IORESOURCE_MEM | IORESOURCE_EXCLUSIVE;
 		res->start = __pfn_to_phys(memblock_region_reserved_base_pfn(region));
 		res->end = __pfn_to_phys(memblock_region_reserved_end_pfn(region)) - 1;
 

@@ -224,7 +224,7 @@ static void __init init_resources(void)
 
 		if (unlikely(memblock_is_nomap(region))) {
 			res->name = "Reserved";
-			res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+			res->flags = IORESOURCE_MEM | IORESOURCE_EXCLUSIVE;
 		} else {
 			res->name = "System RAM";
 			res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;

From: Alexandre Ghiti <[email protected]>

commit 35d33c76d68dfacc330a8eb477b51cc647c5a847 upstream.

Because of the stack canary feature that reads from the current task structure the stack canary value, the thread pointer register "tp" must be set before calling any C function from head.S: by chance, setup_vm and all the functions that it calls does not seem to be part of the functions where the canary check is done, but in the following commits, some functions will.

---
 arch/riscv/kernel/head.S |    1 +
 1 file changed, 1 insertion(+)

@@ -301,6 +301,7 @@ clear_bss_done:
 	REG_S a0, (a2)
 
 	/* Initialize page tables and relocate to virtual addresses */
+	la tp, init_task
 	la sp, init_thread_union + THREAD_SIZE
 	XIP_FIXUP_OFFSET sp
 #ifdef CONFIG_BUILTIN_DTB

From: Samuel Holland <[email protected]>

commit 2273272823db6f67d57761df8116ae32e7f05bed upstream.

irq_work is triggered via an IPI, but the IPI infrastructure is not included in uniprocessor kernels. As a result, irq_work never runs. Fall back to the tick-based irq_work implementation on uniprocessor configurations.

---
 arch/riscv/include/asm/irq_work.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -4,7 +4,7 @@
 
 static inline bool arch_irq_work_has_interrupt(void)
 {
-	return true;
+	return IS_ENABLED(CONFIG_SMP);
 }
 extern void arch_irq_work_raise(void);
 #endif /* _ASM_RISCV_IRQ_WORK_H */

From: Tobias Klauser <[email protected]>

commit 02d88b40cb2e9614e0117c3385afdce878f0d377 upstream.

Move the __ARCH_WANT_MEMFD_SECRET define added in commit 7bb7f2ac24a0 ("arch, mm: wire up memfd_secret system call where relevant") to <uapi/asm/unistd.h> so __NR_memfd_secret is defined when including <unistd.h> in userspace.

This allows the memfd_secret selftest to pass on riscv.

---
 arch/riscv/include/asm/unistd.h      |    1 -
 arch/riscv/include/uapi/asm/unistd.h |    1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

@@ -9,7 +9,6 @@
  */
 
 #define __ARCH_WANT_SYS_CLONE
-#define __ARCH_WANT_MEMFD_SECRET
 
 #include <uapi/asm/unistd.h>
 

@@ -21,6 +21,7 @@
 #endif /* __LP64__ */
 
 #define __ARCH_WANT_SYS_CLONE3
+#define __ARCH_WANT_MEMFD_SECRET
 
 #include <asm-generic/unistd.h>
 

From: Nathan Chancellor <[email protected]>

commit 61114e734ccb804bc12561ab4020745e02c468c2 upstream.

After commit 49b290e430d3 ("riscv: prevent compressed instructions in alternatives"), builds with LLVM's integrated assembler fail:

In file included from arch/riscv/mm/init.c:10:
In file included from ./include/linux/mm.h:29:
In file included from ./include/linux/pgtable.h:6:
In file included from ./arch/riscv/include/asm/pgtable.h:108:
./arch/riscv/include/asm/tlbflush.h:23:2: error: expected assembly-time absolute expression

          ALT_FLUSH_TLB_PAGE(__asm__ __volatile__ ("sfence.vma %0" : : "r" (addr) : "memory"));
          ^
  ./arch/riscv/include/asm/errata_list.h:33:5: note: expanded from macro 'ALT_FLUSH_TLB_PAGE'
  asm(ALTERNATIVE("sfence.vma %0", "sfence.vma", SIFIVE_VENDOR_ID,        \
      ^
  ./arch/riscv/include/asm/alternative-macros.h:187:2: note: expanded from macro 'ALTERNATIVE'
          _ALTERNATIVE_CFG(old_content, new_content, vendor_id, errata_id, CONFIG_k)
          ^
  ./arch/riscv/include/asm/alternative-macros.h:113:2: note: expanded from macro '_ALTERNATIVE_CFG'
          __ALTERNATIVE_CFG(old_c, new_c, vendor_id, errata_id, IS_ENABLED(CONFIG_k))
          ^
  ./arch/riscv/include/asm/alternative-macros.h:110:2: note: expanded from macro '__ALTERNATIVE_CFG'
          ALT_NEW_CONTENT(vendor_id, errata_id, enable, new_c)
          ^
  ./arch/riscv/include/asm/alternative-macros.h:99:3: note: expanded from macro 'ALT_NEW_CONTENT'
          ".org   . - (889b - 888b) + (887b - 886b)\n"                    \
           ^
  <inline asm>:26:6: note: instantiated into assembly here
  .org    . - (889b - 888b) + (887b - 886b)
          ^

This error happens because LLVM's integrated assembler has a one-pass design, which means it cannot figure out the instruction lengths when the .org directive is outside of the subsection that contains the instructions, which was changed by the .option directives added by the above change.

Move the .org directives before the .previous directive so that these directives are always within the same subsection, which resolves the failures and does not introduce any new issues with GNU as. This was done for arm64 in commit 966a0acce2fc ("arm64/alternatives: move length validation inside the subsection") and commit 22315a2296f4 ("arm64:
alternatives: Move length validation in alternative_{insn, endif}").

While there is no error from the assembly versions of the macro, they appear to have the same problem so just make the same change there as well so that there are no problems in the future.

---
 arch/riscv/include/asm/alternative-macros.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -23,9 +23,9 @@
 888 :
 	\new_c
 889 :
-	.previous
 	.org    . - (889b - 888b) + (887b - 886b)
 	.org    . - (887b - 886b) + (889b - 888b)
+	.previous
 	.endif
 .endm
 

@@ -60,9 +60,9 @@
 	"888 :\n"							\
 	new_c "\n"							\
 	"889 :\n"							\
-	".previous\n"							\
 	".org	. - (887b - 886b) + (889b - 888b)\n"			\
 	".org	. - (889b - 888b) + (887b - 886b)\n"			\
+	".previous\n"							\
 	".endif\n"
 
 #define __ALTERNATIVE_CFG(old_c, new_c, vendor_id, errata_id, enable) \

From: Kailang Yang <[email protected]>

commit 60571929d06b028800f27b51a7c81de1144944cf upstream.

Add new type for ALC245.

---
 sound/pci/hda/patch_realtek.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

@@ -3126,6 +3126,7 @@ enum {
 	ALC269_TYPE_ALC257,
 	ALC269_TYPE_ALC215,
 	ALC269_TYPE_ALC225,
+	ALC269_TYPE_ALC245,
 	ALC269_TYPE_ALC287,
 	ALC269_TYPE_ALC294,
 	ALC269_TYPE_ALC300,

@@ -3163,6 +3164,7 @@ static int alc269_parse_auto_config(stru
 	case ALC269_TYPE_ALC257:
 	case ALC269_TYPE_ALC215:
 	case ALC269_TYPE_ALC225:
+	case ALC269_TYPE_ALC245:
 	case ALC269_TYPE_ALC287:
 	case ALC269_TYPE_ALC294:
 	case ALC269_TYPE_ALC300:

@@ -3690,7 +3692,8 @@ static void alc225_init(struct hda_codec
 	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	bool hp1_pin_sense, hp2_pin_sense;
 
-	if (spec->codec_variant != ALC269_TYPE_ALC287)
+	if (spec->codec_variant != ALC269_TYPE_ALC287 &&
+		spec->codec_variant != ALC269_TYPE_ALC245)
 		/* required only at boot or S3 and S4 resume time */
 		if (!spec->done_hp_init ||
 			is_s3_resume(codec) ||

@@ -9879,7 +9882,10 @@ static int patch_alc269(struct hda_codec
 	case 0x10ec0245:
 	case 0x10ec0285:
 	case 0x10ec0289:
-		spec->codec_variant = ALC269_TYPE_ALC215;
+		if (alc_get_coef0(codec) & 0x0010)
+			spec->codec_variant = ALC269_TYPE_ALC245;
+		else
+			spec->codec_variant = ALC269_TYPE_ALC215;
 		spec->shutup = alc225_shutup;
 		spec->init_hook = alc225_init;
 		spec->gen.mixer_nid = 0;

From: Rik van der Kemp <[email protected]>

commit 15dad62f4bdb5dc0f0efde8181d680db9963544c upstream.

The 2022-model XPS 15 appears to use the same 4-speakers-on-ALC289 audio setup as the Dell XPS 15 9510, so requires the same quirk to enable woofer output. Tested on my own 9520.

[ Move the entry to the right position in the SSID order -- tiwai ]

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

@@ -8713,6 +8713,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x0a9d, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x0b19, "Dell XPS 15 9520", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),

From: Marios Levogiannis <[email protected]>

commit 9bfa7b36343c7d84370bc61c9ed774635b05e4eb upstream.

Set microphone pins 0x18 (rear) and 0x19 (front) to VREF_50 to fix the microphone noise on ASUS TUF B550M-PLUS which uses the ALCS1200A codec. The initial value was VREF_80.

The same issue is also present on Windows using both the default Windows driver and all tested Realtek drivers before version 6.0.9049.1. Comparing Realtek driver 6.0.9049.1 (the first one without the microphone noise) to Realtek driver 6.0.9047.1 (the last one with the microphone noise) revealed that the fix is the result of setting pins 0x18 and 0x19 to VREF_50.

This fix may also work for other boards that have been reported to have the same microphone issue and use the ALC1150 and ALCS1200A codecs, since these codecs are similar and the fix in the Realtek driver on Windows is common for both. However, it is currently enabled only for ASUS TUF B550M-PLUS as this is the only board that could be tested.

---
 sound/pci/hda/patch_realtek.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

@@ -1976,6 +1976,7 @@ enum {
 	ALC1220_FIXUP_CLEVO_PB51ED_PINS,
 	ALC887_FIXUP_ASUS_AUDIO,
 	ALC887_FIXUP_ASUS_HMIC,
+	ALCS1200A_FIXUP_MIC_VREF,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,

@@ -2521,6 +2522,14 @@ static const struct hda_fixup alc882_fix
 		.chained = true,
 		.chain_id = ALC887_FIXUP_ASUS_AUDIO,
 	},
+	[ALCS1200A_FIXUP_MIC_VREF] = {
+		.type = HDA_FIXUP_PINCTLS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x18, PIN_VREF50 }, /* rear mic */
+			{ 0x19, PIN_VREF50 }, /* front mic */
+			{}
+		}
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {

@@ -2558,6 +2567,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+	SND_PCI_QUIRK(0x1043, 0x8797, "ASUS TUF B550M-PLUS", ALCS1200A_FIXUP_MIC_VREF),
 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),

From: Takashi Iwai <[email protected]>

commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream.

At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing.

---
 sound/usb/midi.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -1145,6 +1145,9 @@ static int snd_usbmidi_output_open(struc
 
 static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
 {
+	struct usbmidi_out_port *port = substream->runtime->private_data;
+
+	cancel_work_sync(&port->ep->work);
 	return substream_open(substream, 0, 0);
 }
 

From: Johan Hovold <[email protected]>

commit e82e7c6dde91acd6748d672a44dc1980ce239f86 upstream.

At least one pl2303 device has a bcdUSB of 1.0.1 which most likely was was intended as 1.1.

Allow bcdDevice 1.0.1 but interpret it as 1.1.

---
 drivers/usb/serial/pl2303.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -421,6 +421,9 @@ static int pl2303_detect_type(struct usb
 	bcdUSB = le16_to_cpu(desc->bcdUSB);
 
 	switch (bcdUSB) {
+	case 0x101:
+		/* USB 1.0.1? Let's assume they meant 1.1... */
+		fallthrough;
 	case 0x110:
 		switch (bcdDevice) {
 		case 0x300:

From: Carl Yin(殷张成) <[email protected]>

commit 33b7af2f459df453feb0d44628d820c47fefe7a8 upstream.

The BG95 modem has 3 USB configurations that are configurable via the AT command AT+QCFGEXT="usbnet",["ecm"|"modem"|"rmnet"] which make the modem enumerate with the following interfaces, respectively:

"modem": Diag + GNSS + Modem + Modem
"ecm" : Diag + GNSS + Modem + ECM
"rmnet": Diag + GNSS + Modem + QMI
Don't support Full QMI messages (e.g WDS_START_NETWORK_INTERFACE)

A detailed description of the USB configuration for each mode follows:

+QCFGEXT: "usbnet","modem"
--------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

+QCFGEXT: "usbnet","ecm"
------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
A:  FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
I:  If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

+QCFGEXT: "usbnet","rmnet"
--------------------------

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0700 Rev= 0.00
S:  Manufacturer=Quectel, Incorporated
S:  Product=Quectel LPWA Module
S:  SerialNumber=884328a2
C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

---
 drivers/usb/serial/option.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1137,6 +1137,8 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0xff, 0x30) },	/* EM160R-GL */
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0620, 0xff, 0, 0) },
+	{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */
+	  .driver_info = RSVD(3) | ZLP },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),

From: Monish Kumar R <[email protected]>

commit 97fa5887cf283bb75ffff5f6b2c0e71794c02400 upstream.

Add USB_QUIRK_NO_LPM and USB_QUIRK_RESET_RESUME quirks for Dell usb gen 2 device to not fail during enumeration.

Found this bug on own testing

---
 drivers/usb/core/quirks.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -510,6 +510,9 @@ static const struct usb_device_id usb_qu
 	/* DJI CineSSD */
 	{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
 
+	/* DELL USB GEN2 */
+	{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
+
 	/* VCOM device */
 	{ USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
 

From: Linus Walleij <[email protected]>

commit 26ae2c942b5702f2e43d36b2a4389cfb7d616b6a upstream.

Running the driver through kasan gives an interesting splat:

  BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0x70c
  Read of size 20 at addr f1db2e64 by task swapper/0/1
  (...)
  isp1760_register from isp1760_plat_probe+0x1d8/0x220
  (...)

This happens because the loop reading the regmap fields for the different ISP1760 variants look like this:

for (i = 0; i < HC_FIELD_MAX; i++) { ... }

Meaning it expects the arrays to be at least HC_FIELD_MAX - 1 long.

However the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[], isp1763_hc_volatile_ranges[] and isp1763_dc_volatile_ranges[] are dynamically sized during compilation.

Fix this by putting an empty assignment to the [HC_FIELD_MAX] and [DC_FIELD_MAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HC_FIELD_MAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on.

---
 drivers/usb/isp1760/isp1760-core.c |    8 ++++++++
 1 file changed, 8 insertions(+)

@@ -251,6 +251,8 @@ static const struct reg_field isp1760_hc
 	[HW_DM_PULLDOWN]	= REG_FIELD(ISP176x_HC_OTG_CTRL, 2, 2),
 	[HW_DP_PULLDOWN]	= REG_FIELD(ISP176x_HC_OTG_CTRL, 1, 1),
 	[HW_DP_PULLUP]		= REG_FIELD(ISP176x_HC_OTG_CTRL, 0, 0),
+	/* Make sure the array is sized properly during compilation */
+	[HC_FIELD_MAX]		= {},
 };
 
 static const struct reg_field isp1763_hc_reg_fields[] = {

@@ -321,6 +323,8 @@ static const struct reg_field isp1763_hc
 	[HW_DM_PULLDOWN_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 2, 2),
 	[HW_DP_PULLDOWN_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 1, 1),
 	[HW_DP_PULLUP_CLEAR]	= REG_FIELD(ISP1763_HC_OTG_CTRL_CLEAR, 0, 0),
+	/* Make sure the array is sized properly during compilation */
+	[HC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_range isp1763_hc_volatile_ranges[] = {

@@ -405,6 +409,8 @@ static const struct reg_field isp1761_dc
 	[DC_CHIP_ID_HIGH]	= REG_FIELD(ISP176x_DC_CHIPID, 16, 31),
 	[DC_CHIP_ID_LOW]	= REG_FIELD(ISP176x_DC_CHIPID, 0, 15),
 	[DC_SCRATCH]		= REG_FIELD(ISP176x_DC_SCRATCH, 0, 15),
+	/* Make sure the array is sized properly during compilation */
+	[DC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_range isp1763_dc_volatile_ranges[] = {

@@ -458,6 +464,8 @@ static const struct reg_field isp1763_dc
 	[DC_CHIP_ID_HIGH]	= REG_FIELD(ISP1763_DC_CHIPID_HIGH, 0, 15),
 	[DC_CHIP_ID_LOW]	= REG_FIELD(ISP1763_DC_CHIPID_LOW, 0, 15),
 	[DC_SCRATCH]		= REG_FIELD(ISP1763_DC_SCRATCH, 0, 15),
+	/* Make sure the array is sized properly during compilation */
+	[DC_FIELD_MAX]		= {},
 };
 
 static const struct regmap_config isp1763_dc_regmap_conf = {

From: Albert Wang <[email protected]>

commit 3c5880745b4439ac64eccdb040e37fc1cc4c5406 upstream.

When dwc3_gadget_ep_cleanup_completed_requests() called to dwc3_gadget_giveback() where the dwc3 lock is released, other thread is able to execute. In this situation, usb_ep_disable() gets the chance to clear endpoint descriptor pointer which leds to the null pointer dereference problem. So needs to move the null pointer check to a proper place.

Example call stack:

Thread#1:
dwc3_thread_interrupt()
spin_lock
-> dwc3_process_event_buf()
-> dwc3_process_event_entry()

    -> dwc3_endpoint_interrupt()
     -> dwc3_gadget_endpoint_trbs_complete()
      -> dwc3_gadget_ep_cleanup_completed_requests()
       ...
       -> dwc3_giveback()
          spin_unlock
          Thread#2 executes

Thread#2:
configfs_composite_disconnect()
-> __composite_disconnect()
-> ffs_func_disable()

    -> ffs_func_set_alt()
     -> ffs_func_eps_disable()
      -> usb_ep_disable()
         wait for dwc3 spin_lock
         Thread#1 released lock
         clear endpoint.desc

---
 drivers/usb/dwc3/gadget.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -3305,14 +3305,14 @@ static bool dwc3_gadget_endpoint_trbs_co
 	struct dwc3		*dwc = dep->dwc;
 	bool			no_started_trb = true;
 
-	if (!dep->endpoint.desc)
-		return no_started_trb;
-
 	dwc3_gadget_ep_cleanup_completed_requests(dep, event, status);
 
 	if (dep->flags & DWC3_EP_END_TRANSFER_PENDING)
 		goto out;
 
+	if (!dep->endpoint.desc)
+		return no_started_trb;
+
 	if (usb_endpoint_xfer_isoc(dep->endpoint.desc) &&
 		list_empty(&dep->started_list) &&
 		(list_empty(&dep->pending_list) || status == -EXDEV))

From: Kishon Vijay Abraham I <[email protected]>

commit a44623d9279086c89f631201d993aa332f7c9e66 upstream.

It has been observed with certain PCIe USB cards (like Inateck connected to AM64 EVM or J7200 EVM) that as soon as the primary roothub is registered, port status change is handled even before xHC is running leading to cold plug USB devices not detected. For such cases, registering both the root hubs along with the second HCD is required. Add support for deferring roothub registration in usb_add_hcd(), so that both primary and secondary roothubs are registered along with the second HCD.

This patch has been added and reverted earier as it triggered a race in usb device enumeration.
That race is now fixed in 5.16-rc3, and in stable back to 5.4 commit 6cca13de26ee ("usb: hub: Fix locking issues with address0_mutex") commit 6ae6dc22d2d1 ("usb: hub: Fix usb enumeration issue due to address0 race")

---
 drivers/usb/core/hcd.c  |   29 +++++++++++++++++++++++------
 include/linux/usb/hcd.h |    2 ++
 2 files changed, 25 insertions(+), 6 deletions(-)

@@ -2816,6 +2816,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
+	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);

@@ -2976,13 +2977,26 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
+	/* starting here, usbcore will pay attention to the shared HCD roothub */
+	shared_hcd = hcd->shared_hcd;
+	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
+		retval = register_root_hub(shared_hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
+
+		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
+			usb_hcd_poll_rh_status(shared_hcd);
+	}
+
 	/* starting here, usbcore will pay attention to this root hub */
-	retval = register_root_hub(hcd);
-	if (retval != 0)
-		goto err_register_root_hub;
+	if (!HCD_DEFER_RH_REGISTER(hcd)) {
+		retval = register_root_hub(hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
 
-	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-		usb_hcd_poll_rh_status(hcd);
+		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+			usb_hcd_poll_rh_status(hcd);
+	}
 
 	return retval;
 

@@ -3020,6 +3034,7 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
+	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 

@@ -3030,6 +3045,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
+	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 

@@ -3039,7 +3055,8 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	if (rh_registered)
+		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*

@@ -124,6 +124,7 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
+#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().

@@ -134,6 +135,7 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
+#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

From: Konstantin Komarov <[email protected]>

commit 52e00ea6b26e45fb8159e3b57cdde8d3f9bdd8e9 upstream.

Update valid size if write is still in I/O queue.
Fixes xfstest generic/240

---
 fs/ntfs3/inode.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -757,6 +757,7 @@ static ssize_t ntfs_direct_IO(struct kio
 	loff_t vbo = iocb->ki_pos;
 	loff_t end;
 	int wr = iov_iter_rw(iter) & WRITE;
+	size_t iter_count = iov_iter_count(iter);
 	loff_t valid;
 	ssize_t ret;
 

@@ -770,10 +771,13 @@ static ssize_t ntfs_direct_IO(struct kio
 				 wr ? ntfs_get_block_direct_IO_W
 				    : ntfs_get_block_direct_IO_R);
 
-	if (ret <= 0)
+	if (ret > 0)
+		end = vbo + ret;
+	else if (wr && ret == -EIOCBQUEUED)
+		end = vbo + iter_count;
+	else
 		goto out;
 
-	end = vbo + ret;
 	valid = ni->i_valid;
 	if (wr) {
 		if (end > valid && !S_ISBLK(inode->i_mode)) {

From: Konstantin Komarov <[email protected]>

commit 3880f2b816a7e4ca889b7e8a42e6c62c5706ed36 upstream.

Two problems:
1. ntfs3_setattr can't truncate preallocated space;
2. if allocated fragment "cross" valid size, then fragment splits into two parts:
- normal part;
- unwritten part (here we must return FIEMAP_EXTENT_LAST).
Before this commit we returned FIEMAP_EXTENT_LAST for whole fragment. Fixes xfstest generic/092

---
 fs/ntfs3/file.c    |    2 +-
 fs/ntfs3/frecord.c |   10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

@@ -761,7 +761,7 @@ int ntfs3_setattr(struct user_namespace
 		}
 		inode_dio_wait(inode);
 
-		if (attr->ia_size < oldsize)
+		if (attr->ia_size <= oldsize)
 			err = ntfs_truncate(inode, attr->ia_size);
 		else if (attr->ia_size > oldsize)
 			err = ntfs_extend(inode, attr->ia_size, 0, NULL);

@@ -1964,10 +1964,8 @@ int ni_fiemap(struct ntfs_inode *ni, str
 
 		vcn += clen;
 
-		if (vbo + bytes >= end) {
+		if (vbo + bytes >= end)
 			bytes = end - vbo;
-			flags |= FIEMAP_EXTENT_LAST;
-		}
 
 		if (vbo + bytes <= valid) {
 			;

@@ -1977,6 +1975,9 @@ int ni_fiemap(struct ntfs_inode *ni, str
 			/* vbo < valid && valid < vbo + bytes */
 			u64 dlen = valid - vbo;
 
+			if (vbo + dlen >= end)
+				flags |= FIEMAP_EXTENT_LAST;
+
 			err = fiemap_fill_next_extent(fieinfo, vbo, lbo, dlen,
 						      flags);
 			if (err < 0)

@@ -1995,6 +1996,9 @@ int ni_fiemap(struct ntfs_inode *ni, str
 			flags |= FIEMAP_EXTENT_UNWRITTEN;
 		}
 
+		if (vbo + bytes >= end)
+			flags |= FIEMAP_EXTENT_LAST;
+
 		err = fiemap_fill_next_extent(fieinfo, vbo, lbo, bytes, flags);
 		if (err < 0)
 			break;

From: Konstantin Komarov <[email protected]>

commit e95113ed4d428219e3395044e29f5713fc446720 upstream.

If size of file was reduced, we still kept allocated blocks. This commit makes ntfs3 work as other fs like btrfs.

---
 fs/ntfs3/file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -494,7 +494,7 @@ static int ntfs_truncate(struct inode *i
 
 	down_write(&ni->file.run_lock);
 	err = attr_set_size(ni, ATTR_DATA, NULL, 0, &ni->file.run, new_size,
-			    &new_valid, true, NULL);
+			    &new_valid, ni->mi.sbi->options->prealloc, NULL);
 	up_write(&ni->file.run_lock);
 
 	if (new_valid < ni->i_valid)

From: Konstantin Komarov <[email protected]>

commit 114346978cf61de02832cc3cc68432a3de70fb38 upstream.

We must check size before trying to allocate.
Size can be set for example by "ulimit -f".
Fixes xfstest generic/228

---
 fs/ntfs3/file.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

@@ -661,7 +661,13 @@ static long ntfs_fallocate(struct file *
 		/*
 		 * Normal file: Allocate clusters, do not change 'valid' size.
 		 */
-		err = ntfs_set_size(inode, max(end, i_size));
+		loff_t new_size = max(end, i_size);
+
+		err = inode_newsize_ok(inode, new_size);
+		if (err)
+			goto out;
+
+		err = ntfs_set_size(inode, new_size);
 		if (err)
 			goto out;
 

From: Konstantin Komarov <[email protected]>

commit 9186d472ee780fabf74424756c4c00545166157e upstream.

ntfs_init_acl sets mode. ntfs_init_acl calls ntfs_set_acl_ex. ntfs_set_acl_ex must not change this mode.
Fixes xfstest generic/444

---
 fs/ntfs3/xattr.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

@@ -541,7 +541,7 @@ struct posix_acl *ntfs_get_acl(struct in
 
 static noinline int ntfs_set_acl_ex(struct user_namespace *mnt_userns,
 				    struct inode *inode, struct posix_acl *acl,
-				    int type)
+				    int type, bool init_acl)
 {
 	const char *name;
 	size_t size, name_len;

@@ -554,8 +554,9 @@ static noinline int ntfs_set_acl_ex(stru
 
 	switch (type) {
 	case ACL_TYPE_ACCESS:
-		if (acl) {
-			umode_t mode = inode->i_mode;
+		/* Do not change i_mode if we are in init_acl */
+		if (acl && !init_acl) {
+			umode_t mode;
 
 			err = posix_acl_update_mode(mnt_userns, inode, &mode,
 						    &acl);

@@ -616,7 +617,7 @@ out:
 int ntfs_set_acl(struct user_namespace *mnt_userns, struct inode *inode,
 		 struct posix_acl *acl, int type)
 {
-	return ntfs_set_acl_ex(mnt_userns, inode, acl, type);
+	return ntfs_set_acl_ex(mnt_userns, inode, acl, type, false);
 }
 
 /*

@@ -636,7 +637,7 @@ int ntfs_init_acl(struct user_namespace
 
 	if (default_acl) {
 		err = ntfs_set_acl_ex(mnt_userns, inode, default_acl,
-				      ACL_TYPE_DEFAULT);
+				      ACL_TYPE_DEFAULT, true);
 		posix_acl_release(default_acl);
 	} else {
 		inode->i_default_acl = NULL;

@@ -647,7 +648,7 @@ int ntfs_init_acl(struct user_namespace
 	else {
 		if (!err)
 			err = ntfs_set_acl_ex(mnt_userns, inode, acl,
-					      ACL_TYPE_ACCESS);
+					      ACL_TYPE_ACCESS, true);
 		posix_acl_release(acl);
 	}
 

From: Christophe JAILLET <[email protected]>

commit e589f9b7078e1c0191613cd736f598e81d2390de upstream.

All error handling paths lead to 'out' where many resources are freed.

Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak.

---
 fs/ntfs3/fslog.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -4085,8 +4085,10 @@ process_log:
 		if (client == LFS_NO_CLIENT_LE) {
 			/* Insert "NTFS" client LogFile. */
 			client = ra->client_idx[0];
-			if (client == LFS_NO_CLIENT_LE)
-				return -EINVAL;
+			if (client == LFS_NO_CLIENT_LE) {
+				err = -EINVAL;
+				goto out;
+			}
 
 			t16 = le16_to_cpu(client);
 			cr = ca + t16;

From: Konstantin Komarov <[email protected]>

commit 2d44667c306e7806848a3478820f87343feb5421 upstream.

Ctime wasn't updated after setfacl command.
This commit fixes xfstest generic/307

---
 fs/ntfs3/xattr.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -902,6 +902,9 @@ set_new_fa:
 	err = ntfs_set_ea(inode, name, name_len, value, size, flags);
 
 out:
+	inode->i_ctime = current_time(inode);
+	mark_inode_dirty(inode);
+
 	return err;
 }
 

From: Konstantin Komarov <[email protected]>

commit 87e21c99bad763524c953ff4d1a61ee19038ddc2 upstream.

Apparently we need to maintain these functions with ntfs_get_acl_ex and ntfs_set_acl_ex.
This commit fixes xfstest generic/099

---
 fs/ntfs3/xattr.c |   96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 95 insertions(+), 1 deletion(-)

@@ -112,7 +112,7 @@ static int ntfs_read_ea(struct ntfs_inod
 		return -ENOMEM;
 
 	if (!size) {
-		;
+		/* EA info persists, but xattr is empty. Looks like EA problem. */
 	} else if (attr_ea->non_res) {
 		struct runs_tree run;
 

@@ -620,6 +620,67 @@ int ntfs_set_acl(struct user_namespace *
 	return ntfs_set_acl_ex(mnt_userns, inode, acl, type, false);
 }
 
+static int ntfs_xattr_get_acl(struct user_namespace *mnt_userns,
+			      struct inode *inode, int type, void *buffer,
+			      size_t size)
+{
+	struct posix_acl *acl;
+	int err;
+
+	if (!(inode->i_sb->s_flags & SB_POSIXACL)) {
+		ntfs_inode_warn(inode, "add mount option \"acl\" to use acl");
+		return -EOPNOTSUPP;
+	}
+
+	acl = ntfs_get_acl(inode, type, false);
+	if (IS_ERR(acl))
+		return PTR_ERR(acl);
+
+	if (!acl)
+		return -ENODATA;
+
+	err = posix_acl_to_xattr(mnt_userns, acl, buffer, size);
+	posix_acl_release(acl);
+
+	return err;
+}
+
+static int ntfs_xattr_set_acl(struct user_namespace *mnt_userns,
+			      struct inode *inode, int type, const void *value,
+			      size_t size)
+{
+	struct posix_acl *acl;
+	int err;
+
+	if (!(inode->i_sb->s_flags & SB_POSIXACL)) {
+		ntfs_inode_warn(inode, "add mount option \"acl\" to use acl");
+		return -EOPNOTSUPP;
+	}
+
+	if (!inode_owner_or_capable(mnt_userns, inode))
+		return -EPERM;
+
+	if (!value) {
+		acl = NULL;
+	} else {
+		acl = posix_acl_from_xattr(mnt_userns, value, size);
+		if (IS_ERR(acl))
+			return PTR_ERR(acl);
+
+		if (acl) {
+			err = posix_acl_valid(mnt_userns, acl);
+			if (err)
+				goto release_and_out;
+		}
+	}
+
+	err = ntfs_set_acl(mnt_userns, inode, acl, type);
+
+release_and_out:
+	posix_acl_release(acl);
+	return err;
+}
+
 /*
  * ntfs_init_acl - Initialize the ACLs of a new inode.
  *

@@ -786,6 +847,23 @@ static int ntfs_getxattr(const struct xa
 		goto out;
 	}
 
+#ifdef CONFIG_NTFS3_FS_POSIX_ACL
+	if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
+		     sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) ||
+	    (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
+		     sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) {
+		/* TODO: init_user_ns? */
+		err = ntfs_xattr_get_acl(
+			&init_user_ns, inode,
+			name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1
+				? ACL_TYPE_ACCESS
+				: ACL_TYPE_DEFAULT,
+			buffer, size);
+		goto out;
+	}
+#endif
 	/* Deal with NTFS extended attribute. */
 	err = ntfs_get_ea(inode, name, name_len, buffer, size, NULL);
 

@@ -898,6 +976,22 @@ set_new_fa:
 		goto out;
 	}
 
+#ifdef CONFIG_NTFS3_FS_POSIX_ACL
+	if ((name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
+		     sizeof(XATTR_NAME_POSIX_ACL_ACCESS))) ||
+	    (name_len == sizeof(XATTR_NAME_POSIX_ACL_DEFAULT) - 1 &&
+	     !memcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
+		     sizeof(XATTR_NAME_POSIX_ACL_DEFAULT)))) {
+		err = ntfs_xattr_set_acl(
+			mnt_userns, inode,
+			name_len == sizeof(XATTR_NAME_POSIX_ACL_ACCESS) - 1
+				? ACL_TYPE_ACCESS
+				: ACL_TYPE_DEFAULT,
+			value, size);
+		goto out;
+	}
+#endif
 	/* Deal with NTFS extended attribute. */
 	err = ntfs_set_ea(inode, name, name_len, value, size, flags);
 

From: Ronnie Sahlberg <[email protected]>

commit 8378a51e3f8140f60901fb27208cc7a6e47047b5 upstream.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799

---
 fs/cifs/cifsfs.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

@@ -826,7 +826,7 @@ cifs_smb3_do_mount(struct file_system_ty
 	      int flags, struct smb3_fs_context *old_ctx)
 {
 	int rc;
-	struct super_block *sb;
+	struct super_block *sb = NULL;
 	struct cifs_sb_info *cifs_sb = NULL;
 	struct cifs_mnt_data mnt_data;
 	struct dentry *root;

@@ -922,9 +922,11 @@ out_super:
 	return root;
 out:
 	if (cifs_sb) {
-		kfree(cifs_sb->prepath);
-		smb3_cleanup_fs_context(cifs_sb->ctx);
-		kfree(cifs_sb);
+		if (!sb || IS_ERR(sb)) {  /* otherwise kill_sb will handle */
+			kfree(cifs_sb->prepath);
+			smb3_cleanup_fs_context(cifs_sb->ctx);
+			kfree(cifs_sb);
+		}
 	}
 	return root;
 }

From: Ronnie Sahlberg <[email protected]>

commit f66f8b94e7f2f4ac9fffe710be231ca8f25c5057 upstream.

as this is the only way to make sure the region is allocated. Fix the conditional that was wrong and only tried to make already non-sparse files non-sparse.

---
 fs/cifs/smb2ops.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -3791,7 +3791,7 @@ static long smb3_simple_falloc(struct fi
 		if (rc)
 			goto out;
 
-		if ((cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) == 0)
+		if (cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE)
 			smb2_set_sparse(xid, tcon, cfile, inode, false);
 
 		eof = cpu_to_le64(off + len);

From: Mathias Nyman <[email protected]>

commit 74f55a62c4c354f43a6d75f77dd184c4f57b9a26 upstream.

Alder Lake N TCSS xHCI needs to be runtime suspended whenever possible to allow the TCSS hardware block to enter D3 and thus save energy

---
 drivers/usb/host/xhci-pci.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -59,6 +59,7 @@
 #define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI		0x9a13
 #define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI		0x1138
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI		0x461e
+#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI		0x464e
 #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI	0x51ed
 
 #define PCI_DEVICE_ID_AMD_RENOIR_XHCI			0x1639

@@ -268,6 +269,7 @@ static void xhci_pci_quirks(struct devic
 	     pdev->device == PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_XHCI ||
 	     pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI))
 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
 

From: Michael Niewöhner <[email protected]>

commit 1620c80bba53af8c547bab34a1d3bc58319fe608 upstream.

intel_hid_dsm_fn_mask is a bit mask containing one bit for each function index. Fix the function index check in intel_hid_evaluate_method accordingly, which was missed in commit 97ab4516205e ("platform/x86:
intel-hid: fix _DSM function index handling").

---
 drivers/platform/x86/intel/hid.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -245,7 +245,7 @@ static bool intel_hid_evaluate_method(ac
 
 	method_name = (char *)intel_hid_dsm_fn_to_method[fn_index];
 
-	if (!(intel_hid_dsm_fn_mask & fn_index))
+	if (!(intel_hid_dsm_fn_mask & BIT(fn_index)))
 		goto skip_dsm_eval;
 
 	obj = acpi_evaluate_dsm_typed(handle, &intel_dsm_guid,

From: Ammar Faizi <[email protected]>

commit e5f28623ceb103e13fc3d7bd45edf9818b227fd0 upstream.

In mce_threshold_create_device(), if threshold_create_bank() fails, the previously allocated threshold banks array @bp will be leaked because the call to mce_threshold_remove_device() will not free it.

This happens because mce_threshold_remove_device() fetches the pointer through the threshold_banks per-CPU variable but bp is written there only after the bank creation is successful, and not before, when threshold_create_bank() fails.

Add a helper which unwinds all the bank creation work previously done and pass into it the previously allocated threshold banks array for freeing.

[ bp: Massage. ]

---
 arch/x86/kernel/cpu/mce/amd.c |   32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

@@ -1470,10 +1470,23 @@ out_free:
 	kfree(bank);
 }
 
+static void __threshold_remove_device(struct threshold_bank **bp)
+{
+	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
+
+	for (bank = 0; bank < numbanks; bank++) {
+		if (!bp[bank])
+			continue;
+
+		threshold_remove_bank(bp[bank]);
+		bp[bank] = NULL;
+	}
+	kfree(bp);
+}
+
 int mce_threshold_remove_device(unsigned int cpu)
 {
 	struct threshold_bank **bp = this_cpu_read(threshold_banks);
-	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
 
 	if (!bp)
 		return 0;

@@ -1484,13 +1497,7 @@ int mce_threshold_remove_device(unsigned
 	 */
 	this_cpu_write(threshold_banks, NULL);
 
-	for (bank = 0; bank < numbanks; bank++) {
-		if (bp[bank]) {
-			threshold_remove_bank(bp[bank]);
-			bp[bank] = NULL;
-		}
-	}
-	kfree(bp);
+	__threshold_remove_device(bp);
 	return 0;
 }
 

@@ -1527,15 +1534,14 @@ int mce_threshold_create_device(unsigned
 		if (!(this_cpu_read(bank_map) & (1 << bank)))
 			continue;
 		err = threshold_create_bank(bp, cpu, bank);
-		if (err)
-			goto out_err;
+		if (err) {
+			__threshold_remove_device(bp);
+			return err;
+		}
 	}
 	this_cpu_write(threshold_banks, bp);
 
 	if (thresholding_irq_en)
 		mce_threshold_vector = amd_threshold_interrupt;
 	return 0;
-out_err:
-	mce_threshold_remove_device(cpu);
-	return err;
 }

From: Kan Liang <[email protected]>

commit 86dca369075b3e310c3c0adb0f81e513c562b5e4 upstream.

According to the latest event list, the event encoding 0x55 INST_DECODED.DECODERS and 0x56 UOPS_DECODED.DEC0 are only available on the first 4 counters. Add them into the event constraints table.

---
 arch/x86/events/intel/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -255,7 +255,7 @@ static struct event_constraint intel_icl
 	INTEL_EVENT_CONSTRAINT_RANGE(0x03, 0x0a, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x1f, 0x28, 0xf),
 	INTEL_EVENT_CONSTRAINT(0x32, 0xf),	/* SW_PREFETCH_ACCESS.* */
-	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x54, 0xf),
+	INTEL_EVENT_CONSTRAINT_RANGE(0x48, 0x56, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0x60, 0x8b, 0xf),
 	INTEL_UEVENT_CONSTRAINT(0x04a3, 0xff),  /* CYCLE_ACTIVITY.STALLS_TOTAL */
 	INTEL_UEVENT_CONSTRAINT(0x10a3, 0xff),  /* CYCLE_ACTIVITY.CYCLES_MEM_ANY */

From: Baoquan He <[email protected]>

commit b3e34a47f98974d0844444c5121aaff123004e57 upstream.

This is reported by kmemleak detector:

unreferenced object 0xffffc900002a9000 (size 4096):
comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes):

    7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............
    04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00  ..>.............
  backtrace:
    [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170
    [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160
    [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0
    [<0000000019afff23>] crash_load_segments+0x260/0x470
    [<0000000019ebe95c>] bzImage64_load+0x814/0xad0
    [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0
    [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0
    [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530
    [<0000000087c19992>] do_syscall_64+0x3b/0x90
    [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae

In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there.

And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place.

Three different people have reported three bugs about the memory leak on x86_64 inside Redhat.

---
 arch/x86/kernel/machine_kexec_64.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

@@ -373,9 +373,6 @@ void machine_kexec(struct kimage *image)
 #ifdef CONFIG_KEXEC_FILE
 void *arch_kexec_kernel_image_load(struct kimage *image)
 {
-	vfree(image->elf_headers);
-	image->elf_headers = NULL;
-
 	if (!image->fops || !image->fops->load)
 		return ERR_PTR(-ENOEXEC);
 

@@ -511,6 +508,15 @@ overflow:
 	       (int)ELF64_R_TYPE(rel[i].r_info), value);
 	return -ENOEXEC;
 }
+
+int arch_kimage_file_post_load_cleanup(struct kimage *image)
+{
+	vfree(image->elf_headers);
+	image->elf_headers = NULL;
+	image->elf_headers_sz = 0;
+
+	return kexec_image_post_load_cleanup_default(image);
+}
 #endif /* CONFIG_KEXEC_FILE */
 
 static int

From: Kristen Carlson Accardi <[email protected]>

commit 0c9782e204d3cc5625b9e8bf4e8625d38dfe0139 upstream.

When the system runs out of enclave memory, SGX can reclaim EPC pages by swapping to normal RAM. These backing pages are allocated via a per-enclave shared memory area. Since SGX allows unlimited over commit on EPC memory, the reclaimer thread can allocate a large number of backing RAM pages in response to EPC memory pressure.

When the shared memory backing RAM allocation occurs during the reclaimer thread context, the shared memory is charged to the root memory control group, and the shmem usage of the enclave is not properly accounted for, making cgroups ineffective at limiting the amount of RAM an enclave can consume.

For example, when using a cgroup to launch a set of test enclaves, the kernel does not properly account for 50% - 75% of shmem page allocations on average. In the worst case, when nearly all allocations occur during the reclaimer thread, the kernel accounts less than a percent of the amount of shmem used by the enclave's cgroup to the correct cgroup.

SGX stores a list of mm_structs that are associated with an enclave. Pick one of them during reclaim and charge that mm's memcg with the shmem allocation. The one that gets picked is arbitrary, but this list almost always only has one mm. The cases where there is more than one mm with different memcg's are not worth considering.

Create a new function - sgx_encl_alloc_backing(). This function is used whenever a new backing storage page needs to be allocated. Previously the same function was used for page allocation as well as retrieving a previously allocated page. Prior to backing page allocation, if there is a mm_struct associated with the enclave that is requesting the allocation, it is set as the active memory control group.

[ dhansen: - fix merge conflict with ELDU fixes
- check against actual ksgxd_tsk, not ->mm ]

---
 arch/x86/kernel/cpu/sgx/encl.c |  105 ++++++++++++++++++++++++++++++++++++++++-
 arch/x86/kernel/cpu/sgx/encl.h |    7 +-
 arch/x86/kernel/cpu/sgx/main.c |    9 ++-
 3 files changed, 115 insertions(+), 6 deletions(-)

@@ -152,7 +152,7 @@ static int __sgx_encl_eldu(struct sgx_en
 
 	page_pcmd_off = sgx_encl_get_backing_page_pcmd_offset(encl, page_index);
 
-	ret = sgx_encl_get_backing(encl, page_index, &b);
+	ret = sgx_encl_lookup_backing(encl, page_index, &b);
 	if (ret)
 		return ret;
 

@@ -718,7 +718,7 @@ static struct page *sgx_encl_get_backing
  *   0 on success,
  *   -errno otherwise.
  */
-int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
+static int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
 			 struct sgx_backing *backing)
 {
 	pgoff_t page_pcmd_off = sgx_encl_get_backing_page_pcmd_offset(encl, page_index);

@@ -743,6 +743,107 @@ int sgx_encl_get_backing(struct sgx_encl
 	return 0;
 }
 
+/*
+ * When called from ksgxd, returns the mem_cgroup of a struct mm stored
+ * in the enclave's mm_list. When not called from ksgxd, just returns
+ * the mem_cgroup of the current task.
+ */
+static struct mem_cgroup *sgx_encl_get_mem_cgroup(struct sgx_encl *encl)
+{
+	struct mem_cgroup *memcg = NULL;
+	struct sgx_encl_mm *encl_mm;
+	int idx;
+
+	/*
+	 * If called from normal task context, return the mem_cgroup
+	 * of the current task's mm. The remainder of the handling is for
+	 * ksgxd.
+	 */
+	if (!current_is_ksgxd())
+		return get_mem_cgroup_from_mm(current->mm);
+
+	/*
+	 * Search the enclave's mm_list to find an mm associated with
+	 * this enclave to charge the allocation to.
+	 */
+	idx = srcu_read_lock(&encl->srcu);
+
+	list_for_each_entry_rcu(encl_mm, &encl->mm_list, list) {
+		if (!mmget_not_zero(encl_mm->mm))
+			continue;
+
+		memcg = get_mem_cgroup_from_mm(encl_mm->mm);
+
+		mmput_async(encl_mm->mm);
+
+		break;
+	}
+
+	srcu_read_unlock(&encl->srcu, idx);
+
+	/*
+	 * In the rare case that there isn't an mm associated with
+	 * the enclave, set memcg to the current active mem_cgroup.
+	 * This will be the root mem_cgroup if there is no active
+	 * mem_cgroup.
+	 */
+	if (!memcg)
+		return get_mem_cgroup_from_mm(NULL);
+
+	return memcg;
+}
+
+/**
+ * sgx_encl_alloc_backing() - allocate a new backing storage page
+ * @encl:	an enclave pointer
+ * @page_index:	enclave page index
+ * @backing:	data for accessing backing storage for the page
+ *
+ * When called from ksgxd, sets the active memcg from one of the
+ * mms in the enclave's mm_list prior to any backing page allocation,
+ * in order to ensure that shmem page allocations are charged to the
+ * enclave.
+ *
+ * Return:
+ *   0 on success,
+ *   -errno otherwise.
+ */
+int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing)
+{
+	struct mem_cgroup *encl_memcg = sgx_encl_get_mem_cgroup(encl);
+	struct mem_cgroup *memcg = set_active_memcg(encl_memcg);
+	int ret;
+
+	ret = sgx_encl_get_backing(encl, page_index, backing);
+
+	set_active_memcg(memcg);
+	mem_cgroup_put(encl_memcg);
+
+	return ret;
+}
+
+/**
+ * sgx_encl_lookup_backing() - retrieve an existing backing storage page
+ * @encl:	an enclave pointer
+ * @page_index:	enclave page index
+ * @backing:	data for accessing backing storage for the page
+ *
+ * Retrieve a backing page for loading data back into an EPC page with ELDU.
+ * It is the caller's responsibility to ensure that it is appropriate to use
+ * sgx_encl_lookup_backing() rather than sgx_encl_alloc_backing(). If lookup is
+ * not used correctly, this will cause an allocation which is not accounted for.
+ *
+ * Return:
+ *   0 on success,
+ *   -errno otherwise.
+ */
+int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing)
+{
+	return sgx_encl_get_backing(encl, page_index, backing);
+}
+
 /**
  * sgx_encl_put_backing() - Unpin the backing storage
  * @backing:	data for accessing backing storage for the page

@@ -103,10 +103,13 @@ static inline int sgx_encl_find(struct m
 int sgx_encl_may_map(struct sgx_encl *encl, unsigned long start,
 		     unsigned long end, unsigned long vm_flags);
 
+bool current_is_ksgxd(void);
 void sgx_encl_release(struct kref *ref);
 int sgx_encl_mm_add(struct sgx_encl *encl, struct mm_struct *mm);
-int sgx_encl_get_backing(struct sgx_encl *encl, unsigned long page_index,
-			 struct sgx_backing *backing);
+int sgx_encl_lookup_backing(struct sgx_encl *encl, unsigned long page_index,
+			    struct sgx_backing *backing);
+int sgx_encl_alloc_backing(struct sgx_encl *encl, unsigned long page_index,
+			   struct sgx_backing *backing);
 void sgx_encl_put_backing(struct sgx_backing *backing);
 int sgx_encl_test_and_clear_young(struct mm_struct *mm,
 				  struct sgx_encl_page *page);

@@ -292,7 +292,7 @@ static void sgx_reclaimer_write(struct s
 	sgx_encl_put_backing(backing);
 
 	if (!encl->secs_child_cnt && test_bit(SGX_ENCL_INITIALIZED, &encl->flags)) {
-		ret = sgx_encl_get_backing(encl, PFN_DOWN(encl->size),
+		ret = sgx_encl_alloc_backing(encl, PFN_DOWN(encl->size),
 					   &secs_backing);
 		if (ret)
 			goto out;

@@ -365,7 +365,7 @@ static void sgx_reclaim_pages(void)
 		page_index = PFN_DOWN(encl_page->desc - encl_page->encl->base);
 
 		mutex_lock(&encl_page->encl->lock);
-		ret = sgx_encl_get_backing(encl_page->encl, page_index, &backing[i]);
+		ret = sgx_encl_alloc_backing(encl_page->encl, page_index, &backing[i]);
 		if (ret) {
 			mutex_unlock(&encl_page->encl->lock);
 			goto skip;

@@ -462,6 +462,11 @@ static bool __init sgx_page_reclaimer_in
 	return true;
 }
 
+bool current_is_ksgxd(void)
+{
+	return current == ksgxd_tsk;
+}
+
 static struct sgx_epc_page *__sgx_alloc_epc_page_from_node(int nid)
 {
 	struct sgx_numa_node *node = &sgx_numa_nodes[nid];

From: Eric W. Biederman <[email protected]>

commit c200e4bb44e80b343c09841e7caaaca0aac5e5fa upstream.

User mode linux is the last user of the PT_DTRACE flag. Using the flag to indicate single stepping is a little confusing and worse changing tsk->ptrace without locking could potentionally cause problems.

So use a thread info flag with a better name instead of flag in tsk->ptrace.

Remove the definition PT_DTRACE as uml is the last user.

---
 arch/um/include/asm/thread_info.h |    2 ++
 arch/um/kernel/exec.c             |    2 +-
 arch/um/kernel/process.c          |    2 +-
 arch/um/kernel/ptrace.c           |    8 ++++----
 arch/um/kernel/signal.c           |    4 ++--
 include/linux/ptrace.h            |    1 -
 6 files changed, 10 insertions(+), 9 deletions(-)

@@ -64,6 +64,7 @@ static inline struct thread_info *curren
 #define TIF_RESTORE_SIGMASK	7
 #define TIF_NOTIFY_RESUME	8
 #define TIF_SECCOMP		9	/* secure computing */
+#define TIF_SINGLESTEP		10	/* single stepping userspace */
 
 #define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING		(1 << TIF_SIGPENDING)

@@ -72,5 +73,6 @@ static inline struct thread_info *curren
 #define _TIF_MEMDIE		(1 << TIF_MEMDIE)
 #define _TIF_SYSCALL_AUDIT	(1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP		(1 << TIF_SECCOMP)
+#define _TIF_SINGLESTEP		(1 << TIF_SINGLESTEP)
 
 #endif

@@ -42,7 +42,7 @@ void start_thread(struct pt_regs *regs,
 {
 	PT_REGS_IP(regs) = eip;
 	PT_REGS_SP(regs) = esp;
-	current->ptrace &= ~PT_DTRACE;
+	clear_thread_flag(TIF_SINGLESTEP);
 #ifdef SUBARCH_EXECVE1
 	SUBARCH_EXECVE1(regs->regs);
 #endif

@@ -339,7 +339,7 @@ int singlestepping(void * t)
 {
 	struct task_struct *task = t ? t : current;
 
-	if (!(task->ptrace & PT_DTRACE))
+	if (!test_thread_flag(TIF_SINGLESTEP))
 		return 0;
 
 	if (task->thread.singlestep_syscall)

@@ -12,7 +12,7 @@
 
 void user_enable_single_step(struct task_struct *child)
 {
-	child->ptrace |= PT_DTRACE;
+	set_tsk_thread_flag(child, TIF_SINGLESTEP);
 	child->thread.singlestep_syscall = 0;
 
 #ifdef SUBARCH_SET_SINGLESTEPPING

@@ -22,7 +22,7 @@ void user_enable_single_step(struct task
 
 void user_disable_single_step(struct task_struct *child)
 {
-	child->ptrace &= ~PT_DTRACE;
+	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 	child->thread.singlestep_syscall = 0;
 
 #ifdef SUBARCH_SET_SINGLESTEPPING

@@ -121,7 +121,7 @@ static void send_sigtrap(struct uml_pt_r
 }
 
 /*
- * XXX Check PT_DTRACE vs TIF_SINGLESTEP for singlestepping check and
+ * XXX Check TIF_SINGLESTEP for singlestepping check and
  * PT_PTRACED vs TIF_SYSCALL_TRACE for syscall tracing check
  */
 int syscall_trace_enter(struct pt_regs *regs)

@@ -145,7 +145,7 @@ void syscall_trace_leave(struct pt_regs
 	audit_syscall_exit(regs);
 
 	/* Fake a debug trap */
-	if (ptraced & PT_DTRACE)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		send_sigtrap(&regs->regs, 0);
 
 	if (!test_thread_flag(TIF_SYSCALL_TRACE))

@@ -53,7 +53,7 @@ static void handle_signal(struct ksignal
 	unsigned long sp;
 	int err;
 
-	if ((current->ptrace & PT_DTRACE) && (current->ptrace & PT_PTRACED))
+	if (test_thread_flag(TIF_SINGLESTEP) && (current->ptrace & PT_PTRACED))
 		singlestep = 1;
 
 	/* Did we come from a system call? */

@@ -128,7 +128,7 @@ void do_signal(struct pt_regs *regs)
 	 * on the host.  The tracing thread will check this flag and
 	 * PTRACE_SYSCALL if necessary.
 	 */
-	if (current->ptrace & PT_DTRACE)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		current->thread.singlestep_syscall =
 			is_syscall(PT_REGS_IP(&current->thread.regs));
 

@@ -30,7 +30,6 @@ extern int ptrace_access_vm(struct task_
 
 #define PT_SEIZED	0x00010000	/* SEIZE used, enable new behavior */
 #define PT_PTRACED	0x00000001
-#define PT_DTRACE	0x00000002	/* delayed trace (used on m68k, i386) */
 
 #define PT_OPT_FLAG_SHIFT	3
 /* PT_TRACE_* event enable flags */

From: Eric W. Biederman <[email protected]>

commit 4a3d2717d140401df7501a95e454180831a0c5af upstream.

xtensa is the last user of the PT_SINGLESTEP flag. Changing tsk->ptrace in user_enable_single_step and user_disable_single_step without locking could potentiallly cause problems.

So use a thread info flag instead of a flag in tsk->ptrace. Use TIF_SINGLESTEP that xtensa already had defined but unused.

Remove the definitions of PT_SINGLESTEP and PT_BLOCKSTEP as they have no more users.

---
 arch/xtensa/kernel/ptrace.c |    4 ++--
 arch/xtensa/kernel/signal.c |    4 ++--
 include/linux/ptrace.h      |    6 ------
 3 files changed, 4 insertions(+), 10 deletions(-)

@@ -226,12 +226,12 @@ const struct user_regset_view *task_user
 
 void user_enable_single_step(struct task_struct *child)
 {
-	child->ptrace |= PT_SINGLESTEP;
+	set_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 void user_disable_single_step(struct task_struct *child)
 {
-	child->ptrace &= ~PT_SINGLESTEP;
+	clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 /*

@@ -465,7 +465,7 @@ static void do_signal(struct pt_regs *re
 		/* Set up the stack frame */
 		ret = setup_frame(&ksig, sigmask_to_save(), regs);
 		signal_setup_done(ret, &ksig, 0);
-		if (current->ptrace & PT_SINGLESTEP)
+		if (test_thread_flag(TIF_SINGLESTEP))
 			task_pt_regs(current)->icountlevel = 1;
 
 		return;

@@ -491,7 +491,7 @@ static void do_signal(struct pt_regs *re
 	/* If there's no signal to deliver, we just restore the saved mask.  */
 	restore_saved_sigmask();
 
-	if (current->ptrace & PT_SINGLESTEP)
+	if (test_thread_flag(TIF_SINGLESTEP))
 		task_pt_regs(current)->icountlevel = 1;
 	return;
 }

@@ -46,12 +46,6 @@ extern int ptrace_access_vm(struct task_
 #define PT_EXITKILL		(PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT)
 #define PT_SUSPEND_SECCOMP	(PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT)
 
-/* single stepping state bits (used on ARM and PA-RISC) */
-#define PT_SINGLESTEP_BIT	31
-#define PT_SINGLESTEP		(1<<PT_SINGLESTEP_BIT)
-#define PT_BLOCKSTEP_BIT	30
-#define PT_BLOCKSTEP		(1<<PT_BLOCKSTEP_BIT)
-
 extern long arch_ptrace(struct task_struct *child, long request,
 			unsigned long addr, unsigned long data);
 extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);

From: Eric W. Biederman <[email protected]>

commit 6a2d90ba027adba528509ffa27097cffd3879257 upstream.

The current implementation of PTRACE_KILL is buggy and has been for many years as it assumes it's target has stopped in ptrace_stop. At a quick skim it looks like this assumption has existed since ptrace support was added in linux v1.0.

While PTRACE_KILL has been deprecated we can not remove it as a quick search with google code search reveals many existing programs calling it.

When the ptracee is not stopped at ptrace_stop some fields would be set that are ignored except in ptrace_stop. Making the userspace visible behavior of PTRACE_KILL a noop in those case.

As the usual rules are not obeyed it is not clear what the consequences are of calling PTRACE_KILL on a running process. Presumably userspace does not do this as it achieves nothing.

Replace the implementation of PTRACE_KILL with a simple send_sig_info(SIGKILL) followed by a return 0. This changes the observable user space behavior only in that PTRACE_KILL on a process not stopped in ptrace_stop will also kill it. As that has always been the intent of the code this seems like a reasonable change.

---
 arch/x86/kernel/step.c |    3 +--
 kernel/ptrace.c        |    5 ++---
 2 files changed, 3 insertions(+), 5 deletions(-)

@@ -180,8 +180,7 @@ void set_task_blockstep(struct task_stru
 	 *
 	 * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if
 	 * task is current or it can't be running, otherwise we can race
-	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but
-	 * PTRACE_KILL is not safe.
+	 * with __switch_to_xtra(). We rely on ptrace_freeze_traced().
 	 */
 	local_irq_disable();
 	debugctl = get_debugctlmsr();