5.15.212-rc1 review

This is the start of the stable review cycle for the 5.15.212 release. There are 843 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.212-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.15.212-rc1

HyeongJun An <[email protected]>
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value

Takashi Iwai <[email protected]>
ALSA: seq: Check UMP support for midi_version change

Takashi Iwai <[email protected]>
ALSA: seq: Skip event type filtering for UMP events

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix odr switching to same value

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: fix frequency setting when chip is off

Takashi Iwai <[email protected]>
ALSA: seq: Avoid confusion of aligned read size

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix regressions caused by reusing ident

Marc Zyngier <[email protected]>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

Zhan Xusheng <[email protected]>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

Wentao Liang <[email protected]>
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Ricardo Robaina <[email protected]>
audit: fix potential integer overflow in audit_log_n_hex()

Ricardo Robaina <[email protected]>
audit: add audit_log_nf_skb helper function

Qu Wenruo <[email protected]>
btrfs: fix incorrect buffered IO fallback for append direct writes

Giovanni Cabiddu <[email protected]>
crypto: qat - validate RSA CRT component lengths

Qu Wenruo <[email protected]>
btrfs: fix false IO failure after falling back to buffered write

Ahsan Atta <[email protected]>
crypto: qat - fix restarting state leak on allocation failure

Qu Wenruo <[email protected]>
btrfs: do not trim a device which is not writeable

Neill Kapron <[email protected]>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

Thorsten Blum <[email protected]>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A

Uwe Kleine-König <[email protected]>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0

Krzysztof Kozlowski <[email protected]>
crypto: atmel-sha204a - Mark OF related data as maybe unused

Tyler Baker <[email protected]>
usb: gadget: f_fs: initialize reset_work at allocation time

Andy Yan <[email protected]>
usb: typec: tcpm: Fix VDM type for Enter Mode commands

Mauricio Faria de Oliveira <[email protected]>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()

Fan Wu <[email protected]>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove

Uwe Kleine-König <[email protected]>
gpio: pca953x: Make platform teardown callback return void

Uwe Kleine-König <[email protected]>
leds: lm3601x: Improve error reporting for problems during .remove()

Uwe Kleine-König <[email protected]>
leds: lm3697: Remove duplicated error reporting in .remove()

Uwe Kleine-König <[email protected]>
drm/i2c/sil164: Drop no-op remove function

Oliver Neukum <[email protected]>
usb: iowarrior: remove inherent race with minor number

Vlad Poenaru <[email protected]>
bpf: Allow LPM map access from sleepable BPF programs

Andrii Nakryiko <[email protected]>
bpf: Consistently use bpf_rcu_lock_held() everywhere

Kumar Kartikeya Dwivedi <[email protected]>
bpf: Convert lpm_trie.c to rqspinlock

Zhao Zhang <[email protected]>
bpf: Reject fragmented frames in devmap

Lorenzo Bianconi <[email protected]>
xdp: introduce flags field in xdp_buff/xdp_frame

Tristan Madani <[email protected]>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Viacheslav Dubeyko <[email protected]>
hfs/hfsplus: prevent getting negative values of offset/length

Yousef Alhouseen <[email protected]>
xfs: use null daddr for unset first bad log block

Jiapeng Chong <[email protected]>
xfs: Remove dead code

Jiapeng Chong <[email protected]>
xfs: Remove redundant assignment of mp

Andy Shevchenko <[email protected]>
serial: 8250_mid: Disable DMA for selected platforms

Ilpo Järvinen <[email protected]>

    serial: 8250_mid: Remove 8250_pci usage

Manish Khadka <[email protected]>
HID: appleir: fix UAF on pending key_up_timer in remove()

Thomas Gleixner <[email protected]>
treewide: Switch/rename to timer_delete[_sync]()

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (part 1)

Trung Nguyen <[email protected]>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags

Angela Czubak <[email protected]>
HID: add haptics page defines

Jann Horn <[email protected]>
proc: protect ptrace_may_access() with exec_update_lock (FD links)

Christoph Hellwig <[email protected]>
proc: rename proc_setattr to proc_nochmod_setattr

Tyler Hicks (Microsoft) <[email protected]>
proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation

Thomas Weißschuh <[email protected]>
proc: use generic setattr() for /proc/$PID/net

Lukas Wunner <[email protected]>
X.509: Fix validation of ASN.1 certificate header

Zide Chen <[email protected]>
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()

Namjae Jeon <[email protected]>
ksmbd: track the connection owning a byte-range lock

DaeMyung Kang <[email protected]>
ksmbd: centralize ksmbd_conn final release to plug transport leak

DaeMyung Kang <[email protected]>
ksmbd: destroy async_ida in ksmbd_conn_free()

Greg Kroah-Hartman <[email protected]>
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger

Zihan Xi <[email protected]>
smb: client: harden POSIX SID length parsing

Zihan Xi <[email protected]>
smb: client: use unaligned reads in parse_posix_ctxt()

Norbert Manthey <[email protected]>
smb: client: mask server-provided mode to 07777 in modefromsid

Michael Bommarito <[email protected]>
smb: client: resolve SWN tcon from live registrations

David Howells <[email protected]>
cifs: Add tracing for the cifs_tcon struct refcounting

Haoxiang Li <[email protected]>
smb: client: Fix next buffer leak in receive_encrypted_standard()

Runyu Xiao <[email protected]>

    Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

Hyunwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not tracking outstanding TX ident

Florian Westphal <[email protected]>
netfilter: ebtables: zero chainstack array

Qianfeng Rong <[email protected]>
netfilter: ebtables: Use vmalloc_array() to improve code

Runyu Xiao <[email protected]>
gpio: sch: use raw_spinlock_t in the irq startup path

Bartosz Golaszewski <[email protected]>
gpio: sch: use new GPIO line value setter callbacks

Runyu Xiao <[email protected]>
coresight: etb10: restore atomic_t for shared reading state

Marco Nenciarini <[email protected]>
PCI: Skip Resizable BAR restore on read error

Ilpo Järvinen <[email protected]>
PCI: Move Resizable BAR code to rebar.c

Ilpo Järvinen <[email protected]>
PCI: Add kerneldoc for pci_resize_resource()

Ilpo Järvinen <[email protected]>
PCI: Fix restoring BARs on BAR resize rollback path

Ilpo Järvinen <[email protected]>
PCI: Free saved list without holding pci_bus_sem

Ilpo Järvinen <[email protected]>
PCI: Prevent resource tree corruption when BAR resize fails

Giovanni Cabiddu <[email protected]>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

Nikolay Kulikov <[email protected]>
staging: rtl8723bs: fix spaces around binary operators

William Hansen-Baird <[email protected]>
staging: rtl8723bs: core: move constants to right side in comparison

Sevinj Aghayeva <[email protected]>
staging: rtl8723bs: remove redundant braces in if statements

Sevinj Aghayeva <[email protected]>
staging: rtl8723bs: Remove redundant else branches.

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Fix IRQ domain leak when port fails to enable

Christian Marangi <[email protected]>
PCI: mediatek: Convert bool to single quirks entry and bitmap

Jiri Slaby (SUSE) <[email protected]>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

Franziska Naepelt <[email protected]>
staging: rtl8723bs: Fix space issues

Franziska Naepelt <[email protected]>
staging: rtl8723bs: Fix indentation issues

Richard Zhu <[email protected]>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling

Shoichiro Miyamoto <[email protected]>
smb: client: restrict implied bcc[0] exemption to responses without data area

Enzo Matsumiya <[email protected]>
cifs: remove unused server parameter from calc_smb_size()

Enzo Matsumiya <[email protected]>
smb2: small refactor in smb2_check_message()

Jakob Koschel <[email protected]>
cifs: remove check of list iterator against head past the loop body

Ronnie Sahlberg <[email protected]>
cifs: Create a new shared file holding smb2 pdu definitions

Mahesh Vaidya <[email protected]>
PCI: altera: Fix resource leaks on probe failure

Alex Williamson <[email protected]>
vfio/pci: Release the VGA arbiter client on register_device() failure

Zhao Dongdong <[email protected]>
ALSA: aoa: check snd_ctl_new1() return value

Herman van Hazendonk <[email protected]>
iio: common: st_sensors: honour channel endianness in read_axis_data

Alexander Lobakin <[email protected]>
bitops: make BYTES_TO_BITS() treewide-available

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: stabilized timestamp in interrupt

Jean-Baptiste Maneyrol <[email protected]>
iio: invensense: fix timestamp glitches when switching frequency

Colin Ian King <[email protected]>
iio: invensense: remove redundant initialization of variable period

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_mpu6050: use the common inv_sensors timestamp module

Jean-Baptiste Maneyrol <[email protected]>
iio: make invensense timestamp module generic

Jean-Baptiste Maneyrol <[email protected]>
iio: move inv_icm42600 timestamp module in common

Jean-Baptiste Maneyrol <[email protected]>
iio: imu: inv_icm42600: make timestamp module chip independent

Zhang Lixu <[email protected]>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values

Runyu Xiao <[email protected]>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ

Rafael J. Wysocki <[email protected]>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup

Jeremy Linton <[email protected]>
ACPI: CPPC: Suppress UBSAN warning caused by field misuse

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout

Pengpeng Hou <[email protected]>
mtd: rawnand: fsl_ifc: return errors for failed page reads

Runyu Xiao <[email protected]>
mmc: vub300: defer reset until cmd_mutex is unlocked

Pengpeng Hou <[email protected]>
mtd: mchp23k256: use SPI match data for chip caps

Pengpeng Hou <[email protected]>
mtd: onenand: samsung: report DMA completion timeouts

Rafael Beims <[email protected]>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Zhiling Zou <[email protected]>
wifi: mac80211: free ack status frame on TX header build failure

Junrui Luo <[email protected]>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

Zhao Dongdong <[email protected]>
reset: sunxi: fix memory region leak on ioremap failure

Robby Cai <[email protected]>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ

Julian Anastasov <[email protected]>
ipvs: fix more places with wrong ipv6 transport offsets

Maoyi Xie <[email protected]>
memstick: ms_block: reject a card that reports too many blocks

James Raphael Tiovalen <[email protected]>
macsec: fix promiscuity refcount leak in macsec_dev_open()

Xuanqiang Luo <[email protected]>
llc: fix SAP refcount leak when creating incoming sockets

Laxman Acharya Padhya <[email protected]>
Bluetooth: btrtl: validate firmware patch bounds

Asim Viladi Oglu Manizada <[email protected]>
net: openvswitch: reject oversized nested action attrs

Abhishek Ojha <[email protected]>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets

Dawei Feng <[email protected]>

    wifi: mac80211: fix memory leak in ieee80211_register_hw()

Runyu Xiao <[email protected]>
wifi: rt2x00: avoid full teardown before work setup in probe

Farhad Alemi <[email protected]>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Tao Liu <[email protected]>
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Michael Bommarito <[email protected]>
drbd: reject data replies with an out-of-range payload size

Yizhou Zhao <[email protected]>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in SCTP state lookup

Shuangpeng Bai <[email protected]>
llc: fix SAP refcount leak in llc_ui_autobind()

Yousef Alhouseen <[email protected]>
mac802154: remove interfaces with RCU list deletion

Gerald Schaefer <[email protected]>
s390/monwriter: Reject buffer reuse with different data length

HyeongJun An <[email protected]>
hwmon: (asus_atk0110) Check package count before accessing element

Wentao Liang <[email protected]>
ata: pata_pxa: Fix DMA channel leak on probe error

Bryam Vargas <[email protected]>
orangefs: keep the readdir entry size 64-bit in fill_from_part()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix double addition of offset for @+FOFFSET

Bryam Vargas <[email protected]>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Haoxiang Li <[email protected]>
fsl/fman: Free init resources on KeyGen failure in fman_init()

Haoxiang Li <[email protected]>
net: liquidio: fix BAR resource leak on PF number failure

Pengpeng Hou <[email protected]>
hwmon: (w83793) remove vrm sysfs file on probe failure

Pengpeng Hou <[email protected]>
hwmon: (w83627hf) remove VID sysfs files on error and remove

Abdun Nihaal <[email protected]>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()

Sven Eckelmann <[email protected]>
batman-adv: clean untagged VLAN on netdev registration failure

Sven Eckelmann <[email protected]>
batman-adv: ensure minimal ethernet header on TX

Sven Eckelmann <[email protected]>
batman-adv: retrieve ethhdr after potential skb realloc on RX

Shivam Kumar <[email protected]>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

Shitalkumar Gandhi <[email protected]>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure

Michael Bommarito <[email protected]>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation

Michael Bommarito <[email protected]>
ieee802154: admin-gate legacy LLSEC dump operations

Maoyi Xie <[email protected]>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink

Maoyi Xie <[email protected]>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink

Dawei Feng <[email protected]>
net: ena: clean up XDP TX queues when regular TX setup fails

Maoyi Xie <[email protected]>
net: sit: require CAP_NET_ADMIN in the device netns for changelink

Andreas Kemnade <[email protected]>
gpios: palmas: add .get_direction() op

Bradley Morgan <[email protected]>
cpu: hotplug: Bound hotplug states sysfs output

Bradley Morgan <[email protected]>
cpu: hotplug: Preserve per instance callback errors

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix DMA mapping violation in line setup

Dmitry Torokhov <[email protected]>
Input: ims-pcu - add response length checks

Dmitry Torokhov <[email protected]>
Input: ims-pcu - validate control endpoint type

Dmitry Torokhov <[email protected]>
Input: ims-pcu - release data interface on disconnect

Dmitry Torokhov <[email protected]>
Input: ims-pcu - fix use-after-free and double-free in disconnect

Haoxiang Li <[email protected]>
scsi: elx: efct: Fix I/O leak on unsupported additional CDB

WenTao Liang <[email protected]>
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

Bryam Vargas <[email protected]>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE

Bryam Vargas <[email protected]>
scsi: target: Bound PR-OUT TransportID parsing to the received buffer

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

Michael Bommarito <[email protected]>
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path

Xu Rao <[email protected]>
scsi: sg: Report request-table problems when any status is set

Haoxiang Li <[email protected]>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path

Mikulas Patocka <[email protected]>
dm-verity: increase sprintf buffer size

Mikulas Patocka <[email protected]>
dm_early_create: fix freeing used table on dm_resume failure

Mikulas Patocka <[email protected]>
dm-stats: fix merge accounting

Mikulas Patocka <[email protected]>
dm-stats: fix dm_jiffies_to_msec64

Benjamin Marzinski <[email protected]>
dm-log: fix a bitset_size overflow on 32bit machines

Mikulas Patocka <[email protected]>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard

Samuel Moelius <[email protected]>
dm era: fix out-of-bounds memory access for non-zero start sector

Ming-Hung Tsai <[email protected]>
dm thin metadata: fix metadata snapshot consistency on commit failure

Genjian Zhang <[email protected]>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Haoxiang Li <[email protected]>
net: sparx5: unregister blocking notifier on init failure

Oliver Hartkopp <[email protected]>
can: bcm: add missing rcu list annotations and operations

Oliver Hartkopp <[email protected]>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

Oliver Hartkopp <[email protected]>
can: isotp: use unconditional synchronize_rcu() in isotp_release()

Bryam Vargas <[email protected]>
nvmet-rdma: handle inline data with a nonzero offset

Weiming Shi <[email protected]>
sctp: validate STALE_COOKIE cause length before reading staleness

Kunihiko Hayashi <[email protected]>
spi: uniphier: Fix completion initialization order before devm_request_irq()

Wang Yan <[email protected]>
time: Fix off-by-one in compat settimeofday() usec validation

Jaewon Yang <[email protected]>
tpm: Make the TPM character devices non-seekable

Thorsten Blum <[email protected]>
tpm: fix event_size output in tpm1_binary_bios_measurements_show

Maoyi Xie <[email protected]>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink

Sanman Pradhan <[email protected]>
xfrm: use compat translator only for u64 alignment mismatch

Wentao Liang <[email protected]>
xen/gntdev: fix error handling in ioctl

Xuanqiang Luo <[email protected]>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()

Roman Vivchar <[email protected]>
i2c: mediatek: fix WRRD for SoCs without auto_restart option

Joshua Crofts <[email protected]>
hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig

Bhargav Joshi <[email protected]>
irqchip/crossbar: Use correct index in crossbar_domain_free()

Florian Fuchs <[email protected]>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

Michael Bommarito <[email protected]>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters

Michael Bommarito <[email protected]>
ocfs2: reject dinodes whose i_rdev disagrees with the file type

Michael Bommarito <[email protected]>
ocfs2: reject dinodes with non-canonical i_mode type

Ian Bridges <[email protected]>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

Kyle Zeng <[email protected]>
ocfs2: avoid moving extents to occupied clusters

Arseniy Krasnov <[email protected]>
mtd: rawnand: fix condition in 'nand_select_target()'

Vasiliy Kovalev <[email protected]>
net/9p: fix infinite loop in p9_client_rpc on fatal signal

Bastien Curutchet <[email protected]>
mtd: rawnand: pl353: fix probe resource allocation

Tristan Madani <[email protected]>
ocfs2: use kzalloc for quota recovery bitmap allocation

Martin Wilck <[email protected]>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()

Ruoyu Wang <[email protected]>
mtd: slram: remove failed entries from the device list

Krzysztof Wilczyński <[email protected]>
proc: only bump parent nlink when registering directories

Aaron Tomlin <[email protected]>
mips: sched: Fix CPUMASK_OFFSTACK memory corruption

WenTao Liang <[email protected]>
power: supply: charger-manager: fix refcount leak in is_full_charged()

Tristan Madani <[email protected]>
ntfs3: fix out-of-bounds read in decompress_lznt

Michael Bommarito <[email protected]>
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

Michael Bommarito <[email protected]>

    ntfs3: cap RESTART_TABLE free-chain walker at rt->used

Michael Bommarito <[email protected]>

    fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

Michael Bommarito <[email protected]>
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

Konstantin Komarov <[email protected]>
fs/ntfs3: validate lcns_follow in log_replay conversion

Konstantin Komarov <[email protected]>
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

Konstantin Komarov <[email protected]>
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

Zhan Xusheng <[email protected]>
fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix device reference leak in probe

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix kfree() of static object

Johan Hovold <[email protected]>
MIPS: ip22-gio: fix gio device memory leak

Chuck Lever <[email protected]>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

Chuck Lever <[email protected]>
lockd: Plug nlm_file leak when nlm_do_fopen() fails

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path

Abdun Nihaal <[email protected]>
nvdimm/btt: Free arenas on btt_init() error paths

Junrui Luo <[email protected]>
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()

Pauli Virtanen <[email protected]>
Bluetooth: SCO: hold sk properly in sco_conn_ready

Pauli Virtanen <[email protected]>
Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready

Bartosz Golaszewski <[email protected]>
mfd: tps6586x: Fix OF node refcount

Sven Eckelmann <[email protected]>
batman-adv: tt: prevent TVLV OOB check overflow

Sven Eckelmann <[email protected]>
batman-adv: frag: fix primary_if leak on failed linearization

Sven Eckelmann <[email protected]>
batman-adv: frag: free unfragmentable packet

Sven Eckelmann <[email protected]>
batman-adv: fix VLAN priority offset

Sven Eckelmann <[email protected]>
batman-adv: tt: avoid request storms during pending request

Sven Eckelmann <[email protected]>
batman-adv: dat: fix tie-break for candidate selection

Sven Eckelmann <[email protected]>
batman-adv: dat: ensure accessible eth_hdr proto field

Sven Eckelmann <[email protected]>
batman-adv: bla: reacquire gw address after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: dat: acquire ARP hw source only after skb realloc

Sven Eckelmann <[email protected]>

    batman-adv: access unicast_ttvn skb->data only after skb realloc

Sven Eckelmann <[email protected]>
batman-adv: gw: acquire ethernet header only after skb realloc

Thorsten Blum <[email protected]>
x86/boot: Reject too long acpi_rsdp= values

Thorsten Blum <[email protected]>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang

Guangshuo Li <[email protected]>
mfd: sm501: Fix reference leak on failed device registration

Armin Wolf <[email protected]>
leds: uleds: Fix potential buffer overread

Wang Jun <[email protected]>
soc: fsl: qe: panic on ioremap() failure in qe_reset()

Siddharth Vadapalli <[email protected]>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy

Guangshuo Li <[email protected]>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

Xiang Mei (Microsoft) <[email protected]>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

Wyatt Feng <[email protected]>
netfilter: xt_nat: reject unsupported target families

Yizhou Zhao <[email protected]>
netfilter: nf_conncount: fix zone comparison in tuple dedup

Xiang Mei <[email protected]>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: reload possible stale data pointer

Wyatt Feng <[email protected]>
netfilter: xt_cluster: reject template conntracks in hash match

David Carlier <[email protected]>
netfilter: nfnl_cthelper: apply per-class values when updating policies

Muhammad Bilal <[email protected]>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read

Abdun Nihaal <[email protected]>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

Abdun Nihaal <[email protected]>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

Abdun Nihaal <[email protected]>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

Abdun Nihaal <[email protected]>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

Abdun Nihaal <[email protected]>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()

Abdun Nihaal <[email protected]>
fbdev: i740fb: fix potential memory leak in i740fb_probe()

Abdun Nihaal <[email protected]>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

Li RongQing <[email protected]>
fbdev: sm712: Fix operator precedence in big_swap macro

Abdun Nihaal <[email protected]>
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

Abdun Nihaal <[email protected]>
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

Abdun Nihaal <[email protected]>
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

Hyunwoo Kim <[email protected]>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it

Nickolay Goppen <[email protected]>
arm64: dts: qcom: sdm630: describe adsp_mem region properly

Yong Wang <[email protected]>
net: ife: require ETH_HLEN to be pullable in ife_decode()

Zhengchuan Liang <[email protected]>
net: atm: reject out-of-range traffic classes in QoS validation

Michael Bommarito <[email protected]>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

Zhang Tianci <[email protected]>
vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

Wentao Liang <[email protected]>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()

Guangshuo Li <[email protected]>
smb: client: fix overflow in passthrough ioctl bounds check

Li RongQing <[email protected]>
net/mlx5: Fix L3 tunnel entropy refcount leak

Timur Tabi <[email protected]>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK

Douglas Anderson <[email protected]>
regulator: core: Make regulator_lock_two() logic easier to follow

Cao Guanghui <[email protected]>
dm era: fix NULL pointer dereference in metadata_open()

Julian Anastasov <[email protected]>
ipvs: ensure inner headers in ICMP errors are in headroom

Yizhou Zhao <[email protected]>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors

Yizhou Zhao <[email protected]>
ipvs: use parsed transport offset in TCP state lookup

Yizhou Zhao <[email protected]>
ipvs: pass parsed transport offset to state handlers

Eric Dumazet <[email protected]>
ipv6: mcast: Fix potential UAF in MLD delayed work

Kuniyuki Iwashima <[email protected]>
ipv6: mcast: Replace locking comments with lockdep annotations.

Suman Ghosh <[email protected]>
octeontx2-pf: check DMAC extraction support before filtering

Suman Ghosh <[email protected]>
octeontx2-pf: Add additional checks while configuring ucast/bcast/mcast rules

Suman Ghosh <[email protected]>
octeontx2-af: Allow mkex profile without DMAC and add L2M/L2B header extraction support

Ratheesh Kannoth <[email protected]>
octeontx2-af: Drop rules for NPC MCAM

Ratheesh Kannoth <[email protected]>
octeontx2-af: FLR handler for exact match table.

Ratheesh Kannoth <[email protected]>
octeontx2-af: devlink configuration support

Ratheesh Kannoth <[email protected]>
octeontx2-af: Exact match scan from kex profile

Ratheesh Kannoth <[email protected]>
octeontx2-af: Exact match support

Ratheesh Kannoth <[email protected]>
octeontx2-af: Use hashed field in MCAM key

Rakesh Babu <[email protected]>
octeontx2-af: debugfs: Add channel and channel mask.

Samuel Moelius <[email protected]>
net/sched: cake: reject overhead values that underflow length

Enrico Pozzobon <[email protected]>
net: usb: lan78xx: disable VLAN filter in promiscuous mode

Hui Wang <[email protected]>
ring-buffer: Fix event length with forced 8-byte alignment

Weiming Shi <[email protected]>

    Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

Pauli Virtanen <[email protected]>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Xiang Mei <[email protected]>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

Xiang Mei <[email protected]>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing

Daniele Palmas <[email protected]>
net: qualcomm: rmnet: add tx packets aggregation

Shigeru Yoshida <[email protected]>
qede: fix off-by-one in BD ring consumption on build_skb failure

Wyatt Feng <[email protected]>
netfilter: xt_connmark: reject invalid shift parameters

Zhixing Chen <[email protected]>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop

Feng Wu <[email protected]>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()

Wyatt Feng <[email protected]>
netfilter: xt_u32: reject invalid shift counts

Qihang <[email protected]>
gue: validate REMCSUM private option length

Xiang Mei <[email protected]>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Anshuman Khandual <[email protected]>
arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()

Lee Jones <[email protected]>
HID: core: Fix OOB read in hid_get_report for numbered reports

Georgiy Osokin <[email protected]>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

Myeonghun Pak <[email protected]>
ata: sata_gemini: unwind clocks on IDE pinctrl errors

David Howells <[email protected]>
afs: Fix unchecked-length string display in debug statement

David Howells <[email protected]>
afs: Fix the volume AFS_VOLUME_RM_TREE is set on

David Howells <[email protected]>
afs: Fix vllist leak

David Howells <[email protected]>
afs: Fix callback service message parsers to pass through -EAGAIN

Dan Carpenter <[email protected]>
afs: Fix error code in afs_extract_vl_addrs()

Samuel Moelius <[email protected]>
net/sched: hhf: clear heavy-hitter state on reset

Vladimir Zapolskiy <[email protected]>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe

Sechang Lim <[email protected]>
net/sched: act_bpf: use rcu_dereference_bh() to read the filter

Gleb Markov <[email protected]>
cxgb4: Fix decode strings dump for T6 adapters

Longjun Tang <[email protected]>
virtio_net: disable cb when NAPI is busy-polled

Yuho Choi <[email protected]>
irqchip/gic-v3-its: Fix OF node reference leak

Martin Kaiser <[email protected]>
tracing: eprobe: read the complete FILTER_PTR_STRING pointer

Masami Hiramatsu (Google) <[email protected]>
tracing/events: Fix to check the simple_tsk_fn creation

Ido Schimmel <[email protected]>
bridge: stp: Fix a potential use-after-free when deleting a bridge

Rosen Penev <[email protected]>
net: gianfar: dispose irq mappings on probe failure and device removal

Xiang Mei <[email protected]>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()

Pengfei Zhang <[email protected]>
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump

Eric Dumazet <[email protected]>
ipv6: remove RTNL protection from inet6_dump_fib()

Eric Dumazet <[email protected]>
inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU

Eric Dumazet <[email protected]>
rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag

Eric Dumazet <[email protected]>

    rtnetlink: change nlk->cb_mutex role

Matti Vaittinen <[email protected]>
hwmon: adm1275: Prevent reading uninitialized stack

Matvey Kovalev <[email protected]>

    qede: fix out-of-bounds check for cqe->len_list[]

Nuoqi Gui <[email protected]>
seg6: validate SRH length before reading fixed fields

Pengpeng Hou <[email protected]>
gpio: htc-egpio: use managed gpiochip registration

Pengpeng Hou <[email protected]>
gpio: mvebu: fail probe if gpiochip registration fails

Pengpeng Hou <[email protected]>
spi: sh-msiof: abort transfers when reset times out

Martin Kaiser <[email protected]>
tracing: probes: fix typo in a log message

Ruoyu Wang <[email protected]>
net: sungem: fix probe error cleanup

Yun Zhou <[email protected]>
net: mvneta: re-enable percpu interrupt on resume

Haoxiang Li <[email protected]>
rtc: cmos: unregister HPET IRQ handler on probe failure

Fredrik M Olsson <[email protected]>
rtc: ds1307: Fix off-by-one issue with wday for rx8130

Huiwen He <[email protected]>
smb/client: preserve errors from smb2_set_sparse()

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_policy sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in forwarding sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl

Fernando Fernandez Mancera <[email protected]>
ipv6: fix error handling in disable_ipv6 sysctl

Jamal Hadi Salim <[email protected]>
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

Eric Dumazet <[email protected]>
veth: fix NAPI leak in XDP enable error path

Aleksandrova Alyona <[email protected]>
net: dsa: sja1105: round up PTP perout pin duration

Xiang Mei <[email protected]>
net, bpf: check master for NULL in xdp_master_redirect()

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

Koichiro Den <[email protected]>
NTB: epf: Make db_valid_mask cover only real doorbell bits

Runyu Xiao <[email protected]>

    netfilter: nft_synproxy: stop bypassing the priv->info snapshot

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

Kuniyuki Iwashima <[email protected]>
ipv4: fib: Don't ignore error route in local/main tables.

Xiang Mei <[email protected]>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().

Gil Portnoy <[email protected]>

    ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0

Manivannan Sadhasivam <[email protected]>
PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0

Xiang Mei <[email protected]>
drm/edid: fix OOB read in drm_parse_tiled_block()

Avinash Duduskar <[email protected]>
bpf: zero-initialize the fib lookup flow struct

Nuoqi Gui <[email protected]>
bpf: Fix stack slot index in nospec checks

Ronan Dalton <[email protected]>

    rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231

Antoni Pokusinski <[email protected]>

    rtc: abx80x: fix the RTC_VL_CLR clearing all status flags

Aboorva Devarajan <[email protected]>
selftests/mm: fix exclusive_cow test fork() handling

Sayali Patil <[email protected]>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests

Sayali Patil <[email protected]>
selftests/mm: clarify alternate unmapping in compaction_test

Bhargav Joshi <[email protected]>
irqchip/crossbar: Fix parent domain resource leak

Florian Westphal <[email protected]>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak

Florian Westphal <[email protected]>
netfilter: nf_reject: skip iphdr options when looking for icmp header

Jozsef Kadlecsik <[email protected]>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Aleksandr Nogikh <[email protected]>
ieee802154: fix kernel-infoleak in dgram_recvmsg()

Ivan Abramov <[email protected]>

    ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()

Andy Shevchenko <[email protected]>
ACPI: resource: Amend kernel-doc style

Ricardo Neri <[email protected]>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure

Breno Leitao <[email protected]>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS

Ioana Ciornei <[email protected]>
dpaa2-switch: fix VLAN upper check not rejecting bridge join

Xin Long <[email protected]>
sctp: hold socket lock when dumping endpoints in sctp_diag

Jakub Kicinski <[email protected]>
net: psample: fix info leak in PSAMPLE_ATTR_DATA

Ratheesh Kannoth <[email protected]>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Eric Dumazet <[email protected]>
xfrm: validate selector family and prefixlen during match

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use snprintf() for root_dir path construction

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()

Pengpeng Hou <[email protected]>
sparc: led: avoid trimming a newline from empty writes

John Johansen <[email protected]>
apparmor: fix label can not be immediately before a declaration

Adrian Hunter <[email protected]>
i3c: master: Prevent reuse of dynamic address on device add failure

Zygmunt Krynicki <[email protected]>
apparmor: put secmark label after secid lookup

Zygmunt Krynicki <[email protected]>
apparmor: aa_getprocattr free procattr leak on format failure

Maxime Bélair <[email protected]>
apparmor: fix potential UAF in aa_replace_profiles

Ryan Lee <[email protected]>
apparmor: grab ns lock and refresh when looking up changehat child profiles

Zygmunt Krynicki <[email protected]>
apparmor: aa_label_alloc use aa_label_free on alloc failure

Ruoyu Wang <[email protected]>
apparmor: check label build before no_new_privs test

Manivannan Sadhasivam <[email protected]>
PCI: mediatek: Use actual physical address instead of virt_to_phys()

Ryder Lee <[email protected]>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Add bounds checks to elf_read_build_id() note iteration

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix mount_overload() snprintf truncation and toupper range

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix filename__write_int() writing uninitialized stack data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix thread__set_comm_from_proc() on empty comm file

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix snprintf size tracking bug in insn decoder

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Bounds-check .gnu_debuglink section data

Arnaldo Carvalho de Melo <[email protected]>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check

Arnaldo Carvalho de Melo <[email protected]>
tools lib api: Fix missing null termination in filename__read_int/ull()

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file

Arnaldo Carvalho de Melo <[email protected]>
perf pmu: Fix pmu_id() heap underwrite on empty identifier file

Chris Mason <[email protected]>
xprtrdma: Fix bcall rep leak and unbounded peek

Arnaldo Carvalho de Melo <[email protected]>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix idle-hist callchain display using wrong rb_first variant

Lad Prabhakar <[email protected]>
PCI: rcar-host: Remove unused LIST_HEAD(res)

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file

Li RongQing <[email protected]>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write

Mike Snitzer <[email protected]>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors

Dai Ngo <[email protected]>
NFSv4/pnfs: defer return_range callbacks until after inode unlock

Sagi Grimberg <[email protected]>
pNFS/filelayout: fix cheking if a layout is striped

Phillip Varney <[email protected]>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz

Nuno Sá <[email protected]>
dmaengine: Fix possible use after free

Icenowy Zheng <[email protected]>
dmaengine: qcom: gpi: set DMA_PRIVATE capability

Arnaldo Carvalho de Melo <[email protected]>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Fix NULL deref in aio cleanup on alloc failure

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Clean up idle_threads entry on init failure

Arnaldo Carvalho de Melo <[email protected]>
perf mmap: Guard cpu__get_node() return in aio_bind()

Rui Qi <[email protected]>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Add missing kdoc for ALLM parameters

Rosen Penev <[email protected]>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

Sanjay Chitroda <[email protected]>

    iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

Joshua Crofts <[email protected]>
iio: magnetometer: ak8975: fix potential kernel stack memory leak

Joshua Crofts <[email protected]>
iio: light: si1133: prevent race condition on timeout

Joshua Crofts <[email protected]>
iio: light: si1133: reset counter to prevent race condition

Arnaldo Carvalho de Melo <[email protected]>
perf header: Sanity check HEADER_EVENT_DESC attr.size before swap

James Kim <[email protected]>
char: tlclk: fix use-after-free in tlclk_cleanup()

Seungjin Bae <[email protected]>
usb: host: max3421: Reject hub port requests for non-existent ports

Seungjin Bae <[email protected]>

    usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

Guangshuo Li <[email protected]>
staging: most: video: avoid double free on video register failure

Andy Shevchenko <[email protected]>
phy: phy-can-transceiver: Check driver match and driver data against NULL

Ian Rogers <[email protected]>
perf sched: Add missing mmap2 handler in timehist

Rafael J. Wysocki <[email protected]>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling

Rafael J. Wysocki <[email protected]>
x86/platform/olpc: xo15: Drop wakeup source on driver removal

Leo Yan <[email protected]>
coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

Yingchao Deng <[email protected]>
coresight: cti: Fix DT filter signals silently ignored

Alexandru Hossu <[email protected]>
staging: nvec: fix use-after-free in nvec_rx_completed()

Yizhou Zhao <[email protected]>

    net/9p: fix race condition on rdma->state in trans_rdma.c

Aleksandr Nogikh <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write

Guangshuo Li <[email protected]>
ksmbd: fix use-after-free in same_client_has_lease()

Eric Dumazet <[email protected]>

    tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

Eric Dumazet <[email protected]>
tipc: fix UAF in tipc_l2_send_msg()

Gui-Dong Han <[email protected]>
KEYS: Use acquire when reading state in keyring search

Aboorva Devarajan <[email protected]>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus

Aboorva Devarajan <[email protected]>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down

Aboorva Devarajan <[email protected]>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

Yadan Fan <[email protected]>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()

Sechang Lim <[email protected]>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

Weiming Shi <[email protected]>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

Huiwen He <[email protected]>
smb/client: always return a value for FS_IOC_GETFLAGS

Florian Westphal <[email protected]>
netfilter: nf_conncount: callers must hold rcu read lock

Runyu Xiao <[email protected]>
kcm: use WRITE_ONCE() when changing lower socket callbacks

Sun Jian <[email protected]>
bpf: Run generic devmap egress prog on private skb

Aditya Garg <[email protected]>
net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check

Aditya Garg <[email protected]>
net: mana: initialize gdma queue id to INVALID_QUEUE_ID

Victor Nogueira <[email protected]>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Victor Nogueira <[email protected]>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen

Guangshuo Li <[email protected]>
ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO

Lars Pöschel <[email protected]>
spi: xilinx: use FIFO occupancy register to determine buffer size

Herbert Xu <[email protected]>
crypto: rng - Free default RNG on module exit

Felix Gu <[email protected]>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index

Felix Gu <[email protected]>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

Michael Bommarito <[email protected]>
tipc: reject inverted service ranges from peer bindings

Michael Bommarito <[email protected]>
tipc: prevent snt_unacked underflow on CONN_ACK

Michael Bommarito <[email protected]>
tipc: require net admin for TIPCv2 netlink mutators

Victor Nogueira <[email protected]>
net/sched: sch_hfsc: Don't make class passive twice

Xin Long <[email protected]>
sctp: validate embedded address parameter length

Xiang Mei <[email protected]>
bridge: cfm: reject invalid CCM interval at configuration time

Kuniyuki Iwashima <[email protected]>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

HyeongJun An <[email protected]>
ASoC: tegra: tegra210_ahub: Validate written enum value

HyeongJun An <[email protected]>
ASoC: fsl: fsl_audmix: Validate written enum values

HyeongJun An <[email protected]>
ASoC: codecs: hdac_hdmi: Validate written enum value

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix undefined shift of user RQ WQE size

Patrisious Haddad <[email protected]>
RDMA/mlx5: Remove raw RSS QP restrack tracking

Maxwell Doose <[email protected]>
fs: efs: remove unneeded debug prints

Heiko Carstens <[email protected]>
s390/process: Fix kernel thread function pointer type

Daniel Borkmann <[email protected]>
bpf: Tighten cgroup storage cookie checks for prog arrays

Yonghong Song <[email protected]>
selftests/bpf: Fix bpf_iter/task_vma test

Louis Scalbert <[email protected]>
bonding: 3ad: fix mux port state on oper down

longlong yan <[email protected]>
tools/virtio: check mmap return value in vringh_test

Zhang Tianci <[email protected]>
vduse: Requeue failed read to send_list head

Qihang Tang <[email protected]>
vhost/vdpa: validate virtqueue index in mmap and fault paths

Qihang Tang <[email protected]>
vduse: hold vduse_lock across IDR lookup in open path

Jason Gunthorpe <[email protected]>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified

David Laight <[email protected]>
fbdev: sm501fb: Fix buffer errors in OF binding code

Filipe Manana <[email protected]>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

Wolfram Sang <[email protected]>
hwspinlock: qcom: avoid uninitialized struct members

Hui Zhu <[email protected]>
vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

Luca Leonardo Scorcia <[email protected]>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39

Yuho Choi <[email protected]>
watchdog: unregister PM notifier on watchdog unregister

Al Viro <[email protected]>

    configfs: fix lockless traversals of ->s_children

Dmitry Vyukov <[email protected]>
firmware_loader: Fix recursive lock in device_cache_fw_images()

Felix Gu <[email protected]>
spi: ep93xx: fix double-free of zeropage on DMA setup failure

Jason Gunthorpe <[email protected]>
IB/mlx5: Properly support implicit ODP rereg_mr

Jason Gunthorpe <[email protected]>
IB/mlx5: Don't take the rereg_mr fallback without a new translation

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix conservative governor freq_step description

Yuho Choi <[email protected]>
ACPI: IPMI: Fix message kref handling on dead device

Kyle Zeng <[email protected]>
ALSA: seq: Clear variable event pointer on read

Takashi Iwai <[email protected]>
ALSA: seq: Add UMP support

Takashi Iwai <[email protected]>
ALSA: seq: Introduce SNDRV_SEQ_IOCTL_USER_PVERSION ioctl

Rui Qi <[email protected]>

    riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe

Tristan Madani <[email protected]>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

Leon Hwang <[email protected]>
bpf: Update transport_header when encapsulating UDP tunnel in lwt

Jacob Moroni <[email protected]>
RDMA/irdma: Fix OOB read during CQ MR registration

Jason Gunthorpe <[email protected]>
IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()

Pablo Neira Ayuso <[email protected]>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp

Fernando Fernandez Mancera <[email protected]>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures

Joseph Qi <[email protected]>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()

Zhang Cen <[email protected]>
ocfs2/dlm: require a ref for locking_state debugfs open

Zhang Cen <[email protected]>
ocfs2: reject FITRIM ranges shorter than a cluster

Dmitry Antipov <[email protected]>
ocfs2: fix buffer head management in ocfs2_read_blocks()

Zhang Cen <[email protected]>
ocfs2: rebase copied fsdlm LVB pointers in locking_state

Sandipan Das <[email protected]>
perf/x86/amd/core: Always use the NMI latency mitigation

Woojin Ji <[email protected]>
bpftool: Use libbpf error code for flow dissector query

Al Viro <[email protected]>

    configfs_lookup(): don't leave ->s_dentry dangling on failure

Alexander Potapenko <[email protected]>

    lib/test_meminit: use && for bools

Sang-Heon Jeon <[email protected]>
mm/fake-numa: fix under-allocation detection in uniform split

Deepanshu Kartikey <[email protected]>
bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

Dan Carpenter <[email protected]>
scsi: pm8001: Fix error code in non_fatal_log_show()

Martin Wilck <[email protected]>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"

Yuho Choi <[email protected]>
ARM: imx31: Fix IIM mapping leak in revision check

Yuho Choi <[email protected]>
ARM: imx3: Fix CCM node reference leak

Zhang Yi <[email protected]>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback

Chen Cheng <[email protected]>
md/raid10: reset read_slot when reusing r10bio for discard

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur step size on v6

Renjiang Han <[email protected]>
media: qcom: venus: relax encoder frame/blur dimension steps on v4

Renjiang Han <[email protected]>
media: qcom: venus: drop extra padding in NV12 raw size calculation

zhoumin <[email protected]>
EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

Jessica Zhang <[email protected]>
drm/msm/dp: Fix the ISR_* enum values

Jessica Zhang <[email protected]>
drm/msm/dp: fix HPD state status bit shift value

Weili Qian <[email protected]>
crypto: hisilicon/qm - disable error report before flr

Tetsuo Handa <[email protected]>

    ocfs2: kill osb->system_file_mutex lock

ZhengYuan Huang <[email protected]>
ocfs2: don't BUG_ON an invalid journal dinode

Dan Carpenter <[email protected]>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

Davidlohr Bueso <[email protected]>
dax/kmem: account for partial discontiguous resource upon removal

Carlos Llamas <[email protected]>
libbpf: Fix UAF in strset__add_str()

Timur Tabi <[email protected]>
drm/nouveau/bios: specify correct display fuse register for Ampere and Ada

Mikko Perttunen <[email protected]>
drm/tegra: Fix iommu_map_sgtable() return value check

Felix Gu <[email protected]>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()

Jiayuan Chen <[email protected]>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback

Eric Dumazet <[email protected]>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()

Breno Leitao <[email protected]>
workqueue: drop spurious '*' from print_worker_info() fn declaration

Nilay Shroff <[email protected]>
nvme-multipath: fix flex array size in struct nvme_ns_head

Miquel Raynal <[email protected]>
mtd: spi-nor: Drop duplicate Kconfig dependency

Rosen Penev <[email protected]>
mips: n64: add __iomem for writel call

Rosen Penev <[email protected]>
mips: ralink: mt7621: add missing __iomem

Maciej W. Rozycki <[email protected]>
MIPS: DEC: Remove do_IRQ() call indirection

Maciej W. Rozycki <[email protected]>
MIPS: Fix big-endian stack argument fetching in o32 wrapper

Jiakai Xu <[email protected]>
PM: sleep: Use complete() in device_pm_sleep_init()

Lianfa Weng <[email protected]>
RDMA/hns: Fix warning in poll cq direct mode

Guangshuo Li <[email protected]>
IB/mlx4: Fix refcount leak in add_port() error path

Jacob Moroni <[email protected]>
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs

Samuel Holland <[email protected]>
bus: sunxi-rsb: Always check register address validity

Ronaldo Nunez <[email protected]>
pwm: imx27: Fix variable truncation in .apply()

Lifeng Zheng <[email protected]>
cpufreq: conservative: Simplify frequency limit handling

Pengjie Zhang <[email protected]>
cpufreq: Documentation: fix sampling_down_factor range

Stepan Ionichev <[email protected]>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()

Geert Uytterhoeven <[email protected]>
firmware: arm_scmi: Fix OOB in scmi_power_name_get()

Sven Püschel <[email protected]>
media: rockchip: rga: fix too small buffer size

Eric Dumazet <[email protected]>

    net/sched: sch_drr: annotate data-races around cl->deficit

Greg Kroah-Hartman <[email protected]>
sysfs: clamp show() return value in sysfs_kf_read()

Sudeep Holla <[email protected]>
firmware: arm_scmi: Read sensor config as 32-bit value

Zilin Guan <[email protected]>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

Sara Venkatesh <[email protected]>
RDMA/srpt: fix integer overflow in immediate data length check

Prathamesh Deshpande <[email protected]>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference

Alexander Chesnokov <[email protected]>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()

Linmao Li <[email protected]>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

Eric Dumazet <[email protected]>
net/sched: sch_htb: annotate data-races (I)

Eric Dumazet <[email protected]>

    net/sched: sch_htb: do not change sch->flags in htb_dump()

Sean Christopherson <[email protected]>
crypto: ccp - Treat zero-length cert chain as query for blob lengths

Eric Dumazet <[email protected]>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()

Rafael J. Wysocki <[email protected]>
thermal: hwmon: Fix critical temperature attribute removal

Pengpeng Hou <[email protected]>
evm: terminate and bound the evm_xattrs read buffer

Lin He <[email protected]>
drm/hisilicon/hibmc: use clock to look up the PLL value

Lin He <[email protected]>
drm/hisilicon/hibmc: move display contrl config to hibmc_probe()

Cristian Marussi <[email protected]>
clk: scmi: Fix clock rate rounding

Sean Christopherson <[email protected]>
iommu/amd: Fix a stale comment about which legacy mode is user visible

Weiming Shi <[email protected]>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

Thorsten Blum <[email protected]>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic

Felix Gu <[email protected]>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path

Samuel Holland <[email protected]>
media: cedrus: Fix failure to clean up hardware on probe failure

Felix Gu <[email protected]>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure

Yingjie Gao <[email protected]>
watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH

Jihed Chaibi <[email protected]>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint

Tristan Madani <[email protected]>
wifi: ath9k: fix OOB access from firmware tx status queue ID

Xingjing Deng <[email protected]>
kconfig: fix potential NULL pointer dereference in conf_askvalue

Tristan Madani <[email protected]>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

Danilo Krummrich <[email protected]>

    driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

Yuho Choi <[email protected]>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

Tomi Valkeinen <[email protected]>
drm/tidss: Drop extra drm_mode_config_reset() call

Ian Bridges <[email protected]>
fbcon: fix NULL pointer dereference for a console without vc_data

David Howells <[email protected]>
afs: Fix further netns teardown to cancel the preallocation charger

Matvey Kovalev <[email protected]>
afs: fix NULL pointer dereference in afs_get_tree()

David Howells <[email protected]>
afs: Fix netns teardown to cancel the preallocation charger

Matthias Feser <[email protected]>
serial: 8250_omap: clear rx_running on zero-length DMA completes

Stephan Gerhold <[email protected]>
serial: msm: Disable DMA for kernel console UART

Chen-Yu Tsai <[email protected]>
dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix buffer sequence in frame gaps

Ricardo Ribalda <[email protected]>
media: uvcvideo: Avoid partial metadata buffers

Eric Biggers <[email protected]>
crypto: hisi-trng - Remove crypto_rng interface

Eric Biggers <[email protected]>
crypto: crypto4xx - Remove insecure and unused rng_alg

Herbert Xu <[email protected]>
crypto: crypto4xx - Remove ahash-related code

Eric Biggers <[email protected]>
crypto: sun4i-ss - Remove insecure and unused rng_alg

Eric Biggers <[email protected]>
crypto: af_alg - Remove zero-copy support from skcipher and aead

Vladimir Oltean <[email protected]>
net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths

Yichong Chen <[email protected]>
tools/mm/slabinfo: fix total_objects attribute name

Muhammet Kaan KILINÇ <[email protected]>

    crypto: algif_skcipher - force synchronous processing on trees without ctx->state

Adam Li <[email protected]>
sched/fair: Only update stats for allowed CPUs when looking for dst group

Darrick J. Wong <[email protected]>
xfs: resample the data fork mapping after cycling ILOCK

Weiming Shi <[email protected]>
xfs: fail recovery on a committed log item with no regions

Joanne Koong <[email protected]>
fuse: re-lock request before returning from fuse_ref_folio()

Alberto Ruiz <[email protected]>
fuse: fix device node leak in cuse_process_init_reply()

Michael Bommarito <[email protected]>
RDMA/siw: bound Read Response placement to the RREAD length

Zhenhao Wan <[email protected]>
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

Dmitry Torokhov <[email protected]>
Input: maplecontrol - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maplemouse - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: maple_keyb - set driver data before registering input device

Dmitry Torokhov <[email protected]>
Input: mms114 - fix multi-touch slot corruption

Florian Fuchs <[email protected]>
Input: maplemouse - fix NULL pointer dereference in open()

Bryam Vargas <[email protected]>
Input: touchwin - reset the packet index on every complete packet

Bryam Vargas <[email protected]>
Input: iforce - bound the device-reported force-feedback effect index

Bryam Vargas <[email protected]>
Input: goodix - clamp the device-reported contact count

Ranjan Kumar <[email protected]>
Input: elan_i2c - prevent division by zero and arithmetic underflow

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Bryam Vargas <[email protected]>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Haoxiang Li <[email protected]>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure

Guillermo Rodríguez <[email protected]>
i2c: stm32f7: truncate clock period instead of rounding it

Johan Hovold <[email protected]>
i2c: core: fix adapter deregistration race

Mikhail Gavrilov <[email protected]>
udmabuf: fix DMA direction mismatch in release_udmabuf()

Sean Christopherson <[email protected]>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

Koichiro Den <[email protected]>
NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

Bryam Vargas <[email protected]>
exfat: bound uniname advance in exfat_find_dir_entry()

Benjamin Coddington <[email protected]>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

Huihui Huang <[email protected]>
tracing: Prevent out-of-bounds read in glob matching

Carlos Song <[email protected]>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

Carlos Song <[email protected]>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()

Paul Louvel <[email protected]>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header

Eric Biggers <[email protected]>
crypto: drbg - Fix the fips_enabled priority boost

Eric Biggers <[email protected]>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels

Eric Biggers <[email protected]>
crypto: drbg - Fix returning success on failure in CTR_DRBG

Ruijie Li <[email protected]>
crypto: pcrypt - restore callback for non-parallel fallback

Anastasia Tishchenko <[email protected]>
crypto: ecc - Fix carry overflow in vli multiplication

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again

Thorsten Blum <[email protected]>
crypto: caam - use print_hex_dump_devel to guard key hex dumps

Bryam Vargas <[email protected]>
isofs: bound Rock Ridge symlink components to the SL record

Bryam Vargas <[email protected]>
partitions: aix: bound the pp_count scan to the ppe array

Achkinazi, Igor <[email protected]>
nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks

Mikulas Patocka <[email protected]>
dm-ioctl: report an error if a device has no table

Bryam Vargas <[email protected]>
udf: validate sparing table length as an entry count, not a byte count

Bryam Vargas <[email protected]>
udf: validate VAT header length against the VAT inode size

Michael Bommarito <[email protected]>
udf: validate free block extents against the partition length

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check

Madhu M <[email protected]>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode

Andrei Kuchynski <[email protected]>
usb: typec: ucsi: Invert DisplayPort role assignment

Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()

Sam Day <[email protected]>
usbip: vudc: fix NULL deref in vep_dequeue()

Yichong Chen <[email protected]>
usbip: tools: support SuperSpeedPlus devices

Xu Rao <[email protected]>
USB: usb-storage: ene_ub6250: restore media-ready check

Johan Hovold <[email protected]>
USB: ulpi: fix memory leak on registration failure

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write buffer corruption

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix hard lockup on disconnect

Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix broken rx after throttle

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE990D50 compositions

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix information leak

Haoxiang Li <[email protected]>
usb: mtu3: unmap request DMA on queue failure

Myeonghun Pak <[email protected]>
USB: misc: uss720: unregister parport on probe failure

Xu Rao <[email protected]>
USB: storage: include US_FL_NO_SAME in quirks mask

Myeonghun Pak <[email protected]>
usb: sl811-hcd: disable controller wakeup on remove

Johan Hovold <[email protected]>
USB: legousbtower: fix use-after-free on disconnect race

Erich E. Hoover <[email protected]>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD

Johan Hovold <[email protected]>
USB: iowarrior: fix use-after-free on disconnect

Johan Hovold <[email protected]>
USB: ldusb: fix use-after-free on disconnect race

Johan Hovold <[email protected]>
USB: idmouse: fix use-after-free on disconnect race

Jimmy Hu <[email protected]>
usb: gadget: udc: Fix use-after-free in gadget_match_driver

Maoyi Xie <[email protected]>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler

WenTao Liang <[email protected]>
usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()

Rodrigo Lugathe da Conceição Alves <[email protected]>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub

Haoxiang Li <[email protected]>
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

Jared Baldridge <[email protected]>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner

Maoyi Xie <[email protected]>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()

Alexey Nepomnyashih <[email protected]>
xfs: fix unreachable BIGTIME check in dquot flush validation

Deepanshu Kartikey <[email protected]>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers

Tristan Madani <[email protected]>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Srinivas Pandruvada <[email protected]>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads

Maoyi Xie <[email protected]>
HID: lg-g15: cancel pending work on remove to fix a use-after-free

Myeonghun Pak <[email protected]>
HID: wacom: stop hardware after post-start probe failures

WenTao Liang <[email protected]>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

Yuho Choi <[email protected]>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation

Tianxiang Chen <[email protected]>
cpufreq: Fix hotplug-suspend race during reboot

Steven Rostedt <[email protected]>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

Fushuai Wang <[email protected]>

    cpufreq: intel_pstate: Sync policy->cur during CPU offline

Sebastian Andrzej Siewior <[email protected]>
net: Drop the lock in skb_may_tx_timestamp()

Muhammad Bilal <[email protected]>
Bluetooth: L2CAP: validate option length before reading conf opt value

Yousef Alhouseen <[email protected]>
Bluetooth: fix UAF in bt_accept_dequeue()

Yousef Alhouseen <[email protected]>
Bluetooth: bnep: pin L2CAP connection during netdev registration

Xiang Mei <[email protected]>
netfilter: ebtables: terminate table name before find_table_lock()

Florian Westphal <[email protected]>
netfilter: ebtables: module names must be null-terminated

Andrei Kuchynski <[email protected]>
mfd: cros_ec: Delay dev_set_drvdata() until probe success

Wyatt Feng <[email protected]>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Yuyang Huang <[email protected]>
ipv4: igmp: remove multicast group from hash table on device destruction

Runyu Xiao <[email protected]>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

Runyu Xiao <[email protected]>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path

Koichiro Den <[email protected]>
NTB: epf: Avoid calling pci_irq_vector() from hardirq context

Yunpeng Tian <[email protected]>
fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

Thomas Gleixner <[email protected]>
debugobjects: Plug race against a concurrent OOM disable

Chi Wang <[email protected]>
audit: Fix data races of skb_queue_len() readers on audit_queue

Zijing Yin <[email protected]>
net: af_key: initialize alg_key_len for IPComp states

Dawei Feng <[email protected]>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB write in HT_caps_handler()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

Alexandru Hossu <[email protected]>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

Arnd Bergmann <[email protected]>
staging: media: atomisp: reduce load_primary_binaries() stack usage

Ricardo Ribalda <[email protected]>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe

Samuel Page <[email protected]>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks

Yizhou Zhao <[email protected]>
6lowpan: fix NHC entry use-after-free on error path

Runyu Xiao <[email protected]>
usb: dwc3: run gadget disconnect from sleepable suspend context

Alan Stern <[email protected]>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

Michael Bommarito <[email protected]>
hwrng: virtio: clamp device-reported used.len at copy_data()

Johan Hovold <[email protected]>
virtio-mmio: fix device release warning on module unload

Xiang Mei <[email protected]>
netfilter: ipset: fix race between dump and ip_set_list resize

Ratheesh Kannoth <[email protected]>
PCI: host-common: Request bus reassignment when not probe-only

Mahesh Vaidya <[email protected]>
PCI: altera: Do not dispose parent IRQ mapping

胡连勤 <[email protected]>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_free_transaction()

Carlos Llamas <[email protected]>
binder: fix UAF in binder_thread_release()

Johan Hovold <[email protected]>
Bluetooth: btusb: fix wakeup source leak on probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on marvell probe failure

Johan Hovold <[email protected]>
Bluetooth: btusb: fix use-after-free on registration failure

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Roll back quirk control caches on write errors

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()

Darvell Long <[email protected]>
ALSA: usb-audio: avoid kobject path lookup in DualSense match

Maoyi Xie <[email protected]>
ALSA: firewire: isight: bound the sample count to the packet payload

Zhao Dongdong <[email protected]>
ALSA: es1938: check snd_ctl_new1() return value

Maoyi Xie <[email protected]>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

Cássio Gabriel <[email protected]>
ALSA: virtio: Add missing 384 kHz PCM rate mapping

Liviu Stan <[email protected]>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start

Andy Shevchenko <[email protected]>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call

Javier Carrasco <[email protected]>
iio: light: veml6030: fix channel type when pushing events

Stepan Ionichev <[email protected]>
iio: light: tsl2591: return actual error from probe IRQ failure

Joshua Crofts <[email protected]>
iio: light: opt3001: fix missing state reset on timeout

Biren Pandya <[email protected]>
iio: light: gp2ap002: fix runtime PM leak on read error

Vidhu Sarwal <[email protected]>
iio: light: al3010: fix incorrect scale for the highest gain range

Andreas Kempe <[email protected]>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami

Runyu Xiao <[email protected]>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: wait full startup time after mode change at probe

Stepan Ionichev <[email protected]>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table

Lars-Peter Clausen <[email protected]>
iio: event: Fix event FIFO reset race

Maxwell Doose <[email protected]>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

Pengpeng Hou <[email protected]>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors

Maxwell Doose <[email protected]>
iio: adc: spear: Initialize completion before requesting IRQ

Maxwell Doose <[email protected]>
iio: adc: lpc32xx: Initialize completion before requesting IRQ

Biren Pandya <[email protected]>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

Bryam Vargas <[email protected]>
iio: accel: bmc150: clamp the device-reported FIFO frame count

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check for header

Griffin Kroah-Hartman <[email protected]>
usb: gadget: function: rndis: add length check to response query

Davidlohr Bueso <[email protected]>
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Keenan Dong <[email protected]>
rtmutex: Use waiter::task instead of current in remove_waiter()

Taeyang Lee <[email protected]>
perf/core: Detach event groups during remove_on_exec

Hem Parekh <[email protected]>
ksmbd: fix out-of-bounds read in smb_check_perm_dacl()

Michael Bommarito <[email protected]>
NFSv4/flexfiles: reject zero filehandle version count

Mingyu Wang <[email protected]>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

Johan Hovold <[email protected]>
i2c: core: fix adapter registration race

Johan Hovold <[email protected]>
i2c: core: fix adapter debugfs creation

Johan Hovold <[email protected]>
i2c: core: fix NULL-deref on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix hang on adapter registration failure

Johan Hovold <[email protected]>
i2c: core: fix irq domain leak on adapter registration failure

Denis Arefev <[email protected]>
block: Avoid mounting the bdev pseudo-filesystem in userspace

Keshav Verma <[email protected]>
f2fs: fix listxattr handling of corrupted xattr entries

Chao Yu <[email protected]>
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

Ruipeng Qi <[email protected]>
f2fs: fix potential deadlock in f2fs_balance_fs()

Bryam Vargas <[email protected]>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

Wenjie Qi <[email protected]>
f2fs: validate orphan inode entry count

Bartosz Golaszewski <[email protected]>
device property: initialize the remaining fields of fwnode_handle in fwnode_init()

Sunmin Jeong <[email protected]>
f2fs: fix to round down start offset of fallocate for pin file

Jaegeuk Kim <[email protected]>
f2fs: adjust zone capacity when considering valid block count

Wenjie Qi <[email protected]>
f2fs: validate compress cache inode only when enabled

Chao Yu <[email protected]>
f2fs: fix to detect corrupted meta ino

Bryam Vargas <[email protected]>
apparmor: mediate the implicit connect of TCP fast open sendmsg

Maoyi Xie <[email protected]>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

Ruslan Valiyev <[email protected]>
apparmor: fix use-after-free in rawdata dedup loop

Yiming Qian <[email protected]>
net: skmsg: preserve sg.copy across SG transforms

Eric Dumazet <[email protected]>
skmsg: convert struct sk_msg_sg::copy to a bitmap

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: restore set elements when delete set fails

Florian Fainelli <[email protected]>
perf trace beauty fcntl: Fix build with older kernel headers

Sean Christopherson <[email protected]>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()

NeilBrown <[email protected]>
nfsd: change nfs4_client_to_reclaim() to allocate data

NeilBrown <[email protected]>
nfsd: move name lookup out of nfsd4_list_rec_dir()

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

Uwe Kleine-König <[email protected]>
slimbus: Convert to platform remove callback returning void

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix probe error path ordering

Bjorn Andersson <[email protected]>
slimbus: qcom-ngd-ctrl: Fix up platform_driver registration

Tudor Ambarus <[email protected]>
dma-buf: remove unused dma-fence-unwrap.c (stable/linux-5.15.y only)

Pedro Tammela <[email protected]>
net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys

Jiasheng Jiang <[email protected]>
clk: imx: Add check for kcalloc

Kiryl Shutsemau <[email protected]>
userfaultfd: gate must_wait writability check on pte_present()

Jeff Layton <[email protected]>
nfsd: reset write verifier on deferred writeback errors

Chris Mason <[email protected]>
nfsd: release layout stid on setlease failure

Krzysztof Kozlowski <[email protected]>
nfc: llcp: protect nfc_llcp_sock_unlink() calls

Chaitanya Kulkarni <[email protected]>
nvmet-tcp: fix race between ICReq handling and queue teardown

-------------

Diffstat:

 Documentation/admin-guide/pm/cpufreq.rst           |    6 +-
 Documentation/crypto/userspace-if.rst              |   31 +-
 .../media/allwinner,sun4i-a10-video-engine.yaml    |   10 +
 Documentation/driver-api/pci/pci.rst               |    3 +
 Makefile                                           |    4 +-
 arch/alpha/kernel/pci-sysfs.c                      |   13 +-
 arch/arm/boot/dts/am335x-sl50.dts                  |    4 +-
 arch/arm/configs/sunxi_defconfig                   |    1 -
 arch/arm/mach-davinci/board-da850-evm.c            |   12 +-
 arch/arm/mach-imx/cpu-imx31.c                      |    9 +-
 arch/arm/mach-imx/mm-imx3.c                        |    2 +
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |    9 +-
 arch/arm64/kernel/hw_breakpoint.c                  |    9 +
 arch/arm64/kvm/vgic/vgic-its.c                     |    2 +
 arch/arm64/kvm/vgic/vgic.c                         |   11 +-
 arch/arm64/mm/mmu.c                                |   11 +-
 arch/mips/dec/int-handler.S                        |    2 +-
 arch/mips/dec/prom/init.c                          |    6 +-
 arch/mips/dec/setup.c                              |    6 -
 arch/mips/fw/lib/call_o32.S                        |    2 +-
 arch/mips/include/asm/dec/prom.h                   |   15 +-
 arch/mips/kernel/mips-mt-fpaff.c                   |   28 +-
 arch/mips/mm/init.c                                |   12 +-
 arch/mips/n64/init.c                               |    2 +-
 arch/mips/ralink/mt7621.c                          |    2 +-
 arch/mips/sgi-ip22/ip22-gio.c                      |    7 +-
 arch/powerpc/kexec/core_64.c                       |    4 +-
 arch/powerpc/perf/core-fsl-emb.c                   |    3 +-
 arch/powerpc/platforms/cell/spufs/file.c           |    6 +-
 arch/powerpc/platforms/powernv/setup.c             |    3 +-
 arch/riscv/kernel/machine_kexec.c                  |    3 +
 arch/riscv/kernel/stacktrace.c                     |    2 +-
 arch/s390/kernel/process.c                         |    2 +-
 arch/sparc/kernel/led.c                            |    2 +-
 arch/x86/boot/compressed/acpi.c                    |    7 +-
 arch/x86/boot/early_serial_console.c               |   11 +-
 arch/x86/events/amd/core.c                         |    6 +-
 arch/x86/events/intel/uncore_snb.c                 |    7 -
 arch/x86/kvm/vmx/vmx.c                             |    3 +-
 arch/x86/mm/numa_emulation.c                       |   17 +-
 arch/x86/platform/olpc/olpc-xo15-sci.c             |    1 +
 block/bdev.c                                       |    4 -
 block/partitions/aix.c                             |    9 +
 certs/common.c                                     |    2 +-
 crypto/af_alg.c                                    |   54 +-
 crypto/algif_skcipher.c                            |   49 +-
 crypto/asymmetric_keys/verify_pefile.c             |    2 +
 crypto/drbg.c                                      |    4 +-
 crypto/ecc.c                                       |   31 +-
 crypto/ecrdsa.c                                    |    2 +-
 crypto/pcrypt.c                                    |    4 +
 crypto/rng.c                                       |   11 +
 drivers/acpi/acpi_ipmi.c                           |    2 +-
 drivers/acpi/cppc_acpi.c                           |   11 +-
 drivers/acpi/nfit/core.c                           |   15 +-
 drivers/acpi/resource.c                            |    6 +-
 drivers/android/binder.c                           |   19 +-
 drivers/ata/pata_pxa.c                             |    1 +
 drivers/ata/sata_gemini.c                          |    2 +-
 drivers/base/firmware_loader/main.c                |    3 +-
 drivers/base/power/main.c                          |    6 +-
 drivers/base/property.c                            |    4 +-
 drivers/block/drbd/drbd_receiver.c                 |    5 +
 drivers/bluetooth/bpa10x.c                         |    8 +-
 drivers/bluetooth/btrtl.c                          |    5 +-
 drivers/bluetooth/btusb.c                          |   37 +-
 drivers/bus/sunxi-rsb.c                            |    3 +
 drivers/char/hw_random/virtio-rng.c                |   23 +-
 drivers/char/tlclk.c                               |    4 +
 drivers/char/tpm/eventlog/tpm1.c                   |    4 +-
 drivers/char/tpm/tpm-dev.c                         |    2 +-
 drivers/char/tpm/tpmrm-dev.c                       |    2 +-
 drivers/clk/clk-scmi.c                             |    4 +-
 drivers/clk/imx/clk.c                              |    2 +
 drivers/clk/qcom/a53-pll.c                         |    2 +-
 drivers/cpufreq/cpufreq.c                          |    2 +
 drivers/cpufreq/cpufreq_conservative.c             |   12 +-
 drivers/cpufreq/intel_pstate.c                     |    6 +-
 drivers/cpufreq/pcc-cpufreq.c                      |    2 +
 drivers/crypto/allwinner/Kconfig                   |    8 -
 drivers/crypto/allwinner/sun4i-ss/Makefile         |    1 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-core.c  |   36 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss-prng.c  |   69 -
 drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h       |   20 -
 drivers/crypto/amcc/crypto4xx_alg.c                |  106 --
 drivers/crypto/amcc/crypto4xx_core.c               |  130 +-
 drivers/crypto/amcc/crypto4xx_core.h               |   11 -
 drivers/crypto/amcc/crypto4xx_reg_def.h            |   11 -
 drivers/crypto/amlogic/amlogic-gxl-core.c          |    2 +-
 drivers/crypto/atmel-ecc.c                         |    2 +-
 drivers/crypto/atmel-sha204a.c                     |   29 +-
 drivers/crypto/caam/caamalg.c                      |   12 +-
 drivers/crypto/caam/caamalg_qi.c                   |   12 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   12 +-
 drivers/crypto/caam/caamhash.c                     |    4 +-
 drivers/crypto/caam/key_gen.c                      |    4 +-
 drivers/crypto/cavium/cpt/cptvf_reqmanager.c       |    4 +-
 drivers/crypto/ccp/sev-dev.c                       |    3 +-
 drivers/crypto/hisilicon/Kconfig                   |    1 -
 drivers/crypto/hisilicon/qm.c                      |    4 +-
 drivers/crypto/hisilicon/trng/trng.c               |  298 +---
 drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c |    4 +-
 drivers/crypto/qat/qat_common/adf_accel_devices.h  |    2 +
 drivers/crypto/qat/qat_common/adf_aer.c            |    7 +-
 drivers/crypto/qat/qat_common/adf_common_drv.h     |    4 +
 drivers/crypto/qat/qat_common/adf_isr.c            |   18 +
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c      |   27 +
 drivers/crypto/qat/qat_common/adf_sriov.c          |   27 +-
 drivers/crypto/qat/qat_common/qat_asym_algs.c      |   10 +-
 drivers/crypto/talitos.c                           |   26 +-
 drivers/dax/kmem.c                                 |    6 +
 drivers/dma-buf/dma-fence-unwrap.c                 |  176 ---
 drivers/dma-buf/udmabuf.c                          |    5 +-
 drivers/dma/dmaengine.c                            |    3 +-
 drivers/dma/qcom/gpi.c                             |    1 +
 drivers/edac/skx_common.c                          |    3 +
 drivers/firmware/arm_scmi/power.c                  |    6 +-
 drivers/firmware/arm_scmi/sensors.c                |    2 +-
 drivers/gpio/gpio-eic-sprd.c                       |    8 +-
 drivers/gpio/gpio-htc-egpio.c                      |    6 +-
 drivers/gpio/gpio-mvebu.c                          |    5 +-
 drivers/gpio/gpio-palmas.c                         |   19 +
 drivers/gpio/gpio-pca953x.c                        |   11 +-
 drivers/gpio/gpio-sch.c                            |   32 +-
 drivers/gpio/gpio-timberdale.c                     |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |    4 +-
 .../amd/display/modules/info_packet/info_packet.c  |    2 +
 drivers/gpu/drm/drm_edid.c                         |    8 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |   78 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c    |   11 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c   |   22 -
 drivers/gpu/drm/i2c/sil164_drv.c                   |    7 -
 drivers/gpu/drm/msm/dp/dp_display.c                |    4 +-
 drivers/gpu/drm/msm/dp/dp_reg.h                    |    4 +-
 .../gpu/drm/nouveau/nvkm/subdev/bios/shadowramin.c |    3 +-
 drivers/gpu/drm/radeon/radeon_ring.c               |    4 +-
 drivers/gpu/drm/tegra/dc.c                         |    4 +-
 drivers/gpu/drm/tegra/gem.c                        |    9 +-
 drivers/gpu/drm/tidss/tidss_kms.c                  |    2 -
 drivers/gpu/host1x/bus.c                           |    2 +-
 drivers/hid/hid-appleir.c                          |   45 +-
 drivers/hid/hid-core.c                             |    7 +
 drivers/hid/hid-lg-g15.c                           |   16 +
 drivers/hid/hid-logitech-hidpp.c                   |    1 -
 drivers/hid/hid-multitouch.c                       |   32 +-
 drivers/hid/hid-picolcd_core.c                     |    3 +-
 drivers/hid/hid-sensor-hub.c                       |   77 +-
 drivers/hid/wacom_sys.c                            |   12 +-
 drivers/hwmon/Kconfig                              |    1 +
 drivers/hwmon/asus_atk0110.c                       |    3 +
 drivers/hwmon/pmbus/adm1275.c                      |    2 +-
 drivers/hwmon/w83627hf.c                           |    4 +
 drivers/hwmon/w83793.c                             |    1 +
 drivers/hwspinlock/qcom_hwspinlock.c               |    5 +-
 .../hwtracing/coresight/coresight-cti-platform.c   |    1 +
 drivers/hwtracing/coresight/coresight-etb10.c      |    6 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |    4 +-
 drivers/i2c/busses/i2c-mlxbf.c                     |    4 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |    2 +-
 drivers/i2c/busses/i2c-stm32f7.c                   |    9 +-
 drivers/i2c/i2c-core-base.c                        |   85 +-
 drivers/i3c/master.c                               |   19 +-
 drivers/iio/accel/bmc150-accel-core.c              |    2 +
 drivers/iio/accel/kxsd9.c                          |    5 +-
 drivers/iio/accel/mma8452.c                        |    2 +
 drivers/iio/adc/lpc32xx_adc.c                      |    4 +-
 drivers/iio/adc/spear_adc.c                        |    3 +-
 drivers/iio/adc/ti-ads124s08.c                     |    3 +-
 drivers/iio/chemical/scd30_core.c                  |   19 +-
 drivers/iio/common/Kconfig                         |    1 +
 drivers/iio/common/Makefile                        |    1 +
 drivers/iio/common/inv_sensors/Kconfig             |    7 +
 drivers/iio/common/inv_sensors/Makefile            |    6 +
 .../inv_sensors/inv_sensors_timestamp.c}           |  120 +-
 drivers/iio/common/st_sensors/st_sensors_core.c    |   23 +-
 drivers/iio/gyro/bmg160_core.c                     |   16 +-
 drivers/iio/imu/adis_trigger.c                     |    2 +-
 drivers/iio/imu/bmi160/bmi160_core.c               |    3 +-
 drivers/iio/imu/inv_icm42600/Kconfig               |    1 +
 drivers/iio/imu/inv_icm42600/Makefile              |    1 -
 drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c  |   35 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c |   61 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h |    3 +
 drivers/iio/imu/inv_icm42600/inv_icm42600_core.c   |   24 +-
 drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c   |   35 +-
 .../iio/imu/inv_icm42600/inv_icm42600_timestamp.h  |   85 -
 drivers/iio/imu/inv_mpu6050/Kconfig                |    1 +
 drivers/iio/imu/inv_mpu6050/inv_mpu_core.c         |   30 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h          |   18 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c         |   85 +-
 drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c      |   11 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c       |   21 +-
 drivers/iio/industrialio-event.c                   |    5 +-
 drivers/iio/light/al3010.c                         |    2 +-
 drivers/iio/light/gp2ap002.c                       |    2 +-
 drivers/iio/light/opt3001.c                        |    6 +-
 drivers/iio/light/si1133.c                         |   14 +-
 drivers/iio/light/tsl2591.c                        |    6 +-
 drivers/iio/light/veml6030.c                       |    8 +-
 drivers/iio/magnetometer/ak8975.c                  |   15 +
 drivers/iio/orientation/hid-sensor-rotation.c      |   40 +-
 drivers/iio/temperature/ltc2983.c                  |    5 +-
 drivers/infiniband/core/cm.c                       |   13 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |    8 +-
 drivers/infiniband/hw/hns/hns_roce_main.c          |    2 +-
 drivers/infiniband/hw/irdma/verbs.c                |   18 +-
 drivers/infiniband/hw/irdma/verbs.h                |    1 -
 drivers/infiniband/hw/mlx4/mlx4_ib.h               |    1 +
 drivers/infiniband/hw/mlx4/mr.c                    |    9 +-
 drivers/infiniband/hw/mlx4/sysfs.c                 |   45 +-
 drivers/infiniband/hw/mlx5/devx.c                  |   30 +-
 drivers/infiniband/hw/mlx5/mr.c                    |   17 +-
 drivers/infiniband/hw/mlx5/qp.c                    |   12 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |    9 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |    5 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |    5 +-
 drivers/input/joystick/iforce/iforce-packets.c     |   18 +-
 drivers/input/joystick/maplecontrol.c              |    3 +-
 drivers/input/keyboard/maple_keyb.c                |    4 +-
 drivers/input/misc/ims-pcu.c                       |  115 +-
 drivers/input/mouse/elan_i2c_core.c                |   36 +-
 drivers/input/mouse/maplemouse.c                   |    9 +-
 drivers/input/rmi4/rmi_bus.c                       |    4 +-
 drivers/input/rmi4/rmi_f30.c                       |    2 +-
 drivers/input/rmi4/rmi_f3a.c                       |    2 +-
 drivers/input/touchscreen/goodix.c                 |    3 +-
 drivers/input/touchscreen/mms114.c                 |    2 +-
 drivers/input/touchscreen/touchwin.c               |   15 +-
 drivers/iommu/amd/amd_iommu_types.h                |   11 +-
 drivers/irqchip/irq-crossbar.c                     |   10 +-
 drivers/irqchip/irq-gic-v3-its.c                   |    6 +-
 drivers/leds/flash/leds-lm3601x.c                  |   11 +-
 drivers/leds/leds-lm3697.c                         |    4 +-
 drivers/leds/uleds.c                               |    3 +-
 drivers/md/dm-bufio.c                              |    4 +-
 drivers/md/dm-era-target.c                         |   10 +-
 drivers/md/dm-ioctl.c                              |    7 +-
 drivers/md/dm-log.c                                |    3 +
 drivers/md/dm-stats.c                              |   10 +-
 drivers/md/dm-thin-metadata.c                      |   67 +-
 drivers/md/dm-verity-target.c                      |    2 +-
 drivers/md/raid10.c                                |    1 +
 drivers/media/platform/qcom/venus/helpers.c        |    4 +-
 .../media/platform/qcom/venus/hfi_platform_v4.c    |   20 +-
 .../media/platform/qcom/venus/hfi_platform_v6.c    |   16 +-
 drivers/media/platform/rockchip/rga/rga-hw.c       |    2 +-
 drivers/media/platform/rockchip/rga/rga-hw.h       |    2 +-
 drivers/media/usb/uvc/uvc_video.c                  |   30 +-
 drivers/memstick/core/ms_block.c                   |    4 +
 drivers/mfd/cros_ec_dev.c                          |    3 +-
 drivers/mfd/sm501.c                                |    4 +-
 drivers/mfd/tps6586x.c                             |    2 +-
 drivers/mmc/host/vub300.c                          |   26 +-
 drivers/mtd/devices/mchp23k256.c                   |    2 +-
 drivers/mtd/devices/slram.c                        |   22 +-
 drivers/mtd/maps/vmu-flash.c                       |    1 +
 drivers/mtd/nand/onenand/onenand_samsung.c         |    7 +-
 drivers/mtd/nand/raw/fsl_ifc_nand.c                |    9 +-
 drivers/mtd/nand/raw/lpc32xx_mlc.c                 |   12 +-
 drivers/mtd/nand/raw/lpc32xx_slc.c                 |   12 +-
 drivers/mtd/nand/raw/nand_base.c                   |    2 +-
 drivers/mtd/nand/raw/pl35x-nand-controller.c       |    2 +-
 drivers/mtd/spi-nor/Kconfig                        |    1 -
 drivers/net/bonding/bond_3ad.c                     |    1 +
 drivers/net/dsa/sja1105/sja1105_ptp.c              |    2 +-
 drivers/net/ethernet/amazon/ena/ena_netdev.c       |   23 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c    |    3 +-
 .../ethernet/cavium/liquidio/cn23xx_pf_device.c    |   18 +-
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c         |    8 -
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |    2 +-
 drivers/net/ethernet/freescale/fman/fman.c         |    4 +-
 drivers/net/ethernet/freescale/gianfar.c           |   16 +-
 drivers/net/ethernet/marvell/mvneta.c              |    3 +
 drivers/net/ethernet/marvell/octeontx2/af/Makefile |    2 +-
 drivers/net/ethernet/marvell/octeontx2/af/mbox.h   |   28 +
 drivers/net/ethernet/marvell/octeontx2/af/npc.h    |   30 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   16 +
 drivers/net/ethernet/marvell/octeontx2/af/rvu.h    |   25 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_cgx.c    |    1 +
 .../ethernet/marvell/octeontx2/af/rvu_debugfs.c    |    8 +
 .../ethernet/marvell/octeontx2/af/rvu_devlink.c    |   71 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |   73 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c |  307 +++-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc_fs.h |   17 +
 .../ethernet/marvell/octeontx2/af/rvu_npc_hash.c   | 1645 ++++++++++++++++++++
 .../ethernet/marvell/octeontx2/af/rvu_npc_hash.h   |  214 +++
 .../net/ethernet/marvell/octeontx2/af/rvu_reg.h    |   15 +
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |   27 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   44 +-
 .../net/ethernet/mellanox/mlx5/core/lib/port_tun.c |    3 +-
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |    1 +
 .../ethernet/microchip/sparx5/sparx5_switchdev.c   |    4 +-
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |    2 +
 drivers/net/ethernet/microsoft/mana/mana_en.c      |    3 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |    9 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |    5 +
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |   20 +
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   |   23 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h    |    7 +
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |  269 +++-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c    |    9 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h    |    1 +
 drivers/net/ethernet/sun/sungem.c                  |   13 +-
 drivers/net/ieee802154/ca8210.c                    |    9 +-
 drivers/net/macsec.c                               |    7 +-
 drivers/net/usb/gl620a.c                           |    6 +-
 drivers/net/usb/kalmia.c                           |    8 +
 drivers/net/usb/lan78xx.c                          |   18 +-
 drivers/net/usb/net1080.c                          |    2 +-
 drivers/net/veth.c                                 |    2 +
 drivers/net/virtio_net.c                           |    3 +
 drivers/net/wireless/ath/ath9k/xmit.c              |    5 +
 drivers/net/wireless/ath/wcn36xx/smd.c             |    6 +
 drivers/net/wireless/marvell/mwifiex/join.c        |    1 -
 drivers/net/wireless/ralink/rt2x00/rt2x00dev.c     |   12 +-
 drivers/net/wireless/realtek/rtw88/pci.c           |    5 +
 drivers/ntb/hw/epf/ntb_hw_epf.c                    |   20 +-
 drivers/nvdimm/btt.c                               |   14 +-
 drivers/nvme/host/core.c                           |    2 +-
 drivers/nvme/host/multipath.c                      |    6 +
 drivers/nvme/target/rdma.c                         |   18 +-
 drivers/nvme/target/tcp.c                          |   33 +-
 drivers/pci/Makefile                               |    2 +-
 drivers/pci/controller/dwc/pci-imx6.c              |    5 +-
 drivers/pci/controller/dwc/pcie-designware-host.c  |    2 +-
 .../pci/controller/mobiveil/pcie-mobiveil-host.c   |    8 +-
 drivers/pci/controller/pci-host-common.c           |    4 +
 drivers/pci/controller/pcie-altera-msi.c           |    2 +-
 drivers/pci/controller/pcie-altera.c               |   32 +-
 drivers/pci/controller/pcie-mediatek-gen3.c        |    2 +-
 drivers/pci/controller/pcie-mediatek.c             |  125 +-
 drivers/pci/controller/pcie-rcar-host.c            |    1 -
 drivers/pci/controller/pcie-xilinx-nwl.c           |    2 +-
 drivers/pci/endpoint/functions/pci-epf-ntb.c       |   21 +-
 drivers/pci/endpoint/functions/pci-epf-vntb.c      |    9 +-
 drivers/pci/pci.c                                  |  136 --
 drivers/pci/pci.h                                  |    4 +
 drivers/pci/rebar.c                                |  218 +++
 drivers/pci/setup-bus.c                            |  101 +-
 drivers/pci/setup-res.c                            |   53 -
 drivers/phy/phy-can-transceiver.c                  |    3 +
 drivers/pinctrl/mediatek/pinctrl-mt8167.c          |    2 +-
 drivers/pinctrl/mediatek/pinctrl-mt8516.c          |    2 +-
 drivers/pinctrl/sunxi/pinctrl-sunxi.c              |    2 +-
 drivers/platform/x86/xo15-ebook.c                  |    7 +-
 drivers/power/supply/charger-manager.c             |    6 +-
 drivers/pwm/pwm-imx27.c                            |    8 +-
 drivers/rapidio/devices/tsi721.c                   |    3 +-
 drivers/regulator/core.c                           |   29 +-
 drivers/regulator/ltc3676.c                        |   10 +-
 drivers/regulator/scmi-regulator.c                 |    1 +
 drivers/reset/reset-imx7.c                         |    6 +
 drivers/reset/reset-sunxi.c                        |    4 +-
 drivers/rtc/rtc-abx80x.c                           |    3 +-
 drivers/rtc/rtc-cmos.c                             |    6 +
 drivers/rtc/rtc-ds1307.c                           |   30 +-
 drivers/s390/char/monwriter.c                      |    3 +
 drivers/scsi/elx/efct/efct_hw.c                    |    2 +
 drivers/scsi/elx/efct/efct_unsol.c                 |    1 +
 drivers/scsi/hpsa.c                                |    4 +
 drivers/scsi/pm8001/pm8001_ctl.c                   |    5 +-
 drivers/scsi/scsi_scan.c                           |    2 +-
 drivers/scsi/scsi_transport_sas.c                  |   60 +-
 drivers/scsi/sg.c                                  |    7 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |    2 +-
 drivers/slimbus/qcom-ctrl.c                        |    5 +-
 drivers/slimbus/qcom-ngd-ctrl.c                    |  107 +-
 drivers/soc/fsl/qe/qe.c                            |    3 +
 drivers/soc/ti/k3-ringacc.c                        |    4 +-
 drivers/spi/spi-ep93xx.c                           |    1 +
 drivers/spi/spi-fsl-lpspi.c                        |   18 +-
 drivers/spi/spi-sh-msiof.c                         |   10 +-
 drivers/spi/spi-uniphier.c                         |    4 +-
 drivers/spi/spi-xilinx.c                           |   11 +-
 drivers/staging/media/atomisp/pci/atomisp_cmd.c    |    6 +-
 drivers/staging/media/atomisp/pci/sh_css.c         |    6 +-
 drivers/staging/media/ipu3/ipu3-css-params.c       |    8 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |    4 +-
 drivers/staging/most/video/video.c                 |    7 +-
 drivers/staging/nvec/nvec.c                        |    4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |  129 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |   20 +-
 drivers/staging/rtl8723bs/core/rtw_security.c      |    2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c     |   23 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   88 +-
 drivers/target/target_core_fabric_lib.c            |   89 +-
 drivers/target/target_core_internal.h              |    3 +-
 drivers/target/target_core_pr.c                    |   12 +-
 drivers/thermal/intel/therm_throt.c                |    7 +-
 drivers/thermal/thermal_hwmon.c                    |    5 +-
 drivers/tty/serial/8250/8250_mid.c                 |   31 +-
 drivers/tty/serial/8250/8250_omap.c                |    3 +-
 drivers/tty/serial/msm_serial.c                    |    3 +-
 drivers/usb/atm/ueagle-atm.c                       |   36 +-
 drivers/usb/cdns3/cdnsp-mem.c                      |    2 +
 drivers/usb/class/cdc-acm.c                        |    3 +
 drivers/usb/common/ulpi.c                          |   23 +-
 drivers/usb/core/quirks.c                          |    6 +
 drivers/usb/dwc3/dwc3-meson-g12a.c                 |   14 +-
 drivers/usb/dwc3/gadget.c                          |   43 +-
 drivers/usb/gadget/composite.c                     |    5 +-
 drivers/usb/gadget/function/f_fs.c                 |    5 +-
 drivers/usb/gadget/function/rndis.c                |   20 +-
 drivers/usb/gadget/udc/core.c                      |   29 +-
 drivers/usb/host/max3421-hcd.c                     |    8 +
 drivers/usb/host/sl811-hcd.c                       |    1 +
 drivers/usb/host/xhci.c                            |   11 +-
 drivers/usb/misc/chaoskey.c                        |    1 -
 drivers/usb/misc/idmouse.c                         |   45 +-
 drivers/usb/misc/iowarrior.c                       |   21 +-
 drivers/usb/misc/ldusb.c                           |   38 +-
 drivers/usb/misc/legousbtower.c                    |   37 +-
 drivers/usb/misc/uss720.c                          |    5 +-
 drivers/usb/mtu3/mtu3_gadget.c                     |    1 +
 drivers/usb/serial/digi_acceleport.c               |   43 +-
 drivers/usb/serial/keyspan_pda.c                   |    2 +-
 drivers/usb/serial/option.c                        |   16 +
 drivers/usb/storage/ene_ub6250.c                   |    3 +-
 drivers/usb/storage/usb.c                          |    2 +-
 drivers/usb/typec/tcpm/tcpm.c                      |    7 +-
 drivers/usb/typec/ucsi/displayport.c               |    7 +-
 drivers/usb/typec/ucsi/ucsi_ccg.c                  |    2 +-
 drivers/usb/usbip/vudc.h                           |    1 -
 drivers/usb/usbip/vudc_dev.c                       |    4 +-
 drivers/vdpa/vdpa_user/vduse_dev.c                 |   72 +-
 drivers/vfio/pci/vfio_pci_core.c                   |    1 +
 drivers/vhost/vdpa.c                               |   29 +-
 drivers/video/fbdev/aty/radeon_base.c              |    1 +
 drivers/video/fbdev/broadsheetfb.c                 |    8 +-
 drivers/video/fbdev/carminefb.c                    |    1 +
 drivers/video/fbdev/core/fbcon.c                   |   14 +-
 drivers/video/fbdev/hecubafb.c                     |    6 +-
 drivers/video/fbdev/i740fb.c                       |    1 +
 drivers/video/fbdev/metronomefb.c                  |    8 +-
 drivers/video/fbdev/nvidia/nvidia.c                |    1 +
 drivers/video/fbdev/s3fb.c                         |    1 +
 drivers/video/fbdev/sm501fb.c                      |   16 +-
 drivers/video/fbdev/sm712.h                        |    2 +-
 drivers/video/fbdev/tdfxfb.c                       |    1 +
 drivers/video/fbdev/tridentfb.c                    |    1 +
 drivers/video/fbdev/uvesafb.c                      |    4 +-
 drivers/virtio/virtio_mmio.c                       |   26 +-
 drivers/watchdog/sp5100_tco.c                      |    3 +-
 drivers/watchdog/sprd_wdt.c                        |    5 +-
 drivers/watchdog/watchdog_core.c                   |    3 +
 drivers/xen/gntdev.c                               |    8 +-
 drivers/xen/xen-scsiback.c                         |   30 +-
 fs/afs/cell.c                                      |    2 +
 fs/afs/cmservice.c                                 |    2 -
 fs/afs/rxrpc.c                                     |   11 +-
 fs/afs/super.c                                     |    3 +-
 fs/afs/vl_list.c                                   |   10 +-
 fs/afs/volume.c                                    |    2 +-
 fs/btrfs/extent-tree.c                             |   17 +-
 fs/btrfs/inode.c                                   |   77 +-
 fs/btrfs/ordered-data.c                            |   13 +
 fs/btrfs/ordered-data.h                            |    2 +
 fs/cifs/cifs_debug.c                               |    2 +-
 fs/cifs/cifs_swn.c                                 |  333 +++-
 fs/cifs/cifsacl.c                                  |    2 +-
 fs/cifs/cifsfs.c                                   |    3 +-
 fs/cifs/cifsglob.h                                 |    6 +-
 fs/cifs/cifsproto.h                                |   11 +-
 fs/cifs/connect.c                                  |   38 +-
 fs/cifs/dfs_cache.c                                |    2 +-
 fs/cifs/ioctl.c                                    |   12 +-
 fs/cifs/misc.c                                     |   14 +-
 fs/cifs/netmisc.c                                  |    2 +-
 fs/cifs/readdir.c                                  |    6 +-
 fs/cifs/smb2maperror.c                             |   16 +-
 fs/cifs/smb2misc.c                                 |  130 +-
 fs/cifs/smb2ops.c                                  |  118 +-
 fs/cifs/smb2pdu.c                                  |  118 +-
 fs/cifs/smb2pdu.h                                  |  373 +----
 fs/cifs/smb2proto.h                                |    4 +-
 fs/cifs/smb2transport.c                            |   38 +-
 fs/cifs/trace.h                                    |   95 +-
 fs/configfs/dir.c                                  |   57 +-
 fs/efs/file.c                                      |   21 +-
 fs/exfat/dir.c                                     |   13 +-
 fs/ext4/ioctl.c                                    |   12 +-
 fs/f2fs/checkpoint.c                               |   13 +-
 fs/f2fs/data.c                                     |   29 +
 fs/f2fs/debug.c                                    |    2 +-
 fs/f2fs/f2fs.h                                     |    1 +
 fs/f2fs/file.c                                     |   15 +-
 fs/f2fs/gc.c                                       |    4 +-
 fs/f2fs/inode.c                                    |   39 +-
 fs/f2fs/segment.c                                  |   14 +-
 fs/f2fs/segment.h                                  |    8 +-
 fs/f2fs/xattr.c                                    |    4 +-
 fs/fuse/cuse.c                                     |    4 +-
 fs/fuse/dev.c                                      |    2 +-
 fs/hfs/bfind.c                                     |    2 +-
 fs/hfs/bnode.c                                     |   56 +-
 fs/hfs/brec.c                                      |    2 +-
 fs/hfs/btree.c                                     |    2 +-
 fs/hfs/btree.h                                     |   71 +-
 fs/hfs/hfs_fs.h                                    |   85 +-
 fs/hfs/inode.c                                     |    2 +-
 fs/hfsplus/bfind.c                                 |    2 +-
 fs/hfsplus/bnode.c                                 |   62 +-
 fs/hfsplus/brec.c                                  |    2 +-
 fs/hfsplus/btree.c                                 |    2 +-
 fs/hfsplus/hfsplus_fs.h                            |   40 +-
 fs/isofs/rock.c                                    |   11 +
 fs/jbd2/journal.c                                  |    2 +
 fs/ksmbd/connection.c                              |   49 +-
 fs/ksmbd/connection.h                              |    3 +
 fs/ksmbd/oplock.c                                  |   10 +-
 fs/ksmbd/smb2pdu.c                                 |   23 +-
 fs/ksmbd/smbacl.c                                  |    4 +-
 fs/ksmbd/vfs_cache.c                               |   30 +-
 fs/ksmbd/vfs_cache.h                               |    1 +
 fs/lockd/svcsubs.c                                 |    4 +-
 fs/nfs/callback_proc.c                             |    9 +-
 fs/nfs/dir.c                                       |    2 +
 fs/nfs/filelayout/filelayout.c                     |    2 +
 fs/nfs/flexfilelayout/flexfilelayout.c             |   33 +
 fs/nfs/flexfilelayout/flexfilelayout.h             |   16 +
 fs/nfs/pnfs.c                                      |    4 +-
 fs/nfsd/nfs4layouts.c                              |    4 +-
 fs/nfsd/nfs4recover.c                              |  120 +-
 fs/nfsd/nfs4state.c                                |   22 +-
 fs/nfsd/vfs.c                                      |    9 +-
 fs/nilfs2/segment.c                                |   22 +
 fs/ntfs3/fslog.c                                   |   97 +-
 fs/ntfs3/index.c                                   |   31 +-
 fs/ntfs3/lznt.c                                    |    2 +-
 fs/ntfs3/namei.c                                   |    2 +-
 fs/ocfs2/alloc.c                                   |    2 +-
 fs/ocfs2/aops.c                                    |   13 +-
 fs/ocfs2/buffer_head_io.c                          |    7 +-
 fs/ocfs2/dlm/dlmdebug.c                            |   16 +-
 fs/ocfs2/dlmglue.c                                 |   17 +
 fs/ocfs2/inode.c                                   |  150 +-
 fs/ocfs2/journal.c                                 |   13 +-
 fs/ocfs2/move_extents.c                            |    4 +-
 fs/ocfs2/ocfs2.h                                   |    2 -
 fs/ocfs2/quota_local.c                             |    2 +-
 fs/ocfs2/stack_user.c                              |   10 +-
 fs/ocfs2/super.c                                   |    2 -
 fs/ocfs2/sysfile.c                                 |    9 +-
 fs/orangefs/dir.c                                  |    7 +-
 fs/proc/array.c                                    |    6 +
 fs/proc/base.c                                     |  184 +--
 fs/proc/fd.c                                       |   71 +-
 fs/proc/generic.c                                  |    9 +-
 fs/proc/internal.h                                 |    6 +-
 fs/proc/namespaces.c                               |   16 +-
 fs/proc/proc_net.c                                 |    1 +
 fs/smbfs_common/smb2pdu.h                          |  318 ++++
 fs/sysfs/file.c                                    |    4 +
 fs/udf/balloc.c                                    |    5 +-
 fs/udf/super.c                                     |   11 +-
 fs/userfaultfd.c                                   |   14 +-
 fs/xfs/xfs_dquot.c                                 |   16 +-
 fs/xfs/xfs_log_recover.c                           |   76 +-
 fs/xfs/xfs_reflink.c                               |   36 +
 include/crypto/drbg.h                              |   18 +-
 include/linux/audit.h                              |    8 +
 include/linux/bitops.h                             |    2 +
 include/linux/bpf.h                                |    4 +
 include/linux/device.h                             |    5 +-
 include/linux/fwnode.h                             |    2 +
 include/linux/glob.h                               |    1 +
 include/linux/hid-sensor-hub.h                     |   25 +
 include/linux/hid.h                                |   29 +
 include/linux/iio/common/inv_sensors_timestamp.h   |   94 ++
 include/linux/netlink.h                            |    2 +
 include/linux/pci.h                                |    4 +-
 include/linux/platform_data/pca953x.h              |    2 +-
 include/linux/skmsg.h                              |   22 +-
 include/linux/vmalloc.h                            |    4 +-
 include/net/addrconf.h                             |   10 +-
 include/net/bluetooth/hci.h                        |    5 +-
 include/net/bluetooth/l2cap.h                      |    2 +-
 include/net/fib_rules.h                            |    5 +
 include/net/gue.h                                  |    2 +-
 include/net/ip_fib.h                               |    8 +-
 include/net/ip_vs.h                                |    3 +-
 include/net/rtnetlink.h                            |    3 +
 include/net/sctp/sctp.h                            |    3 +-
 include/net/sock.h                                 |    2 +-
 include/net/xdp.h                                  |   29 +
 include/net/xfrm.h                                 |    7 +
 include/sound/asequencer.h                         |    4 +
 include/sound/seq_kernel.h                         |    8 +
 include/uapi/sound/asequencer.h                    |   54 +-
 io_uring/io-wq.c                                   |    2 +-
 kernel/audit.c                                     |   85 +-
 kernel/bpf/core.c                                  |    2 +-
 kernel/bpf/devmap.c                                |   19 +
 kernel/bpf/hashtab.c                               |   21 +-
 kernel/bpf/helpers.c                               |    9 +-
 kernel/bpf/inode.c                                 |   13 +-
 kernel/bpf/lpm_trie.c                              |   10 +-
 kernel/bpf/verifier.c                              |    3 +-
 kernel/cgroup/cpuset.c                             |    7 +-
 kernel/cpu.c                                       |   20 +-
 kernel/events/core.c                               |   14 +-
 kernel/locking/rtmutex.c                           |   14 +-
 kernel/locking/rtmutex_api.c                       |    2 +-
 kernel/sched/fair.c                                |    2 +-
 kernel/sched/features.h                            |    8 +
 kernel/time/posix-cpu-timers.c                     |    3 +-
 kernel/time/time.c                                 |    2 +-
 kernel/trace/ring_buffer.c                         |    3 +-
 kernel/trace/trace_eprobe.c                        |    2 +-
 kernel/trace/trace_events_filter.c                 |    6 +-
 kernel/trace/trace_probe.c                         |    3 +-
 kernel/trace/trace_probe.h                         |    2 +-
 kernel/workqueue.c                                 |    2 +-
 lib/debugobjects.c                                 |   17 +
 lib/glob.c                                         |   31 +-
 lib/test_meminit.c                                 |    2 +-
 net/6lowpan/nhc.c                                  |    2 +-
 net/9p/client.c                                    |    2 +
 net/9p/trans_rdma.c                                |   19 +-
 net/atm/common.c                                   |    2 +
 net/batman-adv/distributed-arp-table.c             |   30 +-
 net/batman-adv/fragmentation.c                     |    8 +-
 net/batman-adv/gateway_client.c                    |    3 +-
 net/batman-adv/main.c                              |   13 +-
 net/batman-adv/routing.c                           |    3 +-
 net/batman-adv/soft-interface.c                    |   17 +-
 net/batman-adv/soft-interface.h                    |    2 +
 net/batman-adv/translation-table.c                 |    5 +-
 net/bluetooth/af_bluetooth.c                       |   17 +-
 net/bluetooth/bnep/core.c                          |   27 +-
 net/bluetooth/l2cap_core.c                         |  123 +-
 net/bluetooth/l2cap_sock.c                         |    4 +-
 net/bluetooth/sco.c                                |   62 +-
 net/bridge/br_cfm.c                                |    6 +
 net/bridge/br_cfm_netlink.c                        |    4 +-
 net/bridge/br_if.c                                 |    3 +
 net/bridge/br_stp.c                                |    3 +-
 net/bridge/netfilter/ebtables.c                    |   22 +-
 net/bridge/netfilter/nft_meta_bridge.c             |    4 +-
 net/can/bcm.c                                      |   90 +-
 net/can/isotp.c                                    |    9 +-
 net/core/fib_rules.c                               |    6 +-
 net/core/filter.c                                  |   44 +-
 net/core/lwt_bpf.c                                 |   12 +
 net/core/rtnetlink.c                               |   10 +
 net/core/skbuff.c                                  |   23 +-
 net/core/skmsg.c                                   |    2 +
 net/dsa/tag_ksz.c                                  |   18 +-
 net/ieee802154/core.c                              |    2 +-
 net/ieee802154/header_ops.c                        |    9 +-
 net/ieee802154/ieee802154.h                        |   17 +
 net/ieee802154/netlink.c                           |   36 +-
 net/ife/ife.c                                      |    2 +-
 net/ipv4/fib_frontend.c                            |   15 +-
 net/ipv4/igmp.c                                    |    1 +
 net/ipv4/ip_gre.c                                  |    6 +
 net/ipv4/ip_vti.c                                  |    3 +
 net/ipv4/ipmr.c                                    |    4 +-
 net/ipv4/netfilter/nf_reject_ipv4.c                |    2 +-
 net/ipv4/sysctl_net_ipv4.c                         |   10 +-
 net/ipv4/tcp_output.c                              |    4 +-
 net/ipv6/addrconf.c                                |   23 +-
 net/ipv6/ip6_fib.c                                 |   73 +-
 net/ipv6/ip6_gre.c                                 |    6 +
 net/ipv6/ip6_vti.c                                 |    3 +
 net/ipv6/ip6mr.c                                   |    4 +-
 net/ipv6/mcast.c                                   |  165 +-
 net/ipv6/netfilter.c                               |    4 +-
 net/ipv6/netfilter/ip6t_ah.c                       |    5 +
 net/ipv6/netfilter/ip6t_hbh.c                      |    1 +
 net/ipv6/netfilter/ip6t_rt.c                       |    3 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |    3 +-
 net/ipv6/route.c                                   |    9 +-
 net/ipv6/seg6.c                                    |    3 +
 net/ipv6/sit.c                                     |    3 +
 net/kcm/kcmsock.c                                  |    8 +-
 net/key/af_key.c                                   |    1 +
 net/llc/af_llc.c                                   |    1 +
 net/llc/llc_conn.c                                 |    1 -
 net/mac80211/main.c                                |    3 +-
 net/mac80211/tx.c                                  |   17 +-
 net/mac802154/iface.c                              |    2 +-
 net/mpls/af_mpls.c                                 |    4 +-
 net/netfilter/ipset/ip_set_core.c                  |   12 +-
 net/netfilter/ipvs/ip_vs_app.c                     |   10 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |    4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |   36 +-
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |   18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |   11 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |    3 +-
 net/netfilter/nf_conncount.c                       |   23 +-
 net/netfilter/nf_conntrack_core.c                  |   18 +-
 net/netfilter/nf_conntrack_irc.c                   |    6 +-
 net/netfilter/nf_conntrack_seqadj.c                |    2 +
 net/netfilter/nf_nat_sip.c                         |    9 +
 net/netfilter/nf_tables_api.c                      |   41 +-
 net/netfilter/nfnetlink_cthelper.c                 |    4 +-
 net/netfilter/nfnetlink_osf.c                      |    6 +-
 net/netfilter/nft_log.c                            |   58 +-
 net/netfilter/nft_set_bitmap.c                     |    4 +-
 net/netfilter/nft_set_hash.c                       |    8 +-
 net/netfilter/nft_set_pipapo.c                     |    5 +-
 net/netfilter/nft_set_rbtree.c                     |    4 +-
 net/netfilter/nft_synproxy.c                       |    9 +-
 net/netfilter/xt_AUDIT.c                           |   58 +-
 net/netfilter/xt_cluster.c                         |    2 +-
 net/netfilter/xt_connmark.c                        |   14 +-
 net/netfilter/xt_nat.c                             |    9 +
 net/netfilter/xt_rateest.c                         |    2 +-
 net/netfilter/xt_u32.c                             |   12 +-
 net/netlink/af_netlink.c                           |   35 +-
 net/netlink/af_netlink.h                           |    5 +-
 net/nfc/llcp_sock.c                                |   14 +-
 net/openvswitch/conntrack.c                        |    2 +-
 net/openvswitch/flow_netlink.c                     |  201 ++-
 net/psample/psample.c                              |    6 +-
 net/qrtr/af_qrtr.c                                 |    2 +-
 net/sched/act_bpf.c                                |    2 +-
 net/sched/act_pedit.c                              |   11 +-
 net/sched/cls_api.c                                |    3 +
 net/sched/cls_bpf.c                                |   10 +-
 net/sched/sch_cake.c                               |    5 +-
 net/sched/sch_codel.c                              |   48 +-
 net/sched/sch_drr.c                                |    8 +-
 net/sched/sch_fq_codel.c                           |   41 +-
 net/sched/sch_hfsc.c                               |   24 +-
 net/sched/sch_hhf.c                                |   27 +
 net/sched/sch_htb.c                                |   14 +-
 net/sched/sch_multiq.c                             |    2 +-
 net/sctp/diag.c                                    |   67 +-
 net/sctp/sm_make_chunk.c                           |   10 +-
 net/sctp/sm_statefuns.c                            |   23 +-
 net/sctp/socket.c                                  |   29 +-
 net/smc/smc_cdc.c                                  |   15 +-
 net/socket.c                                       |    2 +-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |    4 +-
 net/tipc/bcast.c                                   |   22 +-
 net/tipc/bcast.h                                   |    2 +-
 net/tipc/bearer.c                                  |    1 +
 net/tipc/name_distr.c                              |   13 +-
 net/tipc/netlink.c                                 |   12 +
 net/tipc/node.c                                    |   15 +-
 net/tipc/socket.c                                  |    3 +
 net/tls/tls_sw.c                                   |    4 +
 net/xfrm/xfrm_interface_core.c                     |    3 +
 net/xfrm/xfrm_policy.c                             |    3 +
 net/xfrm/xfrm_state.c                              |    2 +-
 net/xfrm/xfrm_user.c                               |    2 +-
 samples/trace_events/trace-events-sample.c         |    4 +
 scripts/kconfig/conf.c                             |    6 +-
 security/apparmor/domain.c                         |   58 +-
 security/apparmor/include/policy_unpack.h          |   19 +
 security/apparmor/label.c                          |    2 +-
 security/apparmor/lsm.c                            |   16 +-
 security/apparmor/net.c                            |    1 +
 security/apparmor/policy.c                         |   14 +-
 security/apparmor/procattr.c                       |    2 +
 security/integrity/evm/evm_secfs.c                 |   16 +-
 security/keys/keyring.c                            |    2 +-
 sound/aoa/fabrics/layout.c                         |    6 +
 sound/core/seq/Kconfig                             |    7 +
 sound/core/seq/seq_clientmgr.c                     |  174 ++-
 sound/core/seq/seq_clientmgr.h                     |    2 +
 sound/core/seq/seq_compat.c                        |    1 +
 sound/core/seq/seq_memory.c                        |   10 +-
 sound/core/seq/seq_memory.h                        |   19 +-
 sound/firewire/isight.c                            |    3 +-
 sound/pci/es1938.c                                 |    2 +
 sound/soc/codecs/adau1372.c                        |    5 +
 sound/soc/codecs/hdac_hdmi.c                       |    4 +-
 sound/soc/fsl/fsl_audmix.c                         |    6 +
 sound/soc/tegra/tegra210_ahub.c                    |    4 +-
 sound/usb/caiaq/input.c                            |    2 +-
 sound/usb/mixer_quirks.c                           |  101 +-
 sound/usb/mixer_scarlett.c                         |    4 +-
 sound/usb/mixer_us16x08.c                          |  127 +-
 sound/virtio/virtio_pcm.c                          |    3 +-
 sound/virtio/virtio_pcm_ops.c                      |    3 +-
 tools/bpf/bpftool/net.c                            |    4 +-
 tools/include/linux/bitops.h                       |    2 +
 tools/lib/api/fs/fs.c                              |   19 +-
 tools/lib/bpf/strset.c                             |   62 +-
 tools/lib/symbol/kallsyms.c                        |    5 +-
 tools/perf/builtin-c2c.c                           |    1 +
 tools/perf/builtin-sched.c                         |   37 +-
 tools/perf/trace/beauty/fcntl.c                    |   16 +
 tools/perf/util/bpf-event.c                        |   18 +-
 tools/perf/util/cpumap.c                           |    6 +
 tools/perf/util/event.c                            |   15 +-
 tools/perf/util/header.c                           |   54 +
 tools/perf/util/hist.c                             |    7 +-
 .../util/intel-pt-decoder/intel-pt-insn-decoder.c  |   11 +-
 tools/perf/util/machine.c                          |   10 +-
 tools/perf/util/mmap.c                             |   18 +-
 tools/perf/util/pmu.c                              |   10 +-
 tools/perf/util/probe-finder.c                     |    4 +-
 tools/perf/util/symbol-elf.c                       |   48 +-
 tools/perf/util/symbol-minimal.c                   |   11 +-
 tools/perf/util/symbol.c                           |    2 +-
 tools/perf/util/thread.c                           |    5 +
 .../selftests/bpf/progs/bpf_iter_task_vma.c        |    2 +-
 tools/testing/selftests/vm/compaction_test.c       |    3 +
 tools/testing/selftests/vm/hmm-tests.c             |   63 +-
 tools/usb/usbip/libsrc/usbip_common.c              |    2 +
 tools/usb/usbip/libsrc/usbip_device_driver.c       |    4 +
 tools/usb/usbip/libsrc/vhci_driver.c               |    1 +
 tools/virtio/vringh_test.c                         |    5 +
 tools/vm/slabinfo.c                                |    4 +-
 virt/kvm/eventfd.c                                 |   12 +-
 virt/kvm/kvm_main.c                                |   16 +-
 810 files changed, 11262 insertions(+), 5387 deletions(-)

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chaitanya Kulkarni <[email protected]>

commit 5293a8882c549fab4a878bc76b0b6c951f980a61 upstream.

nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown.

If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock.

If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue.

The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference.

Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started.

Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes.

[ context diff adaptation: drop queue->state = NVMET_TCP_Q_FAILED since
the enum introduced in 6.7, 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall" ]

---
 drivers/nvme/target/tcp.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

index 29ed707e76e06d..06cfcf0850076b 100644
@@ -357,6 +357,19 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
 
 static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
 {
+	/*
+	 * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
+	 * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
+	 * already been consumed and queue teardown has started.
+	 *
+	 * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
+	 * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
+	 * cancels it, the queue must not keep that old receive state.
+	 * Otherwise the next nvmet_tcp_io_work() run can reach
+	 * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
+	 *
+	 * That is why queue->rcv_state needs to be updated before we return.
+	 */
 	queue->rcv_state = NVMET_TCP_RECV_ERR;
 	if (queue->nvme_sq.ctrl)
 		nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);

@@ -900,10 +913,24 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
 	iov.iov_base = icresp;
 	iov.iov_len = sizeof(*icresp);
 	ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
-	if (ret < 0)
+	if (ret < 0) {
+		spin_lock_bh(&queue->state_lock);
+		if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+			spin_unlock_bh(&queue->state_lock);
+			return -ESHUTDOWN;
+		}
+		spin_unlock_bh(&queue->state_lock);
 		return ret; /* queue removal will cleanup */
+	}
 
+	spin_lock_bh(&queue->state_lock);
+	if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+		spin_unlock_bh(&queue->state_lock);
+		/* Tell nvmet_tcp_socket_error() teardown is in progress. */
+		return -ESHUTDOWN;
+	}
 	queue->state = NVMET_TCP_Q_LIVE;
+	spin_unlock_bh(&queue->state_lock);
 	nvmet_prepare_receive_pdu(queue);
 	return 0;
 }

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <[email protected]>

[ Upstream commit a06b8044169f6d5c3eb34772c13d2c0c1b205352 ]

nfc_llcp_sock_link() is called in all paths (bind/connect) as a last action, still protected with lock_sock(). When cleaning up in llcp_sock_release(), call nfc_llcp_sock_unlink() in a mirrored way:
earlier and still under the lock_sock().

---
 net/nfc/llcp_sock.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

index 54af85d939c6b9..57dea580c02912 100644
@@ -626,6 +626,13 @@ static int llcp_sock_release(struct socket *sock)
 		}
 	}
 
+	if (sock->type == SOCK_RAW)
+		nfc_llcp_sock_unlink(&local->raw_sockets, sk);
+	else if (sk->sk_state == LLCP_CONNECTING)
+		nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+	else
+		nfc_llcp_sock_unlink(&local->sockets, sk);
+
 	if (llcp_sock->reserved_ssap < LLCP_SAP_MAX)
 		nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
 

@@ -638,13 +645,6 @@ static int llcp_sock_release(struct socket *sock)
 	if (sk->sk_state == LLCP_DISCONNECTING)
 		return err;
 
-	if (sock->type == SOCK_RAW)
-		nfc_llcp_sock_unlink(&local->raw_sockets, sk);
-	else if (sk->sk_state == LLCP_CONNECTING)
-		nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
-	else
-		nfc_llcp_sock_unlink(&local->sockets, sk);
-
 out:
 	sock_orphan(sk);
 	sock_put(sk);

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Mason <[email protected]>

commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.

nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer.

The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail.

A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work.

    nfsd4_alloc_layout_stateid()
      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */
      nfsd4_layout_setlease()     /* fails */
        nfs4_put_stid()
          nfsd4_free_layout_stateid()
            delayed_work_pending(&ls->ls_fence_work)  /* needs INIT */
            nfsd4_close_layout()  /* nfsd_file_put(ls->ls_file) */
          put_nfs4_file()

Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp).

---
 fs/nfsd/nfs4layouts.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index d0fbbd34db689c..bcf16dd07d4883 100644
@@ -241,9 +241,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
 	BUG_ON(!ls->ls_file);
 
 	if (nfsd4_layout_setlease(ls)) {
-		nfsd_file_put(ls->ls_file);
-		put_nfs4_file(fp);
-		kmem_cache_free(nfs4_layout_stateid_cache, ls);
+		nfs4_put_stid(stp);
 		return NULL;
 	}
 

2.53.0

Same "perf" build issue with 5.15.212-rc1 here with the following signature:

CC
/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/util/symbol_fprintf.o
util/event.c: In function 'machine__resolve':
util/event.c:700:32: warning: implicit declaration of function 'perf_env__get_cpu_topology'; did you mean 'perf_env__read_cpu_topology_map'? [-Wimplicit-function-declaration]
700 | topo = perf_env__get_cpu_topology(env,

(struct perf_cpu){ al->cpu });
      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~
      |                                perf_env__read_cpu_topology_map
util/event.c:700:83: warning: excess elements in struct initializer
  700 |                         topo = perf_env__get_cpu_topology(env, 
(struct perf_cpu){ al->cpu });
      | 
                  ^~
util/event.c:700:83: note: (near initialization for '(anonymous)')
util/event.c:700:81: error: invalid use of undefined type 'struct perf_cpu'
  700 |                         topo = perf_env__get_cpu_topology(env, 
(struct perf_cpu){ al->cpu });
      | 
                ^

CC
/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/util/color_config.o
make[6]: *** [/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/build/Makefile.build:97: /local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/util/event.o] Error 1 make[6]: *** Waiting for unfinished jobs....

Florian

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email protected]>

commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.

nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to detect deferred writeback errors, but neither rotates the server's write verifier (nn->writeverf) when this check fails. Every other durable-storage-failure path in these functions calls commit_reset_write_verifier() before returning an error.

The missing rotation means clients holding UNSTABLE write data under the current verifier will COMMIT, receive the unchanged verifier back, and conclude their data is durable — silently dropping data that failed writeback. This violates the UNSTABLE+COMMIT durability contract (RFC 1813 §3.3.7, RFC 8881 §18.32).

Add commit_reset_write_verifier() calls at both filemap_check_wb_err() error sites, matching the pattern used by adjacent error paths in the same functions. The helper already filters -EAGAIN and -ESTALE internally, so the calls are unconditionally safe.

---
 fs/nfsd/vfs.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

index e1737984e0ca11..7b0bc4507ad047 100644
@@ -1133,8 +1133,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 	nfsd_stats_io_write_add(nn, exp, *cnt);
 	fsnotify_modify(file);
 	host_err = filemap_check_wb_err(file->f_mapping, since);
-	if (host_err < 0)
+	if (host_err < 0) {
+		nfsd_reset_write_verifier(nn);
+		trace_nfsd_writeverf_reset(nn, rqstp, host_err);
 		goto out_nfserr;
+	}
 
 	if (stable && use_wgather) {
 		host_err = wait_for_concurrent_writes(file);

@@ -1270,6 +1273,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
 			nfsd_copy_write_verifier(verf, nn);
 			err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
 						    since);
+			if (err2 < 0) {
+				nfsd_reset_write_verifier(nn);
+				trace_nfsd_writeverf_reset(nn, rqstp, err2);
+			}
 			err = nfserrno(err2);
 			break;
 		case -EINVAL:

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kiryl Shutsemau <[email protected]>

[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]

userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result.

The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive.

Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.

[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree predates the marker/return-style refactor of these functions ]

---
 fs/userfaultfd.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

index 868405f3cfa0c4..271ce399f6b6fd 100644
@@ -249,7 +249,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (huge_pte_none(pte))
 		ret = true;
-	if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): huge_pte_write() on a
+	 * non-present migration entry decodes random offset bits. The
+	 * migration completion path re-delivers the fault if still needed.
+	 */
+	if (pte_present(pte) && !huge_pte_write(pte) && (reason & VM_UFFD_WP))
 		ret = true;
 out:
 	return ret;

@@ -330,7 +335,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 	 */
 	if (pte_none(*pte))
 		ret = true;
-	if (!pte_write(*pte) && (reason & VM_UFFD_WP))
+	/*
+	 * Gate the writability check on pte_present(): pte_write() on a
+	 * non-present swap/migration entry decodes random offset bits. The
+	 * page-in path re-delivers the fault if it still needs userspace.
+	 */
+	if (pte_present(*pte) && !pte_write(*pte) && (reason & VM_UFFD_WP))
 		ret = true;
 	pte_unmap(pte);
 

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jiasheng Jiang <[email protected]>

commit ed713e2bc093239ccd380c2ce8ae9e4162f5c037 upstream.

As the potential failure of the kcalloc(),
it should be better to check it in order to
avoid the dereference of the NULL pointer.

---
 drivers/clk/imx/clk.c | 2 ++
 1 file changed, 2 insertions(+)

index d4cf0c7045ab27..be0493e5b494e6 100644
@@ -173,6 +173,8 @@ void imx_register_uart_clocks(unsigned int clk_count)
 		int i;
 
 		imx_uart_clocks = kcalloc(clk_count, sizeof(struct clk *), GFP_KERNEL);
+		if (!imx_uart_clocks)
+			return;
 
 		if (!of_stdout)
 			return;

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pedro Tammela <[email protected]>

[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ]

Transform two checks in the 'ex' key parsing into netlink policies removing extra if checks.

---
 net/sched/act_pedit.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

index efcbca97bf2eda..a987f60d202826 100644
@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
 };
 
 static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = {
-	[TCA_PEDIT_KEY_EX_HTYPE]  = { .type = NLA_U16 },
-	[TCA_PEDIT_KEY_EX_CMD]	  = { .type = NLA_U16 },
+	[TCA_PEDIT_KEY_EX_HTYPE] =
+		NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX),
+	[TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX),
 };
 
 static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,

@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
 		k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]);
 		k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]);
 
-		if (k->htype > TCA_PEDIT_HDR_TYPE_MAX ||
-		    k->cmd > TCA_PEDIT_CMD_MAX) {
-			err = -EINVAL;
-			goto err_out;
-		}
-
 		k++;
 	}
 

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tudor Ambarus <[email protected]>

The file drivers/dma-buf/dma-fence-unwrap.c was incorrectly added to the 5.15.y stable branch in commit 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp helper") as a new file, but it was never enabled in the Makefile, and its header include/linux/dma-fence-unwrap.h was not present, making it uncompilable.

A full revert of commit 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp helper") is not desirable because that commit also introduced the valid dma_fence_timestamp() helper and fixed legitimate timestamp race windows in drivers/dma-buf/sync_file.c and drivers/gpu/drm/scheduler/sched_main.c.

Since there are no users of dma-fence-unwrap in the 5.15.y branch, remove the unused file to clean up the tree and avoid confusion.

---
 drivers/dma-buf/dma-fence-unwrap.c | 176 -----------------------------
 1 file changed, 176 deletions(-)
 delete mode 100644 drivers/dma-buf/dma-fence-unwrap.c

deleted file mode 100644
index 628af51c81af3d..00000000000000
@@ -1,176 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * dma-fence-util: misc functions for dma_fence objects
- *
- * Copyright (C) 2022 Advanced Micro Devices, Inc.
- * Authors:
- *	Christian König <[email protected]>
- */
-
-#include <linux/dma-fence.h>
-#include <linux/dma-fence-array.h>
-#include <linux/dma-fence-chain.h>
-#include <linux/dma-fence-unwrap.h>
-#include <linux/slab.h>
-
-/* Internal helper to start new array iteration, don't use directly */
-static struct dma_fence *
-__dma_fence_unwrap_array(struct dma_fence_unwrap *cursor)
-{
-	cursor->array = dma_fence_chain_contained(cursor->chain);
-	cursor->index = 0;
-	return dma_fence_array_first(cursor->array);
-}
-
-/**
- * dma_fence_unwrap_first - return the first fence from fence containers
- * @head: the entrypoint into the containers
- * @cursor: current position inside the containers
- *
- * Unwraps potential dma_fence_chain/dma_fence_array containers and return the
- * first fence.
- */
-struct dma_fence *dma_fence_unwrap_first(struct dma_fence *head,
-					 struct dma_fence_unwrap *cursor)
-{
-	cursor->chain = dma_fence_get(head);
-	return __dma_fence_unwrap_array(cursor);
-}
-EXPORT_SYMBOL_GPL(dma_fence_unwrap_first);
-
-/**
- * dma_fence_unwrap_next - return the next fence from a fence containers
- * @cursor: current position inside the containers
- *
- * Continue unwrapping the dma_fence_chain/dma_fence_array containers and return
- * the next fence from them.
- */
-struct dma_fence *dma_fence_unwrap_next(struct dma_fence_unwrap *cursor)
-{
-	struct dma_fence *tmp;
-
-	++cursor->index;
-	tmp = dma_fence_array_next(cursor->array, cursor->index);
-	if (tmp)
-		return tmp;
-
-	cursor->chain = dma_fence_chain_walk(cursor->chain);
-	return __dma_fence_unwrap_array(cursor);
-}
-EXPORT_SYMBOL_GPL(dma_fence_unwrap_next);
-
-/* Implementation for the dma_fence_merge() marco, don't use directly */
-struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences,
-					   struct dma_fence **fences,
-					   struct dma_fence_unwrap *iter)
-{
-	struct dma_fence_array *result;
-	struct dma_fence *tmp, **array;
-	ktime_t timestamp;
-	unsigned int i;
-	size_t count;
-
-	count = 0;
-	timestamp = ns_to_ktime(0);
-	for (i = 0; i < num_fences; ++i) {
-		dma_fence_unwrap_for_each(tmp, &iter[i], fences[i]) {
-			if (!dma_fence_is_signaled(tmp)) {
-				++count;
-			} else {
-				ktime_t t = dma_fence_timestamp(tmp);
-
-				if (ktime_after(t, timestamp))
-					timestamp = t;
-			}
-		}
-	}
-
-	/*
-	 * If we couldn't find a pending fence just return a private signaled
-	 * fence with the timestamp of the last signaled one.
-	 */
-	if (count == 0)
-		return dma_fence_allocate_private_stub(timestamp);
-
-	array = kmalloc_array(count, sizeof(*array), GFP_KERNEL);
-	if (!array)
-		return NULL;
-
-	/*
-	 * This trashes the input fence array and uses it as position for the
-	 * following merge loop. This works because the dma_fence_merge()
-	 * wrapper macro is creating this temporary array on the stack together
-	 * with the iterators.
-	 */
-	for (i = 0; i < num_fences; ++i)
-		fences[i] = dma_fence_unwrap_first(fences[i], &iter[i]);
-
-	count = 0;
-	do {
-		unsigned int sel;
-
-restart:
-		tmp = NULL;
-		for (i = 0; i < num_fences; ++i) {
-			struct dma_fence *next;
-
-			while (fences[i] && dma_fence_is_signaled(fences[i]))
-				fences[i] = dma_fence_unwrap_next(&iter[i]);
-
-			next = fences[i];
-			if (!next)
-				continue;
-
-			/*
-			 * We can't guarantee that inpute fences are ordered by
-			 * context, but it is still quite likely when this
-			 * function is used multiple times. So attempt to order
-			 * the fences by context as we pass over them and merge
-			 * fences with the same context.
-			 */
-			if (!tmp || tmp->context > next->context) {
-				tmp = next;
-				sel = i;
-
-			} else if (tmp->context < next->context) {
-				continue;
-
-			} else if (dma_fence_is_later(tmp, next)) {
-				fences[i] = dma_fence_unwrap_next(&iter[i]);
-				goto restart;
-			} else {
-				fences[sel] = dma_fence_unwrap_next(&iter[sel]);
-				goto restart;
-			}
-		}
-
-		if (tmp) {
-			array[count++] = dma_fence_get(tmp);
-			fences[sel] = dma_fence_unwrap_next(&iter[sel]);
-		}
-	} while (tmp);
-
-	if (count == 0) {
-		tmp = dma_fence_allocate_private_stub(ktime_get());
-		goto return_tmp;
-	}
-
-	if (count == 1) {
-		tmp = array[0];
-		goto return_tmp;
-	}
-
-	result = dma_fence_array_create(count, array,
-					dma_fence_context_alloc(1),
-					1, false);
-	if (!result) {
-		tmp = NULL;
-		goto return_tmp;
-	}
-	return &result->base;
-
-return_tmp:
-	kfree(array);
-	return tmp;
-}
-EXPORT_SYMBOL_GPL(__dma_fence_unwrap_merge);

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ]

Device drivers should not invoke platform_driver_register()/unregister() in their probe and remove paths. They should further not rely on platform_driver_unregister() as their only means of "deleting" their child devices.

Introduce a helper to unregister the child device and move the platform_driver_register()/unregister() to module_init()/exit().

---
 drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

index defd22edcb414d..346cd7c8127065 100644
@@ -1471,6 +1471,13 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 	return -ENODEV;
 }
 
+static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl)
+{
+	struct qcom_slim_ngd *ngd = ctrl->ngd;
+
+	platform_device_del(ngd->pdev);
+}
+
 static int qcom_slim_ngd_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;

@@ -1580,7 +1587,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 		goto err_pdr_lookup;
 	}
 
-	platform_driver_register(&qcom_slim_ngd_driver);
 	return of_qcom_slim_ngd_register(dev, ctrl);
 
 err_pdr_alloc:

@@ -1594,7 +1600,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 
 static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
-	platform_driver_unregister(&qcom_slim_ngd_driver);
+	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+	qcom_slim_ngd_unregister(ctrl);
 
 	return 0;
 }

@@ -1673,6 +1681,28 @@ static struct platform_driver qcom_slim_ngd_driver = {
 	},
 };
 
-module_platform_driver(qcom_slim_ngd_ctrl_driver);
+static int qcom_slim_ngd_init(void)
+{
+	int ret;
+
+	ret = platform_driver_register(&qcom_slim_ngd_driver);
+	if (ret)
+		return ret;
+
+	ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver);
+	if (ret)
+		platform_driver_unregister(&qcom_slim_ngd_driver);
+
+	return ret;
+}
+
+static void qcom_slim_ngd_exit(void)
+{
+	platform_driver_unregister(&qcom_slim_ngd_ctrl_driver);
+	platform_driver_unregister(&qcom_slim_ngd_driver);
+}
+
+module_init(qcom_slim_ngd_init);
+module_exit(qcom_slim_ngd_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller");

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]

qcom_slim_ngd_ctrl_probe() first registers the SSR callback then allocates the PDR context, as such the error path needs to come in opposite order to allow us to unroll each step.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

index 346cd7c8127065..0ee537576b8204 100644
@@ -1577,23 +1577,22 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	if (IS_ERR(ctrl->pdr)) {
 		dev_err(dev, "Failed to init PDR handle\n");
 		ret = PTR_ERR(ctrl->pdr);
-		goto err_pdr_alloc;
+		goto err_unregister_ssr;
 	}
 
 	pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
 	if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
 		ret = PTR_ERR(pds);
 		dev_err(dev, "pdr add lookup failed: %d\n", ret);
-		goto err_pdr_lookup;
+		goto err_pdr_release;
 	}
 
 	return of_qcom_slim_ngd_register(dev, ctrl);
 
-err_pdr_alloc:
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
-
-err_pdr_lookup:
+err_pdr_release:
 	pdr_handle_release(ctrl->pdr);
+err_unregister_ssr:
+	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	return ret;
 }

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]

PDR and SSR callbacks are registred from the controller probe function, but currently released from the child device's remove function.

The remove() function should only be unwinding what was done in the same device's probe() function.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index 0ee537576b8204..91e9a39c6dcf03 100644
@@ -1601,6 +1601,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 
+	pdr_handle_release(ctrl->pdr);
+	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
 	qcom_slim_ngd_unregister(ctrl);
 
 	return 0;

@@ -1611,8 +1614,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 
 	pm_runtime_disable(&pdev->dev);
-	pdr_handle_release(ctrl->pdr);
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 	qcom_slim_ngd_enable(ctrl, false);
 	qcom_slim_ngd_exit_dma(ctrl);
 	qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email protected]>

[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks.

To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove().

Trivially convert the slimbus drivers from always returning zero in the remove callback to the void returning variant.

Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")

---
 drivers/slimbus/qcom-ctrl.c     |  5 ++---
 drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++-------
 2 files changed, 6 insertions(+), 10 deletions(-)

index ec58091fc948a2..5866014f0e2327 100644
@@ -630,7 +630,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int qcom_slim_remove(struct platform_device *pdev)
+static void qcom_slim_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -639,7 +639,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
 	clk_disable_unprepare(ctrl->rclk);
 	clk_disable_unprepare(ctrl->hclk);
 	destroy_workqueue(ctrl->rxwq);
-	return 0;
 }
 
 /*

@@ -726,7 +725,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
 
 static struct platform_driver qcom_slim_driver = {
 	.probe = qcom_slim_probe,
-	.remove = qcom_slim_remove,
+	.remove_new = qcom_slim_remove,
 	.driver	= {
 		.name = "qcom_slim_ctrl",
 		.of_match_table = qcom_slim_dt_match,

index 91e9a39c6dcf03..eb9d9d3d2948cc 100644
@@ -1597,7 +1597,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -1605,11 +1605,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
 	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	qcom_slim_ngd_unregister(ctrl);
-
-	return 0;
 }
 
-static int qcom_slim_ngd_remove(struct platform_device *pdev)
+static void qcom_slim_ngd_remove(struct platform_device *pdev)
 {
 	struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 

@@ -1622,7 +1620,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
 
 	kfree(ctrl->ngd);
 	ctrl->ngd = NULL;
-	return 0;
 }
 
 static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)

@@ -1665,7 +1662,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
 
 static struct platform_driver qcom_slim_ngd_ctrl_driver = {
 	.probe = qcom_slim_ngd_ctrl_probe,
-	.remove = qcom_slim_ngd_ctrl_remove,
+	.remove_new = qcom_slim_ngd_ctrl_remove,
 	.driver	= {
 		.name = "qcom,slim-ngd-ctrl",
 		.of_match_table = qcom_slim_ngd_dt_match,

@@ -1674,7 +1671,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
 
 static struct platform_driver qcom_slim_ngd_driver = {
 	.probe = qcom_slim_ngd_probe,
-	.remove = qcom_slim_ngd_remove,
+	.remove_new = qcom_slim_ngd_remove,
 	.driver	= {
 		.name = QCOM_SLIM_NGD_DRV_NAME,
 		.pm = &qcom_slim_ngd_dev_pm_ops,

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bjorn Andersson <[email protected]>

[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]

When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards.

One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.

[   21.858578] ------------[ cut here ]------------
[   21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
...
[   21.859251] Call trace:
[   21.859255]  __queue_work+0x5e0/0x790 (P)
[   21.859265]  queue_work_on+0x6c/0xf0
[   21.859273]  qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
[   21.859304]  qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
[   21.859318]  notifier_call_chain+0xa4/0x230
[   21.859329]  srcu_notifier_call_chain+0x64/0xb8
[   21.859338]  ssr_notify_start+0x40/0x78 [qcom_common]
[   21.859355]  rproc_start+0x130/0x230
[   21.859367]  rproc_boot+0x3d4/0x518

...

Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered.

This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.

---
 drivers/slimbus/qcom-ngd-ctrl.c | 56 +++++++++++++++++----------------
 1 file changed, 29 insertions(+), 27 deletions(-)

index eb9d9d3d2948cc..da57e44624caa3 100644
@@ -1521,6 +1521,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct qcom_slim_ngd_ctrl *ctrl;
 	struct resource *res;
+	int irq;
 	int ret;
 	struct pdr_service *pds;
 

@@ -1535,23 +1536,15 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	if (IS_ERR(ctrl->base))
 		return PTR_ERR(ctrl->base);
 
-	res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!res) {
-		dev_err(&pdev->dev, "no slimbus IRQ resource\n");
-		return -ENODEV;
-	}
-
-	ret = devm_request_irq(dev, res->start, qcom_slim_ngd_interrupt,
-			       IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
-	if (ret) {
-		dev_err(&pdev->dev, "request IRQ failed\n");
-		return ret;
-	}
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
 
-	ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
-	ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
-	if (IS_ERR(ctrl->notifier))
-		return PTR_ERR(ctrl->notifier);
+	ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
+			       IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
+			       "slim-ngd", ctrl);
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
 
 	ctrl->dev = dev;
 	ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;

@@ -1574,25 +1567,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
 	init_completion(&ctrl->qmi_up);
 
 	ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
-	if (IS_ERR(ctrl->pdr)) {
-		dev_err(dev, "Failed to init PDR handle\n");
-		ret = PTR_ERR(ctrl->pdr);
-		goto err_unregister_ssr;
-	}
+	if (IS_ERR(ctrl->pdr))
+		return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
+
+	ret = of_qcom_slim_ngd_register(dev, ctrl);
+	if (ret)
+		goto err_pdr_release;
 
 	pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
 	if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
-		ret = PTR_ERR(pds);
-		dev_err(dev, "pdr add lookup failed: %d\n", ret);
-		goto err_pdr_release;
+		ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
+		goto err_unregister_ngd;
+	}
+
+	ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+	ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+	if (IS_ERR(ctrl->notifier)) {
+		ret = PTR_ERR(ctrl->notifier);
+		goto err_unregister_ngd;
 	}
 
-	return of_qcom_slim_ngd_register(dev, ctrl);
+	enable_irq(irq);
+
+	return 0;
 
+err_unregister_ngd:
+	qcom_slim_ngd_unregister(ctrl);
 err_pdr_release:
 	pdr_handle_release(ctrl->pdr);
-err_unregister_ssr:
-	qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
 
 	return ret;
 }

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <[email protected]>

[ Upstream commit 89bd77cf436bf25e448817a662ebf76515f22863 ]

nfsd4_list_rec_dir() is called with two different callbacks. One of the callbacks uses vfs_rmdir() to remove the directory. The other doesn't use the dentry at all, just the name.

As only one callback needs the dentry, this patch moves the lookup into that callback. This prepares of changes to how directory operations are locked.

Stable-dep-of: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")

---
 fs/nfsd/nfs4recover.c | 55 ++++++++++++++++++++++---------------------
 1 file changed, 28 insertions(+), 27 deletions(-)

index b8ea2bdfbcfbf5..52984348ba3995 100644
@@ -254,7 +254,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
 	nfs4_reset_creds(original_cred);
 }
 
-typedef int (recdir_func)(struct dentry *, struct dentry *, struct nfsd_net *);
+typedef int (recdir_func)(struct dentry *, char *, struct nfsd_net *);
 
 struct name_list {
 	char name[HEXDIR_LEN];

@@ -308,23 +308,14 @@ nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
 	}
 
 	status = iterate_dir(nn->rec_file, &ctx.ctx);
-	inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
 
 	list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
-		if (!status) {
-			struct dentry *dentry;
-			dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
-			if (IS_ERR(dentry)) {
-				status = PTR_ERR(dentry);
-				break;
-			}
-			status = f(dir, dentry, nn);
-			dput(dentry);
-		}
+		if (!status)
+			status = f(dir, entry->name, nn);
+
 		list_del(&entry->list);
 		kfree(entry);
 	}
-	inode_unlock(d_inode(dir));
 	nfs4_reset_creds(original_cred);
 
 	list_for_each_entry_safe(entry, tmp, &ctx.names, list) {

@@ -422,18 +413,19 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
 }
 
 static int
-purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+purge_old(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
 	int status;
+	struct dentry *child;
 	struct xdr_netobj name;
 
-	if (child->d_name.len != HEXDIR_LEN - 1) {
-		printk("%s: illegal name %pd in recovery directory\n",
-				__func__, child);
+	if (strlen(cname) != HEXDIR_LEN - 1) {
+		printk("%s: illegal name %s in recovery directory\n",
+				__func__, cname);
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+	name.data = kstrdup(cname, GFP_KERNEL);
 	if (!name.data) {
 		dprintk("%s: failed to allocate memory for name.data!\n",
 			__func__);

@@ -443,10 +435,17 @@ purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
 	if (nfs4_has_reclaimed_state(name, nn))
 		goto out_free;
 
-	status = vfs_rmdir(&init_user_ns, d_inode(parent), child);
-	if (status)
-		printk("failed to remove client recovery directory %pd\n",
-				child);
+	inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+	child = lookup_one_len(cname, parent, HEXDIR_LEN - 1);
+	if (!IS_ERR(child)) {
+		status = vfs_rmdir(&init_user_ns, d_inode(parent), child);
+		if (status)
+			printk("failed to remove client recovery directory %pd\n",
+			       child);
+		dput(child);
+	}
+	inode_unlock(d_inode(parent));
+
 out_free:
 	kfree(name.data);
 out:

@@ -477,18 +476,18 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
 }
 
 static int
-load_recdir(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
 	struct xdr_netobj name;
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 
-	if (child->d_name.len != HEXDIR_LEN - 1) {
-		printk("%s: illegal name %pd in recovery directory\n",
-				__func__, child);
+	if (strlen(cname) != HEXDIR_LEN - 1) {
+		printk("%s: illegal name %s in recovery directory\n",
+				__func__, cname);
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+	name.data = kstrdup(cname, GFP_KERNEL);
 	if (!name.data) {
 		dprintk("%s: failed to allocate memory for name.data!\n",
 			__func__);

@@ -843,11 +842,13 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				return PTR_ERR(name.data);
 			name.len = namelen;
 		}
+#ifdef CONFIG_NFSD_V4
 		if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
 			name.len = name.len - 5;
 			memmove(name.data, name.data + 5, name.len);
 			cn->cn_has_legacy = true;
 		}
+#endif
 		if (!nfs4_client_to_reclaim(name, princhash, nn)) {
 			kfree(name.data);
 			kfree(princhash.data);

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: NeilBrown <[email protected]>

[ Upstream commit 4552f4e3f2c96597914f07b060d5c5db84420ddd ]

The calling convention for nfs4_client_to_reclaim() is clumsy in that the caller needs to free memory if the function fails. It is much cleaner if the function frees its own memory.

This patch changes nfs4_client_to_reclaim() to re-allocate the .data fields to be stored in the newly allocated struct nfs4_client_reclaim, and to free everything on failure.

__cld_pipe_inprogress_downcall() needs to allocate the data anyway to copy it from user-space, so now that data is allocated twice. I think that is a small price to pay for a cleaner interface.

---
 fs/nfsd/nfs4recover.c | 67 +++++++++++++++----------------------------
 fs/nfsd/nfs4state.c   | 22 ++++++++++++--
 2 files changed, 42 insertions(+), 47 deletions(-)

index 52984348ba3995..d13e512149eede 100644
@@ -167,24 +167,13 @@ legacy_recdir_name_error(struct nfs4_client *clp, int error)
 
 static void
 __nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
-		const char *dname, int len, struct nfsd_net *nn)
+				    char *dname, struct nfsd_net *nn)
 {
-	struct xdr_netobj name;
+	struct xdr_netobj name = { .len = strlen(dname), .data = dname };
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 	struct nfs4_client_reclaim *crp;
 
-	name.data = kmemdup(dname, len, GFP_KERNEL);
-	if (!name.data) {
-		dprintk("%s: failed to allocate memory for name.data!\n",
-			__func__);
-		return;
-	}
-	name.len = len;
 	crp = nfs4_client_to_reclaim(name, princhash, nn);
-	if (!crp) {
-		kfree(name.data);
-		return;
-	}
 	crp->cr_clp = clp;
 }
 

@@ -240,8 +229,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
 	inode_unlock(d_inode(dir));
 	if (status == 0) {
 		if (nn->in_grace)
-			__nfsd4_create_reclaim_record_grace(clp, dname,
-					HEXDIR_LEN, nn);
+			__nfsd4_create_reclaim_record_grace(clp, dname, nn);
 		vfs_fsync(nn->rec_file, 0);
 	} else {
 		printk(KERN_ERR "NFSD: failed to write recovery record"

@@ -478,7 +466,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
 static int
 load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 {
-	struct xdr_netobj name;
+	struct xdr_netobj name = { .len = HEXDIR_LEN, .data = cname };
 	struct xdr_netobj princhash = { .len = 0, .data = NULL };
 
 	if (strlen(cname) != HEXDIR_LEN - 1) {

@@ -487,16 +475,7 @@ load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
 		/* Keep trying; maybe the others are OK: */
 		return 0;
 	}
-	name.data = kstrdup(cname, GFP_KERNEL);
-	if (!name.data) {
-		dprintk("%s: failed to allocate memory for name.data!\n",
-			__func__);
-		goto out;
-	}
-	name.len = HEXDIR_LEN;
-	if (!nfs4_client_to_reclaim(name, princhash, nn))
-		kfree(name.data);
-out:
+	nfs4_client_to_reclaim(name, princhash, nn);
 	return 0;
 }
 

@@ -792,6 +771,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 {
 	uint8_t cmd, princhashlen;
 	struct xdr_netobj name, princhash = { .len = 0, .data = NULL };
+	char *namecopy __free(kfree) = NULL;
+	char *princhashcopy __free(kfree) = NULL;
 	uint16_t namelen;
 	struct cld_net *cn = nn->cld_net;
 

@@ -810,20 +791,20 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				dprintk("%s: namelen should not be zero", __func__);
 				return -EINVAL;
 			}
-			name.data = memdup_user(&ci->cc_name.cn_id, namelen);
-			if (IS_ERR(name.data))
-				return PTR_ERR(name.data);
+			namecopy = memdup_user(&ci->cc_name.cn_id, namelen);
+			if (IS_ERR(namecopy))
+				return PTR_ERR(namecopy);
+			name.data = namecopy;
 			name.len = namelen;
 			if (get_user(princhashlen, &ci->cc_princhash.cp_len))
 				return -EFAULT;
 			if (princhashlen > 0) {
-				princhash.data = memdup_user(
-						&ci->cc_princhash.cp_data,
-						princhashlen);
-				if (IS_ERR(princhash.data)) {
-					kfree(name.data);
-					return PTR_ERR(princhash.data);
-				}
+				princhashcopy = memdup_user(
+					&ci->cc_princhash.cp_data,
+					princhashlen);
+				if (IS_ERR(princhashcopy))
+					return PTR_ERR(princhashcopy);
+				princhash.data = princhashcopy;
 				princhash.len = princhashlen;
 			} else
 				princhash.len = 0;

@@ -837,23 +818,21 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
 				dprintk("%s: namelen should not be zero", __func__);
 				return -EINVAL;
 			}
-			name.data = memdup_user(&cnm->cn_id, namelen);
-			if (IS_ERR(name.data))
-				return PTR_ERR(name.data);
+			namecopy = memdup_user(&cnm->cn_id, namelen);
+			if (IS_ERR(namecopy))
+				return PTR_ERR(namecopy);
+			name.data = namecopy;
 			name.len = namelen;
 		}
 #ifdef CONFIG_NFSD_V4
 		if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
 			name.len = name.len - 5;
-			memmove(name.data, name.data + 5, name.len);
+			name.data = name.data + 5;
 			cn->cn_has_legacy = true;
 		}
 #endif
-		if (!nfs4_client_to_reclaim(name, princhash, nn)) {
-			kfree(name.data);
-			kfree(princhash.data);
+		if (!nfs4_client_to_reclaim(name, princhash, nn))
 			return -EFAULT;
-		}
 		return nn->client_tracking_ops->msglen;
 	}
 	return -EFAULT;

index 86e3bf53440e38..e6c0b1520973e9 100644
@@ -8028,9 +8028,6 @@ nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
 
 /*
  * failure => all reset bets are off, nfserr_no_grace...
- *
- * The caller is responsible for freeing name.data if NULL is returned (it
- * will be freed in nfs4_remove_reclaim_record in the normal case).
  */
 struct nfs4_client_reclaim *
 nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,

@@ -8039,6 +8036,22 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 	unsigned int strhashval;
 	struct nfs4_client_reclaim *crp;
 
+	name.data = kmemdup(name.data, name.len, GFP_KERNEL);
+	if (!name.data) {
+		dprintk("%s: failed to allocate memory for name.data!\n",
+			__func__);
+		return NULL;
+	}
+	if (princhash.len) {
+		princhash.data = kmemdup(princhash.data, princhash.len, GFP_KERNEL);
+		if (!princhash.data) {
+			dprintk("%s: failed to allocate memory for princhash.data!\n",
+				__func__);
+			kfree(name.data);
+			return NULL;
+		}
+	} else
+		princhash.data = NULL;
 	crp = alloc_reclaim();
 	if (crp) {
 		strhashval = clientstr_hashval(name);

@@ -8050,6 +8063,9 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
 		crp->cr_princhash.len = princhash.len;
 		crp->cr_clp = NULL;
 		nn->reclaim_str_hashtbl_size++;
+	} else {
+		kfree(name.data);
+		kfree(princhash.data);
 	}
 	return crp;
 }

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email protected]>

commit f1edbed787ba67988ed34e0132ca128b052b6ce8 upstream.

Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses.

For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets).

If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal.

Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.

E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned.

  ------------[ cut here ]------------
  kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
  Oops: invalid opcode: 0000 [#1] SMP
  CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
  Call Trace:
   <TASK>
   __kvm_io_bus_write+0x85/0xb0 [kvm]
   kvm_io_bus_write+0x53/0x80 [kvm]
   vcpu_mmio_write+0x66/0xf0 [kvm]
   emulator_read_write_onepage+0x12a/0x540 [kvm]
   emulator_read_write+0x109/0x2b0 [kvm]
   x86_emulate_insn+0x4f8/0xfb0 [kvm]
   x86_emulate_instruction+0x181/0x790 [kvm]
   kvm_mmu_page_fault+0x313/0x630 [kvm]
   vmx_handle_exit+0x18a/0x590 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
   kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb7/0x890
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f19c931a9bf
   </TASK>
  Modules linked in: kvm_intel kvm irqbypass
  ---[ end trace 0000000000000000 ]---

In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.

Message-ID: <[email protected]>

---
 virt/kvm/eventfd.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

index c841f8bc8228a1..b78a82f6dbbbd0 100644
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/seqlock.h>
 #include <linux/irqbypass.h>
+#include <asm/unaligned.h>
 #include <trace/events/kvm.h>
 
 #include <kvm/iodev.h>

@@ -710,21 +711,18 @@ ioeventfd_in_range(struct _ioeventfd *p, gpa_t addr, int len, const void *val)
 		return true;
 
 	/* otherwise, we have to actually compare the data */
-
-	BUG_ON(!IS_ALIGNED((unsigned long)val, len));
-
 	switch (len) {
 	case 1:
-		_val = *(u8 *)val;
+		_val = get_unaligned((u8 *)val);
 		break;
 	case 2:
-		_val = *(u16 *)val;
+		_val = get_unaligned((u16 *)val);
 		break;
 	case 4:
-		_val = *(u32 *)val;
+		_val = get_unaligned((u32 *)val);
 		break;
 	case 8:
-		_val = *(u64 *)val;
+		_val = get_unaligned((u64 *)val);
 		break;
 	default:
 		return false;

2.53.0

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email protected]>

commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream.

Toolchains with older kernel headers that do not include upstream commit c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write life time hints") will now fail to build perf due to missing definitions for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT.

Provide a fallback definition for these when they are not already defined.

---
 tools/perf/trace/beauty/fcntl.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

@@ -9,6 +9,22 @@
 #include <linux/kernel.h>
 #include <uapi/linux/fcntl.h>
 
+#ifndef F_GET_RW_HINT
+#define F_GET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 11)
+#endif
+
+#ifndef F_SET_RW_HINT
+#define F_SET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 12)
+#endif
+
+#ifndef F_GET_FILE_RW_HINT
+#define F_GET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 13)
+#endif
+
+#ifndef F_SET_FILE_RW_HINT
+#define F_SET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 14)
+#endif
+
 static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix)
 {
 	return val ? scnprintf(bf, size, "%s", "0") :

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pablo Neira Ayuso <[email protected]>

commit e79b47a8615d42c68aaeb68971593333667382ed upstream.

the original state. Currently, it uses the set->ops->walk() to iterate over these set elements. The existing set iterator skips inactive elements in the next generation, this does not work from the abort path to restore the original state since it has to skip active elements instead (not inactive ones).

This patch moves the check for inactive elements to the set iterator callback, then it reverses the logic for the .activate case which needs to skip active elements.

Toggle next generation bit for elements when delete set command is invoked and call nft_clear() from .activate (abort) path to restore the next generation bit.

The splat below shows an object in mappings memleak:

[43929.457523] ------------[ cut here ]------------
[43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
[...]
[43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
[43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90
[43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246
[43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000
[43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550
[43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f
[43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0
[43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002
[43929.458103] FS:  00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000
[43929.458107] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0
[43929.458114] Call Trace:
[43929.458118]  <TASK>
[43929.458121]  ? __warn+0x9f/0x1a0
[43929.458127]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
[43929.458188]  ? report_bug+0x1b1/0x1e0
[43929.458196]  ? handle_bug+0x3c/0x70
[43929.458200]  ? exc_invalid_op+0x17/0x40
[43929.458211]  ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables]
[43929.458271]  ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables]
[43929.458332]  nft_mapelem_deactivate+0x24/0x30 [nf_tables]
[43929.458392]  nft_rhash_walk+0xdd/0x180 [nf_tables]
[43929.458453]  ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables]
[43929.458512]  ? rb_insert_color+0x2e/0x280
[43929.458520]  nft_map_deactivate+0xdc/0x1e0 [nf_tables]
[43929.458582]  ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables]
[43929.458642]  ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables]
[43929.458701]  ? __rcu_read_unlock+0x46/0x70
[43929.458709]  nft_delset+0xff/0x110 [nf_tables]
[43929.458769]  nft_flush_table+0x16f/0x460 [nf_tables]
[43929.458830]  nf_tables_deltable+0x501/0x580 [nf_tables]

[Vegard: CVE-2024-27012; fixed conflicts due to missing commits
0e1ea651c9717ddcd8e0648d8468477a31867b0a ("netfilter: nf_tables: shrink memory consumption of set elements") and 9dad402b89e81a0516bad5e0ac009b7a0a80898f ("netfilter: nf_tables: expose opaque set element as struct nft_elem_priv") so we pass the correct types and values to nft_setelem_data_deactivate(), nft_setelem_validate(), nft_set_elem_ext(), etc.]

[acsjakub: clean cherry-pick of the commit 164936b2fc88
("netfilter: nf_tables: restore set elements when delete set fails") from 6.6.y. Plus, add "[ Upstream commit .." header to the message]

[sidk: clean cherry-pick of the commit faa0deee2721
("netfilter: nf_tables: restore set elements when delete set fails") from 6.1.y.]

---
 net/netfilter/nf_tables_api.c  |   41 +++++++++++++++++++++++++++++++++++++----
 net/netfilter/nft_set_bitmap.c |    4 +---
 net/netfilter/nft_set_hash.c   |    8 ++------
 net/netfilter/nft_set_pipapo.c |    5 +----
 net/netfilter/nft_set_rbtree.c |    4 +---
 5 files changed, 42 insertions(+), 20 deletions(-)

@@ -594,6 +594,12 @@ static int nft_mapelem_deactivate(const
 				  const struct nft_set_iter *iter,
 				  struct nft_set_elem *elem)
 {
+	struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
+	nft_set_elem_change_active(ctx->net, set, ext);
 	nft_setelem_data_deactivate(ctx->net, set, elem);
 
 	return 0;

@@ -619,6 +625,7 @@ static void nft_map_catchall_deactivate(
 			continue;
 
 		elem.priv = catchall->elem;
+		nft_set_elem_change_active(ctx->net, set, ext);
 		nft_setelem_data_deactivate(ctx->net, set, &elem);
 		break;
 	}

@@ -3522,6 +3529,9 @@ int nft_setelem_validate(const struct nf
 	const struct nft_data *data;
 	int err;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
 	    *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
 		return 0;

@@ -3545,19 +3555,22 @@ int nft_setelem_validate(const struct nf
 
 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set)
 {
-	u8 genmask = nft_genmask_next(ctx->net);
+	struct nft_set_iter dummy_iter = {
+		.genmask	= nft_genmask_next(ctx->net),
+	};
 	struct nft_set_elem_catchall *catchall;
 	struct nft_set_elem elem;
+
 	struct nft_set_ext *ext;
 	int ret = 0;
 
 	list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
 		ext = nft_set_elem_ext(set, catchall->elem);
-		if (!nft_set_elem_active(ext, genmask))
+		if (!nft_set_elem_active(ext, dummy_iter.genmask))
 			continue;
 
 		elem.priv = catchall->elem;
-		ret = nft_setelem_validate(ctx, set, NULL, &elem);
+		ret = nft_setelem_validate(ctx, set, &dummy_iter, &elem);
 		if (ret < 0)
 			return ret;
 	}

@@ -5032,6 +5045,11 @@ static int nf_tables_bind_check_setelem(
 					const struct nft_set_iter *iter,
 					struct nft_set_elem *elem)
 {
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	return nft_setelem_data_validate(ctx, set, elem);
 }
 

@@ -5126,6 +5144,13 @@ static int nft_mapelem_activate(const st
 				const struct nft_set_iter *iter,
 				struct nft_set_elem *elem)
 {
+	struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+	/* called from abort path, reverse check to undo changes. */
+	if (nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
+	nft_clear(ctx->net, ext);
 	nft_setelem_data_activate(ctx->net, set, elem);
 
 	return 0;

@@ -5144,6 +5169,7 @@ static void nft_map_catchall_activate(co
 		if (nft_set_elem_active(ext, genmask))
 			continue;
 
+		nft_clear(ctx->net, ext);
 		elem.priv = catchall->elem;
 		nft_setelem_data_activate(ctx->net, set, &elem);
 		break;

@@ -5417,6 +5443,9 @@ static int nf_tables_dump_setelem(const
 	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 	struct nft_set_dump_args *args;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))
 		return 0;
 

@@ -6103,7 +6132,7 @@ static void nft_setelem_activate(struct
 	struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 
 	if (nft_setelem_is_catchall(set, elem)) {
-		nft_set_elem_change_active(net, set, ext);
+		nft_clear(net, ext);
 	} else {
 		set->ops->activate(net, set, elem);
 	}

@@ -6777,9 +6806,13 @@ static int nft_setelem_flush(const struc
 			     const struct nft_set_iter *iter,
 			     struct nft_set_elem *elem)
 {
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 	struct nft_trans *trans;
 	int err;
 
+	if (!nft_set_elem_active(ext, iter->genmask))
+		return 0;
+
 	trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
 				    sizeof(struct nft_trans_elem), GFP_ATOMIC);
 	if (!trans)

@@ -171,7 +171,7 @@ static void nft_bitmap_activate(const st
 	nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
 	/* Enter 11 state. */
 	priv->bitmap[idx] |= (genmask << off);
-	nft_set_elem_change_active(net, set, &be->ext);
+	nft_clear(net, &be->ext);
 }
 
 static bool nft_bitmap_flush(const struct net *net,

@@ -223,8 +223,6 @@ static void nft_bitmap_walk(const struct
 	list_for_each_entry_rcu(be, &priv->list, head) {
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&be->ext, iter->genmask))
-			goto cont;
 
 		elem.priv = be;
 

@@ -196,7 +196,7 @@ static void nft_rhash_activate(const str
 {
 	struct nft_rhash_elem *he = elem->priv;
 
-	nft_set_elem_change_active(net, set, &he->ext);
+	nft_clear(net, &he->ext);
 }
 
 static bool nft_rhash_flush(const struct net *net,

@@ -285,8 +285,6 @@ static void nft_rhash_walk(const struct
 
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&he->ext, iter->genmask))
-			goto cont;
 
 		elem.priv = he;
 

@@ -615,7 +613,7 @@ static void nft_hash_activate(const stru
 {
 	struct nft_hash_elem *he = elem->priv;
 
-	nft_set_elem_change_active(net, set, &he->ext);
+	nft_clear(net, &he->ext);
 }
 
 static bool nft_hash_flush(const struct net *net,

@@ -669,8 +667,6 @@ static void nft_hash_walk(const struct n
 		hlist_for_each_entry_rcu(he, &priv->table[i], node) {
 			if (iter->count < iter->skip)
 				goto cont;
-			if (!nft_set_elem_active(&he->ext, iter->genmask))
-				goto cont;
 
 			elem.priv = he;
 

@@ -1819,7 +1819,7 @@ static void nft_pipapo_activate(const st
 {
 	struct nft_pipapo_elem *e = elem->priv;
 
-	nft_set_elem_change_active(net, set, &e->ext);
+	nft_clear(net, &e->ext);
 }
 
 /**

@@ -2121,9 +2121,6 @@ static void nft_pipapo_walk(const struct
 
 		e = f->mt[r].e;
 
-		if (!nft_set_elem_active(&e->ext, iter->genmask))
-			goto cont;
-
 		elem.priv = e;
 
 		iter->err = iter->fn(ctx, set, iter, &elem);

@@ -548,7 +548,7 @@ static void nft_rbtree_activate(const st
 {
 	struct nft_rbtree_elem *rbe = elem->priv;
 
-	nft_set_elem_change_active(net, set, &rbe->ext);
+	nft_clear(net, &rbe->ext);
 }
 
 static bool nft_rbtree_flush(const struct net *net,

@@ -618,8 +618,6 @@ static void nft_rbtree_walk(const struct
 
 		if (iter->count < iter->skip)
 			goto cont;
-		if (!nft_set_elem_active(&rbe->ext, iter->genmask))
-			goto cont;
 
 		elem.priv = rbe;
 

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 5a8fb33e530512ee67a11b30f3451a4f030f4b01 ]

We have plans for increasing MAX_SKB_FRAGS, but sk_msg_sg::copy is currently an unsigned long, limiting MAX_SKB_FRAGS to 30 on 32bit arches.

Convert it to a bitmap, as Jakub suggested.

Stable-dep-of: 406e8a651a7b ("net: skmsg: preserve sg.copy across SG transforms")

---
 include/linux/skmsg.h |   11 +++++------
 net/core/filter.c     |    4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)

@@ -29,7 +29,7 @@ struct sk_msg_sg {
 	u32				end;
 	u32				size;
 	u32				copybreak;
-	unsigned long			copy;
+	DECLARE_BITMAP(copy, MAX_MSG_FRAGS + 2);
 	/* The extra two elements:
 	 * 1) used for chaining the front and sections when the list becomes
 	 *    partitioned (e.g. end < start). The crypto APIs require the

@@ -38,7 +38,6 @@ struct sk_msg_sg {
 	 */
 	struct scatterlist		data[MAX_MSG_FRAGS + 2];
 };
-static_assert(BITS_PER_LONG >= NR_MSG_FRAG_IDS);
 
 /* UAPI in filter.c depends on struct sk_msg_sg being first element. */
 struct sk_msg {

@@ -236,7 +235,7 @@ static inline void sk_msg_compute_data_p
 {
 	struct scatterlist *sge = sk_msg_elem(msg, msg->sg.start);
 
-	if (test_bit(msg->sg.start, &msg->sg.copy)) {
+	if (test_bit(msg->sg.start, msg->sg.copy)) {
 		msg->data = NULL;
 		msg->data_end = NULL;
 	} else {

@@ -255,7 +254,7 @@ static inline void sk_msg_page_add(struc
 	sg_set_page(sge, page, len, offset);
 	sg_unmark_end(sge);
 
-	__set_bit(msg->sg.end, &msg->sg.copy);
+	__set_bit(msg->sg.end, msg->sg.copy);
 	msg->sg.size += len;
 	sk_msg_iter_next(msg, end);
 }

@@ -264,9 +263,9 @@ static inline void sk_msg_sg_copy(struct
 {
 	do {
 		if (copy_state)
-			__set_bit(i, &msg->sg.copy);
+			__set_bit(i, msg->sg.copy);
 		else
-			__clear_bit(i, &msg->sg.copy);
+			__clear_bit(i, msg->sg.copy);
 		sk_msg_iter_var_next(i);
 		if (i == msg->sg.end)
 			break;

@@ -2660,7 +2660,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 	 * account for the headroom.
 	 */
 	bytes_sg_total = start - offset + bytes;
-	if (!test_bit(i, &msg->sg.copy) && bytes_sg_total <= len)
+	if (!test_bit(i, msg->sg.copy) && bytes_sg_total <= len)
 		goto out;
 
 	/* At this point we need to linearize multiple scatterlist

@@ -2883,7 +2883,7 @@ place_new:
 	/* Place newly allocated data buffer */
 	sk_mem_charge(msg->sk, len);
 	msg->sg.size += len;
-	__clear_bit(new, &msg->sg.copy);
+	__clear_bit(new, msg->sg.copy);
 	sg_set_page(&msg->sg.data[new], page, len + copy, 0);
 	if (rsge.length) {
 		get_page(sg_page(&rsge));

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yiming Qian <[email protected]>

[ Upstream commit 406e8a651a7b854c41fecd5117bb282b3a6c2c6b ]

The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages.

Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache.

Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.

---
 include/linux/skmsg.h |   15 +++++++++++----
 net/core/filter.c     |   27 +++++++++++++++++++++++++++
 net/core/skmsg.c      |    2 ++
 net/tls/tls_sw.c      |    4 ++++
 4 files changed, 44 insertions(+), 4 deletions(-)

@@ -4,6 +4,7 @@
 #ifndef _LINUX_SKMSG_H
 #define _LINUX_SKMSG_H
 
+#include <linux/bitops.h>
 #include <linux/bpf.h>
 #include <linux/filter.h>
 #include <linux/scatterlist.h>

@@ -188,11 +189,14 @@ static inline void sk_msg_xfer(struct sk
 			       int which, u32 size)
 {
 	dst->sg.data[which] = src->sg.data[which];
+	__assign_bit(which, dst->sg.copy, test_bit(which, src->sg.copy));
 	dst->sg.data[which].length  = size;
 	dst->sg.size		   += size;
 	src->sg.size		   -= size;
 	src->sg.data[which].length -= size;
 	src->sg.data[which].offset += size;
+	if (!src->sg.data[which].length)
+		__clear_bit(which, src->sg.copy);
 }
 
 static inline void sk_msg_xfer_full(struct sk_msg *dst, struct sk_msg *src)

@@ -262,16 +266,19 @@ static inline void sk_msg_page_add(struc
 static inline void sk_msg_sg_copy(struct sk_msg *msg, u32 i, bool copy_state)
 {
 	do {
-		if (copy_state)
-			__set_bit(i, msg->sg.copy);
-		else
-			__clear_bit(i, msg->sg.copy);
+		__assign_bit(i, msg->sg.copy, copy_state);
 		sk_msg_iter_var_next(i);
 		if (i == msg->sg.end)
 			break;
 	} while (1);
 }
 
+static inline void sk_msg_sg_copy_assign(struct sk_msg *dst, u32 dst_i,
+					 const struct sk_msg *src, u32 src_i)
+{
+	__assign_bit(dst_i, dst->sg.copy, test_bit(src_i, src->sg.copy));
+}
+
 static inline void sk_msg_sg_copy_set(struct sk_msg *msg, u32 start)
 {
 	sk_msg_sg_copy(msg, start, true);

@@ -2701,11 +2701,13 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 		poffset += len;
 		sge->length = 0;
 		put_page(sg_page(sge));
+		__clear_bit(i, msg->sg.copy);
 
 		sk_msg_iter_var_next(i);
 	} while (i != last_sge);
 
 	sg_set_page(&msg->sg.data[first_sge], page, copy, 0);
+	__clear_bit(first_sge, msg->sg.copy);
 
 	/* To repair sg ring we need to shift entries. If we only
 	 * had a single entry though we can just replace it and

@@ -2731,9 +2733,11 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
 			break;
 
 		msg->sg.data[i] = msg->sg.data[move_from];
+		sk_msg_sg_copy_assign(msg, i, msg, move_from);
 		msg->sg.data[move_from].length = 0;
 		msg->sg.data[move_from].page_link = 0;
 		msg->sg.data[move_from].offset = 0;
+		__clear_bit(move_from, msg->sg.copy);
 		sk_msg_iter_var_next(i);
 	} while (1);
 

@@ -2762,6 +2766,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 {
 	struct scatterlist sge, nsge, nnsge, rsge = {0}, *psge;
 	u32 new, i = 0, l = 0, space, copy = 0, offset = 0;
+	bool sge_copy, nsge_copy, nnsge_copy, rsge_copy = false;
 	u8 *raw, *to, *from;
 	struct page *page;
 

@@ -2834,6 +2839,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		rsge = sk_msg_elem_cpy(msg, i);
+		rsge_copy = test_bit(i, msg->sg.copy);
 
 		psge->length = start - offset;
 		rsge.length -= psge->length;

@@ -2858,24 +2864,32 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
 
 	/* Shift one or two slots as needed */
 	sge = sk_msg_elem_cpy(msg, new);
+	sge_copy = test_bit(new, msg->sg.copy);
 	sg_unmark_end(&sge);
 
 	nsge = sk_msg_elem_cpy(msg, i);
+	nsge_copy = test_bit(i, msg->sg.copy);
 	if (rsge.length) {
 		sk_msg_iter_var_next(i);
 		nnsge = sk_msg_elem_cpy(msg, i);
+		nnsge_copy = test_bit(i, msg->sg.copy);
 		sk_msg_iter_next(msg, end);
 	}
 
 	while (i != msg->sg.end) {
 		msg->sg.data[i] = sge;
+		__assign_bit(i, msg->sg.copy, sge_copy);
 		sge = nsge;
+		sge_copy = nsge_copy;
 		sk_msg_iter_var_next(i);
 		if (rsge.length) {
 			nsge = nnsge;
+			nsge_copy = nnsge_copy;
 			nnsge = sk_msg_elem_cpy(msg, i);
+			nnsge_copy = test_bit(i, msg->sg.copy);
 		} else {
 			nsge = sk_msg_elem_cpy(msg, i);
+			nsge_copy = test_bit(i, msg->sg.copy);
 		}
 	}
 

@@ -2889,6 +2903,7 @@ place_new:
 		get_page(sg_page(&rsge));
 		sk_msg_iter_var_next(new);
 		msg->sg.data[new] = rsge;
+		__assign_bit(new, msg->sg.copy, rsge_copy);
 	}
 
 	sk_msg_reset_curr(msg);

@@ -2916,25 +2931,33 @@ static void sk_msg_shift_left(struct sk_
 		prev = i;
 		sk_msg_iter_var_next(i);
 		msg->sg.data[prev] = msg->sg.data[i];
+		sk_msg_sg_copy_assign(msg, prev, msg, i);
 	} while (i != msg->sg.end);
 
 	sk_msg_iter_prev(msg, end);
+	__clear_bit(msg->sg.end, msg->sg.copy);
 }
 
 static void sk_msg_shift_right(struct sk_msg *msg, int i)
 {
 	struct scatterlist tmp, sge;
+	bool tmp_copy, sge_copy;
 
 	sk_msg_iter_next(msg, end);
 	sge = sk_msg_elem_cpy(msg, i);
+	sge_copy = test_bit(i, msg->sg.copy);
 	sk_msg_iter_var_next(i);
 	tmp = sk_msg_elem_cpy(msg, i);
+	tmp_copy = test_bit(i, msg->sg.copy);
 
 	while (i != msg->sg.end) {
 		msg->sg.data[i] = sge;
+		__assign_bit(i, msg->sg.copy, sge_copy);
 		sk_msg_iter_var_next(i);
 		sge = tmp;
+		sge_copy = tmp_copy;
 		tmp = sk_msg_elem_cpy(msg, i);
+		tmp_copy = test_bit(i, msg->sg.copy);
 	}
 }
 

@@ -2994,6 +3017,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 		struct scatterlist *nsge, *sge = sk_msg_elem(msg, i);
 		int a = start - offset;
 		int b = sge->length - pop - a;
+		u32 sge_i = i;
+		bool sge_copy = test_bit(i, msg->sg.copy);
 
 		sk_msg_iter_var_next(i);
 

@@ -3006,6 +3031,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 				sg_set_page(nsge,
 					    sg_page(sge),
 					    b, sge->offset + pop + a);
+				__assign_bit(i, msg->sg.copy, sge_copy);
 			} else {
 				struct page *page, *orig;
 				u8 *to, *from;

@@ -3022,6 +3048,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 				memcpy(to, from, a);
 				memcpy(to + a, from + a + pop, b);
 				sg_set_page(sge, page, a + b, 0);
+				__clear_bit(sge_i, msg->sg.copy);
 				put_page(orig);
 			}
 			pop = 0;

@@ -65,6 +65,7 @@ int sk_msg_alloc(struct sock *sk, struct
 			sge = &msg->sg.data[msg->sg.end];
 			sg_unmark_end(sge);
 			sg_set_page(sge, pfrag->page, use, orig_offset);
+			__clear_bit(msg->sg.end, msg->sg.copy);
 			get_page(pfrag->page);
 			sk_msg_iter_next(msg, end);
 		}

@@ -185,6 +186,7 @@ static int sk_msg_free_elem(struct sock
 			sk_mem_uncharge(sk, len);
 		put_page(sg_page(sge));
 	}
+	__clear_bit(i, msg->sg.copy);
 	memset(sge, 0, sizeof(*sge));
 	return len;
 }

@@ -607,6 +607,7 @@ static int tls_split_open_record(struct
 	struct scatterlist *sge, *osge, *nsge;
 	u32 orig_size = msg_opl->sg.size;
 	struct scatterlist tmp = { };
+	u32 tmp_i = 0;
 	struct sk_msg *msg_npl;
 	struct tls_rec *new;
 	int ret;

@@ -628,6 +629,7 @@ static int tls_split_open_record(struct
 		if (sge->length > apply) {
 			u32 len = sge->length - apply;
 
+			tmp_i = i;
 			get_page(sg_page(sge));
 			sg_set_page(&tmp, sg_page(sge), len,
 				    sge->offset + apply);

@@ -659,6 +661,7 @@ static int tls_split_open_record(struct
 	nsge = sk_msg_elem(msg_npl, j);
 	if (tmp.length) {
 		memcpy(nsge, &tmp, sizeof(*nsge));
+		sk_msg_sg_copy_assign(msg_npl, j, msg_opl, tmp_i);
 		sk_msg_iter_var_next(j);
 		nsge = sk_msg_elem(msg_npl, j);
 	}

@@ -666,6 +669,7 @@ static int tls_split_open_record(struct
 	osge = sk_msg_elem(msg_opl, i);
 	while (osge->length) {
 		memcpy(nsge, osge, sizeof(*nsge));
+		sk_msg_sg_copy_assign(msg_npl, j, msg_opl, i);
 		sg_unmark_end(nsge);
 		sk_msg_iter_var_next(i);
 		sk_msg_iter_var_next(j);

5.15-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruslan Valiyev <[email protected]>

[ Upstream commit 6f060496d03e4dc560a40f73770bd08335cb7a27 ]

aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_ploaddata_rmfs() is queued on a workqueue that takes ns->lock and removes the entry. Between dropping the last pcount and the workqueue running, an entry remains on the list with pcount == 0.