5.10.270-rc1 review

This is the start of the stable review cycle for the 5.10.270 release. There are 798 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.270-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.270-rc1

Zhang Chen <[email protected]>
Bluetooth: L2CAP: Fix send LE flow credits in ACL link

Steven Rostedt (VMware) <[email protected]>
tracing: Handle %.*s in trace_check_vprintf()

Steven Rostedt (Google) <[email protected]>
tracing: Have trace event string test handle zero length strings

Michael Wu <[email protected]>
tracing: Fix race between update_event_fields and, event_define_fields

Dan Carpenter <[email protected]>
HID: fix an error code in hid_check_device_match()

Rafael Mendonca <[email protected]>
scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

Andy Shevchenko <[email protected]>
ACPI: utils: Document for_each_acpi_dev_match() macro

Thomas Gleixner <[email protected]>
mm/highmem: Take kmap_high_get() properly into account

Bjorn Andersson <[email protected]>
clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled

Hui Tang <[email protected]>
crypto: testmgr - fix initialization of 'secret_size'

Hui Tang <[email protected]>
crypto: ecdh - extend 'cra_driver_name' with curve name

Dmitry Baryshkov <[email protected]>
driver core: platform: don't oops in platform_shutdown() on unbound devices

Jiayuan Chen <[email protected]>
tcp: fix corruption of urgent data on multi-segment retransmit

Deepanshu Kartikey <[email protected]>
usb: atm: usbatm: fix invalid ci_range initialization

bui duc phuc <[email protected]>
net: fec: only stop PTP if it was initialized

Jamal Hadi Salim <[email protected]>
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Account for the UC filter list for filtering tests

Maxime Chevallier <[email protected]>
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering

Maxime Chevallier <[email protected]>
net: stmmac: selftests: Check multiple MMC counters

Muhammad Usama Anjum <[email protected]>
selftests/arm64: Treat KSM merge_across_nodes as optional

Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

Marino Dzalto <[email protected]>
netfilter: xt_HL: add pr_fmt and checkentry validation

Michal Koutný <[email protected]>
netfilter: xt_cgroup: Make it independent from net_cls

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: move hardware offload step after building the chain blob

bui duc phuc <[email protected]>
net: ethernet: sun4i-emac: Fix IRQ error handling

HyeongJun An <[email protected]>
ASoC: dapm: Fix off-by-one check on the second enum channel

John Johansen <[email protected]>
apparmor: policy_int make sure list heads are initialized before fail path

Thorsten Blum <[email protected]>
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init

Ruoyu Wang <[email protected]>
tpm: st33zp24: Validate locality read result

Ruoyu Wang <[email protected]>
tpm: st33zp24: Return zero on status read failure

Victor Nogueira <[email protected]>

    net/sched: sch_teql: restore skb->dev on the slave failure path

Jamal Hadi Salim <[email protected]>
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

Jamal Hadi Salim <[email protected]>
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

Jamal Hadi Salim <[email protected]>
net/sched: fq_pie: clamp default quantum to avoid signed overflow

Jamal Hadi Salim <[email protected]>
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel

Jamal Hadi Salim <[email protected]>
net/sched: fq_codel: clamp default quantum and mtu

Eric Dumazet <[email protected]>

    net_sched: export pfifo_fast prio2band[]

Eric Dumazet <[email protected]>
net_sched: sch_fq: change how @inactive is tracked

Eric Dumazet <[email protected]>
net_sched: sch_fq: struct sched_data reorg

Jiapeng Chong <[email protected]>
net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()

Frank Sorenson <[email protected]>
cifs: fix clearing stats for fastest execution of each smb2 command

Allison Henderson <[email protected]>
net/rds: use wq_has_sleeper() in rds_cong_map_updated()

Xiang Mei <[email protected]>

    net: qualcomm: rmnet: restore skb->dev on deaggregated frames

Cen Zhang (Microsoft) <[email protected]>
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

Hyunwoo Kim <[email protected]>
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

Chris Lu <[email protected]>
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX

Pauli Virtanen <[email protected]>
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister

Edward Adam Davis <[email protected]>
bluetooth/l2cap: sync sock recv cb and release

Sebastian Urban <[email protected]>
Bluetooth: compute LE flow credits based on recvbuf space

Dan Carpenter <[email protected]>
scsi: qla2xxx: Fix an loop timeout test

Junrui Luo <[email protected]>
NFSv4/pnfs: key the data server cache on the NFS version

Jeff Layton <[email protected]>
nfs: move the nfs4_data_server_cache into struct nfs_net

Junrui Luo <[email protected]>
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

Mahanta Jambigi <[email protected]>
net/smc: free pending qentry in smc_llc_flow_stop() before memset

Marek Czernohous <[email protected]>
forcedeth: stop the tx_timeout register dump past the requested window

Fan Ye <[email protected]>
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes

Ruoyu Wang <[email protected]>
net: bridge: Reject descending VLAN tunnel ranges

Serhat Kumral <[email protected]>
RDMA/ucma: Allow path records to exactly fit the output buffer

Bradley Morgan <[email protected]>
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

Yi Ding <[email protected]>
rtc: pcf8563: fix clock provider leak on unbind

Li RongQing <[email protected]>
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

Michael S. Tsirkin <[email protected]>
virtio_balloon: disable indirect descriptors

Ruoyu Wang <[email protected]>
bonding: initialize err for empty target lists

Nguyen Dinh Phi <[email protected]>
vsock: use sock_error() to consume sk_err after a failed connect

Karl Mehltretter <[email protected]>
8139cp: fix Rx and Tx not being disabled in cp_suspend

Xu Rao <[email protected]>
ALSA: hda: Fix connection list comparison in proc output

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix inverted default vlan notification

Joas Antonio dos Santos <[email protected]>
ipvs: fix integer overflow in ftp helper port/address parsing

Lukasz Majewski <[email protected]>
net: hsr: Use full string description when opening HSR network device

Sebastian Andrzej Siewior <[email protected]>
hsr: Use a single struct for self_node.

Qingfang Deng <[email protected]>
pppox: drain queued packets on channel handoff

Junseo Lim <[email protected]>
net: kcm: Hold RCU read lock while running BPF parser

Ruoyu Wang <[email protected]>
NFSv4: remove callback IDR entry on client allocation failure

Arnaud Bonnet <[email protected]>
nfs: refactor pNFS functions using clear_and_wake_up_bit

Trond Myklebust <[email protected]>
NFSv4/pnfs: Clean up layout get on open

Arnaud Bonnet <[email protected]>
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper

Trond Myklebust <[email protected]>
NFS: Always clear an invalid mapping when attempting a buffered write

Junseo Lim <[email protected]>
bpf: Reject negative optlen in cgroup getsockopt hook

Junseo Lim <[email protected]>
lwt_bpf: Restore reserved headroom after xmit program

Delphine CC Chiu <[email protected]>

    hwmon: (emc1403) Add support for EMC1442

Linmao Li <[email protected]>
mailbox: rockchip: disable pclk on probe failure and unbind

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()

Israel Téllez García <[email protected]>
bpf: Fix pending_pos walk on 32-bit ring position wrap

Steven Rostedt (Google) <[email protected]>
tracing: Have TRACE_DEFINE_ENUM affect trace event types as well

Steven Rostedt (VMware) <[email protected]>
tracing: Add DYNAMIC flag for dynamic events

Steven Rostedt (VMware) <[email protected]>
tracing: Add a verifier to check string pointers for trace events

Steven Rostedt (VMware) <[email protected]>
seq_buf: Add seq_buf_terminate() API

Chandrakanth Patil <[email protected]>
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

Phillip Lougher <[email protected]>
Squashfs: check block offset is not negative

Krystian Kaniewski <[email protected]>
ocfs2: fix circular locking dependency in ocfs2_init_acl()

Yuan Chen <[email protected]>
bpftool: Fix double close in map dump

Bijan Tabatabai <[email protected]>
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported

Yuho Choi <[email protected]>
clocksource/drivers/armada: Unwind timer clock on init failure

Guangshuo Li <[email protected]>
clocksource/drivers/clps711x: Do not unmap clocksource MMIO

Yuho Choi <[email protected]>
xenbus: Unregister reboot notifier on init failure

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address

Henrik Grimler <[email protected]>
power: supply: bq27xxx: bq27520g4: fix REG_TTES address

Matti Vaittinen <[email protected]>
power: supply: bd99954: Drop bad register fields

Felix Gu <[email protected]>
spi: img-spfi: don't disable runtime PM on DMA deferred probe

Ran Hongyun <[email protected]>
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC

Rosen Penev <[email protected]>
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

Yuho Choi <[email protected]>
ubi: Fix rollback for explicit UBI device numbers

Zhihao Cheng <[email protected]>
ubi: fastmap: Add module parameter to control reserving filling pool PEBs

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs

Zhihao Cheng <[email protected]>
ubi: fastmap: Wait until there are enough free PEBs before filling pools

Yang Li <[email protected]>
ubi: Simplify bool conversion

ZhaoLong Wang <[email protected]>
ubi: fastmap: Add fastmap control support for module parameter

Zhihao Cheng <[email protected]>
ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl

Zhihao Cheng <[email protected]>
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs

Zhihao Cheng <[email protected]>
UBI: Preserve torture flag when rescheduling failed erasures

Zhihao Cheng <[email protected]>
ubi: Replace erase_block() with sync_erase()

Zhihao Cheng <[email protected]>
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap

Zhihao Cheng <[email protected]>
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash

Zhihao Cheng <[email protected]>
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block

Christophe JAILLET <[email protected]>
ubi: fastmap: Use the bitmap API to allocate bitmaps

Jilin Yuan <[email protected]>
ubi: Fix repeated words in comments

LiangCheng Wang <[email protected]>
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready

bui duc phuc <[email protected]>
ASoC: pxa: Use devm_clk_get_optional() for extclk clock

Zhu Yanjun <[email protected]>
RDMA/cma: Fix WARNING in res_to_rt

Fan Wu <[email protected]>
RDMA/cxgb4: Free debugfs on registration failure

Guangshuo Li <[email protected]>
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal

Linmao Li <[email protected]>
nfc: digital: Do not dump a NULL response in command completion

Yinhao Hu <[email protected]>
nfc: pn533: hold a reference to the request skb during send_frame

Doruk Tan Ozturk <[email protected]>
nfc: llcp: bound SNL TLV parsing to the skb and add length checks

Zhenghang Xiao <[email protected]>
nfc: nci: fix double completion race in nci_data_exchange_complete

Breno Leitao <[email protected]>

    nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

Breno Leitao <[email protected]>
nfc: llcp: avoid userspace overflow on invalid optlen

Babanpreet Singh <[email protected]>
spi: sprd-adi: Fix probe succeeding without registering the controller

Michael Walle <[email protected]>
powerpc/configs: enable CONFIG_RAS to fix EDAC support

Weiming Shi <[email protected]>
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

Karl Mehltretter <[email protected]>
m68k: Fix backtraces for non-running tasks

Desnes Nunes <[email protected]>
iommu/vt-d: Fix UCTP context table slot when copying root entries

Danila Chernetsov <[email protected]>
fbdev: kyro: Validate overlay viewport coordinates

Ian Rogers <[email protected]>
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads

Ian Rogers <[email protected]>
perf synthetic-events: Fix uninitialized pthread_join

Ian Rogers <[email protected]>
perf stat: Fix evsel_list leak in cmd_stat

Namhyung Kim <[email protected]>
perf stat: Clear screen only if output file is a tty

Rosen Penev <[email protected]>
ARM: dts: helios4: add SATA regulator supplies

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to GPIO expander

Rosen Penev <[email protected]>
ARM: dts: helios4: add vcc-supply to EEPROM

Tomáš Macholda <[email protected]>
arm64: dts: turris-mox: fix usb3 phys

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: re-enable irq if runtime suspend fails

Nikhil Gautam <[email protected]>
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

Ali Ahmet Memis <[email protected]>
Bluetooth: MSFT: validate evt_prefix_len against the response length

Tanushree Shah <[email protected]>
perf trace-event: Fix integer truncation in do_read() and skip()

Zijun Hu <[email protected]>
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()

Ricardo Neri <[email protected]>
sched/fair: Check CPU capacity before comparing group types during load balance

Valentin Schneider <[email protected]>
sched/fair: Introduce a CPU capacity comparison helper

Kamal Wadhwa <[email protected]>
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling

Loic Poulain <[email protected]>
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

Yichong Chen <[email protected]>
hugetlbfs: release subpool on fill_super failure

Simon Glass <[email protected]>
pinctrl: rockchip: Reset the pin count when recalculating SoC data

Mukesh Ojha <[email protected]>
firmware_loader: do not queue completed sysfs fallback requests

Russ Weight <[email protected]>
firmware_loader: Check fw_state_is_done in loading_store

Manish Rangankar <[email protected]>
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Use PFP on the compute queues too

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets

Tanushree Shah <[email protected]>
perf trace-event: Fix buffer overflow in read_string()

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Fixup emit_cntxcntl()

Pengpeng Hou <[email protected]>
mfd: iqs62x: Reject zero-length firmware records

Pengpeng Hou <[email protected]>
mfd: rave-sp: validate received frame payload lengths

Vladimir Murzin <[email protected]>
arm64: hibernate: Restore DAIF state on error

Ada Couprie Diaz <[email protected]>
arm64: hibernate: mask DAIF before restoring hibernated kernel

Shuangpeng Bai <[email protected]>
RDMA/siw: Fix use-after-free in siw_accept()

Guoqing Jiang <[email protected]>
RDMA/siw: Introduce siw_free_cm_id

Yehyeong Lee <[email protected]>
IB/isert: post the full-feature receive buffers after session registration

Yehyeong Lee <[email protected]>
IB/isert: delay the final Login Response until the session is registered

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix out-of-bounds write when probed more than once

Karl Mehltretter <[email protected]>
cpufreq: imx6q: fix devres accumulation across driver rebind

Jernej Skrabec <[email protected]>
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz

Jernej Skrabec <[email protected]>
drm/sun4i: dw-hdmi: Drop TCON TOP port reference

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop remote endpoint reference

Jernej Skrabec <[email protected]>
drm/sun4i: crtc: Propagate layer initialization error

Jernej Skrabec <[email protected]>
drm/sun4i: tcon: Drop TCON TOP device reference

Geert Uytterhoeven <[email protected]>
bitfield: Add non-constant field_{prep,get}() helpers

Geert Uytterhoeven <[email protected]>
bitfield: Add less-checking __FIELD_{GET,PREP}()

Kuninori Morimoto <[email protected]>
of: property: use unsigned int return on of_graph_get_endpoint_count()

Kuninori Morimoto <[email protected]>
of: property: add missing kerneldoc for of_graph_get_endpoint_count()

Jernej Skrabec <[email protected]>
drm/sun4i: vi scaler: Fix coefficient selection

Cen Zhang <[email protected]>
ocfs2: synchronize heartbeat callbacks with o2net teardown

Joseph Qi <[email protected]>
ocfs2: use bitmap API in fill_node_map

Xie Yuanbin <[email protected]>
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults

Yehyeong Lee <[email protected]>
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

Sergei Litvin <[email protected]>
scripts/tags.sh: Prevent binary files appearing in cscope.files

Jialu Xu <[email protected]>
scripts/tags.sh: improve compiled sources generation

Mukesh Ojha <[email protected]>
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

Mukesh Ojha <[email protected]>
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()

Mukesh Ojha <[email protected]>
remoteproc: Move resource table data structure to its own header

Suman Anna <[email protected]>
remoteproc: Fix various kernel-doc warnings

Mathieu Poirier <[email protected]>
remoteproc: Introduce function rproc_detach()

Mathieu Poirier <[email protected]>
remoteproc: Introduce function __rproc_detach()

Mathieu Poirier <[email protected]>
remoteproc: Add new detach() remoteproc operation

Suman Anna <[email protected]>
remoteproc: Add a rproc_set_firmware() API

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Add static PCI resource attribute macros

Yichong Chen <[email protected]>
fat: release buffer head after rebuilding parent

Guangshuo Li <[email protected]>

    rapidio: clear mport->net when rio_add_net() fails

Calvin Owens <[email protected]>
pps: don't try to wait for negative timeouts in PPS_FETCH

Bradley Morgan <[email protected]>
lib/string: fix memchr_inv() for large ranges

Tao Cui <[email protected]>
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs

Tao Cui <[email protected]>
block/blk-iocost: collect per-cpu latency stats over possible CPUs

Tao Cui <[email protected]>
block/blk-stat: drain per-cpu callback stats over possible CPUs

Breno Leitao <[email protected]>
phonet: pep: do not write beyond optlen in getsockopt

Sang-Heon Jeon <[email protected]>
iio: light: tsl2583: return zero in write_raw() on success

Sang-Heon Jeon <[email protected]>
iio: light: isl29028: return zero in write_raw() on success

Yuanshen Cao <[email protected]>
iio: light: tsl2772: fix ALS calibscale readback

Arnaldo Carvalho de Melo <[email protected]>
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check

Arnaldo Carvalho de Melo <[email protected]>
perf auxtrace: Fix queue grow overflow and old array leak

Arnaldo Carvalho de Melo <[email protected]>
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

Jiancheng Huang <[email protected]>
HID: lg4ff: validate report length before fixed offsets

Ai Chao <[email protected]>
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

Hans de Goede <[email protected]>
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling

Yousef Alhouseen <[email protected]>
HID: synchronize input before cleaning up a failed probe

Dmitry Torokhov <[email protected]>
HID: ensure timely release of driver-allocated resources

Dmitry Torokhov <[email protected]>
HID: split apart hid_device_probe to make logic more apparent

Karl Mehltretter <[email protected]>
tty: clear cdev pointer after cdev_add() failure

Karl Mehltretter <[email protected]>
serial: amba-pl011: unprepare console clock on unregister

Thomas Bogendoerfer <[email protected]>
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL

Gou Hao <[email protected]>
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

Laxman Acharya Padhya <[email protected]>
firmware: coreboot: Validate table bounds

Titouan Ameline de Cadeville <[email protected]>
firmware: google: Add bounds checks in coreboot_table_populate()

Kees Cook <[email protected]>
firmware: coreboot: Check size of table entry and use flex-array

Philipp Borgers <[email protected]>

    mac80211: add ieee80211_is_tx_data helper function

Slawomir Stepien <[email protected]>
wifi: zd1211rw: reject secondary interfaces to prevent conflicts

Pranjal Shrivastava <[email protected]>
iommu/arm-smmu-v3: Convert to use atomic poll timeout

Linghui Wu <[email protected]>
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation for guest kallsyms path

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Free scandir entries in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Reset errno before strtol in guest kernel map creation

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Don't abort guest map creation on first inaccessible dir

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Check snprintf truncation in machines__findnew()

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Use snprintf() for guestmount path construction

Arnaldo Carvalho de Melo <[email protected]>
perf machine: Guard against NULL strlist in machines__findnew()

Joy Zou <[email protected]>
regulator: core: use system_freezable_wq for init complete work

Jeff Johnson <[email protected]>
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

Konrad Dybcio <[email protected]>
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

Leo Yan <[email protected]>
perf: arm_spe: Make wakeup range check overflow safe

Felix Fietkau <[email protected]>
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

Felix Fietkau <[email protected]>

    wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

Devin Wittmayer <[email protected]>
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

Yichong Chen <[email protected]>
fanotify: report full event length for FIONREAD

Abdun Nihaal <[email protected]>
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

Naveen Kumar Chaudhary <[email protected]>
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

Adrian Hunter <[email protected]>
i3c: master: Fix device_register() error path

Jakub Kicinski <[email protected]>
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

Aneesh Kumar K.V (Arm) <[email protected]>
iommu/dma: Check atomic pool allocation result directly

Vladimir Zapolskiy <[email protected]>
clk: qcom: Return expected ENOMEM error on dynamic allocation failure

Stanislav Kinsburskii <[email protected]>
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

Pu Lehui <[email protected]>
bpf: Fix potential UAF in bpf_netns_link_update_prog

Hongyan Xu <[email protected]>
power: supply: sc2731_charger: cancel work on remove

Uwe Kleine-König <[email protected]>
power: supply: sc2731_charger: Convert to platform remove callback returning void

Hongyan Xu <[email protected]>
power: supply: isp1704_charger: cancel work on remove

Cheng-Han Wu <[email protected]>
selftests/zram: fix kernel_gte() for POSIX sh

Sajal Gupta <[email protected]>
md/raid5-ppl: fix use-after-free in ppl_do_flush()

Abdun Nihaal <[email protected]>
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

Guixin Liu <[email protected]>
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

Yehyeong Lee <[email protected]>
IB/isert: reject login PDUs declaring more data than was received

Yehyeong Lee <[email protected]>
IB/isert: reject PDUs declaring more data than was received

Leon Romanovsky <[email protected]>
RDMA/cxgb4: free STAG index when TPT entry write fails

Leon Romanovsky <[email protected]>
RDMA/mlx5: Send cong param changes to the resolved port mdev

Leon Romanovsky <[email protected]>
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

David Lee <[email protected]>
nilfs2: prevent out-of-bounds read in super root block parsing

Joshua Crofts <[email protected]>
nilfs2: fix infinite loop in nilfs_clean_segments()

longlong yan <[email protected]>
clk/x86: pmc_atom: add kasprintf return value check

Myeonghun Pak <[email protected]>
clk: palmas: Manage external-control prepare with devm

Guangshuo Li <[email protected]>
clk: tegra: tegra124-emc: put EMC node on register failure

Ondrej Jirman <[email protected]>
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix

Yonatan Nachum <[email protected]>
RDMA/efa: Fix PBL chunk length computation

Ivy Lopez <[email protected]>
staging: rtl8723bs: use kfree_sensitive() for key material

Bjorn Andersson <[email protected]>
remoteproc: Prevent crash handling to race with rproc_del()

Jingyi Wang <[email protected]>
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()

Mukesh Ojha <[email protected]>
remoteproc: Use unbounded workqueue for recovery work

Alex Elder <[email protected]>
remoteproc: use freezable workqueue for crash notifications

Mathieu Poirier <[email protected]>
remoteproc: Add new RPROC_ATTACHED state

Mathieu Poirier <[email protected]>
remoteproc: Remove useless check in rproc_del()

Babanpreet Singh <[email protected]>

    w1: ds2482: Fix signedness bug in ds2482_w1_triplet()

Yichong Chen <[email protected]>
isofs: release zisofs block pointer buffer head

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix integer overflow of user QP buffer size

Babanpreet Singh <[email protected]>
power: supply: sbs-battery: Use a per-device serial number buffer

Ikjoon Jang <[email protected]>
power: supply: sbs-battery: cache constant string properties

Karl Mehltretter <[email protected]>
ARM: lpc32xx: only run SoC init on LPC32xx hardware

Fabio Estevam <[email protected]>
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt

Rob Herring <[email protected]>
arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru

Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Add gru-scarlet-dumo board

Florian Westphal <[email protected]>
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

Can Peng <[email protected]>
drm/tve200: add OF module alias for autoloading

Cosmo Chou <[email protected]>
leds: pca9532: Fix phantom device registration on missing hardware

Leo Yan <[email protected]>
perf cs-etm: Avoid truncating AUX buffer sizes to int

Leo Yan <[email protected]>
perf cs-etm: Flush thread stacks after decoder reset

Andre Przywara <[email protected]>
ARM: dts: allwinner: a10: Fix PMU interrupt

Jeff Johnson <[email protected]>
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

Venkateswara Naralasetty <[email protected]>
ath11k: add trace log support

Jeff Johnson <[email protected]>
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request

Jeff Johnson <[email protected]>
wifi: ath6kl: avoid buffer overreads in WMI event handlers

Baokun Li <[email protected]>
ext4: drain in-flight DIO before buffered write fallback

Pengpeng Hou <[email protected]>
thermal: intel: int3400: clean up ODVP on probe failures

Rafael J. Wysocki <[email protected]>

    thermal: int340x_thermal: Consolidate priv->data_vault checks

Mukesh Ojha <[email protected]>
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()

Haoxiang Li <[email protected]>
iommu/qcom: Remove sysfs device on probe failure path

Miaoqian Lin <[email protected]>
iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe

Kalesh AP <[email protected]>
RDMA/restrack: Fix typos in the comments

Leon Romanovsky <[email protected]>
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()

Mike Christie <[email protected]>
scsi: target: srpt: Convert to new submission API

Mike Christie <[email protected]>
scsi: target: core: Break up target_submit_cmd_map_sgls()

Mike Christie <[email protected]>
scsi: target: core: Rename transport_init_se_cmd()

Sebastian Andrzej Siewior <[email protected]>
scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls()

Mike Christie <[email protected]>
scsi: qla2xxx: Move sess cmd list/lock to driver

Mike Christie <[email protected]>
scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG

Mike Christie <[email protected]>
scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG

Yun Zhou <[email protected]>
ext4: skip extra isize expansion during mount to prevent deadlock

Chen Pei <[email protected]>
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root

Pengpeng Hou <[email protected]>
ACPI: processor: validate MADT IOAPIC entry bounds

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

TanZheng <[email protected]>
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Danila Chernetsov <[email protected]>
RDMA/hfi1: Propagate sdma_txinit_ahg() errors

Linmao Li <[email protected]>
ASoC: meson: Keep link pointers valid on realloc failure

Koichiro Den <[email protected]>
dmaengine: dw-edma: Clear stale requests on termination

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize channel state checks

Koichiro Den <[email protected]>
dmaengine: dw-edma: Serialize abort state updates

Yuho Choi <[email protected]>
driver core: soc: Unregister bus on early device registration failure

Greg Kroah-Hartman <[email protected]>
driver core: soc: remove layering violation for the soc_bus

Alban Bedel <[email protected]>
software node: Fix software_node_get_reference_args() with index -1

Ian Rogers <[email protected]>
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure

zhouminqiang <[email protected]>
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

Ruoyu Wang <[email protected]>
mtd: mtdswap: Avoid freeing registered blktrans device twice

Pengpeng Hou <[email protected]>
soc: ti: knav_qmss: Remove debugfs file on teardown

Md Shofiqul Islam <[email protected]>
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()

Xiang Mei <[email protected]>

    vfio/pci: clear vdev->msi_perm after freeing it on init failure

Myeonghun Pak <[email protected]>
char: xilinx_hwicap: unregister class on init errors

Linmao Li <[email protected]>
ppdev: prevent overflow when setting port timeout

Pengpeng Hou <[email protected]>
misc: ad525x_dpot: use driver core groups for sysfs files

Uwe Kleine-König <[email protected]>
misc: ad525x_dpot: Make ad_dpot_remove() return void

Gleb Markov <[email protected]>
misc: rtsx: add missing write register handling

Pavel Zhigulin <[email protected]>
speakup: keyhelp: guard letter_offsets possible out-of-range indexing

Christophe JAILLET <[email protected]>
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()

Yuho Choi <[email protected]>
uio: Fix stale info pointer in failed registration path

David Lee <[email protected]>
UDF symlink pathComponent header OOB read

Karl Mehltretter <[email protected]>
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64

Xu Yang <[email protected]>
usb: gadget: f_uac1_legacy: remove broken string configfs attributes

Rafael J. Wysocki <[email protected]>
ACPI: processor: idle: Expand _LPI package sanity checks

Wolfram Sang <[email protected]>
ACPI: move from strlcpy() with unused retval to strscpy()

Daniel Scally <[email protected]>
media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro

Mikko Perttunen <[email protected]>
gpu: host1x: Avoid stack over-read in debug output helpers

Mikko Perttunen <[email protected]>
gpu: host1x: Fix offset calculation in trace_write_gather

Maoyi Xie <[email protected]>
drm/bridge: tc358767: clamp the reported AUX read size to the request

Uday Khare <[email protected]>

    remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev

Zhongqiu Han <[email protected]>
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()

Rafael J. Wysocki <[email protected]>
cpufreq: schedutil: Add util to struct sg_cpu

Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate()

Herve Codina <[email protected]>
irqdomain: Handle additional domain flags in irq_domain_instantiate()

Herve Codina <[email protected]>
irqdomain: Introduce irq_domain_instantiate()

Dan Carpenter <[email protected]>
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()

Bryam Vargas <[email protected]>
libnvdimm/labels: Bound the on-media label size before the shift

Baochen Qiang <[email protected]>
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

Kyle Zeng <[email protected]>
hfsplus: validate thread record before delete key rebuild

Vishnu Santhosh <[email protected]>
rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Srinivas Kandagatla <[email protected]>
rpmsg: glink: remove duplicate code for rpmsg device remove

Arun Kumar Neelakantam <[email protected]>
rpmsg: glink: Remove the rpmsg dev in close_ack

Ira Weiny <[email protected]>
iov_iter: lift memzero_page() to highmem.h

Thomas Gleixner <[email protected]>
highmem: Provide generic variant of kmap_atomic*

Leon Romanovsky <[email protected]>
RDMA/hfi1: Initialize debugfs after probe completes

Leon Romanovsky <[email protected]>
RDMA/hfi1: Stop flushing the global IB workqueue

Leon Romanovsky <[email protected]>
RDMA/hfi1: Create workqueues before device initialization

Leon Romanovsky <[email protected]>
RDMA/hfi1: Remove redundant PCI device ID validation

Leon Romanovsky <[email protected]>
RDMA/hfi1: Preserve unit 0 on allocation failure

Sean Rhodes <[email protected]>
misc: rtsx_usb: avoid USB I/O in runtime autosuspend

Pengpeng Hou <[email protected]>
pmdomain: bcm: bcm2835: handle genpd provider registration errors

Evgenii Burenchev <[email protected]>
ALSA: hpi: Check transport errors during HPI6000 adapter initialization

Xiang Mei <[email protected]>
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Yuho Choi <[email protected]>
hwrng: ks-sa - Fix runtime PM cleanup on registration failure

Martin Kaiser <[email protected]>
hwrng: ks-sa - access private data via struct hwrng

Leon Romanovsky <[email protected]>
RDMA/ipoib: Drain RCU callbacks during module teardown

Leon Romanovsky <[email protected]>
RDMA/core: Wait for RCU callbacks before unloading ib_core

Tetsuo Handa <[email protected]>
RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage

Mert Seftali <[email protected]>
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE

Laxman Acharya Padhya <[email protected]>
drm/panel: samsung-s6d16d0: Power off on prepare failure

Biju Das <[email protected]>
usb: renesas_usbhs: Fix power-off ordering on unbind

Uwe Kleine-König <[email protected]>
platform: Provide a remove callback that returns no value

Uwe Kleine-König <[email protected]>
driver core: platform: Emit a warning if a remove callback returned non-zero

Uwe Kleine-König <[email protected]>
driver core: platform: use bus_type functions

Uwe Kleine-König <[email protected]>
driver core: platform: change logic implementing platform_driver_probe

Uwe Kleine-König <[email protected]>
driver core: platform: reorder functions

Michael Bommarito <[email protected]>
usb: gadget: configfs: fix out-of-bounds read of qw_sign

Wolfram Sang <[email protected]>
hwspinlock: propagate errno when registering single lock

Cosmo Chou <[email protected]>
leds: pca9532: Fix inverted GPIO output polarity

Wei Wang <[email protected]>
iommu/amd: Fix false positive in SB IOAPIC IVRS validation

Fu Hao <[email protected]>
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC

Wei Wang <[email protected]>
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors

Vladimir Zapolskiy <[email protected]>
iommu/msm: Return -ENOMEM on memory allocation failure in probe

Daniel Borkmann <[email protected]>
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux

Aleksandr Nogikh <[email protected]>
udf: Mark LVID buffer as uptodate before marking it dirty

Hongyan Xu <[email protected]>
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()

Bryan O'Donoghue <[email protected]>
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code

Bryan O'Donoghue <[email protected]>
clk: qcom: gdsc: Release pm subdomains in reverse add order

Dmitry Baryshkov <[email protected]>
clk: qcom: gdsc: enable optional power domain support

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains

Herman van Hazendonk <[email protected]>
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status

David Woodhouse <[email protected]>
timekeeping: Account for monotonicity adjustment in ntp_error

Thomas Weißschuh <[email protected]>

    y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32

Yuho Choi <[email protected]>
clocksource: Unregister subsystem on device registration failure

Jiangshan Yi <[email protected]>
selftests: timers: leap-a-day: Fix -w option and update usage comment

Kemeng Shi <[email protected]>
irqchip/gic-v3-its: Fix memleak in its_probe_one()

Feng Yang <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov

Malaya Kumar Rout <[email protected]>
selftests/bpf: Fix memory leak in msg_alloc_iov error path

Evgenii Burenchev <[email protected]>
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()

Dawei Feng <[email protected]>
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

Ayush Mukkanwar <[email protected]>
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions

Yuvraj Singh Chauhan <[email protected]>
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown

Ayush Mukkanwar <[email protected]>
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

Dan Carpenter <[email protected]>
staging: fbtft: Use sysfs_emit_at() to print to sysfs file

Bryam Vargas <[email protected]>
greybus: audio: bound the topology section sizes against the fetched size

Ahmet Sezgin Duran <[email protected]>
staging: sm750fb: gate dualview dataflow using g_dualview

Alexander A. Klimov <[email protected]>
staging: greybus: audio: correct sscanf() return value check

Jonathan Cameron <[email protected]>
of: Add cleanup.h based auto release via __free(device_node) markings

Haowen Tu <[email protected]>
PM: sleep: Fix off-by-one in wakelocks number limit check

Yuho Choi <[email protected]>
bus: ti-sysc: Fix /chosen node reference leak

Shin'ichiro Kawasaki <[email protected]>
nvmet-rdma: factor out response resource cleanup

Pengpeng Hou <[email protected]>
crypto: sa2ul - stop probe if context pool creation fails

Tang Bin <[email protected]>
crypto: sa2ul - Use the defined variable to clean code

Lothar Rubusch <[email protected]>
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

Thorsten Blum <[email protected]>
crypto: atmel-ecc - reject hardware ECDH without a public key

Thorsten Blum <[email protected]>
crypto: atmel-ecc - clean up and improve ECDH comments

Thorsten Blum <[email protected]>
crypto: atmel-ecc - replace min_t with min

Lee Jones <[email protected]>
crypto: atmel-ecc - Struct headers need to start with keyword 'struct'

Meng Yu <[email protected]>
crypto: ecdh - move curve_id of ECDH from the key to algorithm name

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix memory overread in ring handler

Hisam Mehboob <[email protected]>
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check

Hanlin Song <[email protected]>
csky: Fix a4/a5 restoration in syscall trace path

Sanjay Chitroda <[email protected]>
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure

Srinivas Kandagatla <[email protected]>
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

Srinivas Kandagatla <[email protected]>
soundwire: qcom: add static port map support

Srinivas Kandagatla <[email protected]>
soundwire: qcom: update port map allocation bit mask

Srinivas Kandagatla <[email protected]>
soundwire: add static port mapping support

Vladimir Zapolskiy <[email protected]>
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe

Suraj Gupta <[email protected]>
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

Vladimir Zapolskiy <[email protected]>
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

Asad Kamal <[email protected]>
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define

Sean Young <[email protected]>
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define

Daniel McCarthy <[email protected]>
pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Zide Chen <[email protected]>
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails

Henrik Grimler <[email protected]>
drm/lima: call drm_mm_init() with a valid allocation range

Brian Masney <[email protected]>
clk: imx: scu: drop redundant init.ops variable assignment

Anson Huang <[email protected]>
clk: imx: scu: Add A72 frequency scaling support

Anson Huang <[email protected]>
clk: imx: scu: Add A53 frequency scaling support

Weigang He <[email protected]>
ARM: imx: fix device_node refcount leak in imx_src_init()

Min zhang <[email protected]>
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller

Alexander A. Klimov <[email protected]>
clk: moxart: remove unused variables, fix refcount leak

Gui-Dong Han <[email protected]>
media: cec-pin: Fix event FIFO ordering

Weigang He <[email protected]>
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

Michael Bommarito <[email protected]>
HID: roccat: bound device-supplied profile index

Philipp Weber <[email protected]>
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

Konstantin Andreev <[email protected]>
smack: restrict smackfs/{direct,mapped} values to 0-255

Konstantin Andreev <[email protected]>
smack: deduplicate smackfs/{direct,mapped} file_operations

Dmitry Antipov <[email protected]>
smack: simplify write handlers of sysfs entries

Austin Kim <[email protected]>
smack: mark 'smack_enabled' global variable as __initdata

Konstantin Andreev <[email protected]>
smack: fix incorrect task context in smack_msg_queue_msgrcv

Casey Schaufler <[email protected]>
Smack: fix W=1 build warnings

Maxime Ripard <[email protected]>
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure

Daniel Borkmann <[email protected]>
bpf: Enforce expected_attach_type for tailcall compatibility

Martin Blumenstingl <[email protected]>
clk: meson: align gxbb_32k_clk_sel number of parents with actual count

Mahesh Rao <[email protected]>
firmware: stratix10-svc: Add mutex in stratix10 memory management

Arnaldo Carvalho de Melo <[email protected]>
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

Sven Eckelmann <[email protected]>
batman-adv: bla: avoid CRC corruption due to parallel claim add

Jian Shen <[email protected]>
net: hns3: don't auto enable misc vector

Pengpeng Hou <[email protected]>
Input: aiptek - validate raw macro indices before updating state

Jiayuan Chen <[email protected]>
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

Zhengchuan Liang <[email protected]>
net: af_key: zero aligned sockaddr tail in PF_KEY exports

Xiang Mei <[email protected]>
bridge: mrp: reject zero test interval to avoid OOM panic

Wang Liang <[email protected]>
net: fix NULL pointer dereference in l3mdev_l3_rcv

Andrei Matei <[email protected]>
bpf: Guard stack limits against 32bit overflow

Sechang Lim <[email protected]>
tcp: clear sock_ops cb flags before force-closing a child socket

Arthur Gautier <[email protected]>
xhci: fix lost bounce buffers on TDs spanning several ring segments

Sunil Khatri <[email protected]>
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT

Thadeu Lima de Souza Cascardo <[email protected]>
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used

Harry Wentland <[email protected]>
drm/amd/display: avoid divide-by-zero in __is_lut_linear()

Thomas Zimmermann <[email protected]>
drm/hibmc: Fix list of formats on the primary plane

Wentao Liang <[email protected]>
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()

Danilo Krummrich <[email protected]>
drm: fix race between partial drm_dev_register() failure and ioctl

Johan Hovold <[email protected]>
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure

Zhan Xusheng <[email protected]>
f2fs: fix i_size when pinned fallocate partially fails

Hao-Qun Huang <[email protected]>
f2fs: reject overlapping move range after len expansion

Wenjie Qi <[email protected]>
f2fs: return symlink writeback errors

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak

Nilesh Javali <[email protected]>
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics

Nilesh Javali <[email protected]>
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

Nilesh Javali <[email protected]>
scsi: qla2xxx: Avoid double completion in async IOCB timeout

Nilesh Javali <[email protected]>
scsi: qla2xxx: Don't query firmware state while chip is down

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown

Nilesh Javali <[email protected]>
scsi: qla2xxx: Serialize flash version read in reset handler

Nilesh Javali <[email protected]>
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation

Nilesh Javali <[email protected]>
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()

Nilesh Javali <[email protected]>
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters

Nilesh Javali <[email protected]>

    scsi: qla2xxx: Bound i2c->length in I2C bsg handlers

Nilesh Javali <[email protected]>
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

Arash Golgol <[email protected]>
media: vimc: fix pixel format lookup in enum_framesizes

Uday Khare <[email protected]>
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size calculation in parse_raw_formats()

Mohammed EL Kadiri <[email protected]>
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()

Biren Pandya <[email protected]>
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link

Ilya Krutskih <[email protected]>
media: tda18250: fix possible integer overflow

Lei Huang <[email protected]>
media: s2255: check firmware size before reading trailing marker

HyeongJun An <[email protected]>
media: s2255: bound JPEG frame size before copying into the buffer

Valery Borovsky <[email protected]>
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

Christian Hewitt <[email protected]>
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common

Biren Pandya <[email protected]>
media: i2c: ov7740: fix use-after-destroy in remove

Shuangpeng Bai <[email protected]>
media: go7007: defer the ALSA v4l2 put until card release

Jiangong.Han <[email protected]>

    media: em28xx: fix use-after-free of dev_next->devlist on disconnect

Diego Fernando Mancera Gomez <[email protected]>
media: em28xx: defer audio-only extension registration

Fan Wu <[email protected]>
media: cx23885: cancel NetUP CI work before teardown

Bryam Vargas <[email protected]>
media: cx231xx: reject geometry changes while the VBI queue is busy

Ruoyu Wang <[email protected]>
media: cobalt: Avoid freeing ALSA private data twice

Dawei Feng <[email protected]>
media: cedrus: fix memory leak in cedrus_init_ctrls()

Ruoyu Wang <[email protected]>
media: cec: Serialize exclusive follower delivery

Yi Ding <[email protected]>
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash

Valery Borovsky <[email protected]>
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref

Christian Borntraeger <[email protected]>
KVM: s390: Restore sigset on error path

Christian Borntraeger <[email protected]>
KVM: s390: Zero initialize irq in reinject_machine_check

Christian Borntraeger <[email protected]>
KVM: s390: Free guest debug data on vcpu destroy

Christian Borntraeger <[email protected]>
KVM: s390: Fix old_data leak in guest debug error path

Christian Borntraeger <[email protected]>
KVM: s390: Fix memory leak in guest debug handling

Carlos López <[email protected]>
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

Sanjay Chitroda <[email protected]>
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()

Cong Nguyen <[email protected]>
iio: srf04: fix pm_runtime handling on probe error path

Laxman Acharya Padhya <[email protected]>
iio: light: gp2ap002: Disable regulators on resume failure

Giorgi Tchankvetadze <[email protected]>
iio: light: cm32181: return zero after writing calibscale

Cong Nguyen <[email protected]>
iio: gyro: mpu3050: fix sign of raw angular velocity readings

Erick Henrique <[email protected]>
iio: dac: m62332: Fix regulator reference count imbalance

Linmao Li <[email protected]>
iio: chemical: sgp30: Handle IAQ thread creation failure

WenTao Liang <[email protected]>
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get

Haoxiang Li <[email protected]>
AsoC: intel: sst: fix PCI device reference leak on probe failure

Haoxiang Li <[email protected]>
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure

Runyu Xiao <[email protected]>
ASoC: cs35l34: drain threaded IRQ before runtime suspend

Runyu Xiao <[email protected]>
ASoC: cs35l33: drain threaded IRQ before runtime suspend

Linkai Gong <[email protected]>
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk

Stephan Gerhold <[email protected]>
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk

Sven Eckelmann <[email protected]>
batman-adv: bla: prevent CRC corruptions after claim flush

Sven Eckelmann <[email protected]>
batman-adv: bla: fix freeing of claims on meshif deletion

Sven Eckelmann <[email protected]>
batman-adv: dat: avoid unaligned fault in IP extraction

Zhiling Zou <[email protected]>
batman-adv: fix stale receive device on merged fragments

Pengpeng Hou <[email protected]>
mtd: rawnand: validate ONFI extended parameter page sections

Xu Rao <[email protected]>
mtd: mtdoops: free page bitmap when the backing MTD is removed

Pengpeng Hou <[email protected]>
mtd: afs: validate v2 image info bounds

Helge Deller <[email protected]>
parisc: Fix alignment of asm statements in head.S

Pei Xiao <[email protected]>
parisc: eisa: Fix infinite loop when parsing invalid IRQ value

Bryam Vargas <[email protected]>
nvdimm/btt: reject an arena whose nfree is below the lane count

caina <[email protected]>
Revert "irqchip/mbigen: Fix mbigen node address layout"

Shivam Kumar <[email protected]>
nvmet-tcp: reject unsolicited H2CData PDUs

Shivam Kumar <[email protected]>
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

Yehyeong Lee <[email protected]>
nvme-tcp: check the data direction of a C2HData PDU

Takashi Iwai <[email protected]>
ALSA: pcm: Fix race between non-atomic ops and trigger-start

Ahmad Byagowi <[email protected]>
i2c: mux: Fix channel node leak on adapter add failure

Dapeng Mi <[email protected]>
perf/x86/intel: Fix kernel address leakages in LBR stack

Hajo Noerenberg <[email protected]>
ata: ahci: work around lost interrupts on Marvell 88SE61xx

Koichiro Den <[email protected]>
dmaengine: dw-edma: Complete descriptors before pausing

Mikulas Patocka <[email protected]>
dm: fix resume-vs-remove race

Ibrahim Hashimov <[email protected]>
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

Wei Jie Law <[email protected]>
HID: rmi: fix OOB access with undersized RMI reports

Runyu Xiao <[email protected]>
scsi: pm8001: Use rollback index when freeing MSI-X vectors

Sujal Tuladhar <[email protected]>
scsi: target: iscsi: Reserve a terminator byte for the login payload

Can Peng <[email protected]>
thermal/drivers/qoriq: Disable clock on resume failure

Can Peng <[email protected]>
thermal/drivers/imx: Disable clock on runtime resume failure

Muhammad Bilal <[email protected]>
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()

Jeffin Philip <[email protected]>
usb: gadget: fix null pointer dereference in usb_put_function_instance()

Lovekesh Solanki <[email protected]>
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()

Jameson Thies <[email protected]>
usb: typec: ucsi: displayport: Fix OOB altmode array index

Andy Shevchenko <[email protected]>
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()

Liu Qi <[email protected]>
usb-storage: ene_ub6250: fix race between scan work and probe

Shuangpeng Bai <[email protected]>
media: usbtv: keep device alive while ALSA card exists

HyeongJun An <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()

Griffin Kroah-Hartman <[email protected]>
usb: image: mdc800: change kmalloc() to kzalloc()

Sabrina Dubroca <[email protected]>
espintcp: remove encap socket caching to avoid reference leak

Petr Vaganov <[email protected]>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

Masami Hiramatsu (Google) <[email protected]>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

Steven Rostedt <[email protected]>
tracing/mmiotrace: Remove reference to unused per CPU data pointer

D. Wythe <[email protected]>
net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

Zack Rusin <[email protected]>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import

Koichiro Den <[email protected]>
net: ntb_netdev: Fix TX busy and drop handling

Bryam Vargas <[email protected]>
selinux: reject an unclaimed class value in security_get_classes()

Christian Göttsche <[email protected]>
selinux: avoid implicit conversions in services code

Eric Dumazet <[email protected]>
tcp: fix potential race in tcp_v6_syn_recv_sock()

Youngjae Kwon <[email protected]>
fsnotify: Fix stale object mask after concurrent mark updates

Jinjie Ruan <[email protected]>
entry: Fix seccomp bypass after ptrace with TSYNC

Tristan Madani <[email protected]>
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe

Bob Pearson <[email protected]>
RDMA/rxe: Use the correct size of wqe when processing SRQ

Dan Carpenter <[email protected]>
RDMA/rxe: Missing unlock on error in get_srq_wqe()

Bob Pearson <[email protected]>
RDMA/rxe: Fix over copying in get_srq_wqe

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: make nft_object rhltable per table

Yuqi Xu <[email protected]>
openvswitch: Fix CT limit teardown use-after-free

Ilya Maximets <[email protected]>
net: openvswitch: fix kernel-doc warnings in internal headers

Norbert Szetei <[email protected]>
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

Norbert Szetei <[email protected]>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()

Sonali Pradhan <[email protected]>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect

Tzung-Bi Shih <[email protected]>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam

Zhan Xusheng <[email protected]>
udf: Fix i_lenExtents truncation on 32-bit kernels

Thomas Gleixner <[email protected]>
timer: Keep debugobjects state consistent in migrate_timer_list()

Bradley Morgan <[email protected]>
signal: avoid shared siginfo namespace rewrites

Myeonghun Pak <[email protected]>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout

Maoyi Xie <[email protected]>
w1: ds28e17: reject an oversize length on an I2C block read

Chengfeng Ye <[email protected]>
vsock/virtio: flush works in dependency order

Abdun Nihaal <[email protected]>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

Stanislaw Gruszka <[email protected]>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero

Fabio Estevam <[email protected]>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait

Abdun Nihaal <[email protected]>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()

Adrian Hunter <[email protected]>
i3c: master: Fix info leak and UAF in device unregister path

Haotian Zhang <[email protected]>
dm-switch: use WRITE_ONCE() in switch_region_table_write()

Mikulas Patocka <[email protected]>
dm-stats: fix a crash if allocation of per-cpu data fails

Naman Jain <[email protected]>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: free sk if last

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount

Haoze Xie <[email protected]>
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

Takashi Iwai <[email protected]>
ALSA: serial-u16550: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: portman2x4: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mts64: Check card index validity at probe

Takashi Iwai <[email protected]>
ALSA: mpu401: Check card index validity at probe

Baul Lee <[email protected]>
ALSA: bcd2000: clear the URB pointers on disconnect

Baul Lee <[email protected]>
ALSA: 6fire: bound the MIDI event length from the device

Zhiling Zou <[email protected]>
seg6: reset IP6CB after IPv6 decapsulation

Zhiling Zou <[email protected]>
net: cap advertised IP tunnel headroom

Koichiro Den <[email protected]>
net: ntb_netdev: Count packets dropped on RX refill failure

Koichiro Den <[email protected]>
net: ntb_netdev: Avoid double-accounting netif_rx() drops

Koichiro Den <[email protected]>
NTB: ntb_transport: Reject oversized TX buffers

Koichiro Den <[email protected]>
NTB: ntb_transport: Fail TX enqueue when the QP link is down

Koichiro Den <[email protected]>
NTB: ntb_transport: Recycle TX entries before client callbacks

Ruoyu Wang <[email protected]>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init

Ilya Maximets <[email protected]>
net: openvswitch: fix flow mask use-after-free on flow deletion

Asim Viladi Oglu Manizada <[email protected]>
net: tun: bound receive headroom

Fabio Porcedda <[email protected]>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition

Aleksandr Khromov <[email protected]>
slip: fix use-after-free in sl_sync()

Weiming Shi <[email protected]>
xdp: fix zero-copy frame layout

Alexandra Winter <[email protected]>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Seiji Nishikawa <[email protected]>
ipmi: si: Fix NULL pointer dereference after failed registration

Yousef Alhouseen <[email protected]>
ipmi: ipmb: validate write message length

Kuan-Wei Chiu <[email protected]>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

Bryam Vargas <[email protected]>
platform/chrome: sensorhub: Bound the EC-reported sensor number

Fan Wu <[email protected]>
mmc: via-sdmmc: stop card-detect handling on probe failure

Kevin Tian <[email protected]>
iommu/vt-d: Fix no_iommu to disable platform opt-in

Krzysztof Wilczyński <[email protected]>
PCI/proc: Use file_ns_capable() when checking config space read access

Krzysztof Wilczyński <[email protected]>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses

Krzysztof Wilczyński <[email protected]>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses

Ronald Claveau <[email protected]>
PCI: meson: Fix GPIO state while requesting PERST#

Mohamad Raizudeen <[email protected]>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk

Stefan Haberland <[email protected]>
s390/dasd: Propagate partial completion length across ERP recovery

Stefan Haberland <[email protected]>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data

Stefan Haberland <[email protected]>
s390/dasd: Do not complete a failed ESE read as successful

Jianing Li <[email protected]>
power: supply: max17040: synchronize work cancellation on suspend

Fan Wu <[email protected]>

    power: supply: lp8727: fix use-after-free in lp8727_release_irq()

Jameson Thies <[email protected]>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Bryam Vargas <[email protected]>
power: supply: cros_usbpd-charger: bound the EC-reported port count

Jun Yang <[email protected]>

    sctp: fix stream->outcnt underflow on duplicate RECONF responses

Jun Yang <[email protected]>
sctp: distinguish sequence zero from wildcard in reconf lookup

Weiming Shi <[email protected]>
sctp: fix NULL deref on untransmitted RECONF completion

Hyunwoo Kim <[email protected]>
sctp: drop a chunk if its transport was removed

Hyunwoo Kim <[email protected]>
sctp: stop processing a packet once its association is deleted

Yehyeong Lee <[email protected]>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

Yehyeong Lee <[email protected]>
nvme: zero the discard fallback page

Ewan D. Milne <[email protected]>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path

Michael Bommarito <[email protected]>
lockd: pin next file across nlm_inspect_file lock-drop

Cong Nguyen <[email protected]>
hwmon: (max6621) fix temperature clamp range

Cong Nguyen <[email protected]>
hwmon: (max6621) fix negative temperature offset and crit readings

Norbert Szetei <[email protected]>
openvswitch: only skb_tx_error() a packet we are about to drop

Ali Ahmet Memis <[email protected]>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

Zhan Xusheng <[email protected]>
ocfs2: fix readdir position truncation on 32-bit kernels

Joseph Qi <[email protected]>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure

Joseph Qi <[email protected]>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item

Joseph Qi <[email protected]>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Ibrahim Hashimov <[email protected]>
ocfs2: validate rl_used against rl_count in refcount block validator

Bryam Vargas <[email protected]>
ocfs2: validate lengths in dlm_mig_lockres_handler

Bryam Vargas <[email protected]>
ocfs2: bound namelen in dlm_migrate_request_handler

Dmitry Antipov <[email protected]>
ocfs2: always run deallocs on copy-on-write completion

Zhiling Zou <[email protected]>
orangefs: skip leading spaces before parsing client debug masks

Yifei Gao <[email protected]>
orangefs: fix double-free of trailer_buf on readdir copy failure

WenTao Liang <[email protected]>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata

WenTao Liang <[email protected]>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

Norbert Szetei <[email protected]>
RDMA/ucma: Lock the handler in ucma_set_ib_path()

Fan Wu <[email protected]>
RDMA/cxgb4: Cancel reg_work before freeing device on remove

Vaibhav Nagare <[email protected]>
qede: Fix NULL pointer dereference in TPA fragment processing

Johan Hovold <[email protected]>
remoteproc: scp: Fix device reference leak on failed lookup

Chunkai Deng <[email protected]>
rpmsg: glink: smem: order FIFO read after availability check

Doruk Tan Ozturk <[email protected]>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

David Lee <[email protected]>
udf: reject VAT indexes equal to the entry count

Chuck Lever <[email protected]>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

Chris Mason <[email protected]>
sunrpc: init gssp_lock before publishing proc entry

Chris Mason <[email protected]>
SUNRPC: harden gss_unwrap_resp_priv length checks

Chris Mason <[email protected]>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Chris Mason <[email protected]>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat

Jeff Layton <[email protected]>
SUNRPC: always drain cache_cleaner before destroying a cache_detail

Jeff Layton <[email protected]>
sunrpc: route to a populated pool in svc_pool_for_cpu()

Chris Mason <[email protected]>

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Harshit Varu <[email protected]>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

Qing Ming <[email protected]>
mpls: reload header after pskb_may_pull()

Coly Li <[email protected]>

    md: do overflow check for sb->bblog_shift in super_1_load()

Bryam Vargas <[email protected]>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

Yuyang Huang <[email protected]>
ipv6: use RCU iterator to dump route exceptions

Zhiling Zou <[email protected]>
ip6_gre: fix hardware header length for NBMA tunnels

Zhiling Zou <[email protected]>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Guangshuo Li <[email protected]>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative

Valentin Kindschi <[email protected]>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: serialize security confirmation handling

Gongwei Li <[email protected]>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()

Guangshuo Li <[email protected]>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative

Hui Su <[email protected]>
cpufreq: schedutil: Fix rate limit overflow

Bryam Vargas <[email protected]>
dm array: reject an array block whose value size is not the caller's

Ilya Krutskih <[email protected]>
dm raid1: reserve space for NUL-terminator in build_constructor_string()

liyouhong <[email protected]>
dm-era: fix shadowed superblock leak on take-snap failure

Jiangshan Yi <[email protected]>
bnx2x: fix double free in bnx2x_init_firmware() error path

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU

Christoph Zwerschke <[email protected]>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU

Niklas Cassel <[email protected]>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

Matt Turner <[email protected]>
alpha: marvel: Fix lock ordering in init_io7_irqs()

Matt Turner <[email protected]>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number

Krzysztof Wilczyński <[email protected]>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()

Ivaylo Dimitrov <[email protected]>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device

Tien Sung Ang <[email protected]>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration

Marek Czernohous <[email protected]>
forcedeth: fix off-by-one when saving/restoring non-PCI config space

Myeonghun Pak <[email protected]>
fbdev: uvesafb: unregister connector callback on init failure

Florian Fuchs <[email protected]>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer

Runyu Xiao <[email protected]>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display

Yemu Lu <[email protected]>
fat: restore original value when fat_ent_write failed

Yichong Chen <[email protected]>
ecryptfs: show filename encryption options

Yichong Chen <[email protected]>
ecryptfs: release message context on send failure

Yichong Chen <[email protected]>
ecryptfs: reject too-small tag 70 packets

HanQuan <[email protected]>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet

Yichong Chen <[email protected]>
ecryptfs: pass packet set buffer size to parser

Yichong Chen <[email protected]>
ecryptfs: hold msg ctx list lock when cleaning daemon queue

Yichong Chen <[email protected]>
ecryptfs: fix tag 11 packet exact-fit size check

Pengpeng Hou <[email protected]>
eCryptfs: bound the packet-length peek to the user buffer

Jiangshan Yi <[email protected]>
HID: mcp2221: validate report size in mcp2221_raw_event()

Haoxiang Li <[email protected]>
HID: sensor: custom: Fix field sysfs group cleanup on failure

Xu Rao <[email protected]>
HID: roccat: free buffered reports when destroying device

Ibrahim Hashimov <[email protected]>
HID: picolcd: clamp eeprom debugfs read to bytes actually received

Jérémy Jean <[email protected]>
audit: avoid dropping live tree ref on fsnotify rule autoremove

Michael Bommarito <[email protected]>
ceph: bound xattr value length in __build_xattrs()

Xiubo Li <[email protected]>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock

Jérémy Jean <[email protected]>
libceph: reject buckets with mismatched CRUSH ids

Chuck Lever <[email protected]>
NFSD: Prevent lock owner use-after-free during client teardown

Jeff Layton <[email protected]>
nfsd: revoke copy-notify stateids before dropping their reference

Jeff Layton <[email protected]>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE

Robbie Ko <[email protected]>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE

Jeff Layton <[email protected]>
nfsd: initialize copy-notify stateid before publishing it

Jeff Layton <[email protected]>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

Jeff Layton <[email protected]>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget

Jeff Layton <[email protected]>
nfsd: fix version mismatch loops in nfsd_acl_init_request()

Chris Mason <[email protected]>
nfsd: fix cpntf publish race in nfs4_init_cp_state

Jeff Layton <[email protected]>
nfsd: check client ownership when cancelling a copy-notify stateid

Jeff Layton <[email protected]>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

Jeff Layton <[email protected]>
nfsd: add filehandle match check to nfsd4_delegreturn()

Jeff Layton <[email protected]>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

Jeff Layton <[email protected]>
nfsd: validate symlink target length in NFSv4 CREATE

Chuck Lever <[email protected]>
nfsd: sample writeback error cursor before async COPY loop

Jeff Layton <[email protected]>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types

Chuck Lever <[email protected]>
nfsd: Reset write verifier when async COPY writeback fails

Mike Snitzer <[email protected]>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

Michael Bommarito <[email protected]>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

Chuck Lever <[email protected]>
NFSD: Fix off-by-one in DRC bucket pruning limit

Chuck Lever <[email protected]>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies

Ibrahim Hashimov <[email protected]>
ubifs: fix out-of-bounds read in signature length check

Abdurrahman Hussain <[email protected]>
of: fix out-of-bounds read in of_alias_scan() stem parser

Ryusuke Konishi <[email protected]>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Junrui Luo <[email protected]>
media: vicodec: fix out-of-bounds write in FWHT encoder

Weigang He <[email protected]>
media: cec: stm32: prevent out-of-bounds write on RX overflow

Vincent Mailhol <[email protected]>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

Xingrui Li <[email protected]>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

Daisuke Matsuda <[email protected]>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

Neill Kapron <[email protected]>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop

Jeffin Philip <[email protected]>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Yun Zhou <[email protected]>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

Myeonghun Pak <[email protected]>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral

Johan Hovold <[email protected]>
USB: phy: fsl-usb: fix missing static keywords

Hao-Qun Huang <[email protected]>
staging: greybus: hid: fix SET_REPORT return value

Hans Verkuil <[email protected]>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"

James Kim <[email protected]>
rapidio: mport_cdev: fix use-after-free in dma_req_free()

Bartosz Golaszewski <[email protected]>
powerpc/powermac: fix OF node refcount

Hui Su <[email protected]>
tracing: Fix crash passing ERR_PTR to kthread_stop()

Kiryl Shutsemau (Meta) <[email protected]>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()

Joy H.J. Lee <[email protected]>
tools/compiler: match glibc 2.42 definition of __attribute_const__

Guopeng Zhang <[email protected]>
mm: memcg: stop reclaim when a limit update is superseded

Breno Leitao <[email protected]>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

Jordan R Abrahams-Whitehead <[email protected]>
include/linux/list.h: mark list_add and __list_add as __always_inline

Jérémy Jean <[email protected]>
timers/itimer: Zero-init old itimerval before copy to userspace

Felix Yan <[email protected]>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta

Takashi Iwai <[email protected]>
ALSA: aloop: Fix racy access at PCM trigger

Fedor Pchelkin <[email protected]>
Revert "USB: serial: keyspan_pda: fix information leak"

-------------

Diffstat:

 .../ABI/testing/configfs-usb-gadget-uac1_legacy    |   3 -
 Documentation/usb/gadget-testing.rst               |   3 -
 Makefile                                           |   4 +-
 arch/alpha/kernel/pci-sysfs.c                      |   6 +-
 arch/alpha/kernel/sys_marvel.c                     |  25 +-
 arch/arm/boot/dts/armada-388-helios4.dts           |  13 +
 arch/arm/boot/dts/sun4i-a10.dtsi                   |   2 +-
 arch/arm/mach-imx/src.c                            |   1 +
 arch/arm/mach-lpc32xx/common.c                     |   5 +-
 arch/arm/mach-lpc32xx/common.h                     |   2 +
 arch/arm/mach-lpc32xx/phy3250.c                    |   2 +
 arch/arm/mach-lpc32xx/pm.c                         |   5 +-
 arch/arm/mm/fault.c                                |  16 +-
 .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi   |   4 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |   3 +-
 arch/arm64/boot/dts/rockchip/Makefile              |   1 +
 .../boot/dts/rockchip/rk3399-gru-chromebook.dtsi   |   6 +-
 .../boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts  |  41 ++
 arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi       |   1 +
 arch/arm64/kernel/hibernate.c                      |  16 +-
 arch/csky/kernel/entry.S                           |   6 +-
 arch/m68k/kernel/traps.c                           |   4 +-
 arch/mips/kernel/ptrace.c                          |   6 +-
 arch/openrisc/kernel/entry.S                       |  43 ++-
 arch/parisc/kernel/head.S                          |   1 +
 arch/powerpc/configs/85xx-hw.config                |   1 +
 arch/powerpc/kernel/smp.c                          |   3 +
 arch/powerpc/platforms/powermac/low_i2c.c          |   2 +-
 arch/s390/kvm/guestdbg.c                           |   7 +-
 arch/s390/kvm/interrupt.c                          |   2 +-
 arch/s390/kvm/kvm-s390.c                           |   7 +-
 arch/x86/events/intel/lbr.c                        |  12 +-
 arch/x86/events/intel/uncore.c                     |   2 -
 arch/x86/include/asm/insn-eval.h                   |  36 ++
 arch/x86/include/asm/pkeys.h                       |   3 +
 arch/x86/kvm/emulate.c                             |  26 +-
 arch/x86/kvm/hyperv.c                              |  25 +-
 block/blk-iocost.c                                 |   2 +-
 block/blk-stat.c                                   |   2 +-
 block/kyber-iosched.c                              |   2 +-
 crypto/ecdh.c                                      |  74 ++--
 crypto/ecdh_helper.c                               |   4 +-
 crypto/testmgr.c                                   |  13 +-
 crypto/testmgr.h                                   |  42 +-
 drivers/accessibility/speakup/keyhelp.c            |  17 +-
 drivers/accessibility/speakup/kobjects.c           |   6 +-
 drivers/acpi/bus.c                                 |   4 +-
 drivers/acpi/pci_root.c                            |   3 +-
 drivers/acpi/processor_core.c                      |  31 +-
 drivers/acpi/processor_idle.c                      |  34 +-
 drivers/acpi/utils.c                               |  50 ++-
 drivers/ata/ahci.c                                 |  49 +++
 drivers/ata/libata-scsi.c                          |  28 +-
 drivers/base/firmware_loader/fallback.c            |  38 +-
 drivers/base/firmware_loader/firmware.h            |  10 +
 drivers/base/platform.c                            | 424 +++++++++++----------
 drivers/base/soc.c                                 |  19 +-
 drivers/base/swnode.c                              |   2 +-
 drivers/bluetooth/btmtksdio.c                      |  13 +-
 drivers/bluetooth/btusb.c                          |  15 +-
 drivers/bluetooth/hci_bcm.c                        |   1 +
 drivers/bluetooth/hci_intel.c                      |   1 +
 drivers/bluetooth/hci_ldisc.c                      |   2 +-
 drivers/bluetooth/hci_serdev.c                     |   2 +-
 drivers/bus/ti-sysc.c                              |  12 +-
 drivers/char/hw_random/ks-sa-rng.c                 |  22 +-
 drivers/char/ipmi/ipmb_dev_int.c                   |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |   1 +
 drivers/char/ppdev.c                               |  10 +-
 drivers/char/tpm/st33zp24/st33zp24.c               |   8 +-
 drivers/char/tpm/tpm_i2c_nuvoton.c                 |   6 +-
 drivers/char/xilinx_hwicap/xilinx_hwicap.c         |   5 +-
 drivers/clk/clk-moxart.c                           |  14 -
 drivers/clk/clk-palmas.c                           |  14 +-
 drivers/clk/hisilicon/reset.c                      |   2 +-
 drivers/clk/imx/clk-scu.c                          |   7 +-
 drivers/clk/meson/gxbb.c                           |   2 +-
 drivers/clk/qcom/common.c                          |   4 +-
 drivers/clk/qcom/gcc-msm8916.c                     |   5 +-
 drivers/clk/qcom/gcc-msm8939.c                     |   5 +-
 drivers/clk/qcom/gdsc.c                            | 108 +++++-
 drivers/clk/qcom/gdsc.h                            |   2 +
 drivers/clk/tegra/clk-tegra124-emc.c               |   1 +
 drivers/clk/x86/clk-pmc-atom.c                     |   3 +
 drivers/clocksource/clps711x-timer.c               |   2 +-
 drivers/clocksource/timer-armada-370-xp.c          |  18 +-
 drivers/clocksource/timer-sun4i.c                  |   2 +-
 drivers/cpufreq/imx6q-cpufreq.c                    |   6 +-
 drivers/cpufreq/intel_pstate.c                     |   9 +-
 drivers/cpufreq/spear-cpufreq.c                    |   4 +-
 drivers/crypto/atmel-ecc.c                         |  73 ++--
 drivers/crypto/atmel-sha204a.c                     |   6 +-
 drivers/crypto/sa2ul.c                             |  19 +-
 drivers/dma/dw-edma/dw-edma-core.c                 |  34 +-
 drivers/dma/hisi_dma.c                             |   2 +-
 drivers/dma/mediatek/mtk-uart-apdma.c              |   2 +-
 drivers/dma/qcom/bam_dma.c                         |   1 +
 drivers/dma/xilinx/xilinx_dma.c                    |  12 +-
 drivers/firmware/google/coreboot_table.c           |  35 +-
 drivers/firmware/google/coreboot_table.h           |   1 +
 drivers/firmware/stratix10-svc.c                   |  21 +-
 drivers/fpga/altera-cvp.c                          |  10 +-
 drivers/fpga/stratix10-soc.c                       |  21 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c              |  74 ++--
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c    |   6 +
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c    |  24 ++
 .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c  |  35 +-
 .../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c    |   2 +-
 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c          |   3 +-
 drivers/gpu/drm/bridge/tc358767.c                  |   2 +-
 drivers/gpu/drm/drm_atomic_uapi.c                  |   2 +
 drivers/gpu/drm/drm_drv.c                          |  34 +-
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c     |   6 +-
 drivers/gpu/drm/lima/lima_device.c                 |  12 +-
 drivers/gpu/drm/msm/dsi/dsi_host.c                 |   2 -
 drivers/gpu/drm/panel/panel-samsung-s6d16d0.c      |  10 +-
 drivers/gpu/drm/sun4i/sun4i_backend.c              |   2 +-
 drivers/gpu/drm/sun4i/sun4i_crtc.c                 |   2 +-
 drivers/gpu/drm/sun4i/sun4i_tcon.c                 |  20 +-
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c              |   2 +
 drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c             |   2 +-
 drivers/gpu/drm/sun4i/sun8i_vi_scaler.c            |  18 +-
 drivers/gpu/drm/tve200/tve200_drv.c                |   1 +
 drivers/gpu/drm/vmwgfx/ttm_object.c                |   7 +-
 drivers/gpu/host1x/debug.c                         |   4 +-
 drivers/gpu/host1x/hw/channel_hw.c                 |   5 +-
 drivers/hid/hid-core.c                             | 127 +++---
 drivers/hid/hid-lg4ff.c                            |   8 +
 drivers/hid/hid-mcp2221.c                          |   7 +
 drivers/hid/hid-picolcd_debugfs.c                  |   9 +
 drivers/hid/hid-rmi.c                              |  46 ++-
 drivers/hid/hid-roccat-kone.c                      |   8 +-
 drivers/hid/hid-roccat.c                           |  13 +-
 drivers/hid/hid-sensor-custom.c                    |   9 +-
 drivers/hid/hid-sensor-hub.c                       |  46 ++-
 drivers/hid/i2c-hid/i2c-hid-core.c                 |  16 +-
 drivers/hid/wacom_wac.c                            |  13 +
 drivers/hsi/controllers/omap_ssi_core.c            |   6 +
 drivers/hwmon/emc1403.c                            |   6 +-
 drivers/hwmon/max6621.c                            |   8 +-
 drivers/hwspinlock/hwspinlock_core.c               |   2 +-
 drivers/i2c/i2c-mux.c                              |   1 +
 drivers/i2c/muxes/i2c-demux-pinctrl.c              |   1 +
 drivers/i3c/master.c                               |  11 +-
 drivers/i3c/master/dw-i3c-master.c                 |  10 +-
 drivers/iio/accel/dmard09.c                        |   7 +
 drivers/iio/chemical/sgp30.c                       |   3 +
 drivers/iio/dac/m62332.c                           |  17 +-
 drivers/iio/gyro/mpu3050-core.c                    |   2 +-
 drivers/iio/light/cm32181.c                        |   2 +-
 drivers/iio/light/gp2ap002.c                       |  24 +-
 drivers/iio/light/isl29028.c                       |   2 +-
 drivers/iio/light/tsl2583.c                        |   2 +-
 drivers/iio/light/tsl2772.c                        |   2 +-
 drivers/iio/orientation/hid-sensor-rotation.c      |  20 +-
 drivers/iio/proximity/srf04.c                      |   1 +
 drivers/iio/temperature/hid-sensor-temperature.c   |   3 +-
 drivers/infiniband/core/cma.c                      |   6 +-
 drivers/infiniband/core/device.c                   |  25 +-
 drivers/infiniband/core/restrack.c                 |   4 +-
 drivers/infiniband/core/ucma.c                     |   7 +-
 drivers/infiniband/hw/cxgb4/device.c               |   8 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |   4 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |  15 +-
 drivers/infiniband/hw/hfi1/chip.c                  |   4 +-
 drivers/infiniband/hw/hfi1/hfi.h                   |   2 -
 drivers/infiniband/hw/hfi1/init.c                  |  43 +--
 drivers/infiniband/hw/hfi1/user_sdma.c             |  13 +-
 drivers/infiniband/hw/mlx5/cong.c                  |   8 +-
 drivers/infiniband/hw/mlx5/qp.c                    |  25 +-
 drivers/infiniband/sw/rxe/rxe_resp.c               |  13 +-
 drivers/infiniband/sw/siw/siw_cm.c                 |  32 +-
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |   2 +
 drivers/infiniband/ulp/isert/ib_isert.c            |  85 ++++-
 drivers/infiniband/ulp/isert/ib_isert.h            |   1 +
 drivers/infiniband/ulp/srp/ib_srp.c                |  45 ++-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  20 +-
 drivers/input/tablet/aiptek.c                      |  13 +-
 drivers/interconnect/core.c                        |   7 +-
 drivers/iommu/amd/init.c                           |  42 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        |   5 +-
 drivers/iommu/arm/arm-smmu/qcom_iommu.c            |  14 +-
 drivers/iommu/dma-iommu.c                          |  13 +-
 drivers/iommu/intel/iommu.c                        |  16 +-
 drivers/iommu/msm_iommu.c                          |   2 +-
 drivers/irqchip/irq-gic-v3-its.c                   |  15 +-
 drivers/irqchip/irq-mbigen.c                       |  20 +-
 drivers/leds/leds-pca9532.c                        |  18 +-
 drivers/mailbox/rockchip-mailbox.c                 |  17 +-
 drivers/md/dm-era-target.c                         |   5 +
 drivers/md/dm-log-userspace-base.c                 |   1 +
 drivers/md/dm-stats.c                              |   6 +-
 drivers/md/dm-switch.c                             |   2 +-
 drivers/md/dm.c                                    |   2 +-
 drivers/md/md.c                                    |   7 +
 drivers/md/persistent-data/dm-array.c              |  16 +
 drivers/md/raid5-ppl.c                             |   4 +-
 drivers/media/cec/core/cec-adap.c                  |   8 +-
 drivers/media/cec/core/cec-pin.c                   |   8 +-
 drivers/media/cec/platform/meson/ao-cec-g12a.c     |   1 +
 drivers/media/cec/platform/stm32/stm32-cec.c       |   3 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |  23 +-
 drivers/media/i2c/ov7740.c                         |   4 +-
 drivers/media/i2c/video-i2c.c                      |   8 +-
 drivers/media/pci/cobalt/cobalt-alsa-main.c        |   1 -
 drivers/media/pci/cx23885/cimax2.c                 |   1 +
 drivers/media/platform/qcom/venus/hfi_parser.c     |   9 +-
 drivers/media/test-drivers/vicodec/vicodec-core.c  |   4 +-
 drivers/media/test-drivers/vimc/vimc-capture.c     |   4 +-
 drivers/media/tuners/tda18250.c                    |   4 +-
 drivers/media/usb/airspy/airspy.c                  |  19 +-
 drivers/media/usb/cx231xx/cx231xx-video.c          |   4 +-
 drivers/media/usb/em28xx/em28xx-cards.c            |   3 +-
 drivers/media/usb/em28xx/em28xx-core.c             |   2 +
 drivers/media/usb/go7007/snd-go7007.c              |  10 +-
 drivers/media/usb/s2255/s2255drv.c                 |  11 +
 drivers/media/usb/usbtv/usbtv-audio.c              |  11 +
 drivers/media/v4l2-core/v4l2-dev.c                 |  14 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   2 +
 drivers/mfd/iqs62x.c                               |   2 +-
 drivers/mfd/rave-sp.c                              |  64 +++-
 drivers/misc/ad525x_dpot-i2c.c                     |   4 +-
 drivers/misc/ad525x_dpot-spi.c                     |   4 +-
 drivers/misc/ad525x_dpot.c                         | 181 +++++----
 drivers/misc/ad525x_dpot.h                         |   5 +-
 drivers/misc/cardreader/rtsx_pcr.c                 |   2 +
 drivers/misc/cardreader/rtsx_usb.c                 |  23 +-
 drivers/misc/vmw_vmci/vmci_event.c                 |   4 +-
 drivers/mmc/host/via-sdmmc.c                       |   8 +-
 drivers/mtd/mtdoops.c                              |   3 +
 drivers/mtd/mtdpart.c                              |   3 +-
 drivers/mtd/mtdswap.c                              |   1 +
 drivers/mtd/nand/raw/nand_onfi.c                   |  27 +-
 drivers/mtd/parsers/afs.c                          |   7 +
 drivers/mtd/ubi/attach.c                           |   4 +-
 drivers/mtd/ubi/build.c                            |  63 ++-
 drivers/mtd/ubi/cdev.c                             |   5 +-
 drivers/mtd/ubi/eba.c                              |   5 +-
 drivers/mtd/ubi/fastmap-wl.c                       |  53 ++-
 drivers/mtd/ubi/fastmap.c                          |  76 +---
 drivers/mtd/ubi/io.c                               |  13 +-
 drivers/mtd/ubi/ubi.h                              |  19 +-
 drivers/mtd/ubi/wl.c                               |  38 +-
 drivers/mtd/ubi/wl.h                               |   6 +-
 drivers/net/bonding/bond_netlink.c                 |   2 +-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   4 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c   |   3 +
 drivers/net/ethernet/freescale/fec_main.c          |   6 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |  12 +-
 drivers/net/ethernet/nvidia/forcedeth.c            |   6 +-
 drivers/net/ethernet/qlogic/qede/qede.h            |   8 +-
 drivers/net/ethernet/qlogic/qede/qede_fp.c         |   1 +
 .../net/ethernet/qualcomm/rmnet/rmnet_map_data.c   |   1 +
 drivers/net/ethernet/realtek/8139cp.c              |   2 +-
 .../net/ethernet/stmicro/stmmac/dwmac1000_core.c   |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c  |   2 +-
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |   2 +-
 .../net/ethernet/stmicro/stmmac/stmmac_selftests.c |  35 +-
 drivers/net/gtp.c                                  |   2 +
 drivers/net/ipvlan/ipvlan_l3s.c                    |   1 -
 drivers/net/ntb_netdev.c                           |  38 +-
 drivers/net/ppp/pppox.c                            |  17 +
 drivers/net/slip/slip.c                            |  11 +-
 drivers/net/thunderbolt.c                          |   6 +-
 drivers/net/tun.c                                  |  21 +-
 drivers/net/usb/qmi_wwan.c                         |   1 +
 drivers/net/wireless/ath/ath10k/snoc.c             |   9 +-
 drivers/net/wireless/ath/ath11k/debug.c            |  12 +-
 drivers/net/wireless/ath/ath11k/debug.h            |   3 +-
 drivers/net/wireless/ath/ath11k/dp_rx.c            |  32 +-
 drivers/net/wireless/ath/ath11k/trace.c            |   1 +
 drivers/net/wireless/ath/ath11k/trace.h            | 172 +++++++++
 drivers/net/wireless/ath/ath11k/wmi.c              |  15 +-
 drivers/net/wireless/ath/ath6kl/cfg80211.c         |   5 +
 drivers/net/wireless/ath/ath6kl/wmi.c              |  17 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   3 +-
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  12 +
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c   |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   8 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.h    |   6 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   2 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |   2 +-
 drivers/net/wireless/realtek/rtlwifi/pci.c         |   6 +-
 drivers/net/wireless/realtek/rtw88/tx.c            |   1 +
 drivers/net/wireless/zydas/zd1211rw/zd_usb.c       |   8 +
 drivers/nfc/pn533/pn533.c                          |  21 +-
 drivers/ntb/ntb_transport.c                        |  38 +-
 drivers/nvdimm/btt.c                               |   8 +
 drivers/nvdimm/label.c                             |  17 +-
 drivers/nvme/host/core.c                           |   2 +-
 drivers/nvme/host/fc.c                             |   8 +-
 drivers/nvme/host/tcp.c                            |  11 +-
 drivers/nvme/target/rdma.c                         |  13 +-
 drivers/nvme/target/tcp.c                          |  10 +
 drivers/of/base.c                                  |   2 +-
 drivers/of/property.c                              |  10 +-
 drivers/parisc/eisa.c                              |   5 +
 drivers/pci/controller/dwc/pci-meson.c             |   2 +-
 drivers/pci/controller/pci-hyperv.c                |   1 +
 drivers/pci/pci-sysfs.c                            |  45 ++-
 drivers/pci/proc.c                                 |   8 +-
 drivers/pci/quirks.c                               |   2 +-
 drivers/perf/arm_spe_pmu.c                         |   2 +-
 drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c      |  26 +-
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |   1 -
 drivers/pinctrl/pinctrl-rockchip.c                 |  10 +
 drivers/platform/chrome/cros_ec_sensorhub_ring.c   |  28 +-
 drivers/power/supply/bd99954-charger.h             |  23 +-
 drivers/power/supply/bq27xxx_battery.c             |   6 +-
 drivers/power/supply/cros_usbpd-charger.c          |  17 +-
 drivers/power/supply/isp1704_charger.c             |   1 +
 drivers/power/supply/lp8727_charger.c              |   4 +-
 drivers/power/supply/max17040_battery.c            |   2 +-
 drivers/power/supply/sbs-battery.c                 | 160 +++++---
 drivers/power/supply/sc2731_charger.c              |   8 +-
 drivers/pps/pps.c                                  |  10 +-
 drivers/rapidio/devices/rio_mport_cdev.c           |  10 +-
 drivers/rapidio/rio-scan.c                         |   1 +
 drivers/regulator/as3722-regulator.c               |   1 -
 drivers/regulator/core.c                           |   6 +-
 drivers/regulator/max8998.c                        |   1 -
 drivers/regulator/qcom-rpmh-regulator.c            |   6 +-
 drivers/remoteproc/mtk_scp.c                       |   9 +-
 drivers/remoteproc/qcom_common.c                   |   4 +-
 drivers/remoteproc/remoteproc_core.c               | 357 +++++++++++++----
 drivers/remoteproc/remoteproc_elf_loader.c         |  12 +-
 drivers/remoteproc/remoteproc_sysfs.c              |  35 +-
 drivers/remoteproc/remoteproc_virtio.c             |   6 +-
 drivers/rpmsg/qcom_glink_native.c                  |  36 +-
 drivers/rpmsg/qcom_glink_smem.c                    |   7 +
 drivers/rtc/rtc-pcf8563.c                          |   4 +-
 drivers/s390/block/dasd.c                          |   6 +-
 drivers/s390/block/dasd_eckd.c                     |  40 +-
 drivers/s390/block/dasd_erp.c                      |   3 +
 drivers/scsi/mpt3sas/mpt3sas_base.c                |   2 +
 drivers/scsi/pm8001/pm8001_init.c                  |   4 +-
 drivers/scsi/qla2xxx/qla_attr.c                    |   7 +-
 drivers/scsi/qla2xxx/qla_bsg.c                     |  39 +-
 drivers/scsi/qla2xxx/qla_def.h                     |   2 +
 drivers/scsi/qla2xxx/qla_dfs.c                     |   4 +-
 drivers/scsi/qla2xxx/qla_gs.c                      |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |  47 ++-
 drivers/scsi/qla2xxx/qla_inline.h                  |  13 +
 drivers/scsi/qla2xxx/qla_isr.c                     |  20 +-
 drivers/scsi/qla2xxx/qla_mbx.c                     |  26 +-
 drivers/scsi/qla2xxx/qla_nx2.c                     |   2 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  14 +-
 drivers/scsi/qla2xxx/qla_target.c                  |  24 +-
 drivers/scsi/qla2xxx/qla_target.h                  |   1 +
 drivers/scsi/qla2xxx/tcm_qla2xxx.c                 |  61 +--
 drivers/scsi/scsi_lib.c                            |   2 +
 drivers/soc/bcm/bcm2835-power.c                    |   7 +-
 drivers/soc/samsung/exynos-pmu.c                   |   4 +-
 drivers/soc/ti/knav_qmss.h                         |   1 +
 drivers/soc/ti/knav_qmss_queue.c                   |  14 +-
 drivers/soundwire/qcom.c                           |  31 +-
 drivers/spi/spi-img-spfi.c                         |   5 +-
 drivers/spi/spi-sprd-adi.c                         |   6 +
 drivers/staging/fbtft/fbtft-sysfs.c                |   2 +-
 drivers/staging/greybus/audio_gb.c                 |  13 +
 drivers/staging/greybus/audio_manager_sysfs.c      |   2 +-
 drivers/staging/greybus/hid.c                      |   2 +-
 drivers/staging/media/meson/vdec/vdec.c            |   4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   4 +-
 drivers/staging/octeon/ethernet-mem.c              |  31 +-
 drivers/staging/octeon/ethernet-mem.h              |   5 +-
 drivers/staging/octeon/ethernet-rx.c               |   2 +-
 drivers/staging/octeon/ethernet-tx.c               |   2 +
 drivers/staging/octeon/ethernet.c                  |   6 +-
 drivers/staging/rtl8723bs/core/rtw_cmd.c           |   8 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   3 +
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |   4 +-
 drivers/staging/sm750fb/sm750.c                    |   4 +-
 drivers/target/iscsi/iscsi_target.c                |  16 +-
 drivers/target/iscsi/iscsi_target_login.c          |   2 +-
 drivers/target/target_core_transport.c             | 345 +++++++++--------
 drivers/target/target_core_xcopy.c                 |   8 +-
 drivers/thermal/imx_thermal.c                      |   9 +-
 .../intel/int340x_thermal/int3400_thermal.c        |   9 +-
 drivers/thermal/qoriq_thermal.c                    |  13 +-
 drivers/tty/hvc/Kconfig                            |   2 +-
 drivers/tty/serial/amba-pl011.c                    |  10 +
 drivers/tty/tty_io.c                               |   4 +-
 drivers/uio/uio.c                                  |   5 +
 drivers/usb/atm/usbatm.c                           |   4 +-
 drivers/usb/gadget/configfs.c                      |   4 +-
 drivers/usb/gadget/function/f_fs.c                 |  14 +-
 drivers/usb/gadget/function/f_mass_storage.c       |   2 +-
 drivers/usb/gadget/function/f_tcm.c                |  43 ++-
 drivers/usb/gadget/function/f_uac1_legacy.c        |  56 ---
 drivers/usb/gadget/function/f_uvc.c                |   7 +-
 drivers/usb/gadget/function/u_audio.c              |  24 +-
 drivers/usb/gadget/function/u_uac1_legacy.h        |   3 -
 drivers/usb/gadget/functions.c                     |   2 +-
 drivers/usb/gadget/legacy/inode.c                  |   3 +-
 drivers/usb/gadget/udc/r8a66597-udc.c              |   1 -
 drivers/usb/gadget/udc/snps_udc_plat.c             |   5 +-
 drivers/usb/host/xhci-ring.c                       |  32 +-
 drivers/usb/image/mdc800.c                         |   4 +-
 drivers/usb/phy/phy-fsl-usb.c                      |  52 +--
 drivers/usb/phy/phy-fsl-usb.h                      |   6 +-
 drivers/usb/renesas_usbhs/common.c                 |   6 +-
 drivers/usb/serial/keyspan_pda.c                   |   2 +-
 drivers/usb/storage/ene_ub6250.c                   |   2 +
 drivers/usb/typec/ucsi/displayport.c               |   2 +-
 drivers/vdpa/mlx5/core/mr.c                        |   2 +-
 drivers/vfio/pci/vfio_pci_config.c                 |   1 +
 drivers/video/fbdev/kyro/fbdev.c                   |  24 +-
 .../fbdev/omap2/omapfb/displays/panel-dsi-cm.c     |   4 +-
 drivers/video/fbdev/pvr2fb.c                       |   4 +-
 drivers/video/fbdev/uvesafb.c                      |   2 +
 drivers/virtio/virtio_balloon.c                    |   6 +
 drivers/w1/masters/ds2482.c                        |   4 +
 drivers/w1/slaves/w1_ds28e17.c                     |   8 +
 drivers/xen/xenbus/xenbus_xs.c                     |  16 +-
 fs/ceph/caps.c                                     |  11 +-
 fs/ceph/xattr.c                                    |   1 +
 fs/cifs/cifs_debug.c                               |   2 +-
 fs/ecryptfs/crypto.c                               |   2 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |   3 +-
 fs/ecryptfs/keystore.c                             |  45 ++-
 fs/ecryptfs/messaging.c                            |  11 +-
 fs/ecryptfs/miscdev.c                              |   5 +-
 fs/ecryptfs/super.c                                |   7 +
 fs/ext4/file.c                                     |   7 +
 fs/ext4/inode.c                                    |  10 +
 fs/f2fs/file.c                                     |   9 +-
 fs/f2fs/namei.c                                    |  11 +-
 fs/fat/misc.c                                      |   4 +
 fs/fat/nfs.c                                       |   4 +-
 fs/hfsplus/catalog.c                               |  25 +-
 fs/hfsplus/hfsplus_fs.h                            |   6 +
 fs/hugetlbfs/inode.c                               |   3 +-
 fs/isofs/compress.c                                |   1 +
 fs/lockd/svcsubs.c                                 |  53 +--
 fs/nfs/client.c                                    |  21 +-
 fs/nfs/file.c                                      |   2 +
 fs/nfs/filelayout/filelayoutdev.c                  |   3 +-
 fs/nfs/flexfilelayout/flexfilelayoutdev.c          |   3 +-
 fs/nfs/inode.c                                     | 111 +++---
 fs/nfs/internal.h                                  |   1 +
 fs/nfs/netns.h                                     |   6 +-
 fs/nfs/nfs4client.c                                |   1 +
 fs/nfs/nfs4proc.c                                  |   6 +-
 fs/nfs/pnfs.c                                      |  61 ++-
 fs/nfs/pnfs.h                                      |   3 +-
 fs/nfs/pnfs_nfs.c                                  |  39 +-
 fs/nfsd/flexfilelayoutxdr.c                        |  20 +-
 fs/nfsd/nfs2acl.c                                  |  31 +-
 fs/nfsd/nfs4proc.c                                 |  39 +-
 fs/nfsd/nfs4state.c                                | 206 +++++++---
 fs/nfsd/nfs4xdr.c                                  |  17 +
 fs/nfsd/nfscache.c                                 |   2 +-
 fs/nfsd/nfsfh.c                                    |   4 +-
 fs/nfsd/nfsproc.c                                  |   7 +
 fs/nfsd/nfssvc.c                                   |   4 +-
 fs/nfsd/nfsxdr.c                                   |  32 +-
 fs/nilfs2/bmap.c                                   |   2 +-
 fs/nilfs2/bmap.h                                   |   2 +-
 fs/nilfs2/btree.c                                  |  39 +-
 fs/nilfs2/direct.c                                 |   4 +-
 fs/nilfs2/segment.c                                |   4 +
 fs/nilfs2/the_nilfs.c                              |   6 +
 fs/notify/fanotify/fanotify_user.c                 |  17 +-
 fs/notify/inotify/inotify_user.c                   |  15 +-
 fs/ocfs2/acl.c                                     | 141 ++++---
 fs/ocfs2/acl.h                                     |  19 +-
 fs/ocfs2/cluster/heartbeat.c                       | 201 +++++++---
 fs/ocfs2/cluster/heartbeat.h                       |   7 +-
 fs/ocfs2/cluster/netdebug.c                        |   2 +-
 fs/ocfs2/cluster/nodemanager.c                     |  10 +
 fs/ocfs2/cluster/nodemanager.h                     |   1 +
 fs/ocfs2/cluster/tcp.c                             |  89 ++++-
 fs/ocfs2/cluster/tcp.h                             |   1 +
 fs/ocfs2/dir.c                                     |   2 +-
 fs/ocfs2/dlm/dlmdomain.c                           |   2 +-
 fs/ocfs2/dlm/dlmmaster.c                           |   6 +
 fs/ocfs2/dlm/dlmrecovery.c                         |   9 +
 fs/ocfs2/namei.c                                   |  17 +-
 fs/ocfs2/refcounttree.c                            |  47 ++-
 fs/ocfs2/stack_o2cb.c                              |   6 +-
 fs/ocfs2/xattr.c                                   |  91 +++--
 fs/ocfs2/xattr.h                                   |   9 +-
 fs/orangefs/devorangefs-req.c                      |   1 +
 fs/orangefs/orangefs-debugfs.c                     |   1 +
 fs/squashfs/cache.c                                |   2 +-
 fs/ubifs/auth.c                                    |   2 +-
 fs/udf/inode.c                                     |   2 +-
 fs/udf/partition.c                                 |   2 +-
 fs/udf/super.c                                     |  23 +-
 fs/udf/symlink.c                                   |   2 +
 include/acpi/acpi_bus.h                            |  21 +
 include/crypto/ecdh.h                              |   2 -
 include/linux/bitfield.h                           |  95 ++++-
 include/linux/bpf.h                                |   1 +
 include/linux/hid.h                                |   1 +
 include/linux/highmem.h                            |  89 ++++-
 include/linux/irqdomain.h                          |  23 ++
 include/linux/list.h                               |  15 +-
 include/linux/nfs_fs.h                             |   1 +
 include/linux/nfs_xdr.h                            |   3 +-
 include/linux/of.h                                 |   2 +
 include/linux/of_graph.h                           |   4 +-
 include/linux/platform_device.h                    |  11 +
 include/linux/remoteproc.h                         | 297 ++-------------
 include/linux/rsc_table.h                          | 364 ++++++++++++++++++
 include/linux/rtsx_usb.h                           |   3 +
 include/linux/seq_buf.h                            |  25 ++
 include/linux/soundwire/sdw.h                      |   2 +
 include/linux/trace_events.h                       |   3 +
 include/media/rc-map.h                             |   2 -
 include/net/bluetooth/l2cap.h                      |  11 +-
 include/net/inet_connection_sock.h                 |  11 +-
 include/net/ip_tunnels.h                           |  11 +-
 include/net/mac80211.h                             |  18 +
 include/net/netfilter/nf_queue.h                   |   1 +
 include/net/netfilter/nf_tables.h                  |   4 +-
 include/net/pkt_sched.h                            |   1 +
 include/net/sch_generic.h                          |   1 +
 include/net/sctp/structs.h                         |   2 +-
 include/net/tcp.h                                  |  13 +-
 include/net/xfrm.h                                 |   1 -
 include/target/target_core_base.h                  |   1 -
 include/target/target_core_fabric.h                |  10 +-
 include/uapi/linux/time_types.h                    |   2 +-
 include/uapi/mtd/ubi-user.h                        |   8 +-
 kernel/auditfilter.c                               |   6 +-
 kernel/bpf/cgroup.c                                |   2 +-
 kernel/bpf/core.c                                  |   4 +
 kernel/bpf/net_namespace.c                         |  17 +-
 kernel/bpf/ringbuf.c                               |   2 +-
 kernel/bpf/verifier.c                              |  26 +-
 kernel/entry/common.c                              |   3 +
 kernel/irq/irqdomain.c                             |  41 +-
 kernel/locking/lockdep.c                           |   2 +
 kernel/power/wakelock.c                            |   2 +-
 kernel/sched/cpufreq_schedutil.c                   |  59 +--
 kernel/sched/fair.c                                |  53 +--
 kernel/signal.c                                    |   4 +
 kernel/sys.c                                       |   2 +-
 kernel/time/clocksource.c                          |   8 +-
 kernel/time/itimer.c                               |   2 +-
 kernel/time/timekeeping.c                          |   6 +
 kernel/time/timer.c                                |   1 +
 kernel/trace/trace.c                               | 228 +++++++++++
 kernel/trace/trace.h                               |   3 +
 kernel/trace/trace_dynevent.h                      |   4 +-
 kernel/trace/trace_events.c                        |  32 ++
 kernel/trace/trace_events_synth.c                  |   2 +-
 kernel/trace/trace_kprobe.c                        |   4 +-
 kernel/trace/trace_mmiotrace.c                     |  24 +-
 kernel/trace/trace_output.c                        |   2 +-
 kernel/trace/trace_printk.c                        |  11 +
 kernel/trace/trace_uprobe.c                        |   4 +-
 lib/iov_iter.c                                     |   8 +-
 lib/string.c                                       |   3 +-
 lib/test_hmm.c                                     |   2 +-
 lib/ucs2_string.c                                  |   2 +-
 mm/Kconfig                                         |   3 +
 mm/highmem.c                                       | 151 +++++++-
 mm/memcontrol.c                                    |   6 +
 mm/vmscan.c                                        |   2 +-
 net/batman-adv/bridge_loop_avoidance.c             |  80 ++--
 net/batman-adv/distributed-arp-table.c             |   8 +-
 net/batman-adv/main.c                              |   4 +
 net/bluetooth/6lowpan.c                            |  25 +-
 net/bluetooth/ecdh_helper.c                        |   2 -
 net/bluetooth/hci_event.c                          |   7 +-
 net/bluetooth/l2cap_core.c                         |  58 ++-
 net/bluetooth/l2cap_sock.c                         | 114 +++++-
 net/bluetooth/msft.c                               |   5 +
 net/bluetooth/rfcomm/core.c                        |  12 +-
 net/bluetooth/selftest.c                           |   2 +-
 net/bluetooth/smp.c                                |   6 +-
 net/bridge/br_mrp_netlink.c                        |   4 +-
 net/bridge/br_netlink_tunnel.c                     |   3 +-
 net/bridge/br_vlan.c                               |   4 +-
 net/ceph/osdmap.c                                  |   2 +
 net/core/filter.c                                  |   6 +-
 net/core/lwt_bpf.c                                 |  15 +-
 net/core/skbuff.c                                  |  11 +-
 net/core/xdp.c                                     |   4 +-
 net/dccp/dccp.h                                    |   4 +-
 net/dccp/ipv4.c                                    |   4 +-
 net/dccp/ipv6.c                                    |   7 +-
 net/dccp/minisocks.c                               |   2 +-
 net/hsr/hsr_device.c                               |  14 +-
 net/hsr/hsr_framereg.c                             |  63 ++-
 net/hsr/hsr_main.h                                 |   8 +-
 net/ipv4/esp4.c                                    |  49 +--
 net/ipv4/inet_connection_sock.c                    |   9 +
 net/ipv4/ip_tunnel.c                               |   2 +-
 net/ipv4/syncookies.c                              |   2 +-
 net/ipv4/tcp_fastopen.c                            |   2 +-
 net/ipv4/tcp_ipv4.c                                |   8 +-
 net/ipv4/tcp_minisocks.c                           |   2 +-
 net/ipv4/tcp_output.c                              |   2 +-
 net/ipv6/esp6.c                                    |  49 +--
 net/ipv6/ip6_gre.c                                 |  34 +-
 net/ipv6/ip6_tunnel.c                              |  22 +-
 net/ipv6/route.c                                   |   2 +-
 net/ipv6/seg6_local.c                              |   9 +
 net/ipv6/sit.c                                     |   2 +-
 net/ipv6/tcp_ipv6.c                                |  98 ++---
 net/ipv6/xfrm6_input.c                             |   2 +-
 net/iucv/af_iucv.c                                 |   2 +
 net/kcm/kcmsock.c                                  |   3 +
 net/key/af_key.c                                   |  52 ++-
 net/mpls/af_mpls.c                                 |   2 +
 net/mptcp/pm_netlink.c                             |  30 +-
 net/mptcp/subflow.c                                |   6 +-
 net/mptcp/syncookies.c                             |   1 +
 net/netfilter/Kconfig                              |   2 +-
 net/netfilter/ipvs/ip_vs_ftp.c                     |  10 +-
 net/netfilter/nf_nat_sip.c                         |   5 +
 net/netfilter/nf_queue.c                           |  16 +
 net/netfilter/nf_tables_api.c                      |  48 +--
 net/netfilter/nfnetlink_queue.c                    |   3 +
 net/netfilter/xt_cgroup.c                          |  21 +-
 net/netfilter/xt_hl.c                              |  27 ++
 net/nfc/digital_core.c                             |   2 +-
 net/nfc/llcp_core.c                                |  29 +-
 net/nfc/llcp_sock.c                                |  14 +-
 net/nfc/nci/data.c                                 |  10 +-
 net/openvswitch/conntrack.c                        | 130 ++++---
 net/openvswitch/conntrack.h                        |   6 +-
 net/openvswitch/datapath.c                         |  60 +--
 net/openvswitch/datapath.h                         |  26 +-
 net/openvswitch/vport.h                            |   8 +
 net/phonet/pep.c                                   |   2 +-
 net/rds/cong.c                                     |   4 +-
 net/sched/sch_api.c                                |   7 +-
 net/sched/sch_codel.c                              |   2 +-
 net/sched/sch_fq.c                                 |  30 +-
 net/sched/sch_fq_codel.c                           |   6 +-
 net/sched/sch_fq_pie.c                             |   3 +-
 net/sched/sch_generic.c                            |   9 +-
 net/sched/sch_hhf.c                                |   4 +
 net/sched/sch_sfq.c                                |   3 +-
 net/sched/sch_teql.c                               |   1 +
 net/sctp/inqueue.c                                 |   7 +-
 net/sctp/sm_sideeffect.c                           |   4 +
 net/sctp/stream.c                                  |  48 ++-
 net/smc/af_smc.c                                   |   2 +
 net/smc/smc_llc.c                                  |   1 +
 net/sunrpc/auth_gss/auth_gss.c                     |   6 +-
 net/sunrpc/auth_gss/gss_krb5_wrap.c                |  13 +-
 net/sunrpc/auth_gss/gss_rpc_upcall.c               |   6 -
 net/sunrpc/auth_gss/gss_rpc_upcall.h               |   1 -
 net/sunrpc/auth_gss/svcauth_gss.c                  |   3 +-
 net/sunrpc/cache.c                                 |   7 +-
 net/sunrpc/rpcb_clnt.c                             |   4 +
 net/sunrpc/sunrpc_syms.c                           |   1 +
 net/sunrpc/svc.c                                   |  29 +-
 net/sunrpc/xdr.c                                   |   2 +-
 net/vmw_vsock/af_vsock.c                           |   6 +-
 net/vmw_vsock/virtio_transport.c                   |   2 +-
 net/xfrm/xfrm_state.c                              |   3 -
 scripts/tags.sh                                    |   2 +-
 security/apparmor/lib.c                            |  20 +-
 security/selinux/include/security.h                |   4 +-
 security/selinux/selinuxfs.c                       |   7 +-
 security/selinux/ss/services.c                     |  45 ++-
 security/smack/smack.h                             |   7 +-
 security/smack/smack_lsm.c                         |  95 +++--
 security/smack/smackfs.c                           | 222 ++++-------
 sound/core/pcm_native.c                            |   2 +
 sound/drivers/aloop.c                              | 101 +++--
 sound/drivers/mpu401/mpu401.c                      |   6 +
 sound/drivers/mts64.c                              |   6 +
 sound/drivers/portman2x4.c                         |   6 +
 sound/drivers/serial-u16550.c                      |   6 +
 sound/pci/asihpi/hpi6000.c                         |   5 +
 sound/pci/hda/hda_proc.c                           |   2 +-
 sound/pci/via82xx_modem.c                          |  26 +-
 sound/soc/codecs/cs35l33.c                         |  14 +-
 sound/soc/codecs/cs35l34.c                         |  14 +-
 sound/soc/fsl/fsl-asoc-card.c                      |   4 +-
 sound/soc/fsl/mpc5200_psc_i2s.c                    |   1 +
 sound/soc/intel/atom/sst/sst_pci.c                 |   4 +-
 sound/soc/meson/meson-card-utils.c                 |  17 +-
 sound/soc/pxa/pxa-ssp.c                            |   7 +-
 sound/soc/samsung/aries_wm8994.c                   |   1 +
 sound/soc/soc-dapm.c                               |   2 +-
 sound/soc/xilinx/xlnx_formatter_pcm.c              |  14 +-
 sound/usb/6fire/comm.c                             |   9 +-
 sound/usb/bcd2000/bcd2000.c                        |  11 +-
 sound/usb/midi.c                                   |   2 +
 tools/bpf/bpftool/map.c                            |   4 +-
 tools/include/linux/compiler.h                     |   2 +-
 tools/perf/builtin-sched.c                         |  40 +-
 tools/perf/builtin-stat.c                          |  15 +-
 tools/perf/ui/browsers/hists.c                     |   6 +-
 tools/perf/util/auxtrace.c                         |  15 +-
 tools/perf/util/cs-etm.c                           |  81 +++-
 tools/perf/util/dso.c                              |  19 +-
 tools/perf/util/intel-bts.c                        |   2 +-
 tools/perf/util/intel-pt.c                         |   2 +-
 tools/perf/util/machine.c                          |  34 +-
 tools/perf/util/synthetic-events.c                 |   6 +-
 tools/perf/util/thread-stack.c                     |   2 +-
 tools/perf/util/trace-event-read.c                 |  33 +-
 .../selftests/arm64/mte/check_ksm_options.c        |  29 +-
 tools/testing/selftests/bpf/test_sockmap.c         |   3 +-
 .../selftests/rseq/rseq-x86-thread-pointer.h       |   4 +-
 tools/testing/selftests/timers/leap-a-day.c        |  19 +-
 tools/testing/selftests/zram/zram_lib.sh           |   2 +-
 708 files changed, 8383 insertions(+), 4068 deletions(-)

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fedor Pchelkin <[email protected]>

This reverts commit cccef1711efbcdbe999738ac27d37b9ef6271abd which is commit 6bfc8d01ac4068eced509f8fc74d0cd205e4dcec upstream.

The 5.10 backport is incorrect - instead of keyspan_pda_write_start() it touches the wrong function keyspan_pda_write() which now returns an incorrect number of buffered bytes.

It turns out that the proper fix for keyspan_pda_write_start() has been already incorporated into the ported version of upstream commit 034e38e8f687 ("USB: serial: keyspan_pda: add write-fifo support"), for unknown reason.

Other stable kernels, starting with 5.15, got proper backports.

Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

---
 drivers/usb/serial/keyspan_pda.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 21dfd9bdc1504..7141660d5d591 100644
@@ -606,7 +606,7 @@ static int keyspan_pda_write(struct tty_struct *tty, struct usb_serial_port *por
 	if (rc)
 		return rc;
 
-	return 0;
+	return count;
 }
 
 static void keyspan_pda_dtr_rts(struct usb_serial_port *port, int on)

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email protected]>

[ Upstream commit 826af7fa62e347464b1b4e0ba2fe19a92438084f ]

The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers.

For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.

[ Karl Mehltretter: open-coded spin_lock_irqsave() instead of scoped_guard();
used snd_pcm_running() instead of cruntime->state; dropped the access-mode comparison and notification (462494565c27, e299a9fd433f, cdac6e1f7164); kept the stop_count handling from the e5c33cdc6f40 backport. ]

---
 sound/drivers/aloop.c | 99 ++++++++++++++++++++++++++-----------------
 1 file changed, 59 insertions(+), 40 deletions(-)

index 314ced32efbbc..3901f52164933 100644
@@ -323,56 +323,75 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm)
 
 static int loopback_check_format(struct loopback_cable *cable, int stream)
 {
+	struct loopback_pcm *dpcm_play, *dpcm_capt;
 	struct snd_pcm_runtime *runtime, *cruntime;
 	struct loopback_setup *setup;
 	struct snd_card *card;
-	int check;
+	unsigned long flags;
+	bool stop_capture = false;
+	int check, err = 0;
+
+	spin_lock_irqsave(&cable->lock, flags);
+	dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
+	dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE];
 
 	if (cable->valid != CABLE_VALID_BOTH) {
-		if (stream == SNDRV_PCM_STREAM_PLAYBACK)
-			goto __notify;
-		return 0;
-	}
-	runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
-							substream->runtime;
-	cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
-							substream->runtime;
-	check = runtime->format != cruntime->format ||
-		runtime->rate != cruntime->rate ||
-		runtime->channels != cruntime->channels;
-	if (!check)
-		return 0;
-	if (stream == SNDRV_PCM_STREAM_CAPTURE) {
-		return -EIO;
+		if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play)
+			goto unlock;
 	} else {
-		/* close must not free the peer runtime below */
-		atomic_inc(&cable->stop_count);
-		snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
-					substream, SNDRV_PCM_STATE_DRAINING);
-		if (atomic_dec_and_test(&cable->stop_count))
-			wake_up(&cable->stop_wait);
-	      __notify:
-		runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
-							substream->runtime;
-		setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]);
-		card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card;
-		if (setup->format != runtime->format) {
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-							&setup->format_id);
-			setup->format = runtime->format;
+		if (!dpcm_play || !dpcm_capt) {
+			err = -EIO;
+			goto unlock;
 		}
-		if (setup->rate != runtime->rate) {
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-							&setup->rate_id);
-			setup->rate = runtime->rate;
+		runtime = dpcm_play->substream->runtime;
+		cruntime = dpcm_capt->substream->runtime;
+		if (!runtime || !cruntime) {
+			err = -EIO;
+			goto unlock;
 		}
-		if (setup->channels != runtime->channels) {
-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
-							&setup->channels_id);
-			setup->channels = runtime->channels;
+		check = runtime->format != cruntime->format ||
+			runtime->rate != cruntime->rate ||
+			runtime->channels != cruntime->channels;
+		if (!check)
+			goto unlock;
+		if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+			err = -EIO;
+			goto unlock;
+		} else if (snd_pcm_running(dpcm_capt->substream)) {
+			/* close must not free the peer runtime below */
+			atomic_inc(&cable->stop_count);
+			stop_capture = true;
 		}
 	}
-	return 0;
+
+	setup = get_setup(dpcm_play);
+	card = dpcm_play->loopback->card;
+	runtime = dpcm_play->substream->runtime;
+	if (setup->format != runtime->format) {
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &setup->format_id);
+		setup->format = runtime->format;
+	}
+	if (setup->rate != runtime->rate) {
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &setup->rate_id);
+		setup->rate = runtime->rate;
+	}
+	if (setup->channels != runtime->channels) {
+		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+			       &setup->channels_id);
+		setup->channels = runtime->channels;
+	}
+
+unlock:
+	spin_unlock_irqrestore(&cable->lock, flags);
+	if (stop_capture) {
+		snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
+		if (atomic_dec_and_test(&cable->stop_count))
+			wake_up(&cable->stop_wait);
+	}
+
+	return err;
 }
 
 static void loopback_active_notify(struct loopback_pcm *dpcm)

2.53.0

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Felix Yan <[email protected]>

commit d21808328225ab8cee46885bf9a0dffcefbe630e upstream.

sun4i_clkevt_next_event() compensates for the timer stop/start synchronization delay by programming evt - TIMER_SYNC_TICKS into the hardware interval register. The clockevent device currently advertises TIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed to call set_next_event() with evt == TIMER_SYNC_TICKS.

That programs a zero-tick interval. With oneshot/highres/nohz timer operation this can leave the next event stuck, which was observed as a boot hang on Allwinner D1 after the clockevents core started reusing forced minimum-delta events.

Advertise one extra tick instead, so the smallest event accepted by the core still programs at least one hardware tick after the synchronization compensation.

---
 drivers/clocksource/timer-sun4i.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -209,7 +209,7 @@ static int __init sun4i_timer_init(struc
 	sun4i_timer_clear_interrupt(timer_of_base(&to));
 
 	clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
-					TIMER_SYNC_TICKS, 0xffffffff);
+					TIMER_SYNC_TICKS + 1, 0xffffffff);
 
 	/* Enable timer0 interrupt */
 	val = readl(timer_of_base(&to) + TIMER_IRQ_EN_REG);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jérémy Jean <[email protected]>

commit 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 upstream.

On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes.

Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary.

---
 kernel/time/itimer.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -100,7 +100,7 @@ static int do_getitimer(int which, struc
 static int put_itimerval(struct __kernel_old_itimerval __user *o,
 			 const struct itimerspec64 *i)
 {
-	struct __kernel_old_itimerval v;
+	struct __kernel_old_itimerval v = {};
 
 	v.it_interval.tv_sec = i->it_interval.tv_sec;
 	v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jordan R Abrahams-Whitehead <[email protected]>

commit 2780860eddecba9ffe210bb9436eee3cf22bfcdd upstream.

This commit resolves an issue where modpost section verification fails due to section mismatches between list_add and its callers.

At present, list_add (and its internal __list_add) are called from both .text and .init code sections. Since inlining can vary per call site, list_add can be 4 different states:

list_add in text with arguments to non-.init.data values list_add in init with arguments to static .init.data values list_add in init with arguments to non-.init.data values list_add in text with arguments to static .init.data values

It is last instance that ends up causing the section mismatch caused by constant propagation of the address of static libs inside the dir_add as seen below (with the dir_list being defined statically in initramfs.c, resting in .init.data).

WARNING: modpost: vmlinux.o: section mismatch in reference: __list_add (section: .text.unlikely.) -> dir_list (section: .init.data)

Because of these section matching requirements, semantically, __list_add and list_add MUST be inlined. This will then ensure callers inside .init will receive a list_add that exists and refers to only .init data, and list_add code in .text sections will only refer to non-init data.

This issue manifests predominently in AutoFDO with clang, which is very hesitant to inline cold functions such as list_add even when marked inline. Marking them as __always_inline therefore matches the existing semantic constraints imposed by modpost's section mismatch checks.

---
 include/linux/list.h |   15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

@@ -59,10 +59,13 @@ static inline bool __list_del_entry_vali
  *
  * This is only for internal list manipulation where we know
  * the prev/next entries already!
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
  */
-static inline void __list_add(struct list_head *new,
-			      struct list_head *prev,
-			      struct list_head *next)
+static __always_inline void __list_add(struct list_head *new,
+				       struct list_head *prev,
+				       struct list_head *next)
 {
 	if (!__list_add_valid(new, prev, next))
 		return;

@@ -80,8 +83,12 @@ static inline void __list_add(struct lis
  *
  * Insert a new entry after the specified head.
  * This is good for implementing stacks.
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
  */
-static inline void list_add(struct list_head *new, struct list_head *head)
+static __always_inline void list_add(struct list_head *new,
+				     struct list_head *head)
 {
 	__list_add(new, head, head->next);
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Breno Leitao <[email protected]>

commit 25f52e81216884a7444bf07a606691feb09a94e3 upstream.

I am seeing some rcu_tasks stalls in the Meta fleet during reclaim.

  INFO: rcu_tasks detected stalls on tasks:
	0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8
	task:GlobalCPUThread state:R  running task  pid:2552016 tgid:2524552
  Call Trace:
   shrink_lruvec
   mem_cgroup_iter
   shrink_node
   do_try_to_free_pages
   try_to_free_pages
   __alloc_frozen_pages_noprof
   alloc_pages_noprof
   pte_alloc_one
   __pte_alloc
   handle_mm_fault

Nothing promises direct reclaim returns in bounded time, and the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent state, so the reclaiming task never reports one and becomes a holdout.

Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent state even when cond_resched() does nothing.

PS: This has been discussed in [1]

---
 mm/vmscan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2484,7 +2484,7 @@ static void shrink_lruvec(struct lruvec
 			}
 		}
 
-		cond_resched();
+		cond_resched_tasks_rcu_qs();
 
 		if (nr_reclaimed < nr_to_reclaim || proportional_reclaim)
 			continue;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guopeng Zhang <[email protected]>

commit 9477820c63cbf4d97114238f3d1ff10dfd6bee3f upstream.

kernfs serializes file operations only per open file, so separate open files can update the same memory.high or memory.max file concurrently. Both handlers store the new limit before synchronous reclaim, but continue to use the writer's local target in the reclaim loop. If another writer raises or removes the limit, the first writer can continue reclaiming toward a stale target.

For memory.max, this can leave the writer looping indefinitely once reclaim retries are exhausted. The OOM path sees sufficient margin under the current limit and returns true without killing, while the writer still compares usage against its stale target and records another OOM event.

Check the current limit at the start of each reclaim iteration and stop if it no longer matches the writer's target.

Reproducer:

Populate a cgroup with anonymous memory and disable swapping. Lower memory.max from one open file, then restore it to "max" through another open file after the new limit becomes visible.

Without the patch, the first writer remains blocked and repeatedly increments the OOM event counter. With the patch, it returns normally.

This was not motivated by a reported production workload. We found it through automated randomized testing for our cgroup observability work and reduced it to the reproducer above.

---
 mm/memcontrol.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -6363,6 +6363,9 @@ static ssize_t memory_high_write(struct
 		unsigned long nr_pages = page_counter_read(&memcg->memory);
 		unsigned long reclaimed;
 
+		if (high != READ_ONCE(memcg->memory.high))
+			break;
+
 		if (nr_pages <= high)
 			break;
 

@@ -6411,6 +6414,9 @@ static ssize_t memory_max_write(struct k
 	for (;;) {
 		unsigned long nr_pages = page_counter_read(&memcg->memory);
 
+		if (max != READ_ONCE(memcg->memory.max))
+			break;
+
 		if (nr_pages <= max)
 			break;
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joy H.J. Lee <[email protected]>

commit 8700a4761beb219873956666cf91776a2c61e698 upstream.

glibc 2.42 added __attribute_const__ to sys/cdefs.h:

    # define __attribute_const__ __attribute__ ((__const__))

GCC 15 warns when a macro is redefined to a different replacement list (-Wbuiltin-macro-redefined). Since host tool Makefiles (resolve_btfids, objtool) pass -Werror, this conflict becomes fatal.

The warning is suppressed on standard native builds because GCC treats /usr/include as a system header path (-isystem), and macro-redefinition warnings from system headers are silently suppressed by GCC. It fires when glibc headers are on a regular include path (-I) instead, which is the case in cross-compilation setups such as NixOS, where the sysroot's glibc is passed explicitly via -I rather than -isystem.

Per (C11 6.10.3), identical replacement lists are accepted silently. Match the glibc definition exactly, including the space before "((", so the redefinition is accepted without warning regardless of whether glibc headers are treated as system or non-system includes.

---
 tools/include/linux/compiler.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -69,7 +69,7 @@
 #define __read_mostly
 
 #ifndef __attribute_const__
-# define __attribute_const__
+# define __attribute_const__ __attribute__ ((__const__))
 #endif
 
 #ifndef __maybe_unused

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kiryl Shutsemau (Meta) <[email protected]>

commit 1fe104b048d77d6cb25bd938e6a67450fb50e61d upstream.

KVM's instruction emulator has a small helper, assign_register(), that writes a value into a register following the x86 rules for writes to general-purpose registers: an 8- or 16-bit write leaves the rest of the register untouched, a 32-bit write zero-extends the result to 64 bits, and a 64-bit write replaces the whole register.

The TDX guest #VE handler needs the same logic for port I/O emulation to get 32-bit zero-extension right. Rather than add a third copy of the same switch, move the helper verbatim to <asm/insn-eval.h>, rename it to insn_assign_reg(), and route KVM's callers through it.

Add <asm/insn.h> to the header's includes so it builds standalone in callers that have not pulled it in transitively.

No functional change.

---
 arch/x86/include/asm/insn-eval.h |   36 ++++++++++++++++++++++++++++++++++++
 arch/x86/kvm/emulate.c           |   26 ++++----------------------
 2 files changed, 40 insertions(+), 22 deletions(-)

@@ -9,6 +9,7 @@
 #include <linux/compiler.h>
 #include <linux/bug.h>
 #include <linux/err.h>
+#include <asm/insn.h>
 #include <asm/ptrace.h>
 
 #define INSN_CODE_SEG_ADDR_SZ(params) ((params >> 4) & 0xf)

@@ -29,4 +30,39 @@ int insn_fetch_from_user_inatomic(struct
 bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
 			   unsigned char buf[MAX_INSN_SIZE], int buf_size);
 
+/*
+ * Write @val into *@reg following the x86 rules for writes to
+ * general-purpose registers (Intel SDM Vol. 1, "General-Purpose
+ * Registers in 64-Bit Mode"): an 8- or 16-bit write leaves the rest of
+ * the register untouched, a 32-bit write zero-extends the result into
+ * the upper 32 bits, and a 64-bit write replaces the whole register.
+ *
+ * @bytes is the width of the write, not a property of the instruction:
+ * an instruction that, say, sign-extends a 32-bit immediate into a
+ * 64-bit register does a 64-bit write here.
+ *
+ * @reg need not be 8-byte aligned: KVM's instruction emulator offsets
+ * the pointer by one byte to address the high-byte registers (AH, CH,
+ * DH, BH).  Use narrow stores for the sub-word cases so the access
+ * width matches @bytes and the adjacent bytes are left alone.
+ */
+static inline void insn_assign_reg(unsigned long *reg, u64 val, int bytes)
+{
+	switch (bytes) {
+	case 1:
+		*(u8 *)reg = (u8)val;
+		break;
+	case 2:
+		*(u16 *)reg = (u16)val;
+		break;
+	case 4:
+		/* A 32-bit write zero-extends into the upper 32 bits. */
+		*reg = (u32)val;
+		break;
+	case 8:
+		*reg = val;
+		break;
+	}
+}
+
 #endif /* _ASM_X86_INSN_EVAL_H */

@@ -24,6 +24,7 @@
 #include <linux/stringify.h>
 #include <asm/fpu/api.h>
 #include <asm/debugreg.h>
+#include <asm/insn-eval.h>
 #include <asm/nospec-branch.h>
 
 #include "x86.h"

@@ -526,25 +527,6 @@ static void assign_masked(ulong *dest, u
 	*dest = (*dest & ~mask) | (src & mask);
 }
 
-static void assign_register(unsigned long *reg, u64 val, int bytes)
-{
-	/* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
-	switch (bytes) {
-	case 1:
-		*(u8 *)reg = (u8)val;
-		break;
-	case 2:
-		*(u16 *)reg = (u16)val;
-		break;
-	case 4:
-		*reg = (u32)val;
-		break;	/* 64b: zero-extend */
-	case 8:
-		*reg = val;
-		break;
-	}
-}
-
 static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
 {
 	return (1UL << (ctxt->ad_bytes << 3)) - 1;

@@ -592,7 +574,7 @@ register_address_increment(struct x86_em
 {
 	ulong *preg = reg_rmw(ctxt, reg);
 
-	assign_register(preg, *preg + inc, ctxt->ad_bytes);
+	insn_assign_reg(preg, *preg + inc, ctxt->ad_bytes);
 }
 
 static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)

@@ -1884,7 +1866,7 @@ static int load_segment_descriptor(struc
 
 static void write_register_operand(struct operand *op)
 {
-	return assign_register(op->addr.reg, op->val, op->bytes);
+	return insn_assign_reg(op->addr.reg, op->val, op->bytes);
 }
 
 static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)

@@ -2118,7 +2100,7 @@ static int em_popa(struct x86_emulate_ct
 		rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
 		if (rc != X86EMUL_CONTINUE)
 			break;
-		assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
+		insn_assign_reg(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
 		--reg;
 	}
 	return rc;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hui Su <[email protected]>

commit 649bc7df3e5d7be6f7996a95084037dbf3cad1e5 upstream.

event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel.

Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

---
 kernel/trace/trace_events.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -3603,6 +3603,8 @@ static __init void event_test_stuff(void
 	struct task_struct *test_thread;
 
 	test_thread = kthread_run(event_test_thread, NULL, "test-events");
+	if (WARN_ON(IS_ERR(test_thread)))
+		return;
 	msleep(1);
 	kthread_stop(test_thread);
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email protected]>

commit bd0abfe6b013aeb2a1aebc5fbc7ceeb50355bda3 upstream.

Platform devices created with platform_device_alloc() call platform_device_release() when the last reference to the device's kobject is dropped. This function calls of_node_put() unconditionally. This works fine for devices created with platform_device_register_full() but users of the split approach (platform_device_alloc() + platform_device_add()) must bump the reference of the of_node they assign manually. Add the missing call to of_node_get().

---
 arch/powerpc/platforms/powermac/low_i2c.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1501,7 +1501,7 @@ static int __init pmac_i2c_create_platfo
 		if (bus->platform_dev == NULL)
 			return -ENOMEM;
 		bus->platform_dev->dev.platform_data = bus;
-		bus->platform_dev->dev.of_node = bus->busnode;
+		bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
 		platform_device_add(bus->platform_dev);
 	}
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: James Kim <[email protected]>

commit 5cbef379a94b161726c5f504598bf4791d45cedc upstream.

dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.

Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device interface.

---
 drivers/rapidio/devices/rio_mport_cdev.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

@@ -582,9 +582,13 @@ static void dma_req_free(struct kref *re
 	}
 
 	if (req->map) {
-		mutex_lock(&req->map->md->buf_mutex);
-		kref_put(&req->map->ref, mport_release_mapping);
-		mutex_unlock(&req->map->md->buf_mutex);
+		struct rio_mport_mapping *map = req->map;
+		struct mport_dev *md = map->md;
+
+		mutex_lock(&md->buf_mutex);
+		req->map = NULL;
+		kref_put(&map->ref, mport_release_mapping);
+		mutex_unlock(&md->buf_mutex);
 	}
 
 	kref_put(&priv->dma_ref, mport_release_dma);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hans Verkuil <[email protected]>

commit e7600f5cee5de14065f950807931d6e6d40fb2d7 upstream.

This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.

The intentions of that patch were good, but it doesn't work.

The idea is that if device_register fails, you have to do a put_device to let the ref counter release resources.

However, the V4L2 API says that if video_register_device() fails, then you have to call video_device_release(), which kfree()s the video_device struct.

But the put_device() will already have freed the struct, so you end up in a double-free scenario.

There is not really a good way of fixing this without breaking video_register_device() into two parts, one that initializes everything, and one that does the actual device_register, and then converting all V4L2 drivers to this new model.

That is a massive job, and it is very unlikely that device_register will fail.

So rather than ending up in a double-free scenario, just revert this patch, and in that case we'll have a small memory leak. Which is a lot more robust.

---
 drivers/media/v4l2-core/v4l2-dev.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

@@ -1029,25 +1029,25 @@ int __video_register_device(struct video
 	vdev->dev.class = &video_class;
 	vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
 	vdev->dev.parent = vdev->dev_parent;
-	vdev->dev.release = v4l2_device_release;
 	dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
-
-	/* Increase v4l2_device refcount */
-	v4l2_device_get(vdev->v4l2_dev);
-
 	mutex_lock(&videodev_lock);
 	ret = device_register(&vdev->dev);
 	if (ret < 0) {
 		mutex_unlock(&videodev_lock);
 		pr_err("%s: device_register failed\n", __func__);
-		put_device(&vdev->dev);
-		return ret;
+		goto cleanup;
 	}
+	/* Register the release callback that will be called when the last
+	   reference to the device goes away. */
+	vdev->dev.release = v4l2_device_release;
 
 	if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
 		pr_warn("%s: requested %s%d, got %s\n", __func__,
 			name_base, nr, video_device_node_name(vdev));
 
+	/* Increase v4l2_device refcount */
+	v4l2_device_get(vdev->v4l2_dev);
+
 	/* Part 5: Register the entity. */
 	ret = video_register_media_controller(vdev);
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hao-Qun Huang <[email protected]>

commit 6d45195a9626d8aaaaed212c55638829a9c624a3 upstream.

__gb_hid_output_raw_report() stores the result of gb_hid_set_report() in ret and even adjusts it to account for the report ID byte, but then always returns 0.

This hides Greybus transport errors from HID_REQ_SET_REPORT callers, and makes hidraw report zero bytes written to user space on success, although hid_hw_raw_request() is expected to return the number of bytes transferred or a negative errno. The sibling GET_REPORT path, __gb_hid_get_raw_report(), already follows this convention.

Return ret like the other HID transport drivers do.

---
 drivers/staging/greybus/hid.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -256,7 +256,7 @@ static int __gb_hid_output_raw_report(st
 	if (report_id && ret >= 0)
 		ret++; /* add report_id to the number of transfered bytes */
 
-	return 0;
+	return ret;
 }
 
 static int gb_hid_raw_request(struct hid_device *hid, unsigned char reportnum,

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 80574c40598aedbc1751c528e414d7e224bc6313 upstream.

A recent change enabling compile testing of a Freescale dual-role controller indirectly enabled a USB PHY driver to be built. That driver in turn is missing a bunch of static keywords which results in warnings like:

drivers/usb/phy/phy-fsl-usb.c:105:5: error: no previous prototype for 'write_ulpi' [-Werror=missing-prototypes]
105 | int write_ulpi(u8 addr, u8 data)

        |     ^~~~~~~~~~

which consequently breaks -Werror builds.

Add the missing static keywords.

---
 drivers/usb/phy/phy-fsl-usb.c |   52 +++++++++++++++++++++---------------------
 drivers/usb/phy/phy-fsl-usb.h |    6 ++--
 2 files changed, 29 insertions(+), 29 deletions(-)

@@ -45,7 +45,7 @@
 
 static const char driver_name[] = "fsl-usb2-otg";
 
-const pm_message_t otg_suspend_state = {
+static const pm_message_t otg_suspend_state = {
 	.event = 1,
 };
 

@@ -56,11 +56,11 @@ static struct fsl_otg *fsl_otg_dev;
 static int srp_wait_done;
 
 /* FSM timers */
-struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
+static struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
 	*b_ase0_brst_tmr, *b_se0_srp_tmr;
 
 /* Driver specific timers */
-struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
+static struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
 	*b_srp_wait_tmr, *a_wait_enum_tmr;
 
 static struct list_head active_timers;

@@ -101,7 +101,7 @@ static void (*_fsl_writel)(u32 v, unsign
 #define fsl_writel(val, addr)	writel(val, addr)
 #endif /* CONFIG_PPC32 */
 
-int write_ulpi(u8 addr, u8 data)
+static int write_ulpi(u8 addr, u8 data)
 {
 	u32 temp;
 

@@ -114,7 +114,7 @@ int write_ulpi(u8 addr, u8 data)
 /* Operations that will be called from OTG Finite State Machine */
 
 /* Charge vbus for vbus pulsing in SRP */
-void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
 {
 	u32 tmp;
 

@@ -132,7 +132,7 @@ void fsl_otg_chrg_vbus(struct otg_fsm *f
 }
 
 /* Discharge vbus through a resistor to ground */
-void fsl_otg_dischrg_vbus(int on)
+static void fsl_otg_dischrg_vbus(int on)
 {
 	u32 tmp;
 

@@ -150,7 +150,7 @@ void fsl_otg_dischrg_vbus(int on)
 }
 
 /* A-device driver vbus, controlled through PP bit in PORTSC */
-void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
 {
 	u32 tmp;
 

@@ -168,7 +168,7 @@ void fsl_otg_drv_vbus(struct otg_fsm *fs
  * Pull-up D+, signalling connect by periperal. Also used in
  * data-line pulsing in SRP
  */
-void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
 {
 	u32 tmp;
 

@@ -187,7 +187,7 @@ void fsl_otg_loc_conn(struct otg_fsm *fs
  * port.  In host mode, controller will automatically send SOF.
  * Suspend will block the data on the port.
  */
-void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
 {
 	u32 tmp;
 

@@ -202,7 +202,7 @@ void fsl_otg_loc_sof(struct otg_fsm *fsm
 }
 
 /* Start SRP pulsing by data-line pulsing, followed with v-bus pulsing. */
-void fsl_otg_start_pulse(struct otg_fsm *fsm)
+static void fsl_otg_start_pulse(struct otg_fsm *fsm)
 {
 	u32 tmp;
 

@@ -218,7 +218,7 @@ void fsl_otg_start_pulse(struct otg_fsm
 	fsl_otg_add_timer(fsm, b_data_pulse_tmr);
 }
 
-void b_data_pulse_end(unsigned long foo)
+static void b_data_pulse_end(unsigned long foo)
 {
 #ifdef HA_DATA_PULSE
 #else

@@ -229,7 +229,7 @@ void b_data_pulse_end(unsigned long foo)
 	fsl_otg_pulse_vbus();
 }
 
-void fsl_otg_pulse_vbus(void)
+static void fsl_otg_pulse_vbus(void)
 {
 	srp_wait_done = 0;
 	fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 1);

@@ -237,7 +237,7 @@ void fsl_otg_pulse_vbus(void)
 	fsl_otg_add_timer(&fsl_otg_dev->fsm, b_vbus_pulse_tmr);
 }
 
-void b_vbus_pulse_end(unsigned long foo)
+static void b_vbus_pulse_end(unsigned long foo)
 {
 	fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 0);
 

@@ -250,7 +250,7 @@ void b_vbus_pulse_end(unsigned long foo)
 	fsl_otg_add_timer(&fsl_otg_dev->fsm, b_srp_wait_tmr);
 }
 
-void b_srp_end(unsigned long foo)
+static void b_srp_end(unsigned long foo)
 {
 	fsl_otg_dischrg_vbus(0);
 	srp_wait_done = 1;

@@ -265,7 +265,7 @@ void b_srp_end(unsigned long foo)
  * a_host will start by SRP.  It needs to set b_hnp_enable before
  * actually suspending to start HNP
  */
-void a_wait_enum(unsigned long foo)
+static void a_wait_enum(unsigned long foo)
 {
 	VDBG("a_wait_enum timeout\n");
 	if (!fsl_otg_dev->phy.otg->host->b_hnp_enable)

@@ -275,13 +275,13 @@ void a_wait_enum(unsigned long foo)
 }
 
 /* The timeout callback function to set time out bit */
-void set_tmout(unsigned long indicator)
+static void set_tmout(unsigned long indicator)
 {
 	*(int *)indicator = 1;
 }
 
 /* Initialize timers */
-int fsl_otg_init_timers(struct otg_fsm *fsm)
+static int fsl_otg_init_timers(struct otg_fsm *fsm)
 {
 	/* FSM used timers */
 	a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,

@@ -338,7 +338,7 @@ int fsl_otg_init_timers(struct otg_fsm *
 }
 
 /* Uninitialize timers */
-void fsl_otg_uninit_timers(void)
+static void fsl_otg_uninit_timers(void)
 {
 	/* FSM used timers */
 	kfree(a_wait_vrise_tmr);

@@ -390,7 +390,7 @@ static struct fsl_otg_timer *fsl_otg_get
 }
 
 /* Add timer to timer list */
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
 {
 	struct fsl_otg_timer *timer = gtimer;
 	struct fsl_otg_timer *tmp_timer;

@@ -420,7 +420,7 @@ static void fsl_otg_fsm_add_timer(struct
 }
 
 /* Remove timer from the timer list; clear timeout status */
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
 {
 	struct fsl_otg_timer *timer = gtimer;
 	struct fsl_otg_timer *tmp_timer, *del_tmp;

@@ -442,7 +442,7 @@ static void fsl_otg_fsm_del_timer(struct
 }
 
 /* Reset controller, not reset the bus */
-void otg_reset_controller(void)
+static void otg_reset_controller(void)
 {
 	u32 command;
 

@@ -454,7 +454,7 @@ void otg_reset_controller(void)
 }
 
 /* Call suspend/resume routines in host driver */
-int fsl_otg_start_host(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_host(struct otg_fsm *fsm, int on)
 {
 	struct usb_otg *otg = fsm->otg;
 	struct device *dev;

@@ -521,7 +521,7 @@ end:
  * Call suspend and resume function in udc driver
  * to stop and start udc driver.
  */
-int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
 {
 	struct usb_otg *otg = fsm->otg;
 	struct device *dev;

@@ -703,7 +703,7 @@ static int fsl_otg_start_hnp(struct usb_
  * intact.  It needs to have knowledge of some USB interrupts
  * such as port change.
  */
-irqreturn_t fsl_otg_isr(int irq, void *dev_id)
+static irqreturn_t fsl_otg_isr(int irq, void *dev_id)
 {
 	struct otg_fsm *fsm = &((struct fsl_otg *)dev_id)->fsm;
 	struct usb_otg *otg = ((struct fsl_otg *)dev_id)->phy.otg;

@@ -829,7 +829,7 @@ err:
 }
 
 /* OTG Initialization */
-int usb_otg_start(struct platform_device *pdev)
+static int usb_otg_start(struct platform_device *pdev)
 {
 	struct fsl_otg *p_otg;
 	struct usb_phy *otg_trans = usb_get_phy(USB_PHY_TYPE_USB2);

@@ -1002,7 +1002,7 @@ static int fsl_otg_remove(struct platfor
 	return 0;
 }
 
-struct platform_driver fsl_otg_driver = {
+static struct platform_driver fsl_otg_driver = {
 	.probe = fsl_otg_probe,
 	.remove = fsl_otg_remove,
 	.driver = {

@@ -373,6 +373,6 @@ struct fsl_otg_config {
 
 #define FSL_OTG_NAME		"fsl-usb2-otg"
 
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_pulse_vbus(void);
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_pulse_vbus(void);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Myeonghun Pak <[email protected]>

commit 886338ea7d40e4ba5123c58204d7f7e53d825825 upstream.

When the referenced extcon device has not registered yet, extcon_get_edev_by_phandle() returns -EPROBE_DEFER after the driver has initialized and powered on the PHY. The direct return bypasses the common cleanup path and leaves both operations unbalanced.

Store the lookup error first and route deferred probing through exit_phy, while retaining the existing behavior of suppressing the error message for deferral.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

---
 drivers/usb/gadget/udc/snps_udc_plat.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

@@ -161,10 +161,9 @@ static int udc_plat_probe(struct platfor
 	if (of_get_property(dev->of_node, "extcon", NULL)) {
 		udc->edev = extcon_get_edev_by_phandle(dev, 0);
 		if (IS_ERR(udc->edev)) {
-			if (PTR_ERR(udc->edev) == -EPROBE_DEFER)
-				return -EPROBE_DEFER;
-			dev_err(dev, "Invalid or missing extcon\n");
 			ret = PTR_ERR(udc->edev);
+			if (ret != -EPROBE_DEFER)
+				dev_err(dev, "Invalid or missing extcon\n");
 			goto exit_phy;
 		}
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yun Zhou <[email protected]>

commit 9dbf74f4022f80f7669d2b3c22c5deb46c1b5674 upstream.

usbg_make_tpg() held dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependency with configfs_rmdir():

dep_lock -> configfs root inode lock -> su_mutex -> dep_lock

In usbg_make_tpg(), dep_lock only serialized the read of opts->ready, which is a monotonic flag that transitions from false to true exactly once (in tcm_set_name()) and never reverts. Remove dep_lock from usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access opts->ready locklessly instead.

---
 drivers/usb/gadget/function/f_tcm.c |   23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

@@ -1358,19 +1358,25 @@ static struct se_portal_group *usbg_make
 
 	opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
 		func_inst);
-	mutex_lock(&opts->dep_lock);
-	if (!opts->ready)
-		goto unlock_dep;
+	if (!READ_ONCE(opts->ready))
+		goto unlock_inst;
 
 	if (opts->has_dep) {
 		if (!try_module_get(opts->dependent))
-			goto unlock_dep;
+			goto unlock_inst;
 	} else {
+		/*
+		 * configfs_depend_item_unlocked() may acquire the configfs
+		 * root inode lock when the target belongs to a different
+		 * subsystem. Calling it under dep_lock would create a
+		 * circular dependency:
+		 *   dep_lock -> configfs inode lock -> su_mutex -> dep_lock
+		 */
 		ret = configfs_depend_item_unlocked(
 			wwn->wwn_group.cg_subsys,
 			&opts->func_inst.group.cg_item);
 		if (ret)
-			goto unlock_dep;
+			goto unlock_inst;
 	}
 
 	tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);

@@ -1396,7 +1402,6 @@ static struct se_portal_group *usbg_make
 
 	tpg_instances[i].tpg = tpg;
 	tpg->fi = tpg_instances[i].func_inst;
-	mutex_unlock(&opts->dep_lock);
 	mutex_unlock(&tpg_instances_lock);
 	return &tpg->se_tpg;
 

@@ -1409,8 +1414,6 @@ unref_dep:
 		module_put(opts->dependent);
 	else
 		configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
-unlock_dep:
-	mutex_unlock(&opts->dep_lock);
 unlock_inst:
 	mutex_unlock(&tpg_instances_lock);
 

@@ -2368,9 +2371,7 @@ static int tcm_set_name(struct usb_funct
 
 	pr_debug("tcm: Activating %s\n", name);
 
-	mutex_lock(&opts->dep_lock);
-	opts->ready = true;
-	mutex_unlock(&opts->dep_lock);
+	WRITE_ONCE(opts->ready, true);
 
 	return 0;
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jeffin Philip <[email protected]>

commit bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc upstream.

In uvc_function_bind() error path, we use usb_ep_free_request which uses uvc->control_req but does not set it to NULL afterwards. Thus, uvc->control_req is a dangling pointer causing a UAF. Also we do not set the uvc->control_buf pointer to NULL after freeing it, which is another dangling pointer. Fix it by setting uvc->control_req to NULL after we run usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the same for uvc_function_unbind().

---
 drivers/usb/gadget/function/f_uvc.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -780,9 +780,12 @@ uvc_function_bind(struct usb_configurati
 v4l2_error:
 	v4l2_device_unregister(&uvc->v4l2_dev);
 error:
-	if (uvc->control_req)
+	if (uvc->control_req) {
 		usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+		uvc->control_req = NULL;
+	}
 	kfree(uvc->control_buf);
+	uvc->control_buf = NULL;
 
 	usb_free_all_descriptors(f);
 	return ret;

@@ -957,7 +960,9 @@ static void uvc_function_unbind(struct u
 	uvc->vdev_release_done = NULL;
 
 	usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+	uvc->control_req = NULL;
 	kfree(uvc->control_buf);
+	uvc->control_buf = NULL;
 
 	usb_free_all_descriptors(f);
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Neill Kapron <[email protected]>

commit 569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082 upstream.

Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls wait_event_interruptible_exclusive_locked_irq() with the mutex still held. The wait macro deliberately drops the waitqueue spinlock before sleeping but does not drop the mutex.

If a userspace daemon is polling ep0 via read() and the gadget is asynchronously torn down via configfs (e.g., echo "" > UDC), a deadlock can occur:

1. The configfs teardown calls functionfs_unbind(), which queues a FUNCTIONFS_UNBIND event.
2. The daemon wakes up, consumes the event, and drops the mutex.
3. However, if the daemon loops and immediately issues another read() before exiting, it reacquires ffs->mutex and again goes into an interruptible sleep.
4. Meanwhile, functionfs_unbind() continues execution and attempts to acquire ffs->mutex to tear down ep0req.
5. The kernel deadlocks because the configfs thread is stuck in an uninterruptible sleep waiting for the mutex, while the userspace daemon is in an interruptible sleep holding the mutex forever because no more events will arrive.

To fix this, we drop both the waitqueue spinlock and ffs->mutex before going to sleep, and use wait_event_interruptible_exclusive() instead. Upon waking up, we jump back to the retry label to safely reacquire the mutex and re-evaluate the state machine. By not sleeping with ffs->mutex held, we natively decouple gadget teardowns (which require the mutex) from userspace polling.

---
 drivers/usb/gadget/function/f_fs.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

@@ -518,6 +518,7 @@ static ssize_t ffs_ep0_read(struct file
 	if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
 		return -EIDRM;
 
+retry:
 	/* Acquire mutex */
 	ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
 	if (unlikely(ret < 0))

@@ -552,10 +553,15 @@ static ssize_t ffs_ep0_read(struct file
 			break;
 		}
 
-		if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
-							ffs->ev.count)) {
-			ret = -EINTR;
-			break;
+		if (!ffs->ev.count) {
+			spin_unlock_irq(&ffs->ev.waitq.lock);
+			mutex_unlock(&ffs->mutex);
+
+			if (wait_event_interruptible_exclusive(ffs->ev.waitq,
+							       ffs->ev.count))
+				return -EINTR;
+
+			goto retry;
 		}
 
 		/* unlocks spinlock */

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daisuke Matsuda <[email protected]>

commit 9da70a43b5fea60d758137f7f0ccfe19356cb5bb upstream.

The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault.

Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.

---
 drivers/fpga/altera-cvp.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/sizes.h>
+#include <linux/string.h>
 
 #define CVP_BAR		0	/* BAR used for data transfer in memory mode */
 #define CVP_DUMMY_WR	244	/* dummy writes to clear CvP state machine */

@@ -265,7 +266,7 @@ static int altera_cvp_v2_wait_for_credit
 static int altera_cvp_send_block(struct altera_cvp_conf *conf,
 				 const u32 *data, size_t len)
 {
-	u32 mask, words = len / sizeof(u32);
+	u32 words = len / sizeof(u32);
 	int i, remainder;
 
 	for (i = 0; i < words; i++)

@@ -274,9 +275,10 @@ static int altera_cvp_send_block(struct
 	/* write up to 3 trailing bytes, if any */
 	remainder = len % sizeof(u32);
 	if (remainder) {
-		mask = BIT(remainder * 8) - 1;
-		if (mask)
-			conf->write_data(conf, *data & mask);
+		u32 word = 0;
+
+		memcpy(&word, data, remainder);
+		conf->write_data(conf, word);
 	}
 
 	return 0;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xingrui Li <[email protected]>

commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream.

sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write.

HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer.

---
 drivers/hid/hid-sensor-hub.c |   44 +++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

@@ -240,12 +240,17 @@ int sensor_hub_get_feature(struct hid_se
 			   u32 field_index, int buffer_size, void *buffer)
 {
 	struct hid_report *report;
+	struct hid_field *field;
 	struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
-	int report_size;
+	size_t field_size;
+	size_t report_size;
+	size_t copied = 0;
+	size_t to_copy;
 	int ret = 0;
-	u8 *val_ptr;
-	int buffer_index = 0;
-	int i;
+	unsigned int i;
+
+	if (!buffer || buffer_size <= 0)
+		return -EINVAL;
 
 	memset(buffer, 0, buffer_size);
 

@@ -259,26 +264,29 @@ int sensor_hub_get_feature(struct hid_se
 	hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
 	hid_hw_wait(hsdev->hdev);
 
+	field = report->field[field_index];
+
 	/* calculate number of bytes required to read this field */
-	report_size = DIV_ROUND_UP(report->field[field_index]->report_size,
-				   8) *
-				   report->field[field_index]->report_count;
-	if (!report_size) {
+	field_size = DIV_ROUND_UP(field->report_size, 8);
+	/* HID core stores each parsed report value in a __s32 slot. */
+	if (!field_size || field_size > sizeof(field->value[0])) {
+		ret = -EINVAL;
+		goto done_proc;
+	}
+	if (field->report_count > SIZE_MAX / field_size) {
 		ret = -EINVAL;
 		goto done_proc;
 	}
-	ret = min(report_size, buffer_size);
 
-	val_ptr = (u8 *)report->field[field_index]->value;
-	for (i = 0; i < report->field[field_index]->report_count; ++i) {
-		if (buffer_index >= ret)
-			break;
-
-		memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
-		       report->field[field_index]->report_size / 8);
-		val_ptr += sizeof(__s32);
-		buffer_index += (report->field[field_index]->report_size / 8);
+	report_size = field_size * field->report_count;
+	report_size = min_t(size_t, report_size, buffer_size);
+
+	for (i = 0; i < field->report_count && copied < report_size; ++i) {
+		to_copy = min(field_size, report_size - copied);
+		memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy);
+		copied += to_copy;
 	}
+	ret = copied;
 
 done_proc:
 	mutex_unlock(&data->mutex);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Vincent Mailhol <[email protected]>

commit cec0d03fe785380540dc1b4d07c80f67ae2ffc78 upstream.

Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2.

This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().

The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation.

This patch (of 2):

ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit.

Test the length before dereferencing to prevent an off-by-one out-of-bounds read.

---
 lib/ucs2_string.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -8,7 +8,7 @@ ucs2_strnlen(const ucs2_char_t *s, size_
 {
         unsigned long length = 0;
 
-        while (*s++ != 0 && length < maxlength)
+	while (length < maxlength && *s++ != 0)
                 length++;
         return length;
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Weigang He <[email protected]>

commit fb9dda38d4b9e90db07ed9a0ee2d35bf85494035 upstream.

stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index, incrementing it on every RXBR (receive-byte-ready) interrupt without checking it against the buffer size:

	cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;

rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a completed message (RXEND). The number of bytes received before RXEND is decided by the remote CEC device (it sets EOM), not by the driver. A peer that keeps sending bytes without ending the message drives RXBR repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes out of bounds into the surrounding memory. This is reachable in normal operation once the driver has probed and receiving is enabled, from the IRQ thread, without any local privilege.

The length check in the CEC core runs on the consumer side, after the byte has been stored, so it does not prevent the overflow. Bound the index in the driver before the store, as the other platform CEC drivers already do (e.g. tegra_cec), dropping the excess bytes of an overlong frame.

Found by static analysis tool CodeQL.

---
 drivers/media/cec/platform/stm32/stm32-cec.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -133,7 +133,8 @@ static void stm32_rx_done(struct stm32_c
 		u32 val;
 
 		regmap_read(cec->regmap, CEC_RXDR, &val);
-		cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
+		if (cec->rx_msg.len < CEC_MAX_MSG_SIZE)
+			cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
 	}
 
 	if (cec->irq_status & RXEND) {

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Junrui Luo <[email protected]>

commit cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9 upstream.

vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame() encodes one plane per component, and an incompressible plane takes the FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.

For a 4-component pixel format all four planes are full resolution (width_div == height_div == 1), so a frame that forces every plane through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning the plane by coded_w * coded_h, which can result in corruption of adjacent kernel heap memory.

Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest components_num among the supported raw formats, so the capture buffer is always large enough for the unencoded fallback.

---
 drivers/media/test-drivers/vicodec/vicodec-core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -61,11 +61,11 @@ struct pixfmt_info {
 };
 
 static const struct v4l2_fwht_pixfmt_info pixfmt_fwht = {
-	V4L2_PIX_FMT_FWHT, 0, 3, 1, 1, 1, 1, 1, 0, 1
+	V4L2_PIX_FMT_FWHT, 0, 4, 1, 1, 1, 1, 1, 0, 1
 };
 
 static const struct v4l2_fwht_pixfmt_info pixfmt_stateless_fwht = {
-	V4L2_PIX_FMT_FWHT_STATELESS, 0, 3, 1, 1, 1, 1, 1, 0, 1
+	V4L2_PIX_FMT_FWHT_STATELESS, 0, 4, 1, 1, 1, 1, 1, 0, 1
 };
 
 static void vicodec_dev_release(struct device *dev)

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ryusuke Konishi <[email protected]>

commit 45662dedb8f272ef7f16e69f13424c4bd0399240 upstream.

Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs_direct_propagate() during testing.

Analysis revealed that after truncating a file, a node block immediately below the B-tree root was not deleted. Instead, it remained in the B-tree node cache in a dirty state. The log writer subsequently detected this block and incorrectly invoked nilfs_direct_propagate() on it, which is designed to handle only data blocks in direct mapping.

B-tree nodes in the cache are managed by virtual block numbers, and their logical keys typically exceed the range expected by direct mapping. Consequently, processing such a node as a direct mapping entry triggers a slab-out-of-bounds access.

The root cause is that when a B-tree mapping collapses into a direct mapping during truncation, an intermediate node block pointed to by the root node is left behind as garbage instead of being explicitly deleted.

This resolves the issue by adding a nilfs_btree_discard() operation to delete the remaining intermediate node block during the conversion. A 'deform' flag is added to the bop_delete interface to explicitly signal that the deletion is part of a mapping transformation. This allows the B-tree mapping implementation to perform the necessary cleanup and discarding of the residual node structure that would be otherwise be left orphaned after the transition.

---
 fs/nilfs2/bmap.c   |    2 +-
 fs/nilfs2/bmap.h   |    2 +-
 fs/nilfs2/btree.c  |   39 ++++++++++++++++++++++++++++++++-------
 fs/nilfs2/direct.c |    4 ++--
 4 files changed, 36 insertions(+), 11 deletions(-)

@@ -181,7 +181,7 @@ static int nilfs_bmap_do_delete(struct n
 			return ret;
 	}
 
-	return bmap->b_ops->bop_delete(bmap, key);
+	return bmap->b_ops->bop_delete(bmap, key, false);
 }
 
 /**

@@ -50,7 +50,7 @@ struct nilfs_bmap_operations {
 	int (*bop_lookup_contig)(const struct nilfs_bmap *, __u64, __u64 *,
 				 unsigned int);
 	int (*bop_insert)(struct nilfs_bmap *, __u64, __u64);
-	int (*bop_delete)(struct nilfs_bmap *, __u64);
+	int (*bop_delete)(struct nilfs_bmap *bmap, __u64 key, bool deform);
 	void (*bop_clear)(struct nilfs_bmap *);
 
 	int (*bop_propagate)(struct nilfs_bmap *, struct buffer_head *);

@@ -1427,6 +1427,28 @@ static void nilfs_btree_shrink(struct ni
 	path[level].bp_bh = NULL;
 }
 
+/**
+ * nilfs_btree_discard - discard the last node for the mapping transformation
+ * @btree: bmap struct of btree
+ * @path: array of nilfs_btree_path struct
+ * @level: level of the B-tree node being operated on
+ * @keyp: argument for passing a key (unused)
+ * @ptrp: argument for passing a pointer (unused)
+ */
+static void nilfs_btree_discard(struct nilfs_bmap *btree,
+				struct nilfs_btree_path *path, int level,
+				__u64 *keyp, __u64 *ptrp)
+{
+	struct nilfs_btree_node *root = nilfs_btree_get_root(btree);
+
+	nilfs_btree_node_delete(root, 0, NULL, NULL,
+				NILFS_BTREE_ROOT_NCHILDREN_MAX);
+	nilfs_btree_node_set_level(root, level);
+
+	nilfs_btnode_delete(path[level].bp_bh);
+	path[level].bp_bh = NULL;
+}
+
 static void nilfs_btree_nop(struct nilfs_bmap *btree,
 			    struct nilfs_btree_path *path,
 			    int level, __u64 *keyp, __u64 *ptrp)

@@ -1437,7 +1459,7 @@ static int nilfs_btree_prepare_delete(st
 				      struct nilfs_btree_path *path,
 				      int *levelp,
 				      struct nilfs_bmap_stats *stats,
-				      struct inode *dat)
+				      struct inode *dat, bool deform)
 {
 	struct buffer_head *bh;
 	struct nilfs_btree_node *node, *parent, *sib;

@@ -1524,15 +1546,17 @@ static int nilfs_btree_prepare_delete(st
 			if (nilfs_btree_node_get_nchildren(node) - 1 <=
 			    NILFS_BTREE_ROOT_NCHILDREN_MAX) {
 				path[level].bp_op = nilfs_btree_shrink;
-				stats->bs_nblocks += 2;
-				level++;
-				path[level].bp_op = nilfs_btree_nop;
-				goto shrink_root_child;
+			} else if (deform) {
+				path[level].bp_op = nilfs_btree_discard;
 			} else {
 				path[level].bp_op = nilfs_btree_do_delete;
 				stats->bs_nblocks++;
 				goto out;
 			}
+			stats->bs_nblocks += 2;
+			level++;
+			path[level].bp_op = nilfs_btree_nop;
+			goto shrink_root_child;
 		}
 	}
 

@@ -1583,7 +1607,7 @@ static void nilfs_btree_commit_delete(st
 		nilfs_bmap_set_dirty(btree);
 }
 
-static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key)
+static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key, bool deform)
 
 {
 	struct nilfs_btree_path *path;

@@ -1603,7 +1627,8 @@ static int nilfs_btree_delete(struct nil
 
 	dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
 
-	ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat);
+	ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat,
+			deform);
 	if (ret < 0)
 		goto out;
 	nilfs_btree_commit_delete(btree, path, level, dat);

@@ -144,7 +144,7 @@ static int nilfs_direct_insert(struct ni
 	return ret;
 }
 
-static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key)
+static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key, bool deform)
 {
 	union nilfs_bmap_ptr_req req;
 	struct inode *dat;

@@ -234,7 +234,7 @@ int nilfs_direct_delete_and_convert(stru
 	/* no need to allocate any resource for conversion */
 
 	/* delete */
-	ret = bmap->b_ops->bop_delete(bmap, key);
+	ret = bmap->b_ops->bop_delete(bmap, key, true);
 	if (ret < 0)
 		return ret;
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abdurrahman Hussain <[email protected]>

commit 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f upstream.

The stem parser tests isdigit(*(end - 1)) before checking end > start and so reads one byte before the property name when the name is empty or all digits. Check the bound first.

---
 drivers/of/base.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2014,7 +2014,7 @@ void of_alias_scan(void * (*dt_alloc)(u6
 
 		/* walk the alias backwards to extract the id and work out
 		 * the 'stem' string */
-		while (isdigit(*(end-1)) && end > start)
+		while (end > start && isdigit(*(end - 1)))
 			end--;
 		len = end - start;
 

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ibrahim Hashimov <[email protected]>

commit 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf upstream.

ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field before handing the signature payload to verify_pkcs7_signature(), but the check has the wrong sign:

	if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))

The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ, 64 bytes) into the node, so the payload is at most

	snod->len - sizeof(struct ubifs_sig_node)

bytes long. Adding the header size instead of subtracting it accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds -- past the end of c->sbuf, which is vmalloc(c->leb_size). verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder() is then handed that inflated length and reads beyond the allocation while walking the DER headers. The node length comes straight from the mounted image, so a crafted signed UBIFS image reaches this via ubifs_read_superblock() before the signature is cryptographically checked.

snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner (c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected subtraction cannot underflow. Legitimately signed images are unaffected: a correct superblock never declares a signature longer than the node it is embedded in.

---
 fs/ubifs/auth.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -219,7 +219,7 @@ int ubifs_sb_verify_signature(struct ubi
 
 	signode = snod->node;
 
-	if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) {
+	if (le32_to_cpu(signode->len) > snod->len - sizeof(struct ubifs_sig_node)) {
 		ubifs_err(c, "invalid signature len %d", le32_to_cpu(signode->len));
 		err = -EINVAL;
 		goto out_destroy;

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit ed4edddad19babf76b56882ad9600f5646b167a0 upstream.

The NFSv2 ACL GETACL reply is a union that carries file attributes and ACL data only when the status is NFS_OK. All error cases are void results. However, currently the NFSv2 ACL GETACL result encoder decides whether to append the "OK" body by testing only whether the file handle resolved to a positive dentry, not the actual reply status.

A GETACL request that resolves its file handle but then fails for another reason (an unsupported mask value, a getattr failure, or an ACL retrieval error) therefore appends file attributes and ACL data after the error status on the wire. Worse, when the mask is rejected, fh_getattr() hasn't been called at all, so those attributes are serialized from a zero-filled kstat and are junk.

The logic before the xdr_stream conversion used the reply status. Revert to that approach (but keep the xdr_stream conversion in place).

---
 fs/nfsd/nfs2acl.c |   31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

@@ -246,22 +246,21 @@ nfsaclsvc_encode_getaclres(struct svc_rq
 
 	if (!svcxdr_encode_stat(xdr, resp->status))
 		return false;
-
-	if (dentry == NULL || d_really_is_negative(dentry))
-		return true;
-	inode = d_inode(dentry);
-
-	if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
-		return false;
-	if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
-		return false;
-
-	if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
-				   resp->mask & NFS_ACL, 0))
-		return false;
-	if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
-				   resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
-		return false;
+	switch (resp->status) {
+	case nfs_ok:
+		inode = d_inode(dentry);
+		if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
+			return false;
+		if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
+			return false;
+		if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
+					   resp->mask & NFS_ACL, 0))
+			return false;
+		if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
+					   resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
+			return false;
+		break;
+	}
 
 	return true;
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

commit d0728723c80dcb3432effd67c7e919b596004b1d upstream.

nfsd_prune_bucket_locked() evicts an entry before checking the freed count against @max. The check uses "++freed > max", which does not break until freed exceeds max, resulting in max + 1 evictions. Use ">=" so the limit stated in the function comment is honored.

---
 fs/nfsd/nfscache.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -283,7 +283,7 @@ nfsd_prune_bucket_locked(struct nfsd_net
 		nfsd_cacherep_unlink_locked(nn, b, rp);
 		list_add(&rp->c_lru, dispose);
 
-		if (max && ++freed > max)
+		if (max && ++freed >= max)
 			break;
 	}
 }

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Bommarito <[email protected]>

commit 036c1b182f4da65363e79ec0ac276edc6b7296e5 upstream.

nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer.

The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item.

Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.

---
 fs/nfsd/nfs4state.c |   44 +++++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 19 deletions(-)

@@ -6014,30 +6014,36 @@ static void nfsd4_ssc_shutdown_umount(st
 static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
 {
 	bool do_wakeup = false;
-	struct nfsd4_ssc_umount_item *ni = NULL;
-	struct nfsd4_ssc_umount_item *tmp;
+	struct nfsd4_ssc_umount_item *ni;
 
+restart:
 	spin_lock(&nn->nfsd_ssc_lock);
-	list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
-		if (time_after(jiffies, ni->nsui_expire)) {
-			if (refcount_read(&ni->nsui_refcnt) > 1)
-				continue;
+	list_for_each_entry(ni, &nn->nfsd_ssc_mount_list, nsui_list) {
+		if (!time_after(jiffies, ni->nsui_expire))
+			break;
+		if (refcount_read(&ni->nsui_refcnt) > 1)
+			continue;
 
-			/* mark being unmount */
-			ni->nsui_busy = true;
-			spin_unlock(&nn->nfsd_ssc_lock);
-			mntput(ni->nsui_vfsmount);
-			spin_lock(&nn->nfsd_ssc_lock);
+		/* Prevent concurrent setup during unmount */
+		ni->nsui_busy = true;
+		spin_unlock(&nn->nfsd_ssc_lock);
+		mntput(ni->nsui_vfsmount);
+		spin_lock(&nn->nfsd_ssc_lock);
 
-			/* waiters need to start from begin of list */
-			list_del(&ni->nsui_list);
-			kfree(ni);
+		/* Force concurrent scanners to restart */
+		list_del(&ni->nsui_list);
+		kfree(ni);
 
-			/* wakeup ssc_connect waiters */
-			do_wakeup = true;
-			continue;
-		}
-		break;
+		/* wakeup ssc_connect waiters */
+		do_wakeup = true;
+		/*
+		 * Concurrent nfsd4_ssc_cancel_dul() can free any item
+		 * on the list under nfsd_ssc_lock while mntput() runs
+		 * above.  Restart from the head; the list is short and
+		 * the expire worker is periodic, so this is cheap.
+		 */
+		spin_unlock(&nn->nfsd_ssc_lock);
+		goto restart;
 	}
 	if (do_wakeup)
 		wake_up_all(&nn->nfsd_ssc_waitq);

5.10-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <[email protected]>

commit aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e upstream.

The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories") details the assumption that justified adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is invalid (in the case of NFS reexport).

When NFSD exports an NFS filesystem it is very possible for nfsd_mode_check() to encounter a @dentry that doesn't have i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).

So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir return on that branch must stay. It guards the subsequent lookup_one_unlocked() -> __lookup_slow() path, which calls inode->i_op->lookup() with no NULL check, so returning nfserr_notdir is what keeps a client LOOKUP into such a @dentry from dereferencing a NULL method pointer.