5.10.94-rc1 review

From: Thomas Hellström <[email protected]>

commit 95d35838880fb040ccb9fe4a48816bd0c8b62df5 upstream.

If a dma_fence_array is reported signaled by a call to dma_fence_is_signaled(), it may leak the PENDING_ERROR status.

Fix this by clearing the PENDING_ERROR status if we return true in dma_fence_array_signaled().

v2:
- Update Cc list, and add R-b.

---
 drivers/dma-buf/dma-fence-array.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -104,7 +104,11 @@ static bool dma_fence_array_signaled(str
 {
 	struct dma_fence_array *array = to_dma_fence_array(fence);
 
-	return atomic_read(&array->num_pending) <= 0;
+	if (atomic_read(&array->num_pending) > 0)
+		return false;
+
+	dma_fence_array_clear_pending_error(array);
+	return true;
 }
 
 static void dma_fence_array_release(struct dma_fence *fence)

From: Willy Tarreau <[email protected]>

commit ebbe0d8a449d183fa43b42d84fcb248e25303985 upstream.

After re-checking in the spec and comparing stack offsets with glibc, The last pushed argument must be 16-byte aligned (i.e. aligned before the call) so that in the callee esp+4 is multiple of 16, so the principle is the 32-bit equivalent to what Ammar fixed for x86_64. It's possible that 32-bit code using SSE2 or MMX could have been affected. In addition the frame pointer ought to be zero at the deepest level.

---
 tools/include/nolibc/nolibc.h |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

@@ -606,13 +606,21 @@ struct sys_stat_struct {
 })
 
 /* startup code */
+/*
+ * i386 System V ABI mandates:
+ * 1) last pushed argument must be 16-byte aligned.
+ * 2) The deepest stack frame should be set to zero
+ *
+ */
 asm(".section .text\n"
     ".global _start\n"
     "_start:\n"
     "pop %eax\n"                // argc   (first arg, %eax)
     "mov %esp, %ebx\n"          // argv[] (second arg, %ebx)
     "lea 4(%ebx,%eax,4),%ecx\n" // then a NULL then envp (third arg, %ecx)
-    "and $-16, %esp\n"          // x86 ABI : esp must be 16-byte aligned when
+    "xor %ebp, %ebp\n"          // zero the stack frame
+    "and $-16, %esp\n"          // x86 ABI : esp must be 16-byte aligned before
+    "sub $4, %esp\n"            // the call instruction (args are aligned)
     "push %ecx\n"               // push all registers on the stack so that we
     "push %ebx\n"               // support both regparm and plain stack modes
     "push %eax\n"

From: Ammar Faizi <[email protected]>

commit 937ed91c712273131de6d2a02caafd3ee84e0c72 upstream.

Before this patch, the _start function looks like this:

```
0000000000001170 <_start>:
    1170:	pop    %rdi
    1171:	mov    %rsp,%rsi
    1174:	lea    0x8(%rsi,%rdi,8),%rdx
    1179:	and    $0xfffffffffffffff0,%rsp
    117d:	sub    $0x8,%rsp
    1181:	call   1000 <main>
    1186:	movzbq %al,%rdi
    118a:	mov    $0x3c,%rax
    1191:	syscall
    1193:	hlt
    1194:	data16 cs nopw 0x0(%rax,%rax,1)
    119f:	nop
```

Note the "and" to %rsp with $-16, it makes the %rsp be 16-byte aligned, but then there is a "sub" with $0x8 which makes the %rsp no longer 16-byte aligned, then it calls main. That's the bug!

What actually the x86-64 System V ABI mandates is that right before the "call", the %rsp must be 16-byte aligned, not after the "call". So the "sub" with $0x8 here breaks the alignment. Remove it.

An example where this rule matters is when the callee needs to align its stack at 16-byte for aligned move instruction, like movdqa and movaps. If the callee can't align its stack properly, it will result in segmentation fault.

x86-64 System V ABI also mandates the deepest stack frame should be zero. Just to be safe, let's zero the %rbp on startup as the content of %rbp may be unspecified when the program starts. Now it looks like this:

```
0000000000001170 <_start>:
    1170:	pop    %rdi
    1171:	mov    %rsp,%rsi
    1174:	lea    0x8(%rsi,%rdi,8),%rdx
    1179:	xor    %ebp,%ebp                # zero the %rbp
    117b:	and    $0xfffffffffffffff0,%rsp # align the %rsp
    117f:	call   1000 <main>
    1184:	movzbq %al,%rdi
    1188:	mov    $0x3c,%rax
    118f:	syscall
    1191:	hlt
    1192:	data16 cs nopw 0x0(%rax,%rax,1)
    119d:	nopl   (%rax)
```

[wt: I did this on purpose due to a misunderstanding of the spec, other
archs will thus have to be rechecked, particularly i386]

---
 tools/include/nolibc/nolibc.h |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

@@ -422,14 +422,20 @@ struct stat {
 })
 
 /* startup code */
+/*
+ * x86-64 System V ABI mandates:
+ * 1) %rsp must be 16-byte aligned right before the function call.
+ * 2) The deepest stack frame should be zero (the %rbp).
+ *
+ */
 asm(".section .text\n"
     ".global _start\n"
     "_start:\n"
     "pop %rdi\n"                // argc   (first arg, %rdi)
     "mov %rsp, %rsi\n"          // argv[] (second arg, %rsi)
     "lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx)
-    "and $-16, %rsp\n"          // x86 ABI : esp must be 16-byte aligned when
-    "sub $8, %rsp\n"            // entering the callee
+    "xor %ebp, %ebp\n"          // zero the stack frame
+    "and $-16, %rsp\n"          // x86 ABI : esp must be 16-byte aligned before call
     "call main\n"               // main() returns the status code, we'll exit with it.
     "movzb %al, %rdi\n"         // retrieve exit code from 8 lower bits
     "mov $60, %rax\n"           // NR_exit == 60

From: Christophe Leroy <[email protected]>

commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream.

On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA test leads to "Illegal instruction" failure.

Looking at the content of rodata_objcopy.o, we see that the function content zeroes only:

	Disassembly of section .rodata:

	0000000000000000 <.lkdtm_rodata_do_nothing>:
	   0:	00 00 00 00 	.long 0x0

Add the contents flag in order to keep the content of the section while renaming it.

	Disassembly of section .rodata:

	0000000000000000 <.lkdtm_rodata_do_nothing>:
	   0:	4e 80 00 20 	blr

---
 drivers/misc/lkdtm/Makefile |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -16,7 +16,7 @@ KCOV_INSTRUMENT_rodata.o	:= n
 
 OBJCOPYFLAGS :=
 OBJCOPYFLAGS_rodata_objcopy.o	:= \
-			--rename-section .noinstr.text=.rodata,alloc,readonly,load
+			--rename-section .noinstr.text=.rodata,alloc,readonly,load,contents
 targets += rodata.o rodata_objcopy.o
 $(obj)/rodata_objcopy.o: $(obj)/rodata.o FORCE
 	$(call if_changed,objcopy)

From: Jason Gerecke <[email protected]>

commit df03e9bd6d4806619b4cdc91a3d7695818a8e2b7 upstream.

AES hardware may internally re-classify a contact that it thought was intentional as a palm. Intentional contacts are reported as "down" with the confidence bit set. When this re-classification occurs, however, the state transitions to "up" with the confidence bit cleared. This kind of transition appears to be legal according to Microsoft docs, but we do not handle it correctly. Because the confidence bit is clear, we don't call wacom_wac_finger_slot and update userspace. This causes hung touches that confuse userspace and interfere with pen arbitration.

This commit adds a special case to ignore the confidence flag if a contact is reported as removed. This ensures we do not leave a hung touch if one of these re-classification events occured. Ideally we'd have some way to also let userspace know that the touch has been re-classified as a palm and needs to be canceled, but that's not possible right now :)

---
 drivers/hid/wacom_wac.c |   29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

@@ -2566,6 +2566,24 @@ static void wacom_wac_finger_slot(struct
 	}
 }
 
+static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
+{
+	struct input_mt *mt = dev->mt;
+	struct input_mt_slot *s;
+
+	if (!mt)
+		return false;
+
+	for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
+		if (s->key == key &&
+			input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
 static void wacom_wac_finger_event(struct hid_device *hdev,
 		struct hid_field *field, struct hid_usage *usage, __s32 value)
 {

@@ -2613,9 +2631,14 @@ static void wacom_wac_finger_event(struc
 	}
 
 	if (usage->usage_index + 1 == field->report_count) {
-		if (equivalent_usage == wacom_wac->hid_data.last_slot_field &&
-		    wacom_wac->hid_data.confidence)
-			wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+		if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
+			bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
+				wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
+
+			if (wacom_wac->hid_data.confidence || touch_removed) {
+				wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
+			}
+		}
 	}
 }
 

From: Johan Hovold <[email protected]>

commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream.

USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.

Note that the driver was multiplying some of the timeout values with HZ twice resulting in 3000-second timeouts with HZ=1000.

Also note that two of the timeout defines are currently unused.

---
 drivers/media/usb/b2c2/flexcop-usb.c |   10 +++++-----
 drivers/media/usb/b2c2/flexcop-usb.h |   12 ++++++------
 2 files changed, 11 insertions(+), 11 deletions(-)

@@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(stru
 			0,
 			fc_usb->data,
 			sizeof(u32),
-			B2C2_WAIT_FOR_OPERATION_RDW * HZ);
+			B2C2_WAIT_FOR_OPERATION_RDW);
 
 	if (ret != sizeof(u32)) {
 		err("error while %s dword from %d (%d).", read ? "reading" :

@@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(str
 			wIndex,
 			fc_usb->data,
 			buflen,
-			nWaitTime * HZ);
+			nWaitTime);
 	if (ret != buflen)
 		ret = -EIO;
 

@@ -249,13 +249,13 @@ static int flexcop_usb_i2c_req(struct fl
 		/* DKT 020208 - add this to support special case of DiSEqC */
 	case USB_FUNC_I2C_CHECKWRITE:
 		pipe = B2C2_USB_CTRL_PIPE_OUT;
-		nWaitTime = 2;
+		nWaitTime = 2000;
 		request_type |= USB_DIR_OUT;
 		break;
 	case USB_FUNC_I2C_READ:
 	case USB_FUNC_I2C_REPEATREAD:
 		pipe = B2C2_USB_CTRL_PIPE_IN;
-		nWaitTime = 2;
+		nWaitTime = 2000;
 		request_type |= USB_DIR_IN;
 		break;
 	default:

@@ -282,7 +282,7 @@ static int flexcop_usb_i2c_req(struct fl
 			wIndex,
 			fc_usb->data,
 			buflen,
-			nWaitTime * HZ);
+			nWaitTime);
 
 	if (ret != buflen)
 		ret = -EIO;

@@ -91,13 +91,13 @@ typedef enum {
 	UTILITY_SRAM_TESTVERIFY     = 0x16,
 } flexcop_usb_utility_function_t;
 
-#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ)
-#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ)
+#define B2C2_WAIT_FOR_OPERATION_RW 1000
+#define B2C2_WAIT_FOR_OPERATION_RDW 3000
+#define B2C2_WAIT_FOR_OPERATION_WDW 1000
 
-#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ)
-#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ)
+#define B2C2_WAIT_FOR_OPERATION_V8READ 3000
+#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000
+#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000
 
 typedef enum {
 	V8_MEMORY_PAGE_DVB_CI = 0x20,

This is the start of the stable review cycle for the 5.10.94 release. There are 563 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 26 Jan 2022 18:39:11 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.94-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.94-rc1

Fabio Estevam <[email protected]>
ath10k: Fix the MTU size on QCA9377 SDIO

Doyle, Patrick <[email protected]>
mtd: nand: bbt: Fix corner case in bad block table handling

Andrey Konovalov <[email protected]>
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test

Alistair Popple <[email protected]>
mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault

Miaoqian Lin <[email protected]>

    lib82596: Fix IRQ check in sni_82596_probe

Matthias Schiffer <[email protected]>
scripts/dtc: dtx_diff: remove broken example from help text

Sam Protsenko <[email protected]>
dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7

Alexander Stein <[email protected]>
dt-bindings: display: meson-vpu: Add missing amlogic,canvas property

Alexander Stein <[email protected]>
dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property

Tom Rix <[email protected]>
net: mscc: ocelot: fix using match before it is set

Russell King (Oracle) <[email protected]>
net: sfp: fix high power modules without diagnostic monitoring

Tom Rix <[email protected]>
net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config()

Sergey Shtylyov <[email protected]>
bcmgenet: add WOL IRQ check

Kevin Bracey <[email protected]>
net_sched: restore "mpu xxx" handling

Jie Wang <[email protected]>
net: bonding: fix bond_xmit_broadcast return value error bug

David Heidelberg <[email protected]>
arm64: dts: qcom: msm8996: drop not documented adreno properties

Leon Romanovsky <[email protected]>
devlink: Remove misleading internal_flags from health reporter dump

Zechuan Chen <[email protected]>
perf probe: Fix ppc64 'perf probe add events failed' case

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix at_xdmac_lld struct definition

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix lld view setting

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Fix concurrency over xfers_list

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Print debug message after realeasing the lock

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending

Tudor Ambarus <[email protected]>
dmaengine: at_xdmac: Don't start transactions at tx_submit level

Adrian Hunter <[email protected]>
perf script: Fix hex dump character output

Guillaume Nault <[email protected]>
libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()

Guillaume Nault <[email protected]>
gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst()

Guillaume Nault <[email protected]>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()

Eric Dumazet <[email protected]>
netns: add schedule point in ops_exit_list()

Eric Dumazet <[email protected]>

    inet: frags: annotate races around fqdir->dead and fqdir->high_thresh

Eric W. Biederman <[email protected]>

    taskstats: Cleanup the use of task->exit_code

Michael S. Tsirkin <[email protected]>
virtio_ring: mark ring unused on error

Eli Cohen <[email protected]>
vdpa/mlx5: Fix wrong configuration of virtio_version_1_0

Laurence de Bruxelles <[email protected]>
rtc: pxa: fix null pointer dereference

Dmitry Torokhov <[email protected]>
HID: vivaldi: fix handling devices not using numbered reports

Robert Hancock <[email protected]>
net: axienet: increase default TX ring size to 128

Robert Hancock <[email protected]>
net: axienet: fix for TX busy handling

Robert Hancock <[email protected]>
net: axienet: fix number of TX ring slots for available check

Robert Hancock <[email protected]>
net: axienet: Fix TX ring slot available check

Robert Hancock <[email protected]>
net: axienet: limit minimum TX ring size

Robert Hancock <[email protected]>
net: axienet: add missing memory barriers

Robert Hancock <[email protected]>
net: axienet: reset core on initialization prior to MDIO access

Robert Hancock <[email protected]>
net: axienet: Wait for PhyRstCmplt after core reset

Robert Hancock <[email protected]>
net: axienet: increase reset timeout

Wen Gu <[email protected]>
net/smc: Fix hung_task when removing SMC-R devices

Robert Hancock <[email protected]>
clk: si5341: Fix clock HW provider cleanup

Stephen Boyd <[email protected]>
clk: Emit a stern warning with writable debugfs enabled

Eric Dumazet <[email protected]>
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress

Chao Yu <[email protected]>
f2fs: fix to reserve space for IO align feature

Hyeong-Jun Kim <[email protected]>
f2fs: compress: fix potential deadlock of compress file

Miaoqian Lin <[email protected]>
parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries

Tobias Waldekranz <[email protected]>
net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module

Tobias Waldekranz <[email protected]>
net/fsl: xgmac_mdio: Add workaround for erratum A-009885

Eric Dumazet <[email protected]>
ipv4: avoid quadratic behavior in netns dismantle

Eric Dumazet <[email protected]>
ipv4: update fib_info_cnt under spinlock protection

German Gomez <[email protected]>

    perf evsel: Override attr->sample_period for non-libpfm4 events

Toke Høiland-Jørgensen <[email protected]>
xdp: check prog type before updating BPF link

Quentin Monnet <[email protected]>
bpftool: Remove inclusion of utilities.mak from Makefiles

Russell King <[email protected]>
arm64/bpf: Remove 128MB limit for BPF JIT programs

Ye Bin <[email protected]>
block: Fix fsync always failed if once failed

Tobias Waldekranz <[email protected]>
powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses

Anders Roxell <[email protected]>
powerpc/cell: Fix clang -Wimplicit-fallthrough warning

Moshe Shemesh <[email protected]>
Revert "net/mlx5: Add retry mechanism to the command entry index allocation"

Amelie Delaunay <[email protected]>
dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK

Chengguang Xu <[email protected]>
RDMA/rxe: Fix a typo in opcode name

Yixing Liu <[email protected]>
RDMA/hns: Modify the mapping attribute of doorbell to device

Kunihiko Hayashi <[email protected]>
dmaengine: uniphier-xdmac: Fix type of address variables

Bart Van Assche <[email protected]>
scsi: core: Show SCMD_LAST in text form

Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix not setting adv set duration

Randy Dunlap <[email protected]>
Documentation: fix firewire.rst ABI file path error

Lukas Bulwahn <[email protected]>
Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization

Sakari Ailus <[email protected]>
Documentation: ACPI: Fix data node reference documentation

Daniel Thompson <[email protected]>
Documentation: dmaengine: Correctly describe dmatest with channel unset

Randy Dunlap <[email protected]>
media: correct MEDIA_TEST_SUPPORT help text

Maxime Ripard <[email protected]>
drm/vc4: hdmi: Make sure the device is powered with CEC

Suresh Udipi <[email protected]>
media: rcar-csi2: Optimize the selection PHTW register

Marc Kleine-Budde <[email protected]>
can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message

Ben Hutchings <[email protected]>
firmware: Update Kconfig help text for Google firmware

Baruch Siach <[email protected]>
of: base: Improve argument length mismatch error

Christian König <[email protected]>
drm/radeon: fix error handling in radeon_driver_open_kms

Theodore Ts'o <[email protected]>
ext4: don't use the orphan list when migrating an inode

Ye Bin <[email protected]>
ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits'

Sebastian Andrzej Siewior <[email protected]>
ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal

Xin Yin <[email protected]>
ext4: fast commit may miss tracking unwritten range during ftruncate

Xin Yin <[email protected]>
ext4: use ext4_ext_remove_space() for fast commit replay delete range

Ye Bin <[email protected]>
ext4: Fix BUG_ON in ext4_bread when write quota data

Luís Henriques <[email protected]>
ext4: set csum seed in tmp inode while migrating to extents

Xin Yin <[email protected]>
ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE

Harshad Shirwadkar <[email protected]>
ext4: initialize err_blk before calling __ext4_get_inode_loc

Chunguang Xu <[email protected]>
ext4: fix a possible ABBA deadlock due to busy PA

Jan Kara <[email protected]>
ext4: make sure quota gets properly shutdown on error

Jan Kara <[email protected]>
ext4: make sure to reset inode lockdep class when quota enabling fails

Filipe Manana <[email protected]>
btrfs: respect the max size in the header when activating swap file

Josef Bacik <[email protected]>
btrfs: check the root node for uptodate before returning it

Filipe Manana <[email protected]>
btrfs: fix deadlock between quota enable and other quota operations

Ghalem Boudour <[email protected]>
xfrm: fix policy lookup for ipv6 gre packets

Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device

Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Correctly set PCIe capabilities

Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Fix definitions of reserved bits

Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space

Pali Rohár <[email protected]>
PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only

Lukas Wunner <[email protected]>
PCI: pciehp: Fix infinite loop in IRQ handler upon power fault

Hans de Goede <[email protected]>
PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors

Rob Herring <[email protected]>
PCI: xgene: Fix IB window setup

Nicholas Piggin <[email protected]>
powerpc/64s/radix: Fix huge vmap false positive

John David Anglin <[email protected]>
parisc: Fix lpa and lpa_user defines

Brian Norris <[email protected]>
drm/bridge: analogix_dp: Make PSR-exit block less

Ilia Mirkin <[email protected]>
drm/nouveau/kms/nv04: use vzalloc for nv04_display

Lucas Stach <[email protected]>
drm/etnaviv: limit submit sizes

Sakari Ailus <[email protected]>
device property: Fix fwnode_graph_devcon_match() fwnode leak

Alexander Gordeev <[email protected]>
s390/mm: fix 2KB pgtable release race

Ilan Peer <[email protected]>
iwlwifi: mvm: Increase the scan timeout guard to 30 seconds

Xiangyang Zhang <[email protected]>
tracing/kprobes: 'nmissed' not showed correctly for kretprobe

Andrey Ryabinin <[email protected]>
cputime, cpuacct: Include guest time in user time in cpuacct.stat

Lukas Wunner <[email protected]>
serial: Fix incorrect rs485 polarity on uart open

Xie Yongji <[email protected]>
fuse: Pass correct lend value to filemap_write_and_wait_range()

Oleksandr Andrushchenko <[email protected]>
xen/gntdev: fix unmap notification order

Kunihiko Hayashi <[email protected]>
spi: uniphier: Fix a bug that doesn't point to private data correctly

Patrick Williams <[email protected]>
tpm: fix NPE on probe for missing device

Petr Cvachoucek <[email protected]>
ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers

Meng Li <[email protected]>
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr

Marek Vasut <[email protected]>
crypto: stm32/crc32 - Fix kernel BUG triggered in probe()

Heiner Kallweit <[email protected]>
crypto: omap-aes - Fix broken pm_runtime_and_get() usage

Arnaud Pouliquen <[email protected]>
rpmsg: core: Clean up resources on announce_create failure.

Miaoqian Lin <[email protected]>
phy: mediatek: Fix missing check in mtk_mipi_tx_probe

Tzung-Bi Shih <[email protected]>
ASoC: mediatek: mt8183: fix device_node leak

Tzung-Bi Shih <[email protected]>
ASoC: mediatek: mt8173: fix device_node leak

Christoph Hellwig <[email protected]>
scsi: sr: Don't use GFP_DMA

Tianjia Zhang <[email protected]>
MIPS: Octeon: Fix build errors using clang

Lakshmi Sowjanya D <[email protected]>
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters

Marc Zyngier <[email protected]>
irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time

Ye Guojin <[email protected]>
MIPS: OCTEON: add put_device() after of_find_device_by_node()

Jan Kara <[email protected]>
udf: Fix error handling in udf_new_inode()

Hari Bathini <[email protected]>
powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic

Hari Bathini <[email protected]>
powerpc: handle kdump appropriately with crash_kexec_post_notifiers option

Thadeu Lima de Souza Cascardo <[email protected]>
selftests/powerpc/spectre_v2: Return skip code when miss_percent is high

Christophe Leroy <[email protected]>

    powerpc/40x: Map 32Mbytes of memory at startup

Nathan Chancellor <[email protected]>
MIPS: Loongson64: Use three arguments for slti

Takashi Iwai <[email protected]>
ALSA: seq: Set upper limit of processed events

James Smart <[email protected]>
scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup

Christoph Hellwig <[email protected]>
dm: fix alloc_dax error handling in alloc_dev

Srinivas Kandagatla <[email protected]>
nvmem: core: set size for sysfs bin file

Christophe Leroy <[email protected]>
w1: Misuse of get_user()/put_user() reported by sparse

Alexey Kardashevskiy <[email protected]>
KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST

Alexey Kardashevskiy <[email protected]>
KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots

Christophe Leroy <[email protected]>
powerpc/powermac: Add missing lockdep_register_key()

Martin Blumenstingl <[email protected]>
clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB

Joakim Tjernlund <[email protected]>
i2c: mpc: Correct I2C reset procedure

Michael Ellerman <[email protected]>
powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING

Heiner Kallweit <[email protected]>
i2c: i801: Don't silently correct invalid transfer size

Nicholas Piggin <[email protected]>
powerpc/watchdog: Fix missed watchdog reset due to memory ordering race

Julia Lawall <[email protected]>
powerpc/btext: add missing of_node_put

Julia Lawall <[email protected]>
powerpc/cell: add missing of_node_put

Julia Lawall <[email protected]>
powerpc/powernv: add missing of_node_put

Julia Lawall <[email protected]>
powerpc/6xx: add missing of_node_put

Ingo Molnar <[email protected]>
x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs

Mauro Carvalho Chehab <[email protected]>
scripts: sphinx-pre-install: Fix ctex support on Debian

John David Anglin <[email protected]>
parisc: Avoid calling faulthandler_disabled() twice

Jason A. Donenfeld <[email protected]>
random: do not throw away excess input to crng_fast_load

Lukas Wunner <[email protected]>
serial: core: Keep mctrl register state and cached copy in sync

Lukas Wunner <[email protected]>
serial: pl010: Drop CR register reset on set_termios

Konrad Dybcio <[email protected]>
regulator: qcom_smd: Align probe function with rpmh-regulator

Russell King (Oracle) <[email protected]>
net: gemini: allow any RGMII interface mode

Russell King (Oracle) <[email protected]>
net: phy: marvell: configure RGMII delays for 88E1118

Danielle Ratson <[email protected]>
mlxsw: pci: Avoid flow control for EMAD packets

Joe Thornber <[email protected]>
dm space map common: add bounds check to sm_ll_lookup_bitmap()

Joe Thornber <[email protected]>
dm btree: add a defensive bounds check to insert_at()

Ping-Ke Shih <[email protected]>

    mac80211: allow non-standard VHT MCS-10/11

Florian Fainelli <[email protected]>
net: mdio: Demote probed message to debug print

Josef Bacik <[email protected]>
btrfs: remove BUG_ON(!eie) in find_parent_nodes

Josef Bacik <[email protected]>
btrfs: remove BUG_ON() in find_parent_nodes()

Thomas Weißschuh <[email protected]>
ACPI: battery: Add the ThinkPad "Not Charging" quirk

Marina Nikolic <[email protected]>
amdgpu/pm: Make sysfs pm attributes as read-only for VFs

Zongmin Zhou <[email protected]>
drm/amdgpu: fixup bad vram size on gmc v8

Kirill A. Shutemov <[email protected]>
ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5

Sudeep Holla <[email protected]>
ACPICA: Fix wrong interpretation of PCC address

Rafael J. Wysocki <[email protected]>
ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()

Rafael J. Wysocki <[email protected]>
ACPICA: Utilities: Avoid deleting the same object twice in a row

Mark Langsdorf <[email protected]>
ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions

Kyeong Yoo <[email protected]>
jffs2: GC deadlock reading a page that is used in jffs2_write_begin()

Lucas Stach <[email protected]>
drm/etnaviv: consider completed fence seqno in hang check

Antony Antony <[email protected]>
xfrm: rate limit SA mapping change message to user space

Luiz Augusto von Dentz <[email protected]>
Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES

Ben Greear <[email protected]>
ath11k: Fix napi related hang

Randy Dunlap <[email protected]>
um: registers: Rename function names to avoid conflicts and build problems

Luca Coelho <[email protected]>
iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ

Ilan Peer <[email protected]>
iwlwifi: mvm: Fix calculation of frame length

Johannes Berg <[email protected]>
iwlwifi: remove module loading failure message

Johannes Berg <[email protected]>
iwlwifi: fix leaks/bad data after failed firmware load

Changcheng Deng <[email protected]>
PM: AVS: qcom-cpr: Use div64_ul instead of do_div

Po-Hao Huang <[email protected]>
rtw88: 8822c: update rx settings to prevent potential hw deadlock

Zekun Shen <[email protected]>
ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream

Kai-Heng Feng <[email protected]>
usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0

Rafael J. Wysocki <[email protected]>
cpufreq: Fix initialization of min and max frequency QoS requests

Rafael J. Wysocki <[email protected]>
PM: runtime: Add safety net to supplier device release

Thierry Reding <[email protected]>
arm64: tegra: Adjust length of CCPLEX cluster MMIO region

Biwen Li <[email protected]>
arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus

Paul Moore <[email protected]>
audit: ensure userspace is penalized the same as the kernel when under pressure

Ulf Hansson <[email protected]>
mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO

Zhou Qingyang <[email protected]>
media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()

Sean Young <[email protected]>
media: igorplugusb: receiver overflow should be reported

Alistair Francis <[email protected]>
HID: quirks: Allow inverting the absolute X/Y values

Paolo Abeni <[email protected]>
bpf: Do not WARN in bpf_warn_invalid_xdp_action()

Suresh Kumar <[email protected]>
net: bonding: debug: avoid printing debug logs when bond is not notifying peers

Borislav Petkov <[email protected]>
x86/mce: Mark mce_read_aux() noinstr

Borislav Petkov <[email protected]>
x86/mce: Mark mce_end() noinstr

Borislav Petkov <[email protected]>
x86/mce: Mark mce_panic() noinstr

Borislav Petkov <[email protected]>
x86/mce: Allow instrumentation during task work queueing

Baochen Qiang <[email protected]>
ath11k: Avoid false DEADLOCK warning reported by lockdep

Heiko Carstens <[email protected]>
selftests/ftrace: make kprobe profile testcase description unique

Iwona Winiarska <[email protected]>
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock

Russell King (Oracle) <[email protected]>
net: phy: prefer 1000baseT over 1000baseKX

Antoine Tenart <[email protected]>
net-sysfs: update the queue counts in the unregistration path

Sebastian Gottschall <[email protected]>
ath10k: Fix tx hanging

Wen Gong <[email protected]>
ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work

Shaul Triebitz <[email protected]>
iwlwifi: mvm: avoid clearing a just saved session protection id

Johannes Berg <[email protected]>
iwlwifi: mvm: synchronize with FW after multicast commands

Mika Westerberg <[email protected]>
thunderbolt: Runtime PM activate both ends of the device link

Mauro Carvalho Chehab <[email protected]>

    media: m920x: don't use stack on USB reads

Zhou Qingyang <[email protected]>
media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()

Niklas Söderlund <[email protected]>
media: rcar-vin: Update format alignment constraints

James Hilliard <[email protected]>
media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.

Laurent Pinchart <[email protected]>
drm: rcar-du: Fix CRTC timings when CMM is used

Joerg Roedel <[email protected]>
x86/mm: Flush global TLB when switching to trampoline page-table

Xiongwei Song <[email protected]>
floppy: Add max size check for user space request

Neal Liu <[email protected]>
usb: uhci: add aspeed ast2600 uhci support

Kishon Vijay Abraham I <[email protected]>
arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node

Hans de Goede <[email protected]>
ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win

Hans de Goede <[email protected]>
ACPI / x86: Allow specifying acpi_device_override_status() quirks by path

Hans de Goede <[email protected]>
ACPI: Change acpi_device_always_present() into acpi_device_override_status()

Hans de Goede <[email protected]>
ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table

Mansur Alisha Shaik <[email protected]>
media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions

Sriram R <[email protected]>
ath11k: Avoid NULL ptr access during mgmt tx cleanup

Zekun Shen <[email protected]>
rsi: Fix out-of-bounds read in rsi_read_pkt()

Zekun Shen <[email protected]>
rsi: Fix use-after-free in rsi_rx_done_handler()

Zekun Shen <[email protected]>
mwifiex: Fix skb_over_panic in mwifiex_usb_recv()

Stephan Müller <[email protected]>
crypto: jitter - consider 32 LSB for APT

Chengfeng Ye <[email protected]>
HSI: core: Fix return freed object in hsi_new_client

Hans de Goede <[email protected]>
gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use

Fugang Duan <[email protected]>
tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown()

Martyn Welch <[email protected]>
drm/bridge: megachips: Ensure both bridges are probed before registration

Danielle Ratson <[email protected]>
mlxsw: pci: Add shutdown method in PCI driver

Jan Kiszka <[email protected]>
soc: ti: pruss: fix referenced node in error message

Alex Deucher <[email protected]>
drm/amdgpu/display: set vblank_disable_immediate for DC

Yang Li <[email protected]>
drm/amd/display: check top_pipe_to_program pointer

Lukas Bulwahn <[email protected]>
ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART

Dinh Nguyen <[email protected]>
EDAC/synopsys: Use the quirk for version instead of ddr version

Zheyu Ma <[email protected]>
media: b2c2: Add missing check in flexcop_pci_isr:

José Expósito <[email protected]>
HID: apple: Do not reset quirks when the Fn key is not found

Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L

Pavankumar Kondeti <[email protected]>
usb: gadget: f_fs: Use stream_open() for endpoint files

Baochen Qiang <[email protected]>
ath11k: Fix crash caused by uninitialized TX ring

Mauro Carvalho Chehab <[email protected]>
media: atomisp: handle errors at sh_css_create_isp_params()

Linus Lüssing <[email protected]>
batman-adv: allow netlink usage in unprivileged containers

Wan Jiabing <[email protected]>
ARM: shmobile: rcar-gen2: Add missing of_node_put()

Hans de Goede <[email protected]>
media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure

Mauro Carvalho Chehab <[email protected]>
media: atomisp: set per-device's default mode

Mauro Carvalho Chehab <[email protected]>
media: atomisp: fix try_fmt logic

Ben Skeggs <[email protected]>
drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR

Neil Armstrong <[email protected]>
drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR

Zekun Shen <[email protected]>
ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply

Andrii Nakryiko <[email protected]>
selftests/bpf: Fix bpf_object leak in skb_ctx selftest

Qiang Yu <[email protected]>
drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y

Andrii Nakryiko <[email protected]>
libbpf: Validate that .BTF and .BTF.ext sections contain data

Alexander Aring <[email protected]>
fs: dlm: filter user dlm messages for kernel locks

Wei Yongjun <[email protected]>
Bluetooth: Fix debugfs entry leak in hci_register_dev()

Sicelo A. Mhlongo <[email protected]>
ARM: dts: omap3-n900: Fix lp5523 for multi color

Baruch Siach <[email protected]>
of: base: Fix phandle argument length mismatch error message

Conor Dooley <[email protected]>
clk: bm1880: remove kfrees on static allocations

Shengjiu Wang <[email protected]>
ASoC: fsl_asrc: refine the check of available clock divider

Kamal Heib <[email protected]>
RDMA/cxgb4: Set queue pair state when being queried

Alyssa Ross <[email protected]>
ASoC: fsl_mqs: fix MODULE_ALIAS

Ammar Faizi <[email protected]>
powerpc/xive: Add missing null check after calling kmalloc

Randy Dunlap <[email protected]>
mips: bcm63xx: add support for clk_set_parent()

Randy Dunlap <[email protected]>
mips: lantiq: add support for clk_set_parent()

Sameer Pujar <[email protected]>
arm64: tegra: Remove non existent Tegra194 reset

Sameer Pujar <[email protected]>
arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering

Fabrice Gasnier <[email protected]>
counter: stm32-lptimer-cnt: remove iio counter abi

Wei Yongjun <[email protected]>
misc: lattice-ecp3-config: Fix task hung when firmware load failed

Jiasheng Jiang <[email protected]>
ASoC: samsung: idma: Check of ioremap return value

Jiasheng Jiang <[email protected]>
ASoC: mediatek: Check for error clk pointer

Ryuta NAKANISHI <[email protected]>
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register

Alan Stern <[email protected]>
scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume()

Xiongfeng Wang <[email protected]>
iommu/iova: Fix race between FQ timeout and teardown

Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Test dmaengine_submit() result before moving on

Maxim Levitsky <[email protected]>
iommu/amd: Restore GA log/tail pointer on host resume

Suravee Suthikulpanit <[email protected]>
iommu/amd: Remove iommu_init_ga()

Arnd Bergmann <[email protected]>

    dmaengine: pxa/mmp: stop referencing config->slave_id

Lukas Bulwahn <[email protected]>
mips: fix Kconfig reference to PHYS_ADDR_T_64BIT

Lukas Bulwahn <[email protected]>
mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support

Dillon Min <[email protected]>
clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell

Frank Rowand <[email protected]>
of: unittest: 64 bit dma address test requires arch support

Jim Quinlan <[email protected]>
of: unittest: fix warning on PowerPC frame size warning

Jiasheng Jiang <[email protected]>
ASoC: rt5663: Handle device_property_read_u32_array error codes

Avihai Horon <[email protected]>
RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry

Avihai Horon <[email protected]>
RDMA/core: Let ib_find_gid() continue search even after empty entry

Christophe Leroy <[email protected]>
powerpc/powermac: Add additional missing lockdep_register_key()

Thomas Gleixner <[email protected]>
PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()

Kamal Heib <[email protected]>
RDMA/qedr: Fix reporting max_{send/recv}_wr attrs

Bart Van Assche <[email protected]>
scsi: ufs: Fix race conditions related to driver data

Hector Martin <[email protected]>
iommu/io-pgtable-arm: Fix table descriptor paddr formatting

Jiasheng Jiang <[email protected]>
uio: uio_dmem_genirq: Catch the Exception

Stafford Horne <[email protected]>
openrisc: Add clone3 ABI wrapper

Todd Kjos <[email protected]>
binder: fix handling of error during copy

Kees Cook <[email protected]>
char/mwave: Adjust io port register size

Takashi Iwai <[email protected]>
ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID

Bixuan Cui <[email protected]>
ALSA: oss: fix compile error when OSS_DEBUG is enabled

Waiman Long <[email protected]>
clocksource: Avoid accidental unstable marking of clocksources

Paul E. McKenney <[email protected]>
clocksource: Reduce clocksource-skew threshold

Christophe Leroy <[email protected]>
powerpc/32s: Fix shift-out-of-bounds in KASAN init

Athira Rajeev <[email protected]>
powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC

Christophe Leroy <[email protected]>

    powerpc/irq: Add helper to set regs->softe

Nicholas Piggin <[email protected]>
powerpc/perf: move perf irq/nmi handling details into traps.c

Athira Rajeev <[email protected]>
powerpc/perf: MMCR0 control for PMU registers under PMCC=00

Jordan Niethe <[email protected]>
powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C

Niklas Söderlund <[email protected]>
dt-bindings: thermal: Fix definition of cooling-maps contribution property

Lukas Bulwahn <[email protected]>
ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA

Peiwei Hu <[email protected]>
powerpc/prom_init: Fix improper check of prom_getprop()

Adam Ford <[email protected]>
clk: imx8mn: Fix imx8mn_clko1_sels

Igor Pylypiv <[email protected]>

    scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd()

Kamal Heib <[email protected]>
RDMA/hns: Validate the pkey index

Christophe JAILLET <[email protected]>
RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit"

Takashi Iwai <[email protected]>
ALSA: hda: Add missing rwsem around snd_ctl_remove() calls

Takashi Iwai <[email protected]>
ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls

Takashi Iwai <[email protected]>
ALSA: jack: Add missing rwsem around snd_ctl_remove() calls

Jan Kara <[email protected]>
ext4: avoid trim error on fs with small groups

Pavel Skripkin <[email protected]>
net: mcs7830: handle usb read errors properly

Nathan Chancellor <[email protected]>
iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing()

Dominik Brodowski <[email protected]>
pcmcia: fix setting of kthread task states

Jiasheng Jiang <[email protected]>
can: xilinx_can: xcan_probe(): check for error irq

Marc Kleine-Budde <[email protected]>
can: softing: softing_startstop(): fix set but not used variable warning

Christophe Jaillet <[email protected]>
tpm_tis: Fix an error handling path in 'tpm_tis_core_init()'

Chen Jun <[email protected]>
tpm: add request_locality before write TPM_INT_ENABLE

Marc Kleine-Budde <[email protected]>
can: mcp251xfd: add missing newline to printed strings

Fabio Estevam <[email protected]>
regmap: Call regmap_debugfs_exit() prior to _init()

Dan Carpenter <[email protected]>
netrom: fix api breakage in nr_setsockopt()

Dan Carpenter <[email protected]>
ax25: uninitialized variable in ax25_setsockopt()

Miaoqian Lin <[email protected]>
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe

Dan Carpenter <[email protected]>
Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt()

Zizhuang Deng <[email protected]>
lib/mpi: Add the return value check of kcalloc()

Moshe Shemesh <[email protected]>
net/mlx5: Set command entry semaphore up once got index free

Aya Levin <[email protected]>
Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels"

Maor Dickman <[email protected]>
net/mlx5e: Don't block routes with nexthop objects in SW

Aya Levin <[email protected]>
net/mlx5e: Fix page DMA map/unmap attributes

Michal Suchanek <[email protected]>
debugfs: lockdown: Allow reading debugfs files that are not world readable

José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad

José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init

José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc

José Expósito <[email protected]>
HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init

Miaoqian Lin <[email protected]>
usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe

Miaoqian Lin <[email protected]>
Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe

Jiasheng Jiang <[email protected]>
Bluetooth: hci_bcm: Check for error irq

Jiasheng Jiang <[email protected]>
fsl/fman: Check for null pointer after calling devm_ioremap

Jiasheng Jiang <[email protected]>
staging: greybus: audio: Check null pointer

Dan Carpenter <[email protected]>
rocker: fix a sleeping in atomic bug

Eric Dumazet <[email protected]>
ppp: ensure minimum packet size in ppp_write()

Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone

Kuniyuki Iwashima <[email protected]>
bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt().

Daniel Borkmann <[email protected]>
bpf: Don't promote bogus looking registers after null check.

Xin Xiong <[email protected]>
netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()

Jiasheng Jiang <[email protected]>
power: reset: mt6397: Check for null res pointer

Zhou Qingyang <[email protected]>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()

Zhou Qingyang <[email protected]>
pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()

Hans de Goede <[email protected]>
ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes

Zhang Zixun <[email protected]>
x86/mce/inject: Avoid out-of-bounds write when setting flags

Arseny Demidov <[email protected]>
hwmon: (mr75203) fix wrong power-up delay value

Nathan Chancellor <[email protected]>
x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS

Panicker Harish <[email protected]>
Bluetooth: hci_qca: Stop IBS timer during BT OFF

Clément Léger <[email protected]>
software node: fix wrong node passed to find nargs_prop

Marijn Suijten <[email protected]>
backlight: qcom-wled: Respect enabled-strings in set_brightness

Marijn Suijten <[email protected]>
backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion

Marijn Suijten <[email protected]>
backlight: qcom-wled: Override default length with qcom,enabled-strings

Marijn Suijten <[email protected]>
backlight: qcom-wled: Fix off-by-one maximum with default num_strings

Marijn Suijten <[email protected]>
backlight: qcom-wled: Pass number of elements to read to read_u32_array

Marijn Suijten <[email protected]>
backlight: qcom-wled: Validate enabled string indices in DT

Paul Chaignon <[email protected]>
bpftool: Enable line buffering for stdout

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix using wrong mode

Johannes Berg <[email protected]>
um: virtio_uml: Fix time-travel external time propagation

Johannes Berg <[email protected]>
um: fix ndelay/udelay defines

Bernard Zhao <[email protected]>
selinux: fix potential memleak in selinux_add_opt()

Sergey Shtylyov <[email protected]>
mmc: meson-mx-sdio: add IRQ check

Sergey Shtylyov <[email protected]>
mmc: meson-mx-sdhc: add IRQ check

Nathan Errera <[email protected]>
iwlwifi: mvm: test roc running status bits before removing the sta

Johannes Berg <[email protected]>
iwlwifi: mvm: fix 32-bit build in FTM

Marek Behún <[email protected]>
ARM: dts: armada-38x: Add generic compatible to UART nodes

Robert Marko <[email protected]>
arm64: dts: marvell: cn9130: enable CP0 GPIO controllers

Robert Marko <[email protected]>
arm64: dts: marvell: cn9130: add GPIO and SPI aliases

Wei Yongjun <[email protected]>
usb: ftdi-elan: fix memory leak on device disconnect

Andre Przywara <[email protected]>
ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding

Antony Antony <[email protected]>
xfrm: state and policy should fail if XFRMA_IF_ID 0

Antony Antony <[email protected]>
xfrm: interface with if_id 0 should return error

Jernej Skrabec <[email protected]>
media: hantro: Fix probe func error path

Robin Murphy <[email protected]>
drm/tegra: vic: Fix DMA API misuse

Stephen Boyd <[email protected]>
drm/bridge: ti-sn65dsi86: Set max register for regmap

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix safe status debugfs file

Baruch Siach <[email protected]>
arm64: dts: qcom: ipq6018: Fix gpio-ranges property

Srinivas Kandagatla <[email protected]>
arm64: dts: qcom: c630: Fix soundcard setup

Zhou Qingyang <[email protected]>
ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan()

Jiasheng Jiang <[email protected]>
media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes

Wang Hai <[email protected]>
media: msi001: fix possible null-ptr-deref in msi001_probe()

Anton Vasilyev <[email protected]>
media: dw2102: Fix use after free

Christian Lamparter <[email protected]>
ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors

Rameshkumar Sundaram <[email protected]>
ath11k: Fix deleting uninitialized kernel timer during fragment cache flush

Herbert Xu <[email protected]>
crypto: stm32 - Revert broken pm_runtime_resume_and_get changes

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix bugs and crash in tests

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix lrw chaining mode

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix double pm exit

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - check early input data

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix xts and race condition in crypto_engine requests

Nicolas Toromanoff <[email protected]>
crypto: stm32/cryp - fix CTR counter carry

Herbert Xu <[email protected]>
crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter

Jakub Kicinski <[email protected]>
selftests: harness: avoid false negatives if test has no ASSERTs

Anders Roxell <[email protected]>
selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST

Kees Cook <[email protected]>
x86/uaccess: Move variable into switch case statement

Eric Dumazet <[email protected]>
xfrm: fix a small bug in xfrm_sa_len()

Brian Norris <[email protected]>
mwifiex: Fix possible ABBA deadlock

Frederic Weisbecker <[email protected]>
rcu/exp: Mark current CPU as exp-QS in IPI loop second pass

Jackie Liu <[email protected]>
drm/msm/dp: displayPort driver need algorithm rational

Li Hua <[email protected]>
sched/rt: Try to restart rt period timer when rt runtime exceeded

Lv Yunlong <[email protected]>
wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma

Robert Schlabbach <[email protected]>
media: si2157: Fix "warm" tuner state detection

Zhou Qingyang <[email protected]>
media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()

Zhou Qingyang <[email protected]>

    media: dib8000: Fix a memleak in dib8000_init()

Reiji Watanabe <[email protected]>

    arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1

Will Deacon <[email protected]>
arm64: lib: Annotate {clear, copy}_page() as position-independent

Kajol Jain <[email protected]>
bpf: Remove config check to enable bpf support for branch records

Hou Tao <[email protected]>
bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)

Alexei Starovoitov <[email protected]>
bpf: Adjust BTF log size limit.

Vincent Donnefort <[email protected]>
sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity

Vincent Donnefort <[email protected]>
sched/fair: Fix detection of per-CPU kthreads waking a task

Sean Wang <[email protected]>
Bluetooth: btmtksdio: fix resume failure

Yang Yingliang <[email protected]>
staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib()

Yang Yingliang <[email protected]>
staging: rtl8192e: return error code from rtllib_softmac_init()

Tasos Sahanidis <[email protected]>
floppy: Fix hang in watchdog when disk is ejected

Lino Sanfilippo <[email protected]>
serial: amba-pl011: do not request memory region twice

Lizhi Hou <[email protected]>
tty: serial: uartlite: allow 64 bit address

Nishanth Menon <[email protected]>

    arm64: dts: ti: k3-j7200: Correct the d-cache-sets info

Nishanth Menon <[email protected]>

    arm64: dts: ti: k3-j721e: Fix the L2 cache sets

Nishanth Menon <[email protected]>

    arm64: dts: ti: k3-j7200: Fix the L2 cache sets

Zhou Qingyang <[email protected]>
drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()

Zhou Qingyang <[email protected]>
drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()

Paul Gerber <[email protected]>
thermal/drivers/imx8mm: Enable ADC when enabling monitor

Rafael J. Wysocki <[email protected]>
ACPI: EC: Rework flushing of EC work while suspended to idle

William Kucharski <[email protected]>
cgroup: Trace event cgroup id fields should be u64

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8916: fix MMC controller aliases

Florian Westphal <[email protected]>
netfilter: bridge: add support for pppoe filtering

Oleksij Rempel <[email protected]>
thermal/drivers/imx: Implement runtime PM support

Christophe JAILLET <[email protected]>
media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()'

Christophe JAILLET <[email protected]>
media: venus: core: Fix a potential NULL pointer dereference in an error handling path

Bryan O'Donoghue <[email protected]>
media: venus: core, venc, vdec: Fix probe dependency error

Stanimir Varbanov <[email protected]>
media: venus: pm_helpers: Control core power domain manually

Philipp Zabel <[email protected]>
media: coda: fix CODA960 JPEG encoder buffer overflow

Dafna Hirschfeld <[email protected]>
media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released

Yang Yingliang <[email protected]>

    media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()

Fabio Estevam <[email protected]>
media: imx-pxp: Initialize the spinlock prior to using it

Suresh Udipi <[email protected]>
media: rcar-csi2: Correct the selection of hsfreqrange

Claudiu Beznea <[email protected]>
mfd: atmel-flexcom: Use .resume_noirq

Claudiu Beznea <[email protected]>
mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP

Tudor Ambarus <[email protected]>
tty: serial: atmel: Call dma_async_issue_pending()

Tudor Ambarus <[email protected]>
tty: serial: atmel: Check return code of dmaengine_submit()

Peng Fan <[email protected]>
arm64: dts: ti: k3-j721e: correct cache-sets info

Anilkumar Kolli <[email protected]>
ath11k: Use host CE parameters for CE interrupts configuration

Giovanni Cabiddu <[email protected]>
crypto: qat - fix undetected PFVF timeout in ACK loop

Marco Chiappero <[email protected]>
crypto: qat - make pfvf send message direction agnostic

Marco Chiappero <[email protected]>
crypto: qat - remove unnecessary collision prevention step in PFVF

Bhaskar Chowdhury <[email protected]>

    crypto: qat - fix spelling mistake: "messge" -> "message"

Dillon Min <[email protected]>
ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco

George G. Davis <[email protected]>
mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove

Chengfeng Ye <[email protected]>
crypto: qce - fix uaf on qce_skcipher_register_one

Chengfeng Ye <[email protected]>
crypto: qce - fix uaf on qce_ahash_register_one

Wang Hai <[email protected]>
media: dmxdev: fix UAF when dvb_register_device() fails

Biju Das <[email protected]>
arm64: dts: renesas: cat875: Add rx/tx delays

Dan Carpenter <[email protected]>
drm/vboxvideo: fix a NULL vs IS_ERR() check

Alexander Aring <[email protected]>
fs: dlm: fix build with CONFIG_IPV6 disabled

Jens Wiklander <[email protected]>
tee: fix put order in teedev_close_context()

Karthikeyan Kathirvel <[email protected]>
ath11k: reset RSN/WPA present state for open BSS

Karthikeyan Kathirvel <[email protected]>
ath11k: clear the keys properly via DISABLE_KEY

Sven Eckelmann <[email protected]>
ath11k: Fix ETSI regd with weather radar overlap

Pavel Skripkin <[email protected]>
Bluetooth: stop proccessing malicious adv data

Lad Prabhakar <[email protected]>
memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails

Alexander Aring <[email protected]>
fs: dlm: don't call kernel_getpeername() in error_report()

Alexander Aring <[email protected]>

    fs: dlm: use sk->sk_socket instead of con->sock

Christian Hewitt <[email protected]>
arm64: dts: meson-gxbb-wetek: fix missing GPIO binding

Christian Hewitt <[email protected]>
arm64: dts: meson-gxbb-wetek: fix HDMI in early boot

Alexander Stein <[email protected]>
arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+

Alexander Stein <[email protected]>
arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name

Jammy Huang <[email protected]>
media: aspeed: Update signal status immediately to ensure sane hw state

Dongliang Mu <[email protected]>
media: em28xx: fix memory leak in em28xx_init_dev

Jammy Huang <[email protected]>
media: aspeed: fix mode-detect always time out at 2nd run

Dan Carpenter <[email protected]>
media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr()

Mauro Carvalho Chehab <[email protected]>
media: atomisp: fix enum formats logic

Tsuchiya Yuto <[email protected]>
media: atomisp: add NULL check for asd obtained from atomisp_video_pipe

Aline Santana Cordeiro <[email protected]>
media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c

Tsuchiya Yuto <[email protected]>
media: atomisp: fix ifdefs in sh_css.c

Tsuchiya Yuto <[email protected]>
media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid()

Tsuchiya Yuto <[email protected]>
media: atomisp: do not use err var when checking port validity for ISP2400

Tsuchiya Yuto <[email protected]>
media: atomisp: fix inverted logic in buffers_needed()

Tsuchiya Yuto <[email protected]>
media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case

Tsuchiya Yuto <[email protected]>
media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities()

Dillon Min <[email protected]>
media: videobuf2: Fix the size printk format

Lad Prabhakar <[email protected]>
mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init()

Rameshkumar Sundaram <[email protected]>
ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware

Benjamin Li <[email protected]>
wcn36xx: fix RX BD rate mapping for 5GHz legacy rates

Benjamin Li <[email protected]>
wcn36xx: populate band before determining rate on RX

Bryan O'Donoghue <[email protected]>
wcn36xx: Put DXE block into reset before freeing memory

Bryan O'Donoghue <[email protected]>
wcn36xx: Release DMA channel descriptor allocations

Bryan O'Donoghue <[email protected]>
wcn36xx: Fix DMA channel enable/disable cycle

Bryan O'Donoghue <[email protected]>
wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND

Benjamin Li <[email protected]>
wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan

Maxime Ripard <[email protected]>
drm/vc4: hdmi: Set a default HSM rate

Maxime Ripard <[email protected]>
clk: bcm-2835: Remove rounding up the dividers

Maxime Ripard <[email protected]>
clk: bcm-2835: Pick the closest clock rate

Wang Hai <[email protected]>
Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails

Brian Norris <[email protected]>
drm/rockchip: dsi: Reconfigure hardware on resume()

Brian Norris <[email protected]>
drm/rockchip: dsi: Disable PLL clock on bind error

Brian Norris <[email protected]>
drm/rockchip: dsi: Hold pm-runtime across bind/unbind

Brian Norris <[email protected]>
drm/rockchip: dsi: Fix unbalanced clock on probe error

Brian Norris <[email protected]>
drm/panel: innolux-p079zca: Delete panel on attach() failure

Brian Norris <[email protected]>
drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure

Wang Hai <[email protected]>
drm: fix null-ptr-deref in drm_dev_init_release()

Dan Carpenter <[email protected]>
drm/bridge: display-connector: fix an uninitialized pointer in probe()

Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not initializing sk_peer_pid

xinhui pan <[email protected]>
drm/ttm: Put BO in its memory manager's lru list

Gang Li <[email protected]>
shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode

Baoquan He <[email protected]>
mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages

Baoquan He <[email protected]>
dma/pool: create dma atomic pool only if dma zone has managed pages

Baoquan He <[email protected]>
mm_zone: add function to check if managed dma zone exists

Yifeng Li <[email protected]>
PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller

Thomas Hellström <[email protected]>
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()

Dmitry Osipenko <[email protected]>
gpu: host1x: Add back arm_iommu_detach_device()

Yunfei Wang <[email protected]>
iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure

Christophe Leroy <[email protected]>
lkdtm: Fix content of section containing lkdtm_rodata_do_nothing()

Jonathan Cameron <[email protected]>
iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs

Johan Hovold <[email protected]>
can: softing_cs: softingcs_probe(): fix memleak on registration failure

Hans Verkuil <[email protected]>
media: cec-pin: fix interrupt en/disable handling

Johan Hovold <[email protected]>
media: stk1160: fix control-message timeouts

Johan Hovold <[email protected]>
media: pvrusb2: fix control-message timeouts

Johan Hovold <[email protected]>
media: redrat3: fix control-message timeouts

Michael Kuron <[email protected]>
media: dib0700: fix undefined behavior in tuner shutdown

Johan Hovold <[email protected]>
media: s2255: fix control-message timeouts

Johan Hovold <[email protected]>
media: cpia2: fix control-message timeouts

Johan Hovold <[email protected]>
media: em28xx: fix control-message timeouts

Johan Hovold <[email protected]>
media: mceusb: fix control-message timeouts

Johan Hovold <[email protected]>
media: flexcop-usb: fix control-message timeouts

Hans Verkuil <[email protected]>
media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE

Mateusz Jończyk <[email protected]>
rtc: cmos: take rtc_lock while reading from CMOS

Willy Tarreau <[email protected]>
tools/nolibc: fix incorrect truncation of exit code

Willy Tarreau <[email protected]>
tools/nolibc: i386: fix initial stack alignment

Ammar Faizi <[email protected]>
tools/nolibc: x86-64: Fix startup code bug

Lucas De Marchi <[email protected]>
x86/gpu: Reserve stolen memory for first integrated Intel GPU

Paul Cercueil <[email protected]>
mtd: rawnand: davinci: Rewrite function description

Paul Cercueil <[email protected]>
mtd: rawnand: davinci: Avoid duplicated page read

Paul Cercueil <[email protected]>
mtd: rawnand: davinci: Don't calculate ECC when reading page

Andreas Oetken <[email protected]>
mtd: Fixed breaking list in __mtd_del_partition.

Stefan Riedmueller <[email protected]>
mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6

Christian Eggers <[email protected]>
mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings

Krzysztof Kozlowski <[email protected]>
nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()

Chao Yu <[email protected]>
f2fs: fix to do sanity check in is_alive()

Jason Gerecke <[email protected]>
HID: wacom: Avoid using stale array indicies to read contact count

Jason Gerecke <[email protected]>
HID: wacom: Ignore the confidence flag when a touch is removed

Jason Gerecke <[email protected]>
HID: wacom: Reset expected and received contact counts at the same time

Jann Horn <[email protected]>
HID: uhid: Fix worker destroying device without any protection

Marcelo Tosatti <[email protected]>
KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock

-------------

Diffstat:

 .../ABI/testing/sysfs-bus-iio-lptimer-stm32        |  62 --
 Documentation/admin-guide/hw-vuln/spectre.rst      |   2 +-
 .../bindings/display/amlogic,meson-dw-hdmi.yaml    |   5 +
 .../bindings/display/amlogic,meson-vpu.yaml        |   6 +
 .../devicetree/bindings/thermal/thermal-zones.yaml |   9 +-
 .../devicetree/bindings/watchdog/samsung-wdt.yaml  |   5 +-
 Documentation/driver-api/dmaengine/dmatest.rst     |   7 +-
 Documentation/driver-api/firewire.rst              |   4 +-
 .../acpi/dsd/data-node-references.rst              |  10 +-
 Makefile                                           |   4 +-
 arch/arm/Kconfig.debug                             |  14 +-
 arch/arm/boot/compressed/efi-header.S              |  22 +-
 arch/arm/boot/compressed/head.S                    |   3 +-
 arch/arm/boot/dts/armada-38x.dtsi                  |   4 +-
 arch/arm/boot/dts/gemini-nas4220b.dts              |   2 +-
 arch/arm/boot/dts/omap3-n900.dts                   |  50 +-
 arch/arm/boot/dts/stm32f429-disco.dts              |   2 +-
 arch/arm/include/debug/imx-uart.h                  |  18 +-
 arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c |   5 +-
 arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi  |   2 +-
 .../boot/dts/amlogic/meson-g12b-odroid-n2.dtsi     |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi  |   3 +
 arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts  |  14 +-
 arch/arm64/boot/dts/marvell/cn9130.dtsi            |  15 +
 arch/arm64/boot/dts/nvidia/tegra186.dtsi           |   2 +-
 arch/arm64/boot/dts/nvidia/tegra194.dtsi           |   9 +-
 arch/arm64/boot/dts/qcom/ipq6018.dtsi              |   2 +-
 arch/arm64/boot/dts/qcom/msm8916.dtsi              |   4 +-
 arch/arm64/boot/dts/qcom/msm8996.dtsi              |   3 -
 .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts      |  27 +
 arch/arm64/boot/dts/renesas/cat875.dtsi            |   1 +
 arch/arm64/boot/dts/ti/k3-j7200-main.dtsi          |   2 +-
 arch/arm64/boot/dts/ti/k3-j7200.dtsi               |   6 +-
 arch/arm64/boot/dts/ti/k3-j721e.dtsi               |   6 +-
 arch/arm64/include/asm/extable.h                   |   9 -
 arch/arm64/include/asm/memory.h                    |   5 +-
 arch/arm64/kernel/traps.c                          |   2 +-
 arch/arm64/lib/clear_page.S                        |  14 +-
 arch/arm64/lib/copy_page.S                         |   4 +-
 arch/arm64/mm/ptdump.c                             |   2 -
 arch/arm64/net/bpf_jit_comp.c                      |   7 +-
 arch/mips/Kconfig                                  |   6 +-
 arch/mips/bcm63xx/clk.c                            |   6 +
 arch/mips/cavium-octeon/octeon-platform.c          |   2 +
 arch/mips/cavium-octeon/octeon-usb.c               |   1 +
 .../asm/mach-loongson64/kernel-entry-init.h        |   4 +-
 arch/mips/include/asm/octeon/cvmx-bootinfo.h       |   4 +-
 arch/mips/lantiq/clk.c                             |   6 +
 arch/openrisc/include/asm/syscalls.h               |   2 +
 arch/openrisc/kernel/entry.S                       |   5 +
 arch/parisc/include/asm/special_insns.h            |  44 +-
 arch/parisc/kernel/traps.c                         |   2 +-
 arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi      |   2 +
 arch/powerpc/include/asm/cpu_setup_power.h         |  12 +
 arch/powerpc/include/asm/hw_irq.h                  |  51 +-
 arch/powerpc/include/asm/reg.h                     |   1 +
 arch/powerpc/kernel/btext.c                        |   4 +-
 arch/powerpc/kernel/cpu_setup_power.S              | 252 ------
 arch/powerpc/kernel/cpu_setup_power.c              | 272 ++++++
 arch/powerpc/kernel/cputable.c                     |  12 +-
 arch/powerpc/kernel/dt_cpu_ftrs.c                  |   1 +
 arch/powerpc/kernel/fadump.c                       |   8 +
 arch/powerpc/kernel/head_40x.S                     |   9 +-
 arch/powerpc/kernel/prom_init.c                    |   2 +-
 arch/powerpc/kernel/smp.c                          |  42 +
 arch/powerpc/kernel/traps.c                        |  31 +-
 arch/powerpc/kernel/watchdog.c                     |  41 +-
 arch/powerpc/kvm/book3s_hv.c                       |   8 +-
 arch/powerpc/kvm/book3s_hv_nested.c                |   2 +-
 arch/powerpc/mm/book3s64/radix_pgtable.c           |   4 +-
 arch/powerpc/mm/kasan/book3s_32.c                  |   3 +-
 arch/powerpc/mm/pgtable_64.c                       |  14 +-
 arch/powerpc/perf/core-book3s.c                    |  97 ++-
 arch/powerpc/perf/core-fsl-emb.c                   |  25 -
 arch/powerpc/perf/isa207-common.c                  |   8 +
 arch/powerpc/platforms/cell/iommu.c                |   1 +
 arch/powerpc/platforms/cell/pervasive.c            |   1 +
 arch/powerpc/platforms/embedded6xx/hlwd-pic.c      |   1 +
 arch/powerpc/platforms/powermac/low_i2c.c          |   3 +
 arch/powerpc/platforms/powernv/opal-lpc.c          |   1 +
 arch/powerpc/sysdev/xive/spapr.c                   |   3 +
 arch/s390/mm/pgalloc.c                             |   4 +-
 arch/um/drivers/virtio_uml.c                       |   4 +
 arch/um/include/asm/delay.h                        |   4 +-
 arch/um/include/shared/registers.h                 |   4 +-
 arch/um/os-Linux/registers.c                       |   4 +-
 arch/um/os-Linux/start_up.c                        |   2 +-
 arch/x86/boot/compressed/Makefile                  |   7 +-
 arch/x86/configs/i386_defconfig                    |   1 +
 arch/x86/configs/x86_64_defconfig                  |   1 +
 arch/x86/include/asm/realmode.h                    |   1 +
 arch/x86/include/asm/uaccess.h                     |   5 +-
 arch/x86/kernel/cpu/mce/core.c                     |  42 +-
 arch/x86/kernel/cpu/mce/inject.c                   |   2 +-
 arch/x86/kernel/early-quirks.c                     |  10 +-
 arch/x86/kernel/reboot.c                           |  12 +-
 arch/x86/kernel/tsc.c                              |   1 +
 arch/x86/kvm/vmx/posted_intr.c                     |  16 +-
 arch/x86/realmode/init.c                           |  26 +
 arch/x86/um/syscalls_64.c                          |   3 +-
 block/blk-flush.c                                  |   4 +-
 block/blk-pm.c                                     |  22 +-
 crypto/jitterentropy.c                             |   3 +-
 drivers/acpi/acpica/exfield.c                      |   7 +-
 drivers/acpi/acpica/exoparg1.c                     |   3 +-
 drivers/acpi/acpica/hwesleep.c                     |   4 +-
 drivers/acpi/acpica/hwsleep.c                      |   4 +-
 drivers/acpi/acpica/hwxfsleep.c                    |   2 -
 drivers/acpi/acpica/utdelete.c                     |   1 +
 drivers/acpi/battery.c                             |  22 +
 drivers/acpi/bus.c                                 |   4 +-
 drivers/acpi/ec.c                                  |  57 +-
 drivers/acpi/internal.h                            |   2 +
 drivers/acpi/scan.c                                |  13 +-
 drivers/acpi/x86/utils.c                           | 116 ++-
 drivers/android/binder.c                           |   4 +-
 drivers/base/core.c                                |   3 +-
 drivers/base/power/runtime.c                       |  41 +-
 drivers/base/property.c                            |   4 +-
 drivers/base/regmap/regmap.c                       |   1 +
 drivers/base/swnode.c                              |   2 +-
 drivers/block/floppy.c                             |   6 +-
 drivers/bluetooth/btmtksdio.c                      |   2 +
 drivers/bluetooth/hci_bcm.c                        |   7 +-
 drivers/bluetooth/hci_qca.c                        |   5 +-
 drivers/bluetooth/hci_vhci.c                       |   2 +
 drivers/char/mwave/3780i.h                         |   2 +-
 drivers/char/random.c                              |  19 +-
 drivers/char/tpm/tpm_tis_core.c                    |  14 +-
 drivers/clk/bcm/clk-bcm2835.c                      |  13 +-
 drivers/clk/clk-bm1880.c                           |  20 +-
 drivers/clk/clk-si5341.c                           |   2 +-
 drivers/clk/clk-stm32f4.c                          |   4 -
 drivers/clk/clk.c                                  |  18 +
 drivers/clk/imx/clk-imx8mn.c                       |   6 +-
 drivers/clk/meson/gxbb.c                           |  44 +-
 drivers/counter/Kconfig                            |   2 +-
 drivers/counter/stm32-lptimer-cnt.c                | 297 +------
 drivers/cpufreq/cpufreq.c                          |   4 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   2 +-
 drivers/crypto/omap-aes.c                          |   2 +-
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c      |  45 +-
 drivers/crypto/qat/qat_common/adf_vf2pf_msg.c      |   4 +-
 drivers/crypto/qce/sha.c                           |   2 +-
 drivers/crypto/qce/skcipher.c                      |   2 +-
 drivers/crypto/stm32/stm32-crc32.c                 |   4 +-
 drivers/crypto/stm32/stm32-cryp.c                  | 938 ++++++++-------------
 drivers/crypto/stm32/stm32-hash.c                  |   6 +-
 drivers/dma-buf/dma-fence-array.c                  |   6 +-
 drivers/dma/at_xdmac.c                             |  57 +-
 drivers/dma/mmp_pdma.c                             |   6 -
 drivers/dma/pxa_dma.c                              |   7 -
 drivers/dma/stm32-mdma.c                           |   2 +-
 drivers/dma/uniphier-xdmac.c                       |   5 +-
 drivers/edac/synopsys_edac.c                       |   3 +-
 drivers/firmware/google/Kconfig                    |   6 +-
 drivers/gpio/gpio-aspeed.c                         |  52 +-
 drivers/gpio/gpiolib-acpi.c                        |  15 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c     |   6 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c            |   1 -
 drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c              |  13 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   3 +
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   3 +-
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |   6 +
 drivers/gpu/drm/bridge/analogix/analogix_dp_reg.c  |  14 +-
 drivers/gpu/drm/bridge/display-connector.c         |   2 +-
 .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c   |  40 +-
 .../gpu/drm/bridge/synopsys/dw-hdmi-ahb-audio.c    |  10 +-
 drivers/gpu/drm/bridge/synopsys/dw-hdmi-audio.h    |   4 +-
 .../gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c    |   9 +-
 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c          |  12 +-
 drivers/gpu/drm/bridge/ti-sn65dsi86.c              |   1 +
 drivers/gpu/drm/drm_drv.c                          |   9 +-
 drivers/gpu/drm/drm_panel_orientation_quirks.c     |   6 +
 drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c       |   6 +
 drivers/gpu/drm/etnaviv/etnaviv_gpu.h              |   1 +
 drivers/gpu/drm/etnaviv/etnaviv_sched.c            |   4 +-
 drivers/gpu/drm/lima/lima_device.c                 |   1 +
 drivers/gpu/drm/mediatek/mtk_mipi_tx.c             |   2 +
 drivers/gpu/drm/msm/Kconfig                        |   1 +
 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c            |   4 +-
 drivers/gpu/drm/nouveau/dispnv04/disp.c            |   4 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c     |  37 +-
 drivers/gpu/drm/panel/panel-innolux-p079zca.c      |  10 +-
 drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c |   8 +-
 drivers/gpu/drm/radeon/radeon_kms.c                |  42 +-
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c             |  20 +-
 drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c    |  82 +-
 drivers/gpu/drm/tegra/vic.c                        |   7 +-
 drivers/gpu/drm/ttm/ttm_bo.c                       |   2 +
 drivers/gpu/drm/vboxvideo/vbox_main.c              |   4 +-
 drivers/gpu/drm/vc4/vc4_hdmi.c                     |  24 +-
 drivers/gpu/host1x/dev.c                           |  15 +
 drivers/hid/hid-apple.c                            |   2 +-
 drivers/hid/hid-input.c                            |   6 +
 drivers/hid/hid-uclogic-params.c                   |  31 +-
 drivers/hid/hid-vivaldi.c                          |  34 +-
 drivers/hid/uhid.c                                 |  29 +-
 drivers/hid/wacom_wac.c                            |  39 +-
 drivers/hsi/hsi_core.c                             |   1 +
 drivers/hwmon/mr75203.c                            |   2 +-
 drivers/i2c/busses/i2c-designware-pcidrv.c         |   8 +-
 drivers/i2c/busses/i2c-i801.c                      |  15 +-
 drivers/i2c/busses/i2c-mpc.c                       |  23 +-
 drivers/iio/adc/ti-adc081c.c                       |  22 +-
 drivers/infiniband/core/cma.c                      |  12 +-
 drivers/infiniband/core/device.c                   |   3 +-
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c         |   6 +-
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.h         |   1 -
 drivers/infiniband/hw/cxgb4/qp.c                   |   1 +
 drivers/infiniband/hw/hns/hns_roce_main.c          |   5 +-
 drivers/infiniband/hw/qedr/verbs.c                 |   2 +
 drivers/infiniband/sw/rxe/rxe_opcode.c             |   2 +-
 drivers/iommu/amd/init.c                           |  48 +-
 drivers/iommu/io-pgtable-arm-v7s.c                 |   6 +-
 drivers/iommu/io-pgtable-arm.c                     |   9 +-
 drivers/iommu/iova.c                               |   3 +-
 drivers/irqchip/irq-gic-v3.c                       |  16 +
 drivers/md/dm.c                                    |   4 +-
 drivers/md/persistent-data/dm-btree.c              |   8 +-
 drivers/md/persistent-data/dm-space-map-common.c   |   5 +
 drivers/media/Kconfig                              |   8 +-
 drivers/media/cec/core/cec-pin.c                   |  31 +-
 drivers/media/common/saa7146/saa7146_fops.c        |   2 +-
 .../media/common/videobuf2/videobuf2-dma-contig.c  |   8 +-
 drivers/media/dvb-core/dmxdev.c                    |  18 +-
 drivers/media/dvb-frontends/dib8000.c              |   4 +-
 drivers/media/pci/b2c2/flexcop-pci.c               |   3 +
 drivers/media/pci/saa7146/hexium_gemini.c          |   7 +-
 drivers/media/pci/saa7146/hexium_orion.c           |   8 +-
 drivers/media/pci/saa7146/mxb.c                    |   8 +-
 drivers/media/platform/aspeed-video.c              |  14 +-
 drivers/media/platform/coda/coda-common.c          |   8 +-
 drivers/media/platform/coda/coda-jpeg.c            |  21 +-
 drivers/media/platform/coda/imx-vdoa.c             |   6 +-
 drivers/media/platform/imx-pxp.c                   |   4 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c |   2 +-
 drivers/media/platform/qcom/venus/core.c           |  39 +-
 drivers/media/platform/qcom/venus/core.h           |   2 -
 drivers/media/platform/qcom/venus/pm_helpers.c     |  94 +--
 drivers/media/platform/qcom/venus/pm_helpers.h     |   7 +-
 drivers/media/platform/rcar-vin/rcar-csi2.c        |  18 +-
 drivers/media/platform/rcar-vin/rcar-v4l2.c        |  15 +-
 drivers/media/radio/si470x/radio-si470x-i2c.c      |   3 +-
 drivers/media/rc/igorplugusb.c                     |   4 +-
 drivers/media/rc/mceusb.c                          |   8 +-
 drivers/media/rc/redrat3.c                         |  22 +-
 drivers/media/tuners/msi001.c                      |   7 +
 drivers/media/tuners/si2157.c                      |   2 +-
 drivers/media/usb/b2c2/flexcop-usb.c               |  10 +-
 drivers/media/usb/b2c2/flexcop-usb.h               |  12 +-
 drivers/media/usb/cpia2/cpia2_usb.c                |   4 +-
 drivers/media/usb/dvb-usb/dib0700_core.c           |   2 -
 drivers/media/usb/dvb-usb/dw2102.c                 | 338 +++++---
 drivers/media/usb/dvb-usb/m920x.c                  |  12 +-
 drivers/media/usb/em28xx/em28xx-cards.c            |  18 +-
 drivers/media/usb/em28xx/em28xx-core.c             |   4 +-
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c            |   8 +-
 drivers/media/usb/s2255/s2255drv.c                 |   4 +-
 drivers/media/usb/stk1160/stk1160-core.c           |   4 +-
 drivers/media/usb/uvc/uvcvideo.h                   |   2 +-
 drivers/media/v4l2-core/v4l2-ioctl.c               |   4 +-
 drivers/memory/renesas-rpc-if.c                    |   2 +-
 drivers/mfd/atmel-flexcom.c                        |  11 +-
 drivers/misc/lattice-ecp3-config.c                 |  12 +-
 drivers/misc/lkdtm/Makefile                        |   2 +-
 drivers/mmc/core/sdio.c                            |   4 +-
 drivers/mmc/host/meson-mx-sdhc-mmc.c               |   5 +
 drivers/mmc/host/meson-mx-sdio.c                   |   5 +
 drivers/mtd/hyperbus/rpc-if.c                      |   8 +-
 drivers/mtd/mtdpart.c                              |   2 +-
 drivers/mtd/nand/bbt.c                             |   2 +-
 drivers/mtd/nand/raw/davinci_nand.c                |  16 +-
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c         |  37 +-
 drivers/net/bonding/bond_main.c                    |  36 +-
 drivers/net/can/softing/softing_cs.c               |   2 +-
 drivers/net/can/softing/softing_fw.c               |  11 +-
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c     |   6 +-
 drivers/net/can/xilinx_can.c                       |   7 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |  10 +-
 drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c  |   3 +-
 drivers/net/ethernet/cortina/gemini.c              |   9 +-
 drivers/net/ethernet/freescale/fman/mac.c          |  21 +-
 drivers/net/ethernet/freescale/xgmac_mdio.c        |  28 +-
 drivers/net/ethernet/i825xx/sni_82596.c            |   3 +-
 drivers/net/ethernet/mediatek/mtk_eth_soc.c        |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |  36 +-
 .../net/ethernet/mellanox/mlx5/core/en/xsk/pool.c  |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  10 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c   |   6 +-
 drivers/net/ethernet/mellanox/mlxsw/cmd.h          |  12 +
 drivers/net/ethernet/mellanox/mlxsw/pci.c          |   7 +-
 drivers/net/ethernet/mscc/ocelot_flower.c          |  15 +-
 drivers/net/ethernet/rocker/rocker_ofdpa.c         |   3 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  | 135 +--
 drivers/net/phy/marvell.c                          |   6 +
 drivers/net/phy/mdio_bus.c                         |   2 +-
 drivers/net/phy/phy-core.c                         |   2 +-
 drivers/net/phy/sfp.c                              |  25 +-
 drivers/net/ppp/ppp_generic.c                      |   7 +-
 drivers/net/usb/mcs7830.c                          |  12 +-
 drivers/net/wireless/ath/ar5523/ar5523.c           |   4 +
 drivers/net/wireless/ath/ath10k/core.c             |  19 +-
 drivers/net/wireless/ath/ath10k/htt_tx.c           |   3 +
 drivers/net/wireless/ath/ath10k/hw.h               |   3 +
 drivers/net/wireless/ath/ath10k/txrx.c             |   2 -
 drivers/net/wireless/ath/ath11k/ahb.c              |  28 +-
 drivers/net/wireless/ath/ath11k/core.h             |   2 +-
 drivers/net/wireless/ath/ath11k/dp.h               |   3 +-
 drivers/net/wireless/ath/ath11k/dp_tx.c            |   2 +-
 drivers/net/wireless/ath/ath11k/hal.c              |  22 +
 drivers/net/wireless/ath/ath11k/hal.h              |   2 +
 drivers/net/wireless/ath/ath11k/hw.c               |   2 -
 drivers/net/wireless/ath/ath11k/mac.c              |  52 +-
 drivers/net/wireless/ath/ath11k/pci.c              |  12 +-
 drivers/net/wireless/ath/ath11k/reg.c              | 103 +--
 drivers/net/wireless/ath/ath11k/wmi.c              |   5 +-
 drivers/net/wireless/ath/ath9k/hif_usb.c           |   7 +
 drivers/net/wireless/ath/wcn36xx/dxe.c             |  49 +-
 drivers/net/wireless/ath/wcn36xx/main.c            |  34 +-
 drivers/net/wireless/ath/wcn36xx/smd.c             |   8 +-
 drivers/net/wireless/ath/wcn36xx/txrx.c            |  41 +-
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h         |   1 +
 drivers/net/wireless/intel/iwlwifi/iwl-drv.c       |  17 +-
 .../net/wireless/intel/iwlwifi/mvm/ftm-initiator.c |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |  17 +
 drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c      |  27 +
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c      |   2 +-
 .../net/wireless/intel/iwlwifi/mvm/time-event.c    |  27 +-
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c       |   7 +-
 drivers/net/wireless/intel/iwlwifi/queue/tx.c      |   1 +
 drivers/net/wireless/marvell/mwifiex/sta_event.c   |   8 +-
 drivers/net/wireless/marvell/mwifiex/usb.c         |   3 +-
 drivers/net/wireless/realtek/rtw88/main.c          |   2 +-
 drivers/net/wireless/realtek/rtw88/rtw8821c.h      |   2 +-
 drivers/net/wireless/realtek/rtw88/rtw8822b.c      |   2 +-
 drivers/net/wireless/realtek/rtw88/rtw8822c.c      |   2 +-
 drivers/net/wireless/rsi/rsi_91x_main.c            |   4 +
 drivers/net/wireless/rsi/rsi_91x_usb.c             |   9 +-
 drivers/net/wireless/rsi/rsi_usb.h                 |   2 +
 drivers/nvmem/core.c                               |   2 +
 drivers/of/base.c                                  |  11 +-
 drivers/of/unittest.c                              |  21 +-
 drivers/parisc/pdc_stable.c                        |   4 +-
 drivers/pci/controller/pci-aardvark.c              |   4 +-
 drivers/pci/controller/pci-mvebu.c                 |   8 +
 drivers/pci/controller/pci-xgene.c                 |   2 +-
 drivers/pci/hotplug/pciehp.h                       |   3 +
 drivers/pci/hotplug/pciehp_core.c                  |   2 +-
 drivers/pci/hotplug/pciehp_hpc.c                   |  28 +-
 drivers/pci/msi.c                                  |  26 +-
 drivers/pci/pci-bridge-emul.c                      |  70 +-
 drivers/pci/quirks.c                               |   3 +
 drivers/pcmcia/cs.c                                |   8 +-
 drivers/pcmcia/rsrc_nonstatic.c                    |   6 +
 drivers/phy/socionext/phy-uniphier-usb3ss.c        |  10 +-
 drivers/power/reset/mt6323-poweroff.c              |   3 +
 drivers/regulator/qcom_smd-regulator.c             | 100 ++-
 drivers/rpmsg/rpmsg_core.c                         |  20 +-
 drivers/rtc/rtc-cmos.c                             |   3 +
 drivers/rtc/rtc-pxa.c                              |   4 +
 drivers/scsi/lpfc/lpfc.h                           |   2 +-
 drivers/scsi/lpfc/lpfc_attr.c                      |  62 +-
 drivers/scsi/lpfc/lpfc_hbadisc.c                   |   8 +-
 drivers/scsi/lpfc/lpfc_sli.c                       |   6 -
 drivers/scsi/pm8001/pm8001_hwi.c                   |   4 +-
 drivers/scsi/scsi_debugfs.c                        |   1 +
 drivers/scsi/scsi_pm.c                             |   2 +-
 drivers/scsi/sr.c                                  |   2 +-
 drivers/scsi/sr_vendor.c                           |   4 +-
 drivers/scsi/ufs/tc-dwc-g210-pci.c                 |   1 -
 drivers/scsi/ufs/ufshcd-pci.c                      |   2 -
 drivers/scsi/ufs/ufshcd-pltfrm.c                   |   2 -
 drivers/scsi/ufs/ufshcd.c                          |   7 +
 drivers/soc/mediatek/mtk-scpsys.c                  |  15 +-
 drivers/soc/qcom/cpr.c                             |   2 +-
 drivers/soc/ti/pruss.c                             |   2 +-
 drivers/spi/spi-meson-spifc.c                      |   1 +
 drivers/spi/spi-uniphier.c                         |  11 +-
 drivers/staging/greybus/audio_topology.c           |  15 +
 drivers/staging/media/atomisp/i2c/ov2680.h         |  24 -
 drivers/staging/media/atomisp/pci/atomisp_cmd.c    |  92 +-
 drivers/staging/media/atomisp/pci/atomisp_fops.c   |  11 +
 .../media/atomisp/pci/atomisp_gmin_platform.c      |   2 +-
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c  | 185 +++-
 drivers/staging/media/atomisp/pci/atomisp_subdev.c |  15 +-
 drivers/staging/media/atomisp/pci/atomisp_subdev.h |   3 +
 drivers/staging/media/atomisp/pci/atomisp_v4l2.c   |  13 +-
 drivers/staging/media/atomisp/pci/atomisp_v4l2.h   |   3 +-
 drivers/staging/media/atomisp/pci/sh_css.c         |  27 +-
 drivers/staging/media/atomisp/pci/sh_css_mipi.c    |  41 +-
 drivers/staging/media/atomisp/pci/sh_css_params.c  |   8 +-
 drivers/staging/media/hantro/hantro_drv.c          |   3 +-
 drivers/staging/rtl8192e/rtllib.h                  |   2 +-
 drivers/staging/rtl8192e/rtllib_module.c           |  16 +-
 drivers/staging/rtl8192e/rtllib_softmac.c          |   6 +-
 drivers/tee/tee_core.c                             |   4 +-
 drivers/thermal/imx8mm_thermal.c                   |   3 +
 drivers/thermal/imx_thermal.c                      | 145 ++--
 drivers/thunderbolt/acpi.c                         |  13 +
 drivers/tty/serial/amba-pl010.c                    |   3 -
 drivers/tty/serial/amba-pl011.c                    |  27 +-
 drivers/tty/serial/atmel_serial.c                  |  14 +
 drivers/tty/serial/imx.c                           |   7 +-
 drivers/tty/serial/serial_core.c                   |   7 +-
 drivers/tty/serial/uartlite.c                      |   2 +-
 drivers/uio/uio_dmem_genirq.c                      |   6 +-
 drivers/usb/core/hub.c                             |   5 +-
 drivers/usb/dwc3/dwc3-qcom.c                       |   7 +-
 drivers/usb/gadget/function/f_fs.c                 |   4 +-
 drivers/usb/host/uhci-platform.c                   |   3 +-
 drivers/usb/misc/ftdi-elan.c                       |   1 +
 drivers/vdpa/mlx5/net/mlx5_vnet.c                  |   2 -
 drivers/video/backlight/qcom-wled.c                | 122 +--
 drivers/virtio/virtio_ring.c                       |   4 +-
 drivers/w1/slaves/w1_ds28e04.c                     |  26 +-
 drivers/xen/gntdev.c                               |   6 +-
 fs/btrfs/backref.c                                 |  21 +-
 fs/btrfs/ctree.c                                   |  19 +-
 fs/btrfs/inode.c                                   |  11 +
 fs/btrfs/qgroup.c                                  |  19 +
 fs/debugfs/file.c                                  |   2 +-
 fs/dlm/lock.c                                      |   9 +
 fs/dlm/lowcomms.c                                  |  45 +-
 fs/ext4/ext4.h                                     |   1 +
 fs/ext4/ext4_jbd2.c                                |   2 +
 fs/ext4/extents.c                                  |   2 -
 fs/ext4/fast_commit.c                              |  18 +-
 fs/ext4/inode.c                                    |  14 +-
 fs/ext4/ioctl.c                                    |   2 -
 fs/ext4/mballoc.c                                  |  48 +-
 fs/ext4/migrate.c                                  |  23 +-
 fs/ext4/super.c                                    |  27 +-
 fs/f2fs/compress.c                                 |  50 +-
 fs/f2fs/f2fs.h                                     |  11 +
 fs/f2fs/gc.c                                       |   3 +
 fs/f2fs/segment.h                                  |   3 +-
 fs/f2fs/super.c                                    |  44 +
 fs/f2fs/sysfs.c                                    |   4 +-
 fs/fuse/file.c                                     |   2 +-
 fs/jffs2/file.c                                    |  40 +-
 fs/ubifs/super.c                                   |   1 -
 fs/udf/ialloc.c                                    |   2 +
 include/acpi/acpi_bus.h                            |   5 +-
 include/acpi/actypes.h                             |  10 +-
 include/linux/blk-pm.h                             |   2 +-
 include/linux/bpf_verifier.h                       |   7 +
 include/linux/clocksource.h                        |   3 +
 include/linux/hid.h                                |   2 +
 include/linux/mmzone.h                             |   9 +
 include/linux/pm_runtime.h                         |   3 +
 include/net/inet_frag.h                            |  11 +-
 include/net/ipv6_frag.h                            |   3 +-
 include/net/sch_generic.h                          |   5 +
 include/net/xfrm.h                                 |   5 +
 include/trace/events/cgroup.h                      |  12 +-
 include/uapi/linux/xfrm.h                          |   1 +
 kernel/audit.c                                     |  18 +-
 kernel/bpf/btf.c                                   |   3 +-
 kernel/bpf/verifier.c                              |  18 +-
 kernel/dma/pool.c                                  |   4 +-
 kernel/rcu/tree_exp.h                              |   1 +
 kernel/sched/cputime.c                             |   4 +-
 kernel/sched/fair.c                                |   4 +-
 kernel/sched/rt.c                                  |  23 +-
 kernel/time/clocksource.c                          |  96 ++-
 kernel/time/jiffies.c                              |  15 +-
 kernel/trace/bpf_trace.c                           |   6 +-
 kernel/trace/trace_kprobe.c                        |   5 +-
 kernel/tsacct.c                                    |   7 +-
 lib/mpi/mpi-mod.c                                  |   2 +
 lib/test_hmm.c                                     |  24 +
 lib/test_meminit.c                                 |   1 +
 mm/hmm.c                                           |   5 +-
 mm/page_alloc.c                                    |  19 +-
 mm/shmem.c                                         |  37 +-
 net/ax25/af_ax25.c                                 |  10 +-
 net/batman-adv/netlink.c                           |  30 +-
 net/bluetooth/cmtp/core.c                          |   4 +-
 net/bluetooth/hci_core.c                           |   1 +
 net/bluetooth/hci_event.c                          |   8 +-
 net/bluetooth/hci_request.c                        |   2 +-
 net/bluetooth/l2cap_sock.c                         |  45 +-
 net/bridge/br_netfilter_hooks.c                    |   7 +-
 net/core/dev.c                                     |   6 +
 net/core/devlink.c                                 |   2 -
 net/core/filter.c                                  |   8 +-
 net/core/net-sysfs.c                               |   3 +
 net/core/net_namespace.c                           |   4 +-
 net/ipv4/fib_semantics.c                           |  47 +-
 net/ipv4/inet_fragment.c                           |   8 +-
 net/ipv4/ip_fragment.c                             |   3 +-
 net/ipv4/ip_gre.c                                  |   5 +-
 net/ipv4/netfilter/ipt_CLUSTERIP.c                 |   5 +-
 net/ipv6/ip6_gre.c                                 |   5 +-
 net/mac80211/rx.c                                  |   2 +-
 net/netfilter/nft_set_pipapo.c                     |   8 +
 net/netrom/af_netrom.c                             |  12 +-
 net/nfc/llcp_sock.c                                |   5 +
 net/sched/sch_generic.c                            |   1 +
 net/smc/smc_core.c                                 |  17 +-
 net/unix/garbage.c                                 |  14 +-
 net/unix/scm.c                                     |   6 +-
 net/xfrm/xfrm_compat.c                             |   6 +-
 net/xfrm/xfrm_interface.c                          |  14 +-
 net/xfrm/xfrm_policy.c                             |  24 +-
 net/xfrm/xfrm_state.c                              |  23 +-
 net/xfrm/xfrm_user.c                               |  41 +-
 scripts/dtc/dtx_diff                               |   8 +-
 scripts/sphinx-pre-install                         |   3 +
 security/selinux/hooks.c                           |  12 +-
 sound/core/jack.c                                  |   3 +
 sound/core/oss/pcm_oss.c                           |   2 +-
 sound/core/pcm.c                                   |   6 +-
 sound/core/seq/seq_queue.c                         |  14 +-
 sound/pci/hda/hda_codec.c                          |   3 +
 sound/soc/codecs/rt5663.c                          |  12 +-
 sound/soc/fsl/fsl_asrc.c                           |  69 +-
 sound/soc/fsl/fsl_mqs.c                            |   2 +-
 sound/soc/intel/catpt/dsp.c                        |  14 +-
 sound/soc/mediatek/mt8173/mt8173-max98090.c        |   3 +
 sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c   |   2 +
 sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c   |   2 +
 sound/soc/mediatek/mt8173/mt8173-rt5650.c          |   2 +
 sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c |   6 +-
 .../mt8183/mt8183-mt6358-ts3a227-max98357.c        |   7 +-
 sound/soc/samsung/idma.c                           |   2 +
 sound/soc/uniphier/Kconfig                         |   2 -
 sound/usb/format.c                                 |   2 +-
 sound/usb/mixer_quirks.c                           |   2 +-
 sound/usb/quirks.c                                 |   2 +-
 tools/bpf/bpftool/Documentation/Makefile           |   1 -
 tools/bpf/bpftool/Makefile                         |   1 -
 tools/bpf/bpftool/main.c                           |   2 +
 tools/include/nolibc/nolibc.h                      |  33 +-
 tools/lib/bpf/libbpf.c                             |   4 +
 tools/perf/util/debug.c                            |   2 +-
 tools/perf/util/evsel.c                            |  25 +-
 tools/perf/util/probe-event.c                      |   3 +
 tools/testing/selftests/bpf/prog_tests/skb_ctx.c   |   2 +
 tools/testing/selftests/clone3/clone3.c            |   6 +
 .../selftests/ftrace/test.d/kprobe/profile.tc      |   2 +-
 tools/testing/selftests/kselftest_harness.h        |   2 +-
 .../selftests/powerpc/security/spectre_v2.c        |   2 +-
 tools/testing/selftests/vm/hmm-tests.c             |  42 +
 546 files changed, 5569 insertions(+), 3345 deletions(-)

From: Chao Yu <[email protected]>

commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream.

In fuzzed image, SSA table may indicate that a data block belongs to invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in order to avoid migrating inconsistent data in such corrupted image, let's do sanity check anyway before data block migration.

---
 fs/f2fs/gc.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -998,6 +998,9 @@ static bool is_alive(struct f2fs_sb_info
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
 	}
 
+	if (f2fs_check_nid_range(sbi, dni->ino))
+		return false;
+
 	*nofs = ofs_of_node(node_page);
 	source_blkaddr = data_blkaddr(NULL, node_page, ofs_in_node);
 	f2fs_put_page(node_page, 1);

From: Dan Carpenter <[email protected]>

[ Upstream commit 189723fbe9aca18d6f7d638c59a40288030932b5 ]

The "label" pointer is used for debug output. The code assumes that it is either NULL or valid, but it is never set to NULL. It is either valid or uninitialized.

---
 drivers/gpu/drm/bridge/display-connector.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 4d278573cdb99..544a47335cac4 100644
@@ -104,7 +104,7 @@ static int display_connector_probe(struct platform_device *pdev)
 {
 	struct display_connector *conn;
 	unsigned int type;
-	const char *label;
+	const char *label = NULL;
 	int ret;
 
 	conn = devm_kzalloc(&pdev->dev, sizeof(*conn), GFP_KERNEL);

2.34.1

From: Brian Norris <[email protected]>

[ Upstream commit 5f31dbeae8a88f31c3eb4eb526ab4807c40da241 ]

If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't ready), we leave a dangling drm_panel reference to freed memory. Clean that up on failure.

---
 drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 86e4213e8bb13..daccb1fd5fdad 100644
@@ -406,7 +406,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi)
 	if (err < 0)
 		return err;
 
-	return mipi_dsi_attach(dsi);
+	err = mipi_dsi_attach(dsi);
+	if (err < 0) {
+		kingdisplay_panel_del(kingdisplay);
+		return err;
+	}
+
+	return 0;
 }
 
 static int kingdisplay_panel_remove(struct mipi_dsi_device *dsi)

2.34.1

From: Brian Norris <[email protected]>

[ Upstream commit 251888398753924059f3bb247a44153a2853137f ]

Our probe() function never enabled this clock, so we shouldn't disable it if we fail to probe the bridge.

Noted by inspection.

---
 drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

index d0c9610ad2202..433b2f459a7d9 100644
@@ -1126,14 +1126,10 @@ static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev)
 		if (ret != -EPROBE_DEFER)
 			DRM_DEV_ERROR(dev,
 				      "Failed to probe dw_mipi_dsi: %d\n", ret);
-		goto err_clkdisable;
+		return ret;
 	}
 
 	return 0;
-
-err_clkdisable:
-	clk_disable_unprepare(dsi->pllref_clk);
-	return ret;
 }
 
 static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev)

2.34.1

From: Jann Horn <[email protected]>

commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream.

uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free).

Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler.

---
 drivers/hid/uhid.c |   29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

@@ -28,11 +28,22 @@
 
 struct uhid_device {
 	struct mutex devlock;
+
+	/* This flag tracks whether the HID device is usable for commands from
+	 * userspace. The flag is already set before hid_add_device(), which
+	 * runs in workqueue context, to allow hid_add_device() to communicate
+	 * with userspace.
+	 * However, if hid_add_device() fails, the flag is cleared without
+	 * holding devlock.
+	 * We guarantee that if @running changes from true to false while you're
+	 * holding @devlock, it's still fine to access @hid.
+	 */
 	bool running;
 
 	__u8 *rd_data;
 	uint rd_size;
 
+	/* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */
 	struct hid_device *hid;
 	struct uhid_event input_buf;
 

@@ -63,9 +74,18 @@ static void uhid_device_add_worker(struc
 	if (ret) {
 		hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
 
-		hid_destroy_device(uhid->hid);
-		uhid->hid = NULL;
+		/* We used to call hid_destroy_device() here, but that's really
+		 * messy to get right because we have to coordinate with
+		 * concurrent writes from userspace that might be in the middle
+		 * of using uhid->hid.
+		 * Just leave uhid->hid as-is for now, and clean it up when
+		 * userspace tries to close or reinitialize the uhid instance.
+		 *
+		 * However, we do have to clear the ->running flag and do a
+		 * wakeup to make sure userspace knows that the device is gone.
+		 */
 		uhid->running = false;
+		wake_up_interruptible(&uhid->report_wait);
 	}
 }
 

@@ -474,7 +494,7 @@ static int uhid_dev_create2(struct uhid_
 	void *rd_data;
 	int ret;
 
-	if (uhid->running)
+	if (uhid->hid)
 		return -EALREADY;
 
 	rd_size = ev->u.create2.rd_size;

@@ -556,7 +576,7 @@ static int uhid_dev_create(struct uhid_d
 
 static int uhid_dev_destroy(struct uhid_device *uhid)
 {
-	if (!uhid->running)
+	if (!uhid->hid)
 		return -EINVAL;
 
 	uhid->running = false;

@@ -565,6 +585,7 @@ static int uhid_dev_destroy(struct uhid_
 	cancel_work_sync(&uhid->worker);
 
 	hid_destroy_device(uhid->hid);
+	uhid->hid = NULL;
 	kfree(uhid->rd_data);
 
 	return 0;

From: Maxime Ripard <[email protected]>

[ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ]

The driver, once it found a divider, tries to round it up by increasing the least significant bit of the fractional part by one when the round_up argument is set and there's a remainder.

However, since it increases the divider it will actually reduce the clock rate below what we were asking for, leading to issues with clk_set_min_rate() that will complain that our rounded clock rate is below the minimum of the rate.

Since the dividers are fairly precise already, let's remove that part so that we can have clk_set_min_rate() working.

This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor").

---
 drivers/clk/bcm/clk-bcm2835.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

index a919ee9c3fcb8..178886823b90c 100644
@@ -933,8 +933,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw)
 
 static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
 				    unsigned long rate,
-				    unsigned long parent_rate,
-				    bool round_up)
+				    unsigned long parent_rate)
 {
 	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
 	const struct bcm2835_clock_data *data = clock->data;

@@ -946,10 +945,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw,
 
 	rem = do_div(temp, rate);
 	div = temp;
-
-	/* Round up and mask off the unused bits */
-	if (round_up && ((div & unused_frac_mask) != 0 || rem != 0))
-		div += unused_frac_mask + 1;
 	div &= ~unused_frac_mask;
 
 	/* different clamping limits apply for a mash clock */

@@ -1080,7 +1075,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw,
 	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
 	struct bcm2835_cprman *cprman = clock->cprman;
 	const struct bcm2835_clock_data *data = clock->data;
-	u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false);
+	u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate);
 	u32 ctl;
 
 	spin_lock(&cprman->regs_lock);

@@ -1131,7 +1126,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw,
 
 	if (!(BIT(parent_idx) & data->set_rate_parent)) {
 		*prate = clk_hw_get_rate(parent);
-		*div = bcm2835_clock_choose_div(hw, rate, *prate, true);
+		*div = bcm2835_clock_choose_div(hw, rate, *prate);
 
 		*avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div);
 

2.34.1

From: Maxime Ripard <[email protected]>

[ Upstream commit 3e85b81591609bb794bb00cd619b20965b5b38cd ]

When the firmware doesn't setup the HSM rate (such as when booting without an HDMI cable plugged in), its rate is 0 and thus any register access results in a CPU stall, even though HSM is enabled.

Let's enforce a minimum rate at boot to avoid this issue.

---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

index ee293f061f0a8..5d5c4e9a86218 100644
@@ -79,6 +79,7 @@
 # define VC4_HD_M_SW_RST			BIT(2)
 # define VC4_HD_M_ENABLE			BIT(0)
 
+#define HSM_MIN_CLOCK_FREQ	120000000
 #define CEC_CLOCK_FREQ 40000
 #define VC4_HSM_MID_CLOCK 149985000
 

@@ -1806,6 +1807,19 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
 	vc4_hdmi->disable_wifi_frequencies =
 		of_property_read_bool(dev->of_node, "wifi-2.4ghz-coexistence");
 
+	/*
+	 * If we boot without any cable connected to the HDMI connector,
+	 * the firmware will skip the HSM initialization and leave it
+	 * with a rate of 0, resulting in a bus lockup when we're
+	 * accessing the registers even if it's enabled.
+	 *
+	 * Let's put a sensible default at runtime_resume so that we
+	 * don't end up in this situation.
+	 */
+	ret = clk_set_min_rate(vc4_hdmi->hsm_clock, HSM_MIN_CLOCK_FREQ);
+	if (ret)
+		goto err_put_ddc;
+
 	if (vc4_hdmi->variant->reset)
 		vc4_hdmi->variant->reset(vc4_hdmi);
 

2.34.1

From: Willy Tarreau <[email protected]>

commit de0244ae40ae91145faaf164a4252347607c3711 upstream.

Ammar Faizi reported that our exit code handling is wrong. We truncate it to the lowest 8 bits but the syscall itself is expected to take a regular 32-bit signed integer, not an unsigned char. It's the kernel that later truncates it to the lowest 8 bits. The difference is visible in strace, where the program below used to show exit(255) instead of exit(-1):

  int main(void)
  {
        return -1;
  }

This patch applies the fix to all archs. x86_64, i386, arm64, armv7 and mips were all tested and confirmed to work fine now. Risc-v was not tested but the change is trivial and exactly the same as for other archs.

---
 tools/include/nolibc/nolibc.h |   13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

@@ -437,7 +437,7 @@ asm(".section .text\n"
     "xor %ebp, %ebp\n"          // zero the stack frame
     "and $-16, %rsp\n"          // x86 ABI : esp must be 16-byte aligned before call
     "call main\n"               // main() returns the status code, we'll exit with it.
-    "movzb %al, %rdi\n"         // retrieve exit code from 8 lower bits
+    "mov %eax, %edi\n"          // retrieve exit code (32 bit)
     "mov $60, %rax\n"           // NR_exit == 60
     "syscall\n"                 // really exit
     "hlt\n"                     // ensure it does not return

@@ -625,9 +625,9 @@ asm(".section .text\n"
     "push %ebx\n"               // support both regparm and plain stack modes
     "push %eax\n"
     "call main\n"               // main() returns the status code in %eax
-    "movzbl %al, %ebx\n"        // retrieve exit code from lower 8 bits
-    "movl   $1, %eax\n"         // NR_exit == 1
-    "int    $0x80\n"            // exit now
+    "mov %eax, %ebx\n"          // retrieve exit code (32-bit int)
+    "movl $1, %eax\n"           // NR_exit == 1
+    "int $0x80\n"               // exit now
     "hlt\n"                     // ensure it does not
     "");
 

@@ -811,7 +811,6 @@ asm(".section .text\n"
     "and %r3, %r1, $-8\n"         // AAPCS : sp must be 8-byte aligned in the
     "mov %sp, %r3\n"              //         callee, an bl doesn't push (lr=pc)
     "bl main\n"                   // main() returns the status code, we'll exit with it.
-    "and %r0, %r0, $0xff\n"       // limit exit code to 8 bits
     "movs r7, $1\n"               // NR_exit == 1
     "svc $0x00\n"
     "");

@@ -1008,7 +1007,6 @@ asm(".section .text\n"
     "add x2, x2, x1\n"            //           + argv
     "and sp, x1, -16\n"           // sp must be 16-byte aligned in the callee
     "bl main\n"                   // main() returns the status code, we'll exit with it.
-    "and x0, x0, 0xff\n"          // limit exit code to 8 bits
     "mov x8, 93\n"                // NR_exit == 93
     "svc #0\n"
     "");

@@ -1213,7 +1211,7 @@ asm(".section .text\n"
     "addiu $sp,$sp,-16\n"         // the callee expects to save a0..a3 there!
     "jal main\n"                  // main() returns the status code, we'll exit with it.
     "nop\n"                       // delayed slot
-    "and $a0, $v0, 0xff\n"        // limit exit code to 8 bits
+    "move $a0, $v0\n"             // retrieve 32-bit exit code from v0
     "li $v0, 4001\n"              // NR_exit == 4001
     "syscall\n"
     ".end __start\n"

@@ -1411,7 +1409,6 @@ asm(".section .text\n"
     "add   a2,a2,a1\n"           //             + argv
     "andi  sp,a1,-16\n"          // sp must be 16-byte aligned
     "call  main\n"               // main() returns the status code, we'll exit with it.
-    "andi  a0, a0, 0xff\n"       // limit exit code to 8 bits
     "li a7, 93\n"                // NR_exit == 93
     "ecall\n"
     "");

From: Hans Verkuil <[email protected]>

commit cd9d9377ed235b294a492a094e1666178a5e78fd upstream.

If V4L2_CAP_READWRITE is not set, then readbuffers must be set to 0, otherwise v4l2-compliance will complain.

A note on the Fixes tag below: this patch does not really fix that commit, but it can be applied from that commit onwards. For older code there is no guarantee that device_caps is set, so even though this patch would apply, it will not work reliably.

---
 drivers/media/v4l2-core/v4l2-ioctl.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -2127,6 +2127,7 @@ static int v4l_prepare_buf(const struct
 static int v4l_g_parm(const struct v4l2_ioctl_ops *ops,
 				struct file *file, void *fh, void *arg)
 {
+	struct video_device *vfd = video_devdata(file);
 	struct v4l2_streamparm *p = arg;
 	v4l2_std_id std;
 	int ret = check_fmt(file, p->type);

@@ -2138,7 +2139,8 @@ static int v4l_g_parm(const struct v4l2_
 	if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
 	    p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
 		return -EINVAL;
-	p->parm.capture.readbuffers = 2;
+	if (vfd->device_caps & V4L2_CAP_READWRITE)
+		p->parm.capture.readbuffers = 2;
 	ret = ops->vidioc_g_std(file, fh, &std);
 	if (ret == 0)
 		v4l2_video_std_frame_period(std, &p->parm.capture.timeperframe);

From: Benjamin Li <[email protected]>

[ Upstream commit c9c5608fafe4dae975c9644c7d14c51ad3b0ed73 ]

status.band is used in determination of status.rate -- for 5GHz on legacy rates there is a linear shift between the BD descriptor's rate field and the wcn36xx driver's rate table (wcn_5ghz_rates).

We have a special clause to populate status.band for hardware scan offload frames. However, this block occurs after status.rate is already populated. Correctly handle this dependency by moving the band block before the rate block.

This patch addresses kernel warnings & missing scan results for 5GHz APs that send their beacons/probe responses at the higher four legacy rates (24-54 Mbps), when using hardware scan offload:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4532 ieee80211_rx_napi+0x744/0x8d8
  Modules linked in: wcn36xx [...]
  CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         4.19.107-g73909fa #1
  Hardware name: Square, Inc. T2 (all variants) (DT)
  Call trace:
  dump_backtrace+0x0/0x148
  show_stack+0x14/0x1c
  dump_stack+0xb8/0xf0
  __warn+0x2ac/0x2d8
  warn_slowpath_null+0x44/0x54
  ieee80211_rx_napi+0x744/0x8d8
  ieee80211_tasklet_handler+0xa4/0xe0
  tasklet_action_common+0xe0/0x118
  tasklet_action+0x20/0x28
  __do_softirq+0x108/0x1ec
  irq_exit+0xd4/0xd8
  __handle_domain_irq+0x84/0xbc
  gic_handle_irq+0x4c/0xb8
  el1_irq+0xe8/0x190
  lpm_cpuidle_enter+0x220/0x260
  cpuidle_enter_state+0x114/0x1c0
  cpuidle_enter+0x34/0x48
  do_idle+0x150/0x268
  cpu_startup_entry+0x20/0x24
  rest_init+0xd4/0xe0
  start_kernel+0x398/0x430
  ---[ end trace ae28cb759352b403 ]---

---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 37 +++++++++++++------------
 1 file changed, 19 insertions(+), 18 deletions(-)

index bbd7194c82e27..f76de106570d2 100644
@@ -259,8 +259,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
 	fc = __le16_to_cpu(hdr->frame_control);
 	sn = IEEE80211_SEQ_TO_SN(__le16_to_cpu(hdr->seq_ctrl));
 
-	status.freq = WCN36XX_CENTER_FREQ(wcn);
-	status.band = WCN36XX_BAND(wcn);
 	status.mactime = 10;
 	status.signal = -get_rssi0(bd);
 	status.antenna = 1;

@@ -272,6 +270,25 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
 
 	wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x\n", status.flag);
 
+	if (bd->scan_learn) {
+		/* If packet originate from hardware scanning, extract the
+		 * band/channel from bd descriptor.
+		 */
+		u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
+
+		if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
+			status.band = NL80211_BAND_5GHZ;
+			status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
+								     status.band);
+		} else {
+			status.band = NL80211_BAND_2GHZ;
+			status.freq = ieee80211_channel_to_frequency(hwch, status.band);
+		}
+	} else {
+		status.band = WCN36XX_BAND(wcn);
+		status.freq = WCN36XX_CENTER_FREQ(wcn);
+	}
+
 	if (bd->rate_id < ARRAY_SIZE(wcn36xx_rate_table)) {
 		rate = &wcn36xx_rate_table[bd->rate_id];
 		status.encoding = rate->encoding;

@@ -298,22 +315,6 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
 	    ieee80211_is_probe_resp(hdr->frame_control))
 		status.boottime_ns = ktime_get_boottime_ns();
 
-	if (bd->scan_learn) {
-		/* If packet originates from hardware scanning, extract the
-		 * band/channel from bd descriptor.
-		 */
-		u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
-
-		if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
-			status.band = NL80211_BAND_5GHZ;
-			status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
-								     status.band);
-		} else {
-			status.band = NL80211_BAND_2GHZ;
-			status.freq = ieee80211_channel_to_frequency(hwch, status.band);
-		}
-	}
-
 	memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
 
 	if (ieee80211_is_beacon(hdr->frame_control)) {

2.34.1

From: Lucas De Marchi <[email protected]>

commit 9c494ca4d3a535f9ca11ad6af1813983c1c6cbdd upstream.

"Stolen memory" is memory set aside for use by an Intel integrated GPU. The intel_graphics_quirks() early quirk reserves this memory when it is called for a GPU that appears in the intel_early_ids[] table of integrated GPUs.

Previously intel_graphics_quirks() was marked as QFLAG_APPLY_ONCE, so it was called only for the first Intel GPU found. If a discrete GPU happened to be enumerated first, intel_graphics_quirks() was called for it but not for any integrated GPU found later. Therefore, stolen memory for such an integrated GPU was never reserved.

For example, this problem occurs in this Alderlake-P (integrated) + DG2 (discrete) topology where the DG2 is found first, but stolen memory is associated with the integrated GPU:

- 00:01.0 Bridge

    `- 03:00.0 DG2 discrete GPU

- 00:02.0 Integrated GPU (with stolen memory)

Remove the QFLAG_APPLY_ONCE flag and call intel_graphics_quirks() for every Intel GPU. Reserve stolen memory for the first GPU that appears in intel_early_ids[].

[bhelgaas: commit log, add code comment, squash in
https://lore.kernel.org/r/20220118190558.2ququ4vdfjuahicm@ldmartin-desk2]

---
 arch/x86/kernel/early-quirks.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

@@ -515,6 +515,7 @@ static const struct intel_early_ops gen1
 	.stolen_size = gen9_stolen_size,
 };
 
+/* Intel integrated GPUs for which we need to reserve "stolen memory" */
 static const struct pci_device_id intel_early_ids[] __initconst = {
 	INTEL_I830_IDS(&i830_early_ops),
 	INTEL_I845G_IDS(&i845_early_ops),

@@ -588,6 +589,13 @@ static void __init intel_graphics_quirks
 	u16 device;
 	int i;
 
+	/*
+	 * Reserve "stolen memory" for an integrated GPU.  If we've already
+	 * found one, there's nothing to do for other (discrete) GPUs.
+	 */
+	if (resource_size(&intel_graphics_stolen_res))
+		return;
+
 	device = read_pci_config_16(num, slot, func, PCI_DEVICE_ID);
 
 	for (i = 0; i < ARRAY_SIZE(intel_early_ids); i++) {

@@ -700,7 +708,7 @@ static struct chipset early_qrk[] __init
 	{ PCI_VENDOR_ID_INTEL, 0x3406, PCI_CLASS_BRIDGE_HOST,
 	  PCI_BASE_CLASS_BRIDGE, 0, intel_remapping_check },
 	{ PCI_VENDOR_ID_INTEL, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA, PCI_ANY_ID,
-	  QFLAG_APPLY_ONCE, intel_graphics_quirks },
+	  0, intel_graphics_quirks },
 	/*
 	 * HPET on the current version of the Baytrail platform has accuracy
 	 * problems: it will halt in deep idle state - so we disable it.

From: Yifeng Li <[email protected]>

commit e445375882883f69018aa669b67cbb37ec873406 upstream.

Like other SATA controller chips in the Marvell 88SE91xx series, the Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents it from working under IOMMU. Add it to the list of devices that need the quirk.

Without this patch, device initialization fails with DMA errors:

ata8: softreset failed (1st FIS failed)
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 [fault reason 0x02] Present bit in context entry is clear

After applying the patch, the controller can be successfully initialized:

ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330)
ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100
ata8.00: configured for UDMA/100
scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI: 5

---
 drivers/pci/quirks.c |    3 +++
 1 file changed, 3 insertions(+)

@@ -4077,6 +4077,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M
 			 quirk_dma_func1_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
 			 quirk_dma_func1_alias);
+/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c136 */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125,
+			 quirk_dma_func1_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
 			 quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */

From: Tsuchiya Yuto <[email protected]>

[ Upstream commit e1921cd14640f0f4d1fad5eb8e448c58a536415d ]

When config.mode is IA_CSS_INPUT_MODE_BUFFERED_SENSOR, it rather needs buffers. Fix it by inverting the return value.

---
 drivers/staging/media/atomisp/pci/sh_css_mipi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index d5ae7f0b5864b..e18c0cfb4ce3a 100644
@@ -389,17 +389,17 @@ static bool buffers_needed(struct ia_css_pipe *pipe)
 {
 	if (!IS_ISP2401) {
 		if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR)
-			return false;
-		else
 			return true;
+		else
+			return false;
 	}
 
 	if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR ||
 	    pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG ||
 	    pipe->stream->config.mode == IA_CSS_INPUT_MODE_PRBS)
-		return false;
+		return true;
 
-	return true;
+	return false;
 }
 
 int

2.34.1

From: Baoquan He <[email protected]>

commit c4dc63f0032c77464fbd4e7a6afc22fa6913c4a7 upstream.

In kdump kernel of x86_64, page allocation failure is observed:

kworker/u2:2: page allocation failure: order:0, mode:0xcc1(GFP_KERNEL|GFP_DMA), nodemask=(null),cpuset=/,mems_allowed=0

 CPU: 0 PID: 55 Comm: kworker/u2:2 Not tainted 5.16.0-rc4+ #5
 Hardware name: AMD Dinar/Dinar, BIOS RDN1505B 06/05/2013
 Workqueue: events_unbound async_run_entry_fn
 Call Trace:
  <TASK>
  dump_stack_lvl+0x48/0x5e
  warn_alloc.cold+0x72/0xd6
  __alloc_pages_slowpath.constprop.0+0xc69/0xcd0
  __alloc_pages+0x1df/0x210
  new_slab+0x389/0x4d0
  ___slab_alloc+0x58f/0x770
  __slab_alloc.constprop.0+0x4a/0x80
  kmem_cache_alloc_trace+0x24b/0x2c0
  sr_probe+0x1db/0x620
  ......
  device_add+0x405/0x920
  ......
  __scsi_add_device+0xe5/0x100
  ata_scsi_scan_host+0x97/0x1d0
  async_run_entry_fn+0x30/0x130
  process_one_work+0x1e8/0x3c0
  worker_thread+0x50/0x3b0
  ? rescuer_thread+0x350/0x350
  kthread+0x16b/0x190
  ? set_kthread_struct+0x40/0x40
  ret_from_fork+0x22/0x30
  </TASK>
 Mem-Info:
 ......

The above failure happened when calling kmalloc() to allocate buffer with GFP_DMA. It requests to allocate slab page from DMA zone while no managed pages at all in there.

sr_probe()
--> get_capabilities()

     --> buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);

Because in the current kernel, dma-kmalloc will be created as long as CONFIG_ZONE_DMA is enabled. However, kdump kernel of x86_64 doesn't have managed pages on DMA zone since commit 6f599d84231f ("x86/kdump: Always reserve the low 1M when the crashkernel option is specified"). The failure can be always reproduced.

For now, let's mute the warning of allocation failure if requesting pages from DMA zone while no managed pages.

[[email protected]: fix warning]

---
 mm/page_alloc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

@@ -3964,7 +3964,9 @@ void warn_alloc(gfp_t gfp_mask, nodemask
 	va_list args;
 	static DEFINE_RATELIMIT_STATE(nopage_rs, 10*HZ, 1);
 
-	if ((gfp_mask & __GFP_NOWARN) || !__ratelimit(&nopage_rs))
+	if ((gfp_mask & __GFP_NOWARN) ||
+	     !__ratelimit(&nopage_rs) ||
+	     ((gfp_mask & __GFP_DMA) && !has_managed_dma()))
 		return;
 
 	va_start(args, fmt);

From: Christian Hewitt <[email protected]>

[ Upstream commit 8182a35868db5f053111d5d9d4da8fcb3f99259d ]

Mark the VDDIO_AO18 regulator always-on and set hdmi-supply for the hdmi_tx node to ensure HDMI is powered in the early stages of boot.

---
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 ++
 1 file changed, 2 insertions(+)

index a350fee1264d7..8e2af986cebaf 100644
@@ -64,6 +64,7 @@
 		regulator-name = "VDDIO_AO18";
 		regulator-min-microvolt = <1800000>;
 		regulator-max-microvolt = <1800000>;
+		regulator-always-on;
 	};
 
 	vcc_3v3: regulator-vcc_3v3 {

@@ -161,6 +162,7 @@
 	status = "okay";
 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
 	pinctrl-names = "default";
+	hdmi-supply = <&vddio_ao18>;
 };
 
 &hdmi_tx_tmds_port {

2.34.1

From: Robin Murphy <[email protected]>

[ Upstream commit 5566174cb10a5167d59b0793871cab7990b149b8 ]

Upon failure, dma_alloc_coherent() returns NULL. If that does happen, passing some uninitialised stack contents to dma_mapping_error() - which belongs to a different API in the first place - has precious little chance of detecting it.

Also include the correct header, because the fragile transitive inclusion currently providing it is going to break soon.

---
 drivers/gpu/drm/tegra/vic.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

index b77f726303d89..ec0e4d8f0aade 100644
@@ -5,6 +5,7 @@
 
 #include <linux/clk.h>
 #include <linux/delay.h>
+#include <linux/dma-mapping.h>
 #include <linux/host1x.h>
 #include <linux/iommu.h>
 #include <linux/module.h>

@@ -265,10 +266,8 @@ static int vic_load_firmware(struct vic *vic)
 
 	if (!client->group) {
 		virt = dma_alloc_coherent(vic->dev, size, &iova, GFP_KERNEL);
-
-		err = dma_mapping_error(vic->dev, iova);
-		if (err < 0)
-			return err;
+		if (!virt)
+			return -ENOMEM;
 	} else {
 		virt = tegra_drm_alloc(tegra, size, &iova);
 	}

2.34.1

From: Alexander Aring <[email protected]>

[ Upstream commit feb704bd17786c8ff52a49d7759b8ee4f3a5aaac ]

Instead of dereference "con->sock" we can get the socket structure over "sk->sk_socket" as well. This patch will switch to this behaviour.

---
 fs/dlm/lowcomms.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 0c78fdfb1f6fa..0a8645ed4b2d6 100644
@@ -480,8 +480,7 @@ static void lowcomms_error_report(struct sock *sk)
 		goto out;
 
 	orig_report = listen_sock.sk_error_report;
-	if (con->sock == NULL ||
-	    kernel_getpeername(con->sock, (struct sockaddr *)&saddr) < 0) {
+	if (kernel_getpeername(sk->sk_socket, (struct sockaddr *)&saddr) < 0) {
 		printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
 				   "sending to node %d, port %d, "
 				   "sk_err=%d/%d\n", dlm_our_nodeid(),

2.34.1

From: Alexander Aring <[email protected]>

[ Upstream commit 4c3d90570bcc2b338f70f61f01110268e281ca3c ]

In some cases kernel_getpeername() will held the socket lock which is already held when the socket layer calls error_report() callback. Since commit 9dfc685e0262 ("inet: remove races in inet{6}_getname()") this problem becomes more likely because the socket lock will be held always. You will see something like:

bob9-u5 login: [ 562.316860] BUG: spinlock recursion on CPU#7, swapper/7/0

[  562.318562]  lock: 0xffff8f2284720088, .magic: dead4ead, .owner: swapper/7/0, .owner_cpu: 7
[  562.319522] CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.15.0+ #135
[  562.320346] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
[  562.321277] Call Trace:
[  562.321529]  <IRQ>
[  562.321734]  dump_stack_lvl+0x33/0x42
[  562.322282]  do_raw_spin_lock+0x8b/0xc0
[  562.322674]  lock_sock_nested+0x1e/0x50
[  562.323057]  inet_getname+0x39/0x110
[  562.323425]  ? sock_def_readable+0x80/0x80
[  562.323838]  lowcomms_error_report+0x63/0x260 [dlm]
[  562.324338]  ? wait_for_completion_interruptible_timeout+0xd2/0x120
[  562.324949]  ? lock_timer_base+0x67/0x80
[  562.325330]  ? do_raw_spin_unlock+0x49/0xc0
[  562.325735]  ? _raw_spin_unlock_irqrestore+0x1e/0x40
[  562.326218]  ? del_timer+0x54/0x80
[  562.326549]  sk_error_report+0x12/0x70
[  562.326919]  tcp_validate_incoming+0x3c8/0x530
[  562.327347]  ? kvm_clock_read+0x14/0x30
[  562.327718]  ? ktime_get+0x3b/0xa0
[  562.328055]  tcp_rcv_established+0x121/0x660
[  562.328466]  tcp_v4_do_rcv+0x132/0x260
[  562.328835]  tcp_v4_rcv+0xcea/0xe20
[  562.329173]  ip_protocol_deliver_rcu+0x35/0x1f0
[  562.329615]  ip_local_deliver_finish+0x54/0x60
[  562.330050]  ip_local_deliver+0xf7/0x110
[  562.330431]  ? inet_rtm_getroute+0x211/0x840
[  562.330848]  ? ip_protocol_deliver_rcu+0x1f0/0x1f0
[  562.331310]  ip_rcv+0xe1/0xf0
[  562.331603]  ? ip_local_deliver+0x110/0x110
[  562.332011]  __netif_receive_skb_core+0x46a/0x1040
[  562.332476]  ? inet_gro_receive+0x263/0x2e0
[  562.332885]  __netif_receive_skb_list_core+0x13b/0x2c0
[  562.333383]  netif_receive_skb_list_internal+0x1c8/0x2f0
[  562.333896]  ? update_load_avg+0x7e/0x5e0
[  562.334285]  gro_normal_list.part.149+0x19/0x40
[  562.334722]  napi_complete_done+0x67/0x160
[  562.335134]  virtnet_poll+0x2ad/0x408 [virtio_net]
[  562.335644]  __napi_poll+0x28/0x140
[  562.336012]  net_rx_action+0x23d/0x300
[  562.336414]  __do_softirq+0xf2/0x2ea
[  562.336803]  irq_exit_rcu+0xc1/0xf0
[  562.337173]  common_interrupt+0xb9/0xd0

It is and was always forbidden to call kernel_getpeername() in context of error_report(). To get rid of the problem we access the destination address for the peer over the socket structure. While on it we fix to print out the destination port of the inet socket.

---
 fs/dlm/lowcomms.c | 42 ++++++++++++++++++++----------------------
 1 file changed, 20 insertions(+), 22 deletions(-)

index 0a8645ed4b2d6..904855fa20655 100644
@@ -471,8 +471,8 @@ int dlm_lowcomms_connect_node(int nodeid)
 static void lowcomms_error_report(struct sock *sk)
 {
 	struct connection *con;
-	struct sockaddr_storage saddr;
 	void (*orig_report)(struct sock *) = NULL;
+	struct inet_sock *inet;
 
 	read_lock_bh(&sk->sk_callback_lock);
 	con = sock2con(sk);

@@ -480,33 +480,31 @@ static void lowcomms_error_report(struct sock *sk)
 		goto out;
 
 	orig_report = listen_sock.sk_error_report;
-	if (kernel_getpeername(sk->sk_socket, (struct sockaddr *)&saddr) < 0) {
-		printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
-				   "sending to node %d, port %d, "
-				   "sk_err=%d/%d\n", dlm_our_nodeid(),
-				   con->nodeid, dlm_config.ci_tcp_port,
-				   sk->sk_err, sk->sk_err_soft);
-	} else if (saddr.ss_family == AF_INET) {
-		struct sockaddr_in *sin4 = (struct sockaddr_in *)&saddr;
 
+	inet = inet_sk(sk);
+	switch (sk->sk_family) {
+	case AF_INET:
 		printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
-				   "sending to node %d at %pI4, port %d, "
+				   "sending to node %d at %pI4, dport %d, "
 				   "sk_err=%d/%d\n", dlm_our_nodeid(),
-				   con->nodeid, &sin4->sin_addr.s_addr,
-				   dlm_config.ci_tcp_port, sk->sk_err,
+				   con->nodeid, &inet->inet_daddr,
+				   ntohs(inet->inet_dport), sk->sk_err,
 				   sk->sk_err_soft);
-	} else {
-		struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&saddr;
-
+		break;
+	case AF_INET6:
 		printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
-				   "sending to node %d at %u.%u.%u.%u, "
-				   "port %d, sk_err=%d/%d\n", dlm_our_nodeid(),
-				   con->nodeid, sin6->sin6_addr.s6_addr32[0],
-				   sin6->sin6_addr.s6_addr32[1],
-				   sin6->sin6_addr.s6_addr32[2],
-				   sin6->sin6_addr.s6_addr32[3],
-				   dlm_config.ci_tcp_port, sk->sk_err,
+				   "sending to node %d at %pI6c, "
+				   "dport %d, sk_err=%d/%d\n", dlm_our_nodeid(),
+				   con->nodeid, &sk->sk_v6_daddr,
+				   ntohs(inet->inet_dport), sk->sk_err,
 				   sk->sk_err_soft);
+		break;
+	default:
+		printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
+				   "invalid socket family %d set, "
+				   "sk_err=%d/%d\n", dlm_our_nodeid(),
+				   sk->sk_family, sk->sk_err, sk->sk_err_soft);
+		goto out;
 	}
 out:
 	read_unlock_bh(&sk->sk_callback_lock);

2.34.1

From: Pavel Skripkin <[email protected]>

[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ]

Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check.

We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course.

---
 net/bluetooth/hci_event.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 9f52145bb7b76..7ffcca9ae82a1 100644
@@ -5661,7 +5661,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		struct hci_ev_le_advertising_info *ev = ptr;
 		s8 rssi;
 
-		if (ev->length <= HCI_MAX_AD_LENGTH) {
+		if (ev->length <= HCI_MAX_AD_LENGTH &&
+		    ev->data + ev->length <= skb_tail_pointer(skb)) {
 			rssi = ev->data[ev->length];
 			process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 					   ev->bdaddr_type, NULL, 0, rssi,

@@ -5671,6 +5672,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		}
 
 		ptr += sizeof(*ev) + ev->length + 1;
+
+		if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
+			bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
+			break;
+		}
 	}
 
 	hci_dev_unlock(hdev);

2.34.1

From: Tsuchiya Yuto <[email protected]>

[ Upstream commit 5a1b2725558f8a3b4cbf0504f53cffae8e163034 ]

## if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) { case

The intel-aero atomisp has #if defined(IS_ISP_2400_SYSTEM) [1]. It is to be defined in the following two places [2]:

- css/hive_isp_css_common/system_global.h
- css/css_2401_csi2p_system/system_global.h

and the former file is to be included on ISP2400 devices, too. So, it is to be defined for both ISP2400 and ISP2401 devices.

Because the upstreamed atomisp driver now supports only ISP2400 and ISP2401, just remove the ISP version test again. This matches the other upstream commits like 3c0538fbad9f ("media: atomisp: get rid of most checks for ISP2401 version").

While here, moved the comment for define GP_ISEL_TPG_MODE to the appropriate place.

[1] https://github.com/intel-aero/linux-kernel/blob/a1b673258feb915268377275130c5c5df0eafc82/drivers/media/pci/atomisp/css/sh_css.c#L552-L558
[2] https://github.com/intel-aero/linux-kernel/search?q=IS_ISP_2400_SYSTEM

## isys_stream_descr->polling_mode case

This does not exist on the intel-aero atomisp. This is because it is based on css version irci_stable_candrpv_0415_20150521_0458.

On the other hand, the upstreamed atomisp is based on the following css version depending on the ISP version using ifdefs:

- ISP2400: irci_stable_candrpv_0415_20150521_0458
- ISP2401: irci_master_20150911_0724

The isys_stream_descr->polling_mode usage was added on updating css version to irci_master_20150701_0213 [3].

So, it is not a ISP version specific thing, but css version specific thing. Because the upstreamed atomisp driver uses irci_master_20150911_0724 for ISP2401, re-add the ISP version check for now.

I say "for now" because ISP2401 should eventually use the same css version with ISP2400 (i.e., irci_stable_candrpv_0415_20150521_0458)

[3] https://raw.githubusercontent.com/intel/ProductionKernelQuilts/cht-m1stable-2016_ww31/uefi/cht-m1stable/patches/cam-0439-atomisp2-css2401-and-2401_legacy-irci_master_2015070.patch
("atomisp2: css2401 and 2401_legacy-irci_master_20150701_0213")
Link to Intel's Android kernel patch.

## coord = &me->config.internal_frame_origin_bqs_on_sctbl; case

it was added on commit 4f744a573db3 ("media: atomisp: make sh_css_sp_init_pipeline() ISP version independent") for ISP2401. Because the upstreamed atomisp for the ISP2401 part is based on irci_master_20150911_0724, hence the difference.

Because the upstreamed atomisp driver uses irci_master_20150911_0724 for ISP2401, revert the test back to if (IS_ISP2401).

---
 drivers/staging/media/atomisp/pci/sh_css.c | 27 +++++++++-------------
 1 file changed, 11 insertions(+), 16 deletions(-)

index ddee04c8248d0..54a18921fbd15 100644
@@ -527,6 +527,7 @@ ia_css_stream_input_format_bits_per_pixel(struct ia_css_stream *stream)
 	return bpp;
 }
 
+/* TODO: move define to proper file in tools */
 #define GP_ISEL_TPG_MODE 0x90058
 
 #if !defined(ISP2401)

@@ -579,12 +580,8 @@ sh_css_config_input_network(struct ia_css_stream *stream) {
 		vblank_cycles = vblank_lines * (width + hblank_cycles);
 		sh_css_sp_configure_sync_gen(width, height, hblank_cycles,
 					     vblank_cycles);
-		if (!IS_ISP2401) {
-			if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG) {
-				/* TODO: move define to proper file in tools */
-				ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
-			}
-		}
+		if (pipe->stream->config.mode == IA_CSS_INPUT_MODE_TPG)
+			ia_css_device_store_uint32(GP_ISEL_TPG_MODE, 0);
 	}
 	ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
 			    "sh_css_config_input_network() leave:\n");

@@ -1019,16 +1016,14 @@ static bool sh_css_translate_stream_cfg_to_isys_stream_descr(
 	 * ia_css_isys_stream_capture_indication() instead of
 	 * ia_css_pipeline_sp_wait_for_isys_stream_N() as isp processing of
 	 * capture takes longer than getting an ISYS frame
-	 *
-	 * Only 2401 relevant ??
 	 */
-#if 0 // FIXME: NOT USED on Yocto Aero
-	isys_stream_descr->polling_mode
-	    = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
-	      : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
-	ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
-			    "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
-#endif
+	if (IS_ISP2401) {
+		isys_stream_descr->polling_mode
+		    = early_polling ? INPUT_SYSTEM_POLL_ON_CAPTURE_REQUEST
+		      : INPUT_SYSTEM_POLL_ON_WAIT_FOR_FRAME;
+		ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
+				    "sh_css_translate_stream_cfg_to_isys_stream_descr() leave:\n");
+	}
 
 	return rc;
 }

@@ -1451,7 +1446,7 @@ static void start_pipe(
 
 	assert(me); /* all callers are in this file and call with non null argument */
 
-	if (!IS_ISP2401) {
+	if (IS_ISP2401) {
 		coord = &me->config.internal_frame_origin_bqs_on_sctbl;
 		params = me->stream->isp_params_configs;
 	}

2.34.1

From: Jens Wiklander <[email protected]>

[ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ]

Prior to this patch was teedev_close_context() calling tee_device_put() before teedev_ctx_put() leading to teedev_ctx_release() accessing ctx->teedev just after the reference counter was decreased on the teedev. Fix this by calling teedev_ctx_put() before tee_device_put().

---
 drivers/tee/tee_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index 6ade4a5c48407..dfc239c64ce3c 100644
@@ -98,8 +98,10 @@ void teedev_ctx_put(struct tee_context *ctx)
 
 static void teedev_close_context(struct tee_context *ctx)
 {
-	tee_device_put(ctx->teedev);
+	struct tee_device *teedev = ctx->teedev;
+
 	teedev_ctx_put(ctx);
+	tee_device_put(teedev);
 }
 
 static int tee_open(struct inode *inode, struct file *filp)

2.34.1

From: Johan Hovold <[email protected]>

commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream.

USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ.

Use the common control-message timeout define for the five-second timeouts.

---
 drivers/media/usb/s2255/s2255drv.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1884,7 +1884,7 @@ static long s2255_vendor_req(struct s225
 				    USB_TYPE_VENDOR | USB_RECIP_DEVICE |
 				    USB_DIR_IN,
 				    Value, Index, buf,
-				    TransferBufferLength, HZ * 5);
+				    TransferBufferLength, USB_CTRL_SET_TIMEOUT);
 
 		if (r >= 0)
 			memcpy(TransferBuffer, buf, TransferBufferLength);

@@ -1893,7 +1893,7 @@ static long s2255_vendor_req(struct s225
 		r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
 				    Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				    Value, Index, buf,
-				    TransferBufferLength, HZ * 5);
+				    TransferBufferLength, USB_CTRL_SET_TIMEOUT);
 	}
 	kfree(buf);
 	return r;

From: Michael Kuron <[email protected]>

commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream.

This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16.

Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner.

The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist.

Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers.

---
 drivers/media/usb/dvb-usb/dib0700_core.c |    2 --
 1 file changed, 2 deletions(-)

@@ -618,8 +618,6 @@ int dib0700_streaming_ctrl(struct dvb_us
 		deb_info("the endpoint number (%i) is not correct, use the adapter id instead", adap->fe_adap[0].stream.props.endpoint);
 		if (onoff)
 			st->channel_state |=	1 << (adap->id);
-		else
-			st->channel_state |=	1 << ~(adap->id);
 	} else {
 		if (onoff)
 			st->channel_state |=	1 << (adap->fe_adap[0].stream.props.endpoint-2);

From: Brian Norris <[email protected]>

[ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ]

If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't ready), we leave a dangling drm_panel reference to freed memory. Clean that up on failure.

This problem exists since the driver's introduction, but is especially relevant after refactored for dual-DSI variants.

---
 drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

index aea3162253914..f194b62e290ca 100644
@@ -484,6 +484,7 @@ static void innolux_panel_del(struct innolux_panel *innolux)
 static int innolux_panel_probe(struct mipi_dsi_device *dsi)
 {
 	const struct panel_desc *desc;
+	struct innolux_panel *innolux;
 	int err;
 
 	desc = of_device_get_match_data(&dsi->dev);

@@ -495,7 +496,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi)
 	if (err < 0)
 		return err;
 
-	return mipi_dsi_attach(dsi);
+	err = mipi_dsi_attach(dsi);
+	if (err < 0) {
+		innolux = mipi_dsi_get_drvdata(dsi);
+		innolux_panel_del(innolux);
+		return err;
+	}
+
+	return 0;
 }
 
 static int innolux_panel_remove(struct mipi_dsi_device *dsi)

2.34.1

From: Wang Hai <[email protected]>

[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ]

I got a kernel BUG report when doing fault injection test:

------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
...
RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d
...
Call Trace:
 proto_unregister+0x83/0x220
 cmtp_cleanup_sockets+0x37/0x40 [cmtp]
 cmtp_exit+0xe/0x1f [cmtp]
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits.

---
 net/bluetooth/cmtp/core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

index 0a2d78e811cf5..83eb84e8e688f 100644
@@ -501,9 +501,7 @@ static int __init cmtp_init(void)
 {
 	BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
 
-	cmtp_init_sockets();
-
-	return 0;
+	return cmtp_init_sockets();
 }
 
 static void __exit cmtp_exit(void)

2.34.1

From: Bryan O'Donoghue <[email protected]>

[ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ]

When unloading the driver we are not releasing the DMA descriptors which we previously allocated.

---
 drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++
 1 file changed, 5 insertions(+)

index 0909d0c423cbb..b117d8a0f446f 100644
@@ -1014,4 +1014,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn)
 
 	wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch);
 	wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch);
+
+	wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch);
+	wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch);
+	wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch);
+	wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch);
 }

2.34.1

From: Paul Cercueil <[email protected]>

commit 9c9d709965385de5a99f84b14bd5860e1541729e upstream.

The function nand_davinci_read_page_hwecc_oob_first() first reads the OOB data, extracts the ECC information, programs the ECC hardware before reading the actual data in a loop.

Right after the OOB data was read, it called nand_read_page_op() to reset the read cursor to the beginning of the page. This caused the first page to be read twice: in that call, and later in the loop.

Address that issue by changing the call to nand_read_page_op() to nand_change_read_column_op(), which will only reset the read cursor.

---
 drivers/mtd/nand/raw/davinci_nand.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -401,7 +401,8 @@ static int nand_davinci_read_page_hwecc_
 	if (ret)
 		return ret;
 
-	ret = nand_read_page_op(chip, page, 0, NULL, 0);
+	/* Move read cursor to start of page */
+	ret = nand_change_read_column_op(chip, 0, NULL, 0, false);
 	if (ret)
 		return ret;
 

From: Lad Prabhakar <[email protected]>

[ Upstream commit 981387ed06b96908223a607f5fba6efa42728fc2 ]

rpcif_sw_init() can fail so make sure we check the return value of it and on error exit rpcif_hb_probe() callback with error code.

---
 drivers/mtd/hyperbus/rpc-if.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index ecb050ba95cdf..367b0d72bf622 100644
@@ -124,7 +124,9 @@ static int rpcif_hb_probe(struct platform_device *pdev)
 	if (!hyperbus)
 		return -ENOMEM;
 
-	rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+	error = rpcif_sw_init(&hyperbus->rpc, pdev->dev.parent);
+	if (error)
+		return error;
 
 	platform_set_drvdata(pdev, hyperbus);
 

2.34.1

From: Dillon Min <[email protected]>

[ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ]

Since the type of parameter size is unsigned long, it should printk by %lu, instead of %ld, fix it.

---
 drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index 2f3a5996d3fc9..fe626109ef4db 100644
@@ -150,7 +150,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long attrs,
 	buf->cookie = dma_alloc_attrs(dev, size, &buf->dma_addr,
 					GFP_KERNEL | gfp_flags, buf->attrs);
 	if (!buf->cookie) {
-		dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size);
+		dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size);
 		kfree(buf);
 		return ERR_PTR(-ENOMEM);
 	}

@@ -196,9 +196,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma)
 
 	vma->vm_ops->open(vma);
 
-	pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n",
-		__func__, (unsigned long)buf->dma_addr, vma->vm_start,
-		buf->size);
+	pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n",
+		 __func__, (unsigned long)buf->dma_addr, vma->vm_start,
+		 buf->size);
 
 	return 0;
 }

2.34.1

From: xinhui pan <[email protected]>

commit 781050b0a3164934857c300bb0bc291e38c26b6f upstream.

After we move BO to a new memory region, we should put it to the new memory manager's lru list regardless we unlock the resv or not.

---
 drivers/gpu/drm/ttm/ttm_bo.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -789,6 +789,8 @@ int ttm_mem_evict_first(struct ttm_bo_de
 	ret = ttm_bo_evict(bo, ctx);
 	if (locked)
 		ttm_bo_unreserve(bo);
+	else
+		ttm_bo_move_to_lru_tail_unlocked(bo);
 
 	ttm_bo_put(bo);
 	return ret;

From: Luiz Augusto von Dentz <[email protected]>

[ Upstream commit f5ff291098f70a70b344df1e388596755c3c8315 ]

In order to group sockets being connected using L2CAP_MODE_EXT_FLOWCTL the pid is used but sk_peer_pid was not being initialized as it is currently only done for af_unix.

---
 net/bluetooth/l2cap_sock.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

index 160c016a5dfb9..4574c5cb1b596 100644
@@ -172,6 +172,21 @@ done:
 	return err;
 }
 
+static void l2cap_sock_init_pid(struct sock *sk)
+{
+	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+	/* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to
+	 * group the channels being requested.
+	 */
+	if (chan->mode != L2CAP_MODE_EXT_FLOWCTL)
+		return;
+
+	spin_lock(&sk->sk_peer_lock);
+	sk->sk_peer_pid = get_pid(task_tgid(current));
+	spin_unlock(&sk->sk_peer_lock);
+}
+
 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 			      int alen, int flags)
 {

@@ -243,6 +258,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 	if (chan->psm && bdaddr_type_is_le(chan->src_type) && !chan->mode)
 		chan->mode = L2CAP_MODE_LE_FLOWCTL;
 
+	l2cap_sock_init_pid(sk);
+
 	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 				 &la.l2_bdaddr, la.l2_bdaddr_type);
 	if (err)

@@ -298,6 +315,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 		goto done;
 	}
 
+	l2cap_sock_init_pid(sk);
+
 	sk->sk_max_ack_backlog = backlog;
 	sk->sk_ack_backlog = 0;
 

2.34.1

From: Biju Das <[email protected]>

[ Upstream commit e1a9faddffe7e555304dc2e3284c84fbee0679ee ]

The CAT875 sub board from Silicon Linux uses a Realtek PHY.

The phy driver commit bbc4d71d63549bcd003 ("net: phy: realtek: fix rtl8211e rx/tx delay config") introduced NFS mount failures. Now it needs both rx/tx delays for the NFS mount to work.

This patch fixes the NFS mount failure issue by adding "rgmii-id" mode to the avb device node.

---
 arch/arm64/boot/dts/renesas/cat875.dtsi | 1 +
 1 file changed, 1 insertion(+)

index 801ea54b027c4..20f8adc635e72 100644
@@ -18,6 +18,7 @@
 	pinctrl-names = "default";
 	renesas,no-ether-link;
 	phy-handle = <&phy0>;
+	phy-mode = "rgmii-id";
 	status = "okay";
 
 	phy0: ethernet-phy@0 {

2.34.1

From: Giovanni Cabiddu <[email protected]>

[ Upstream commit 5002200b4fedd7e90e4fbc2e5c42a4b3351df814 ]

If the remote function did not ACK the reception of a message, the function __adf_iov_putmsg() could detect it as a collision.

This was due to the fact that the collision and the timeout checks after the ACK loop were in the wrong order. The timeout must be checked at the end of the loop, so fix by swapping the order of the two checks.

---
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

index 7b34273d18937..74afafc84c716 100644
@@ -132,6 +132,12 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
 		val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
 	} while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY));
 
+	if (val & int_bit) {
+		dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
+		val &= ~int_bit;
+		ret = -EIO;
+	}
+
 	if (val != msg) {
 		dev_dbg(&GET_DEV(accel_dev),
 			"Collision - PFVF CSR overwritten by remote function\n");

@@ -139,12 +145,6 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
 		goto out;
 	}
 
-	if (val & int_bit) {
-		dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
-		val &= ~int_bit;
-		ret = -EIO;
-	}
-
 	/* Finished with the PFVF CSR; relinquish it and leave msg in CSR */
 	ADF_CSR_WR(pmisc_bar_addr, pf2vf_offset, val & ~local_in_use_mask);
 out:

2.34.1

From: Anilkumar Kolli <[email protected]>

[ Upstream commit b689f091aafd1a874b2f88137934276ab0fca480 ]

CE interrupt configuration uses host ce parameters to assign/free interrupts. Use host ce parameters to enable/disable interrupts. This patch fixes below BUG,

BUG: KASAN: global-out-of-bounds in 0xffffffbffdfb035c at addr
ffffffbffde6eeac
 Read of size 4 by task kworker/u8:2/132
 Address belongs to variable ath11k_core_qmi_firmware_ready+0x1b0/0x5bc [ath11k]

OOB is due to ath11k_ahb_ce_irqs_enable() iterates ce_count(which is 12) times and accessing 12th element in target_ce_config
(which has only 11 elements) from ath11k_ahb_ce_irq_enable().

With this change host ce configs are used to enable/disable interrupts.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-00471-QCAHKSWPL_SILICONZ-1

---
 drivers/net/wireless/ath/ath11k/ahb.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

index 430723c64adce..e8cca58e18ffc 100644
@@ -206,13 +206,13 @@ static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)
 
 static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
 {
-	const struct ce_pipe_config *ce_config;
+	const struct ce_attr *ce_attr;
 
-	ce_config = &ab->hw_params.target_ce_config[ce_id];
-	if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_OUT)
+	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+	if (ce_attr->src_nentries)
 		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
 
-	if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_IN) {
+	if (ce_attr->dest_nentries) {
 		ath11k_ahb_setbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
 		ath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
 				    CE_HOST_IE_3_ADDRESS);

@@ -221,13 +221,13 @@ static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)
 
 static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)
 {
-	const struct ce_pipe_config *ce_config;
+	const struct ce_attr *ce_attr;
 
-	ce_config = &ab->hw_params.target_ce_config[ce_id];
-	if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_OUT)
+	ce_attr = &ab->hw_params.host_ce_config[ce_id];
+	if (ce_attr->src_nentries)
 		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_ADDRESS);
 
-	if (__le32_to_cpu(ce_config->pipedir) & PIPEDIR_IN) {
+	if (ce_attr->dest_nentries) {
 		ath11k_ahb_clearbit32(ab, ce_id, CE_HOST_IE_2_ADDRESS);
 		ath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,
 				      CE_HOST_IE_3_ADDRESS);

2.34.1

From: Dongliang Mu <[email protected]>

[ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ]

In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails to deallocate the media_dev allocated in the em28xx_media_device_init.

Fix this by adding em28xx_unregister_media_device to free media_dev.

BTW, this patch is tested in my local syzkaller instance, and it can prevent the memory leak from occurring again.

---
 drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

index cf45cc566cbe2..87e375562dbb2 100644
@@ -3575,8 +3575,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
 
 	if (dev->is_audio_only) {
 		retval = em28xx_audio_setup(dev);
-		if (retval)
-			return -ENODEV;
+		if (retval) {
+			retval = -ENODEV;
+			goto err_deinit_media;
+		}
 		em28xx_init_extension(dev);
 
 		return 0;

@@ -3595,7 +3597,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
 		dev_err(&dev->intf->dev,
 			"%s: em28xx_i2c_register bus 0 - error [%d]!\n",
 		       __func__, retval);
-		return retval;
+		goto err_deinit_media;
 	}
 
 	/* register i2c bus 1 */

@@ -3611,9 +3613,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
 				"%s: em28xx_i2c_register bus 1 - error [%d]!\n",
 				__func__, retval);
 
-			em28xx_i2c_unregister(dev, 0);
-
-			return retval;
+			goto err_unreg_i2c;
 		}
 	}
 

@@ -3621,6 +3621,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
 	em28xx_card_setup(dev);
 
 	return 0;
+
+err_unreg_i2c:
+	em28xx_i2c_unregister(dev, 0);
+err_deinit_media:
+	em28xx_unregister_media_device(dev);
+	return retval;
 }
 
 static int em28xx_duplicate_dev(struct em28xx *dev)

2.34.1

From: Jammy Huang <[email protected]>

[ Upstream commit af6d1bde395cac174ee71adcd3fa43f6435c7206 ]

If res-chg, VE_INTERRUPT_MODE_DETECT_WD irq will be raised. But v4l2_input_status won't be updated to no-signal immediately until aspeed_video_get_resolution() in aspeed_video_resolution_work().

During the period of time, aspeed_video_start_frame() could be called because it doesn't know signal becomes unstable now. If it goes with aspeed_video_init_regs() of aspeed_video_irq_res_change() simultaneously, it will mess up hw state.

To fix this problem, v4l2_input_status is updated to no-signal immediately for VE_INTERRUPT_MODE_DETECT_WD irq.

---
 drivers/media/platform/aspeed-video.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 23c41c545c536..debc7509c173c 100644
@@ -556,6 +556,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay)
 	set_bit(VIDEO_RES_CHANGE, &video->flags);
 	clear_bit(VIDEO_FRAME_INPRG, &video->flags);
 
+	video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL;
+
 	aspeed_video_off(video);
 	aspeed_video_bufs_done(video, VB2_BUF_STATE_ERROR);
 

@@ -1337,7 +1339,6 @@ static void aspeed_video_resolution_work(struct work_struct *work)
 	struct delayed_work *dwork = to_delayed_work(work);
 	struct aspeed_video *video = container_of(dwork, struct aspeed_video,
 						  res_work);
-	u32 input_status = video->v4l2_input_status;
 
 	aspeed_video_on(video);
 

@@ -1350,8 +1351,7 @@ static void aspeed_video_resolution_work(struct work_struct *work)
 	aspeed_video_get_resolution(video);
 
 	if (video->detected_timings.width != video->active_timings.width ||
-	    video->detected_timings.height != video->active_timings.height ||
-	    input_status != video->v4l2_input_status) {
+	    video->detected_timings.height != video->active_timings.height) {
 		static const struct v4l2_event ev = {
 			.type = V4L2_EVENT_SOURCE_CHANGE,
 			.u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION,

2.34.1

From: Dan Carpenter <[email protected]>

[ Upstream commit cb4d67a998e97365afdf34965b069601da1dae60 ]

The "power" pointer is not initialized on the else path and that would lead to an Oops.

---
 drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 135994d44802c..34480ca164746 100644
@@ -481,7 +481,7 @@ fail:
 
 static u8 gmin_get_pmic_id_and_addr(struct device *dev)
 {
-	struct i2c_client *power;
+	struct i2c_client *power = NULL;
 	static u8 pmic_i2c_addr;
 
 	if (pmic_id)

2.34.1

From: Stanimir Varbanov <[email protected]>

[ Upstream commit a76f43a490542ecb8c57176730b6eb665d716139 ]

Presently we use device_link to control core power domain. But this leads to issues because the genpd doesn't guarantee synchronous on/off for supplier devices. Switch to manually control by pmruntime calls.

---
 drivers/media/platform/qcom/venus/core.h      |  2 --
 .../media/platform/qcom/venus/pm_helpers.c    | 36 ++++++++++---------
 2 files changed, 19 insertions(+), 19 deletions(-)

index 05c9fbd51f0c0..f2a0ef9ee884e 100644
@@ -123,7 +123,6 @@ struct venus_caps {
  * @clks:	an array of struct clk pointers
  * @vcodec0_clks: an array of vcodec0 struct clk pointers
  * @vcodec1_clks: an array of vcodec1 struct clk pointers
- * @pd_dl_venus: pmdomain device-link for venus domain
  * @pmdomains:	an array of pmdomains struct device pointers
  * @vdev_dec:	a reference to video device structure for decoder instances
  * @vdev_enc:	a reference to video device structure for encoder instances

@@ -161,7 +160,6 @@ struct venus_core {
 	struct icc_path *cpucfg_path;
 	struct opp_table *opp_table;
 	bool has_opp_table;
-	struct device_link *pd_dl_venus;
 	struct device *pmdomains[VIDC_PMDOMAINS_NUM_MAX];
 	struct device_link *opp_dl_venus;
 	struct device *opp_pmdomain;

index 2946547a0df4a..bce9a370015fb 100644
@@ -773,13 +773,6 @@ static int vcodec_domains_get(struct device *dev)
 		core->pmdomains[i] = pd;
 	}
 
-	core->pd_dl_venus = device_link_add(dev, core->pmdomains[0],
-					    DL_FLAG_PM_RUNTIME |
-					    DL_FLAG_STATELESS |
-					    DL_FLAG_RPM_ACTIVE);
-	if (!core->pd_dl_venus)
-		return -ENODEV;
-
 skip_pmdomains:
 	if (!core->has_opp_table)
 		return 0;

@@ -806,14 +799,12 @@ skip_pmdomains:
 opp_dl_add_err:
 	dev_pm_opp_detach_genpd(core->opp_table);
 opp_attach_err:
-	if (core->pd_dl_venus) {
-		device_link_del(core->pd_dl_venus);
-		for (i = 0; i < res->vcodec_pmdomains_num; i++) {
-			if (IS_ERR_OR_NULL(core->pmdomains[i]))
-				continue;
-			dev_pm_domain_detach(core->pmdomains[i], true);
-		}
+	for (i = 0; i < res->vcodec_pmdomains_num; i++) {
+		if (IS_ERR_OR_NULL(core->pmdomains[i]))
+			continue;
+		dev_pm_domain_detach(core->pmdomains[i], true);
 	}
+
 	return ret;
 }
 

@@ -826,9 +817,6 @@ static void vcodec_domains_put(struct device *dev)
 	if (!res->vcodec_pmdomains_num)
 		goto skip_pmdomains;
 
-	if (core->pd_dl_venus)
-		device_link_del(core->pd_dl_venus);
-
 	for (i = 0; i < res->vcodec_pmdomains_num; i++) {
 		if (IS_ERR_OR_NULL(core->pmdomains[i]))
 			continue;

@@ -916,16 +904,30 @@ static void core_put_v4(struct device *dev)
 static int core_power_v4(struct device *dev, int on)
 {
 	struct venus_core *core = dev_get_drvdata(dev);
+	struct device *pmctrl = core->pmdomains[0];
 	int ret = 0;
 
 	if (on == POWER_ON) {
+		if (pmctrl) {
+			ret = pm_runtime_get_sync(pmctrl);
+			if (ret < 0) {
+				pm_runtime_put_noidle(pmctrl);
+				return ret;
+			}
+		}
+
 		ret = core_clks_enable(core);
+		if (ret < 0 && pmctrl)
+			pm_runtime_put_sync(pmctrl);
 	} else {
 		/* Drop the performance state vote */
 		if (core->opp_pmdomain)
 			dev_pm_opp_set_rate(dev, 0);
 
 		core_clks_disable(core);
+
+		if (pmctrl)
+			pm_runtime_put_sync(pmctrl);
 	}
 
 	return ret;

2.34.1

From: Bryan O'Donoghue <[email protected]>

[ Upstream commit 08b1cf474b7f72750adebe0f0a35f8e9a3eb75f6 ]

Commit aaaa93eda64b ("media] media: venus: venc: add video encoder files") is the last in a series of three commits to add core.c vdec.c and venc.c adding core, encoder and decoder.

The encoder and decoder check for core drvdata as set and return -EPROBE_DEFER if it has not been set, however both the encoder and decoder rely on core.v4l2_dev as valid.

core.v4l2_dev will not be valid until v4l2_device_register() has completed in core.c's probe().

Normally this is never seen however, Dmitry reported the following backtrace when compiling drivers and firmware directly into a kernel image.

[    5.259968] Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
[    5.269850] sd 0:0:0:3: [sdd] Optimal transfer size 524288 bytes
[    5.275505] Workqueue: events deferred_probe_work_func
[    5.275513] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[    5.441211] usb 2-1: new SuperSpeedPlus Gen 2 USB device number 2 using xhci-hcd
[    5.442486] pc : refcount_warn_saturate+0x140/0x148
[    5.493756] hub 2-1:1.0: USB hub found
[    5.496266] lr : refcount_warn_saturate+0x140/0x148
[    5.500982] hub 2-1:1.0: 4 ports detected
[    5.503440] sp : ffff80001067b730
[    5.503442] x29: ffff80001067b730
[    5.592660] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[    5.598478] x28: ffff6c6bc1c379b8
[    5.598480] x27: ffffa5c673852960 x26: ffffa5c673852000
[    5.598484] x25: ffff6c6bc1c37800 x24: 0000000000000001
[    5.810652] x23: 0000000000000000 x22: ffffa5c673bc7118
[    5.813777] hub 1-1:1.0: USB hub found
[    5.816108] x21: ffffa5c674440000 x20: 0000000000000001
[    5.820846] hub 1-1:1.0: 4 ports detected
[    5.825415] x19: ffffa5c6744f4000 x18: ffffffffffffffff
[    5.825418] x17: 0000000000000000 x16: 0000000000000000
[    5.825421] x15: 00000a4810c193ba x14: 0000000000000000
[    5.825424] x13: 00000000000002b8 x12: 000000000000f20a
[    5.825427] x11: 000000000000f20a x10: 0000000000000038
[    5.845447] usb 2-1.1: new SuperSpeed Gen 1 USB device number 3 using xhci-hcd
[    5.845904]
[    5.845905] x9 : 0000000000000000 x8 : ffff6c6d36fae780
[    5.871208] x7 : ffff6c6d36faf240 x6 : 0000000000000000
[    5.876664] x5 : 0000000000000004 x4 : 0000000000000085
[    5.882121] x3 : 0000000000000119 x2 : ffffa5c6741ef478
[    5.887578] x1 : 3acbb3926faf5f00 x0 : 0000000000000000
[    5.893036] Call trace:
[    5.895551]  refcount_warn_saturate+0x140/0x148
[    5.900202]  __video_register_device+0x64c/0xd10
[    5.904944]  venc_probe+0xc4/0x148
[    5.908444]  platform_probe+0x68/0xe0
[    5.912210]  really_probe+0x118/0x3e0
[    5.915977]  driver_probe_device+0x5c/0xc0
[    5.920187]  __device_attach_driver+0x98/0xb8
[    5.924661]  bus_for_each_drv+0x68/0xd0
[    5.928604]  __device_attach+0xec/0x148
[    5.932547]  device_initial_probe+0x14/0x20
[    5.936845]  bus_probe_device+0x9c/0xa8
[    5.940788]  device_add+0x3e8/0x7c8
[    5.944376]  of_device_add+0x4c/0x60
[    5.948056]  of_platform_device_create_pdata+0xbc/0x140
[    5.953425]  of_platform_bus_create+0x17c/0x3c0
[    5.958078]  of_platform_populate+0x80/0x110
[    5.962463]  venus_probe+0x2ec/0x4d8
[    5.966143]  platform_probe+0x68/0xe0
[    5.969907]  really_probe+0x118/0x3e0
[    5.973674]  driver_probe_device+0x5c/0xc0
[    5.977882]  __device_attach_driver+0x98/0xb8
[    5.982356]  bus_for_each_drv+0x68/0xd0
[    5.986298]  __device_attach+0xec/0x148
[    5.990242]  device_initial_probe+0x14/0x20
[    5.994539]  bus_probe_device+0x9c/0xa8
[    5.998481]  deferred_probe_work_func+0x74/0xb0
[    6.003132]  process_one_work+0x1e8/0x360
[    6.007254]  worker_thread+0x208/0x478
[    6.011106]  kthread+0x150/0x158
[    6.014431]  ret_from_fork+0x10/0x30
[    6.018111] ---[ end trace f074246b1ecdb466 ]---

This patch fixes by

- Only setting drvdata after v4l2_device_register() completes
- Moving v4l2_device_register() so that suspend/reume in core::probe() stays as-is
- Changes pm_ops->core_function() to take struct venus_core not struct device
- Minimal rework of v4l2_device_*register in probe/remove

---
 drivers/media/platform/qcom/venus/core.c      | 30 +++++++++++--------
 .../media/platform/qcom/venus/pm_helpers.c    | 30 ++++++++-----------
 .../media/platform/qcom/venus/pm_helpers.h    |  7 +++--
 3 files changed, 34 insertions(+), 33 deletions(-)

index 58ddebbb84468..bad553bf9f304 100644
@@ -222,7 +222,6 @@ static int venus_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	core->dev = dev;
-	platform_set_drvdata(pdev, core);
 
 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	core->base = devm_ioremap_resource(dev, r);

@@ -252,7 +251,7 @@ static int venus_probe(struct platform_device *pdev)
 		return -ENODEV;
 
 	if (core->pm_ops->core_get) {
-		ret = core->pm_ops->core_get(dev);
+		ret = core->pm_ops->core_get(core);
 		if (ret)
 			return ret;
 	}

@@ -277,6 +276,12 @@ static int venus_probe(struct platform_device *pdev)
 	if (ret)
 		goto err_core_put;
 
+	ret = v4l2_device_register(dev, &core->v4l2_dev);
+	if (ret)
+		goto err_core_deinit;
+
+	platform_set_drvdata(pdev, core);
+
 	pm_runtime_enable(dev);
 
 	ret = pm_runtime_get_sync(dev);

@@ -311,10 +316,6 @@ static int venus_probe(struct platform_device *pdev)
 	if (ret)
 		goto err_venus_shutdown;
 
-	ret = v4l2_device_register(dev, &core->v4l2_dev);
-	if (ret)
-		goto err_core_deinit;
-
 	ret = pm_runtime_put_sync(dev);
 	if (ret) {
 		pm_runtime_get_noresume(dev);

@@ -327,8 +328,6 @@ static int venus_probe(struct platform_device *pdev)
 
 err_dev_unregister:
 	v4l2_device_unregister(&core->v4l2_dev);
-err_core_deinit:
-	hfi_core_deinit(core, false);
 err_venus_shutdown:
 	venus_shutdown(core);
 err_runtime_disable:

@@ -336,9 +335,11 @@ err_runtime_disable:
 	pm_runtime_set_suspended(dev);
 	pm_runtime_disable(dev);
 	hfi_destroy(core);
+err_core_deinit:
+	hfi_core_deinit(core, false);
 err_core_put:
 	if (core->pm_ops->core_put)
-		core->pm_ops->core_put(dev);
+		core->pm_ops->core_put(core);
 	return ret;
 }
 

@@ -364,11 +365,14 @@ static int venus_remove(struct platform_device *pdev)
 	pm_runtime_disable(dev);
 
 	if (pm_ops->core_put)
-		pm_ops->core_put(dev);
+		pm_ops->core_put(core);
+
+	v4l2_device_unregister(&core->v4l2_dev);
 
 	hfi_destroy(core);
 
 	v4l2_device_unregister(&core->v4l2_dev);
+
 	mutex_destroy(&core->pm_lock);
 	mutex_destroy(&core->lock);
 	venus_dbgfs_deinit(core);

@@ -387,7 +391,7 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
 		return ret;
 
 	if (pm_ops->core_power) {
-		ret = pm_ops->core_power(dev, POWER_OFF);
+		ret = pm_ops->core_power(core, POWER_OFF);
 		if (ret)
 			return ret;
 	}

@@ -405,7 +409,7 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
 err_video_path:
 	icc_set_bw(core->cpucfg_path, kbps_to_icc(1000), 0);
 err_cpucfg_path:
-	pm_ops->core_power(dev, POWER_ON);
+	pm_ops->core_power(core, POWER_ON);
 
 	return ret;
 }

@@ -425,7 +429,7 @@ static __maybe_unused int venus_runtime_resume(struct device *dev)
 		return ret;
 
 	if (pm_ops->core_power) {
-		ret = pm_ops->core_power(dev, POWER_ON);
+		ret = pm_ops->core_power(core, POWER_ON);
 		if (ret)
 			return ret;
 	}

index bce9a370015fb..63095d70f8d82 100644
@@ -276,16 +276,13 @@ set_freq:
 	return 0;
 }
 
-static int core_get_v1(struct device *dev)
+static int core_get_v1(struct venus_core *core)
 {
-	struct venus_core *core = dev_get_drvdata(dev);
-
 	return core_clks_get(core);
 }
 
-static int core_power_v1(struct device *dev, int on)
+static int core_power_v1(struct venus_core *core, int on)
 {
-	struct venus_core *core = dev_get_drvdata(dev);
 	int ret = 0;
 
 	if (on == POWER_ON)

@@ -752,12 +749,12 @@ static int venc_power_v4(struct device *dev, int on)
 	return ret;
 }
 
-static int vcodec_domains_get(struct device *dev)
+static int vcodec_domains_get(struct venus_core *core)
 {
 	int ret;
 	struct opp_table *opp_table;
 	struct device **opp_virt_dev;
-	struct venus_core *core = dev_get_drvdata(dev);
+	struct device *dev = core->dev;
 	const struct venus_resources *res = core->res;
 	struct device *pd;
 	unsigned int i;

@@ -808,9 +805,8 @@ opp_attach_err:
 	return ret;
 }
 
-static void vcodec_domains_put(struct device *dev)
+static void vcodec_domains_put(struct venus_core *core)
 {
-	struct venus_core *core = dev_get_drvdata(dev);
 	const struct venus_resources *res = core->res;
 	unsigned int i;