Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge tag 'ASB-2023-02-05_12-5.10' of https://android.googlesource.co…
…m/kernel/common into lineage-21 https://source.android.com/docs/security/bulletin/2023-02-01 CVE-2022-39189 CVE-2022-39842 CVE-2022-41222 CVE-2023-20937 CVE-2023-20938 CVE-2022-0850 * tag 'ASB-2023-02-05_12-5.10' of https://android.googlesource.com/kernel/common: UPSTREAM: net: loopback: use NET_NAME_PREDICTABLE for name_assign_type UPSTREAM: Bluetooth: L2CAP: Fix u8 overflow UPSTREAM: HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk UPSTREAM: HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 UPSTREAM: HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E UPSTREAM: HID: ite: Add support for Acer S1002 keyboard-dock UPSTREAM: igb: Initialize mailbox message for VF reset UPSTREAM: xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N UPSTREAM: USB: serial: f81534: fix division by zero on line-speed change UPSTREAM: USB: serial: f81232: fix division by zero on line-speed change UPSTREAM: USB: serial: cp210x: add Kamstrup RF sniffer PIDs UPSTREAM: USB: serial: option: add Quectel EM05-G modem UPSTREAM: usb: gadget: uvc: Prevent buffer overflow in setup handler BACKPORT: f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED BACKPORT: f2fs: handle decompress only post processing in softirq BACKPORT: f2fs: introduce memory mode BACKPORT: f2fs: allow compression for mmap files in compress_mode=user UPSTREAM: iommu/iova: Fix alloc iova overflows issue UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing ANDROID: GKI: Add Tuxera symbol list UPSTREAM: usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer UPSTREAM: usb: dwc3: Increase DWC3 controller halt timeout UPSTREAM: usb: dwc3: Remove DWC3 locking during gadget suspend/resume UPSTREAM: usb: dwc3: Avoid unmapping USB requests if endxfer is not complete UPSTREAM: usb: dwc3: gadget: Continue handling EP0 xfercomplete events UPSTREAM: usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect UPSTREAM: usb: dwc3: gadget: Force sending delayed status during soft disconnect UPSTREAM: usb: dwc3: Do not service EP0 and conndone events if soft disconnected UPSTREAM: efi: rt-wrapper: Add missing include UPSTREAM: arm64: efi: Execute runtime services from a dedicated stack ANDROID: cpu: correct dl_cpu_busy() calls UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF UPSTREAM: firmware: tegra: Reduce stack usage UPSTREAM: scsi: bfa: Move a large struct from the stack onto the heap ANDROID: mm: page_pinner: ensure do_div() arguments matches with respect to type ANDROID: Revert "ANDROID: allmodconfig: disable WERROR" FROMGIT: scsi: ufs: Modify Tactive time setting conditions UPSTREAM: remoteproc: core: Fix rproc->firmware free in rproc_set_firmware() UPSTREAM: usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode ANDROID: GKI: add symbol list file for honor ANDROID: add TEST_MAPPING for net/, include/net BACKPORT: arm64/bpf: Remove 128MB limit for BPF JIT programs ANDROID: usb: f_accessory: Check buffer size when initialised via composite BACKPORT: mm: make minimum slab alignment a runtime property BACKPORT: printk: stop including cache.h from printk.h UPSTREAM: kasan: fix a missing header include of static_keys.h BACKPORT: kasan: split kasan_*enabled() functions into a separate header UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request UPSTREAM: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait UPSTREAM: usb: dwc3: gadget: conditionally remove requests UPSTREAM: usb: dwc3: ep0: Properly handle setup_packet_pending scenario in data stage UPSTREAM: usb: dwc3: gadget: Fix IN endpoint max packet size allocation UPSTREAM: usb: dwc3: gadget: Delay issuing End Transfer UPSTREAM: usb: dwc3: gadget: Only End Transfer for ep0 data phase UPSTREAM: usb: dwc3: ep0: Don't prepare beyond Setup stage UPSTREAM: usb: dwc3: gadget: move cmd_endtransfer to extra function UPSTREAM: usb: dwc3: gadget: ep_queue simplify isoc start condition UPSTREAM: usb: dwc3: gadget: Skip reading GEVNTSIZn UPSTREAM: usb: dwc3: gadget: Ignore Update Transfer cmd params UPSTREAM: usb: dwc3: gadget: Skip checking Update Transfer status UPSTREAM: pstore: Properly assign mem_type property BACKPORT: ext4: fix use-after-free in ext4_rename_dir_prepare ANDROID: GKI: rockchip: Update symbols BACKPORT: f2fs: let's avoid panic if extent_tree is not created BACKPORT: f2fs: should use a temp extent_info for lookup BACKPORT: f2fs: don't mix to use union values in extent_info BACKPORT: f2fs: initialize extent_cache parameter BACKPORT: f2fs: add block_age-based extent cache BACKPORT: f2fs: allocate the extent_cache by default BACKPORT: f2fs: refactor extent_cache to support for read and more BACKPORT: f2fs: remove unnecessary __init_extent_tree BACKPORT: f2fs: move internal functions into extent_cache.c BACKPORT: f2fs: specify extent cache for read explicitly BACKPORT: f2fs: add "c_len" into trace_f2fs_update_extent_tree_range for compressed file BACKPORT: f2fs: fix race condition on setting FI_NO_EXTENT flag BACKPORT: f2fs: extent cache: support unaligned extent UPSTREAM: io_uring: kill goto error handling in io_sqpoll_wait_sq() ANDROID: allmodconfig: disable WERROR UPSTREAM: Enable '-Werror' by default for all kernel builds ANDROID: GKI: VIVO: Add a symbol to symbol list ANDROID: fips140: add crypto_memneq() back to the module ANDROID: GKI: rockchip: Update module fragment and symbol list ANDROID: GKI: rockchip: Enable symbols for HDMIRX ANDROID: GKI: rockchip: Enable symbols for Ethernet ANDROID: Re-enable fast mremap and fix UAF with SPF Revert "ANDROID: Make SPF aware of fast mremaps" ANDROID: GKI: Update symbols to symbol list ANDROID: fips140: add dump_jitterentropy command to fips140_lab_util UPSTREAM: io_uring: add missing item types for splice request Linux 5.10.160 ASoC: ops: Correct bounds check for second channel on SX controls nvme-pci: clear the prp2 field when not used ASoC: cs42l51: Correct PGA Volume minimum value can: mcba_usb: Fix termination command argument can: sja1000: fix size of OCR_MODE_MASK define pinctrl: meditatek: Startup with the IRQs disabled libbpf: Use page size as max_entries when probing ring buffer map ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() ASoC: fsl_micfil: explicitly clear CHnF flags ASoC: fsl_micfil: explicitly clear software reset bit io_uring: add missing item types for splice request fuse: always revalidate if exclusive create nfp: fix use-after-free in area_cache_get() vfs: fix copy_file_range() averts filesystem freeze protection vfs: fix copy_file_range() regression in cross-fs copies x86/smpboot: Move rcu_cpu_starting() earlier ANDROID: usb: gadget: uvc: remove duplicate code in unbind Linux 5.10.159 can: esd_usb: Allow REC and TEC to return to zero macsec: add missing attribute validation for offload net: mvneta: Fix an out of bounds check ipv6: avoid use-after-free in ip6_fragment() net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq() xen/netback: fix build warning ethernet: aeroflex: fix potential skb leak in greth_init_rings() tipc: call tipc_lxc_xmit without holding node_read_lock net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() ipv4: Fix incorrect route flushing when table ID 0 is used ipv4: Fix incorrect route flushing when source address is deleted tipc: Fix potential OOB in tipc_link_proto_rcv() net: hisilicon: Fix potential use-after-free in hix5hd2_rx() net: hisilicon: Fix potential use-after-free in hisi_femac_rx() net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq ip_gre: do not report erspan version on GRE interface net: stmmac: fix "snps,axi-config" node property parsing nvme initialize core quirks before calling nvme_init_subsystem NFC: nci: Bounds check struct nfc_target arrays i40e: Disallow ip4 and ip6 l4_4_bytes i40e: Fix for VF MAC address 0 i40e: Fix not setting default xps_cpus after reset net: mvneta: Prevent out of bounds read in mvneta_config_rss() xen-netfront: Fix NULL sring after live migration net: encx24j600: Fix invalid logic in reading of MISTAT register net: encx24j600: Add parentheses to fix precedence mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload net: dsa: ksz: Check return value Bluetooth: Fix not cleanup led when bt_init fails Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn() vmxnet3: correctly report encapsulated LRO packet af_unix: Get user_ns from in_skb in unix_diag_get_exact(). drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420 igb: Allocate MSI-X vector when testing e1000e: Fix TX dispatch condition gpio: amd8111: Fix PCI device reference count leak drm/bridge: ti-sn65dsi86: Fix output polarity setting bug netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark ca8210: Fix crash by zero initializing data ieee802154: cc2520: Fix error return code in cc2520_hw_init() netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one rtc: mc146818-lib: fix signedness bug in mc146818_get_time() rtc: mc146818-lib: fix locking in mc146818_set_time rtc: cmos: Disable irq around direct invocation of cmos_interrupt() mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page can: af_can: fix NULL pointer dereference in can_rcv_filter HID: core: fix shift-out-of-bounds in hid_report_raw_event HID: hid-lg4ff: Add check for empty lbuf HID: usbhid: Add ALWAYS_POLL quirk for some mice drm/shmem-helper: Avoid vm_open error paths drm/shmem-helper: Remove errant put in error path drm/vmwgfx: Don't use screen objects when SEV is active KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field Bluetooth: Fix crash when replugging CSR fake controllers Bluetooth: btusb: Add debug message for CSR controllers mm/gup: fix gup_pud_range() for dax memcg: fix possible use-after-free in memcg_write_event_control() media: v4l2-dv-timings.c: fix too strict blanking sanity checks Revert "ARM: dts: imx7: Fix NAND controller size-cells" media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() xen/netback: don't call kfree_skb() with interrupts disabled xen/netback: do some code cleanup xen/netback: Ensure protocol headers don't fall in the non-linear area rtc: mc146818: Reduce spinlock section in mc146818_set_time() rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ rtc: cmos: avoid UIP when reading alarm time rtc: cmos: avoid UIP when writing alarm time rtc: mc146818-lib: extract mc146818_avoid_UIP rtc: mc146818-lib: fix RTC presence check rtc: Check return value from mc146818_get_time() rtc: mc146818-lib: change return values of mc146818_get_time() rtc: cmos: remove stale REVISIT comments rtc: mc146818: Dont test for bit 0-5 in Register D rtc: mc146818: Detect and handle broken RTCs rtc: mc146818: Prevent reading garbage mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths mm/khugepaged: fix GUP-fast interaction by sending IPI mm/khugepaged: take the right locks for page table retraction net: usb: qmi_wwan: add u-blox 0x1342 composition 9p/xen: check logical size for buffer size usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer fbcon: Use kzalloc() in fbcon_prepare_logo() regulator: twl6030: fix get status of twl6032 regulators ASoC: soc-pcm: Add NULL check in BE reparenting btrfs: send: avoid unaligned encoded writes when attempting to clone range ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event regulator: slg51000: Wait after asserting CS pin 9p/fd: Use P9_HDRSZ for header size ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name arm64: dts: rockchip: fix ir-receiver node names ARM: dts: rockchip: fix ir-receiver node names arm: dts: rockchip: fix node name for hym8563 rtc arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series Revert "mmc: sdhci: Fix voltage switch delay" ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION Linux 5.10.158 ipc/sem: Fix dangling sem_array access in semtimedop race v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails proc: proc_skip_spaces() shouldn't think it is working on C strings proc: avoid integer type confusion in get_proc_long block: unhash blkdev part inode when the part is deleted Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() char: tpm: Protect tpm_pm_suspend with locks Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" ACPI: HMAT: Fix initiator registration for single-initiator systems ACPI: HMAT: remove unnecessary variable initialization i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set i2c: npcm7xx: Fix error handling in npcm_i2c_init() x86/pm: Add enumeration check before spec MSRs save/restore setup x86/tsx: Add a feature bit for TSX control MSR support Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" ipv4: Fix route deletion when nexthop info is not specified ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference selftests: net: fix nexthop warning cleanup double ip typo selftests: net: add delete nexthop route warning test Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled parisc: Increase FRAME_WARN to 2048 bytes on parisc xtensa: increase size of gcc stack frame check parisc: Increase size of gcc stack frame check iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() iommu/vt-d: Fix PCI device refcount leak in has_external_pci() pinctrl: single: Fix potential division by zero ASoC: ops: Fix bounds check for _sx controls io_uring: don't hold uring_lock when calling io_run_task_work* tracing: Free buffers when a used dynamic event is removed drm/i915: Never return 0 if not all requests retired drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame mmc: sdhci: Fix voltage switch delay mmc: sdhci-sprd: Fix no reset data and command after voltage switch mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: mmc_test: Fix removal of debugfs file net: stmmac: Set MAC's flow control register to reflect current settings pinctrl: intel: Save and restore pins in "direct IRQ" mode x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" error-injection: Add prompt for function error injection riscv: vdso: fix section overlapping under some conditions net/mlx5: DR, Fix uninitialized var warning hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() hwmon: (coretemp) Check for null before removing sysfs attrs net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed sctp: fix memory leak in sctp_stream_outq_migrate() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE net: tun: Fix use-after-free in tun_detach() afs: Fix fileserver probe RTT handling net: hsr: Fix potential use-after-free tipc: re-fetch skb cb after tipc_msg_validate dsa: lan9303: Correct stat name net: ethernet: nixge: fix NULL dereference net/9p: Fix a potential socket leak in p9_socket_open net: net_netdev: Fix error handling in ntb_netdev_init_module() net: phy: fix null-ptr-deref while probe() failed wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration wifi: cfg80211: don't allow multi-BSSID in S1G wifi: cfg80211: fix buffer overflow in elem comparison aquantia: Do not purge addresses when setting the number of rings qlcnic: fix sleep-in-atomic-context bugs caused by msleep can: cc770: cc770_isa_probe(): add missing free_cc770dev() can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() net/mlx5e: Fix use-after-free when reverting termination table net/mlx5: Fix uninitialized variable bug in outlen_write() e100: Fix possible use after free in e100_xmit_prepare e100: switch from 'pci_' to 'dma_' API iavf: Fix error handling in iavf_init_module() iavf: remove redundant ret variable fm10k: Fix error handling in fm10k_init_module() i40e: Fix error handling in i40e_init_module() ixgbevf: Fix resource leak in ixgbevf_init_module() of: property: decrement node refcount in of_fwnode_get_reference_args() bpf: Do not copy spin lock field from user in bpf_selem_alloc hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ina3221) Fix shunt sum critical calculation hwmon: (ltc2947) fix temperature scaling libbpf: Handle size overflow for ringbuf mmap ARM: at91: rm9200: fix usb device clock id scripts/faddr2line: Fix regression in name resolution on ppc64le bpf, perf: Use subprog name when reporting subprog ksymbol iio: light: rpr0521: add missing Kconfig dependencies iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: health: afe4403: Fix oob read in afe4403_read_raw btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" drm/amdgpu: update drm_display_info correctly when the edid is read drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: free btrfs_path before copying inodes to userspace btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino Revert "xfrm: fix "disable_policy" on ipv4 early demux" ANDROID: CRC ABI fixups in ip.h and ipv6.h Linux 5.10.157 fuse: lock inode unconditionally in fuse_fallocate() drm/i915: fix TLB invalidation for Gen12 video and compute engines drm/amdgpu: always register an MMU notifier for userptr drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() btrfs: free btrfs_path before copying subvol info to userspace btrfs: free btrfs_path before copying fspath to userspace btrfs: free btrfs_path before copying root refs to userspace genirq: Take the proposed affinity at face value if force==true irqchip/gic-v3: Always trust the managed affinity provided by the core code genirq: Always limit the affinity to online CPUs genirq/msi: Shutdown managed interrupts with unsatifiable affinities wifi: wilc1000: validate number of channels wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute wifi: wilc1000: validate pairwise and authentication suite offsets dm integrity: clear the journal on suspend dm integrity: flush the journal on suspend gpu: host1x: Avoid trying to use GART on Tegra20 net: usb: qmi_wwan: add Telit 0x103a composition tcp: configurable source port perturb table size platform/x86: hp-wmi: Ignore Smart Experience App event zonefs: fix zone report size in __zonefs_io_error() platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() xen/platform-pci: add missing free_irq() in error path xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] Input: soc_button_array - add use_low_level_irq module parameter Input: goodix - try resetting the controller when no config is set serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 binder: Address corner cases in deferred copy and fixup binder: fix pointer cast warning binder: defer copies of pre-patched txn data binder: read pre-translated fds from sender buffer binder: avoid potential data leakage when copying txn x86/ioremap: Fix page aligned size calculation in __ioremap_caller() KVM: x86: remove exit_int_info warning in svm_handle_exit KVM: x86: nSVM: leave nested mode on vCPU free mm: vmscan: fix extreme overreclaim and swap floods gcov: clang: fix the buffer overflow issue nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty usb: dwc3: gadget: Clear ep descriptor last usb: dwc3: gadget: Return -ESHUTDOWN on ep disable usb: dwc3: gadget: conditionally remove requests ceph: fix NULL pointer dereference for req->r_session ceph: Use kcalloc for allocating multiple elements ceph: fix possible NULL pointer dereference for req->r_session ceph: put the requests/sessions when it fails to alloc memory ceph: fix off by one bugs in unsafe_request_wait() ceph: flush the mdlog before waiting on unsafe reqs ceph: flush mdlog before umounting ceph: make iterate_sessions a global symbol ceph: make ceph_create_session_msg a global symbol usb: cdns3: Add support for DRD CDNSP mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI mmc: sdhci-brcmstb: Enable Clock Gating to save power mmc: sdhci-brcmstb: Re-organize flags nios2: add FORCE for vmlinuz.gz init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails iio: light: apds9960: fix wrong register for gesture gain arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency ext4: fix use-after-free in ext4_ext_shift_extents usb: dwc3: exynos: Fix remove() function lib/vdso: use "grep -E" instead of "egrep" net: enetc: preserve TX ring priority across reconfiguration net: enetc: cache accesses to &priv->si->hw net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled s390/crashdump: fix TOD programmable field size net: thunderx: Fix the ACPI memory leak nfc: st-nci: fix memory leaks in EVT_TRANSACTION nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION arcnet: fix potential memory leak in com20020_probe() net: arcnet: Fix RESET flag handling s390/dasd: fix no record found for raw_track_access ipv4: Fix error return code in fib_table_insert() dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). netfilter: flowtable_offload: add missing locking dma-buf: fix racing conflict of dma_heap_add() bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() regulator: twl6030: re-add TWL6032_SUBCLASS NFC: nci: fix memory leak in nci_rx_data_packet() net: sched: allow act_ct to be built without NF_NAT sfc: fix potential memleak in __ef100_hard_start_xmit() xfrm: Fix ignored return value in xfrm6_init() tipc: check skb_linearize() return value in tipc_disc_rcv() tipc: add an extra conn_get in tipc_conn_alloc tipc: set con sock in tipc_conn_alloc net/mlx5: Fix handling of entry refcount when command is not issued to FW net/mlx5: Fix FW tracer timestamp calculation netfilter: ipset: regression in ip_set_hash_ip.c netfilter: ipset: Limit the maximal range of consecutive elements to add/delete Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() macsec: Fix invalid error code set nfp: add port from netdev validation for EEPROM access nfp: fill splittable of devlink_port_attrs correctly net: pch_gbe: fix pci device refcount leak while module exiting net/qla3xxx: fix potential memleak in ql3xxx_send() net/mlx4: Check retval of mlx4_bitmap_init net: ethernet: mtk_eth_soc: fix error handling in mtk_open() ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties ARM: mxs: fix memory leak in mxs_machine_init() netfilter: conntrack: Fix data-races around ct mark 9p/fd: fix issue of list_del corruption in p9_fd_cancel() net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() nfc/nci: fix race with opening and closing rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] rxrpc: Use refcount_t rather than atomic_t rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc net: liquidio: simplify if expression ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl tee: optee: fix possible memory leak in optee_register_device() bus: sunxi-rsb: Support atomic transfers regulator: core: fix UAF in destroy_regulator() spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() regulator: core: fix kobject release warning and memory leak in regulator_register() scsi: storvsc: Fix handling of srb_status and capacity change events ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove ASoC: hdac_hda: fix hda pcm buffer overflow issue ARM: dts: am335x-pcm-953: Define fixed regulators in root node af_key: Fix send_acquire race with pfkey_register xfrm: replay: Fix ESN wrap around for GSO xfrm: fix "disable_policy" on ipv4 early demux MIPS: pic32: treat port as signed integer RISC-V: vdso: Do not add missing symbols to version section in linker script arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. block, bfq: fix null pointer dereference in bfq_bio_bfqg() drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC scsi: ibmvfc: Avoid path failures during live migration platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 Revert "net: macsec: report real_dev features when HW offloading is enabled" selftests/bpf: Add verifier test for release_reference() spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run wifi: mac80211: Fix ack frame idr leak when mesh has no route wifi: airo: do not assign -1 to unsigned char audit: fix undefined behavior in bit shift for AUDIT_BIT riscv: dts: sifive unleashed: Add PWM controlled LEDs wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support wifi: mac80211: fix memory free error when registering wiphy fail ceph: avoid putting the realm twice when decoding snaps fails ceph: do not update snapshot context when there is no new snapshot iio: pressure: ms5611: fixed value compensation bug iio: ms5611: Simplify IO callback parameters nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH drm/display: Don't assume dual mode adaptors support i2c sub-addressing bridge: switchdev: Fix memory leaks when changing VLAN protocol bridge: switchdev: Notify about VLAN protocol changes ata: libata-core: do not issue non-internal commands once EH is pending ata: libata-scsi: simplify __ata_scsi_queuecmd() scsi: scsi_transport_sas: Fix error handling in sas_phy_add() ANDROID: abi preservation for fscrypt change in 5.10.154 Revert "serial: 8250: Let drivers request full 16550A feature probing" Linux 5.10.156 Revert "net: broadcom: Fix BCMGENET Kconfig" ntfs: check overflow when iterating ATTR_RECORDs ntfs: fix out-of-bounds read in ntfs_attr_find() ntfs: fix use-after-free in ntfs_attr_find() mm: fs: initialize fsdata passed to write_begin/write_end interface 9p/trans_fd: always use O_NONBLOCK read/write gfs2: Switch from strlcpy to strscpy gfs2: Check sb_bsize_shift after reading superblock 9p: trans_fd/p9_conn_cancel: drop client lock earlier kcm: close race conditions on sk_receive_queue kcm: avoid potential race in kcm_tx_work tcp: cdg: allow tcp_cdg_release() to be called multiple times macvlan: enforce a consistent minimal mtu uapi/linux/stddef.h: Add include guards Input: i8042 - fix leaking of platform device on module removal kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() net: use struct_group to copy ip/ipv6 header addresses stddef: Introduce struct_group() helper macro usbnet: smsc95xx: Fix deadlock on runtime resume ring-buffer: Include dropped pages in counting dirty patches net: fix a concurrency bug in l2tp_tunnel_register() nvme: ensure subsystem reset is single threaded nvme: restrict management ioctls to admin perf/x86/intel/pt: Fix sampling using single range output misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() docs: update mediator contact information in CoC doc mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout mmc: core: properly select voltage range without power cycle firmware: coreboot: Register bus in module init iommu/vt-d: Set SRE bit only when hardware has SRS cap scsi: zfcp: Fix double free of FSF request when qdio send fails maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault() Input: iforce - invert valid length check when fetching device IDs serial: 8250_lpss: Configure DMA also w/o DMA filter serial: 8250: Flush DMA Rx on RLSI serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs dm ioctl: fix misbehavior if list_versions races with module loading iio: pressure: ms5611: changed hardcoded SPI speed to value limited iio: adc: mp2629: fix potential array out of bound access iio: adc: mp2629: fix wrong comparison of channel iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() usb: typec: mux: Enter safe mode only when pins need to be reconfigured usb: chipidea: fix deadlock in ci_otg_del_timer usb: add NO_LPM quirk for Realforce 87U Keyboard USB: serial: option: add Fibocom FM160 0x0111 composition USB: serial: option: add u-blox LARA-L6 modem USB: serial: option: add u-blox LARA-R6 00B modem USB: serial: option: remove old LARA-R6 PID USB: serial: option: add Sierra Wireless EM9191 USB: bcma: Make GPIO explicitly optional speakup: fix a segfault caused by switching consoles slimbus: stream: correct presence rate frequencies Revert "usb: dwc3: disable USB core PHY management" ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() tracing: Fix wild-memory-access in register_synth_event() tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() tracing/ring-buffer: Have polling block on watermark ring_buffer: Do not deactivate non-existant pages ftrace: Fix null pointer dereference in ftrace_add_mod() ftrace: Optimize the allocation for mcount entries ftrace: Fix the possible incorrect kernel message cifs: add check for returning value of SMB2_set_info_init net: thunderbolt: Fix error handling in tbnet_init() cifs: Fix wrong return value checking when GETFLAGS net/x25: Fix skb leak in x25_lapb_receive_frame() net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in ag71xx_open() cifs: add check for returning value of SMB2_close_init platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized drbd: use after free in drbd_create_device() net: ena: Fix error handling in ena_init() net: ionic: Fix error handling in ionic_init_module() xen/pcpu: fix possible memory leak in register_pcpu() bnxt_en: Remove debugfs when pci_register_driver failed net: caif: fix double disconnect client in chnl_net_open() net: macvlan: Use built-in RCU list checking mISDN: fix misuse of put_device() in mISDN_register_device() net: liquidio: release resources when liquidio driver open failed net: hinic: Fix error handling in hinic_module_init() mISDN: fix possible memory leak in mISDN_dsp_element_register() net: bgmac: Drop free_netdev() from bgmac_enet_remove() bpf: Initialize same number of free nodes for each pcpu_freelist ata: libata-transport: fix error handling in ata_tdev_add() ata: libata-transport: fix error handling in ata_tlink_add() ata: libata-transport: fix error handling in ata_tport_add() ata: libata-transport: fix double ata_host_put() in ata_tport_add() arm64: dts: imx8mn: Fix NAND controller size-cells arm64: dts: imx8mm: Fix NAND controller size-cells ARM: dts: imx7: Fix NAND controller size-cells drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() drm/drv: Fix potential memory leak in drm_dev_init() drm/panel: simple: set bpc field for logic technologies displays pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map parport_pc: Avoid FIFO port location truncation siox: fix possible memory leak in siox_device_add() arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro block: sed-opal: kmalloc the cmd/resp buffers sctp: clear out_curr if all frag chunks of current msg are pruned sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent ASoC: soc-utils: Remove __exit for snd_soc_util_exit() bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send serial: imx: Add missing .thaw_noirq hook serial: 8250: omap: Flush PM QOS work on remove serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() serial: 8250_omap: remove wait loop from Errata i202 workaround serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() serial: 8250: Remove serial_rs485 sanitization from em485 ASoC: tas2764: Fix set_tdm_slot in case of single slot ASoC: tas2770: Fix set_tdm_slot in case of single slot ASoC: core: Fix use-after-free in snd_soc_exit() spi: stm32: Print summary 'callbacks suppressed' message drm/amdgpu: disable BACO on special BEIGE_GOBY card drm/amd/pm: disable BACO entry/exit completely on several sienna cichlid cards drm/amd/pm: Read BIF STRAP also for BACO check drm/amd/pm: support power source switch on Sienna Cichlid mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA spi: intel: Use correct mask for flash and protected regions mtd: spi-nor: intel-spi: Disable write protection only if asked ALSA: hda/realtek: fix speakers and micmute on HP 855 G8 ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm btrfs: remove pointless and double ulist frees in error paths of qgroup tests drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid i2c: i801: add lis3lv02d's I2C address for Vostro 5568 i2c: tegra: Allocate DMA memory for DMA engine NFSv4: Retry LOCK on OLD_STATEID during delegation return drm/amd/display: Remove wrong pipe control lock ASoC: rt1308-sdw: add the default value of some registers selftests/intel_pstate: fix build for ARCH=x86_64 selftests/futex: fix build for clang ASoC: codecs: jz4725b: fix capture selector naming ASoC: codecs: jz4725b: use right control for Capture Volume ASoC: codecs: jz4725b: fix reported volume for Master ctl ASoC: codecs: jz4725b: add missed Line In power control bit spi: intel: Fix the offset to get the 64K erase opcode ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK ASoC: mt6660: Keep the pm_runtime enables before component stuff in mt6660_i2c_probe ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" ANDROID: fix up struct sk_buf ABI breakage ANDROID: fix up CRC issue with struct tcp_sock Revert "serial: 8250: Toggle IER bits on only after irq has been set up" Linux 5.10.155 io_uring: kill goto error handling in io_sqpoll_wait_sq() x86/cpu: Restore AMD's DE_CFG MSR after resume mmc: sdhci-esdhc-imx: Convert the driver to DT-only net: tun: call napi_schedule_prep() to ensure we own a napi dmaengine: at_hdmac: Check return code of dma_async_device_register dmaengine: at_hdmac: Fix impossible condition dmaengine: at_hdmac: Don't allow CPU to reorder channel enable dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware dmaengine: at_hdmac: Fix concurrency over the active list dmaengine: at_hdmac: Free the memset buf without holding the chan lock dmaengine: at_hdmac: Fix concurrency over descriptor dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all() dmaengine: at_hdmac: Protect atchan->status with the channel lock dmaengine: at_hdmac: Do not call the complete callback on device_terminate_all dmaengine: at_hdmac: Fix premature completion of desc in issue_pending dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending dmaengine: at_hdmac: Don't start transactions at tx_submit level dmaengine: at_hdmac: Fix at_lli struct definition cert host tools: Stop complaining about deprecated OpenSSL functions can: j1939: j1939_send_one(): fix missing CAN header initialization mm/memremap.c: map FS_DAX device memory as decrypted udf: Fix a slab-out-of-bounds write bug in udf_find_entry() mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi drm/i915/dmabuf: fix sg_table handling in map_dma_buf nilfs2: fix use-after-free bug of ns_writer on remount nilfs2: fix deadlock in nilfs_count_free_blocks() ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure vmlinux.lds.h: Fix placement of '.data..decrypted' section ALSA: usb-audio: Add DSD support for Accuphase DAC-60 ALSA: usb-audio: Add quirk entry for M-Audio Micro ALSA: hda/realtek: Add Positivo C6300 model quirk ALSA: hda: fix potential memleak in 'add_widget_node' ALSA: hda/ca0132: add quirk for EVGA Z390 DARK ALSA: hda/hdmi - enable runtime pm for more AMD display audio mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI MIPS: jump_label: Fix compat branch range check arm64: efi: Fix handling of misaligned runtime regions and drop warning riscv: fix reserved memory setup riscv: Separate memory init from paging init riscv: Enable CMA support riscv: vdso: fix build with llvm riscv: process: fix kernel info leakage net: macvlan: fix memory leaks of macvlan_common_newlink ethernet: tundra: free irq when alloc ring failed in tsi108_open() net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() ethernet: s2io: disable napi when start nic failed in s2io_card_up() net: atlantic: macsec: clear encryption keys from the stack net: phy: mscc: macsec: clear encryption keys when freeing a flow cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open() net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() net: cpsw: disable napi in cpsw_ndo_open() net/mlx5e: E-Switch, Fix comparing termination table instance net/mlx5: Allow async trigger completion execution on single CPU systems net: nixge: disable napi when enable interrupts failed in nixge_open() net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() perf stat: Fix printing os->prefix in CSV metrics output drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() dmaengine: pxa_dma: use platform_get_irq_optional tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header net: broadcom: Fix BCMGENET Kconfig net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() can: af_can: fix NULL pointer dereference in can_rx_register() ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() hamradio: fix issue of dev reference count leakage in bpq_device_event() net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() KVM: s390: pv: don't allow userspace to set the clock under PV KVM: s390x: fix SCK locking capabilities: fix undefined behavior in bit shift for CAP_TO_MASK net: fman: Unregister ethernet device on removal bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() net: tun: Fix memory leaks of napi_get_frags macsec: clear encryption keys from the stack after setting up offload macsec: fix detection of RXSCs when toggling offloading macsec: fix secy->n_rx_sc accounting macsec: delete new rxsc when offload fails net: gso: fix panic on frag_list with mixed head alloc types bpf: Fix wrong reg type conversion in release_reference() bpf: Add helper macro bpf_for_each_reg_in_vstate bpf: Support for pointers beyond pkt_end. HID: hyperv: fix possible memory leak in mousevsc_probe() bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues wifi: cfg80211: fix memory leak in query_regdb_file() wifi: cfg80211: silence a sparse RCU warning phy: stm32: fix an error code in probe hwspinlock: qcom: correct MMIO max register for newer SoCs fuse: fix readdir cache race ANDROID: gki_defconfig: remove CONFIG_INIT_STACK_ALL_ZERO=y Revert "serial: 8250: Fix restoring termios speed after suspend" Linux 5.10.154 ipc: remove memcg accounting for sops objects in do_semtimedop() wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() drm/i915/sdvo: Setup DDC fully before output init drm/i915/sdvo: Filter out invalid outputs more sensibly drm/rockchip: dsi: Force synchronous probe ext4,f2fs: fix readahead of verity data KVM: x86: emulator: update the emulation mode after CR0 write KVM: x86: emulator: introduce emulator_recalc_and_set_mode KVM: x86: emulator: em_sysexit should update ctxt->mode KVM: x86: Mask off reserved bits in CPUID.80000001H KVM: x86: Mask off reserved bits in CPUID.80000008H KVM: x86: Mask off reserved bits in CPUID.8000001AH KVM: x86: Mask off reserved bits in CPUID.80000006H ext4: fix BUG_ON() when directory entry has invalid rec_len ext4: fix warning in 'ext4_da_release_space' parisc: Avoid printing the hardware path twice parisc: Export iosapic_serial_irq() symbol for serial port driver parisc: Make 8250_gsc driver dependend on CONFIG_PARISC perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] perf/x86/intel: Fix pebs event constraints for ICL efi: random: Use 'ACPI reclaim' memory for random seed efi: random: reduce seed size to 32 bytes fuse: add file_modified() to fallocate capabilities: fix potential memleak on error path from vfs_getxattr_alloc() tracing/histogram: Update document for KEYS_MAX size tools/nolibc/string: Fix memcmp() implementation kprobe: reverse kp->flags when arm_kprobe failed tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() tcp/udp: Make early_demux back namespacified. ftrace: Fix use-after-free for dynamic ftrace_ops btrfs: fix type of parameter generation in btrfs_get_dentry coresight: cti: Fix hang in cti_disable_hw() binder: fix UAF of alloc->vma in race with munmap() memcg: enable accounting of ipc resources mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times tcp/udp: Fix memory leak in ipv6_renew_options(). fscrypt: fix keyring memory leak on mount failure fscrypt: stop using keyrings subsystem for fscrypt_master_key fscrypt: simplify master key locking ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices block, bfq: protect 'bfqd->queued' by 'bfqd->lock' Bluetooth: L2CAP: Fix attempting to access uninitialized memory Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM i2c: piix4: Fix adapter not be removed in piix4_remove() arm64: dts: juno: Add thermal critical trip points firmware: arm_scmi: Make Rx chan_setup fail on memory errors firmware: arm_scmi: Suppress the driver's bind attributes ARM: dts: imx6qdl-gw59{10,13}: fix user pushbutton GPIO offset efi/tpm: Pass correct address to memblock_reserve i2c: xiic: Add platform module alias drm/amdgpu: set vm_update_mode=0 as default for Sienna Cichlid in SRIOV case HID: saitek: add madcatz variant of MMO7 mouse device ID scsi: core: Restrict legal sdev_state transitions via sysfs ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() media: meson: vdec: fix possible refcount leak in vdec_probe() media: dvb-frontends/drxk: initialize err to 0 media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE media: rkisp1: Zero v4l2_subdev_format fields in when validating links media: rkisp1: Initialize color space on resizer sink and source pads s390/boot: add secure boot trailer xhci-pci: Set runtime PM as default policy on all xHC 1.2 or later devices mtd: parsers: bcm47xxpart: Fix halfblock reads mtd: parsers: bcm47xxpart: print correct offset on read error fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards video/fbdev/stifb: Implement the stifb_fillrect() function mmc: sdhci-pci-core: Disable ES for ASUS BIOS on Jasper Lake mmc: sdhci-pci: Avoid comma separated statements mmc: sdhci-esdhc-imx: Propagate ESDHC_FLAG_HS400* only on 8bit bus drm/msm/hdmi: fix IRQ lifetime drm/msm/hdmi: Remove spurious IRQF_ONESHOT flag ipv6: fix WARNING in ip6_route_net_exit_late() net, neigh: Fix null-ptr-deref in neigh_table_clear() net: mdio: fix undefined behavior in bit shift for __mdiobus_register Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu btrfs: fix ulist leaks in error paths of qgroup self tests btrfs: fix inode list leak during backref walking at find_parent_nodes() btrfs: fix inode list leak during backref walking at resolve_indirect_refs() isdn: mISDN: netjet: fix wrong check of device registration mISDN: fix possible memory leak in mISDN_register_device() rose: Fix NULL pointer dereference in rose_send_frame() ipvs: fix WARNING in ip_vs_app_net_cleanup() ipvs: fix WARNING in __ip_vs_cleanup_batch() ipvs: use explicitly signed chars netfilter: nf_tables: release flow rule object from commit path net: tun: fix bugs for oversize packet when napi frags enabled net: sched: Fix use after free in red_enqueue() ata: pata_legacy: fix pdc20230_set_piomode() net: fec: fix improper use of NETDEV_TX_BUSY nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() NFC: nxp-nci: remove unnecessary labels nfc: fdp: Fix potential memory leak in fdp_nci_send() nfc: fdp: drop ftrace-like debugging messages RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() RDMA/core: Fix null-ptr-deref in ib_core_cleanup() net: dsa: Fix possible memory leaks in dsa_loop_init() nfs4: Fix kmemleak when allocate slot failed NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot NFSv4.1: Handle RECLAIM_COMPLETE trunking errors NFSv4: Fix a potential state reclaim deadlock IB/hfi1: Correctly move list in sc_disable() RDMA/cma: Use output interface for net_dev check KVM: x86: Add compat handler for KVM_X86_SET_MSR_FILTER KVM: x86: Copy filter arg outside kvm_vm_ioctl_set_msr_filter() KVM: x86: Protect the unused bits in MSR exiting flags x86/topology: Fix duplicated core ID within a package x86/topology: Fix multiple packages shown on a single-package system x86/topology: Set cpu_die_id only if DIE_TYPE found KVM: x86: Treat #DBs from the emulator as fault-like (code and DR7.GD=1) KVM: x86: Trace re-injected exceptions KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02 KVM: nVMX: Pull KVM L0's desired controls directly from vmcs01 serial: ar933x: Deassert Transmit Enable on ->rs485_config() serial: 8250: Let drivers request full 16550A feature probing Linux 5.10.153 serial: Deassert Transmit Enable on probe in driver-specific way serial: core: move RS485 configuration tasks from drivers into core can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive arm64/kexec: Test page size support with new TGRAN range values arm64/mm: Fix __enable_mmu() for new TGRAN range values scsi: sd: Revert "scsi: sd: Remove a local variable" arm64: Add AMPERE1 to the Spectre-BHB affected list net: enetc: survive memory pressure without crashing net/mlx5: Fix crash during sync firmware reset net/mlx5: Fix possible use-after-free in async command interface net/mlx5e: Do not increment ESN when updating IPsec ESN state nh: fix scope used to find saddr when adding non gw nh net: ehea: fix possible memory leak in ehea_register_port() openvswitch: switch from WARN to pr_warn ALSA: aoa: Fix I2S device accounting ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() net: fec: limit register access on i.MX6UL PM: domains: Fix handling of unavailable/disabled idle states net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() i40e: Fix flow-type by setting GL_HASH_INSET registers i40e: Fix VF hang when reset is triggered on another VF i40e: Fix ethtool rx-flow-hash setting for X722 ipv6: ensure sane device mtu in tunnels media: vivid: set num_in/outputs to 0 if not supported media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' media: v4l2-dv-timings: add sanity checks for blanking values media: vivid: dev->bitmap_cap wasn't freed in all cases media: vivid: s_fbuf: add more sanity checks PM: hibernate: Allow hybrid sleep to work with s2idle can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path tcp: fix indefinite deferral of RTO with SACK reneging tcp: fix a signed-integer-overflow bug in tcp_add_backlog() tcp: minor optimization in tcp_add_backlog() net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed kcm: annotate data-races around kcm->rx_wait kcm: annotate data-races around kcm->rx_psock atlantic: fix deadlock at aq_nic_stop amd-xgbe: add the bit rate quirk for Molex cables amd-xgbe: fix the SFP compliance codes check for DAC cables x86/unwind/orc: Fix unreliable stack dump with gcov net: hinic: fix the issue of double release MBOX callback of VF net: hinic: fix the issue of CMDQ memory leaks net: hinic: fix memory leak when reading function table net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg() net: netsec: fix error handling in netsec_register_mdio() tipc: fix a null-ptr-deref in tipc_topsrv_accept perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap() ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile arc: iounmap() arg is volatile ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile drm/msm: Fix return type of mdp4_lvds_connector_mode_valid media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation net: ieee802154: fix error return code in dgram_bind() mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages mm/memory: add non-anonymous page check in the copy_present_page() xen/gntdev: Prevent leaking grants Xen/gntdev: don't ignore kernel unmapping error s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() s390/futex: add missing EX_TABLE entry to __futex_atomic_op() perf auxtrace: Fix address filter symbol name match for modules kernfs: fix use-after-free in __kernfs_remove counter: microchip-tcb-capture: Handle Signal1 read and Synapse mmc: core: Fix kernel panic when remove non-standard SDIO card mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO drm/msm/dp: fix IRQ lifetime drm/msm/hdmi: fix memory corruption with too many bridges drm/msm/dsi: fix memory corruption with too many bridges scsi: qla2xxx: Use transport-defined speed mask for supported_speeds mac802154: Fix LQI recording exec: Copy oldsighand->action under spin-lock fs/binfmt_elf: Fix memory leak in load_elf_binary() fbdev: smscufx: Fix several use-after-free bugs iio: temperature: ltc2983: allocate iio channels once iio: light: tsl2583: Fix module unloading tools: iio: iio_utils: fix digit calculation xhci: Remove device endpoints from bandwidth list when freeing the device xhci: Add quirk to reset host back to default state at shutdown mtd: rawnand: marvell: Use correct logic for nand-keep-config usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller usb: bdc: change state when port disconnected usb: dwc3: gadget: Don't set IMI for no_interrupt usb: dwc3: gadget: Stop processing more requests on IMI USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM ALSA: rme9652: use explicitly signed char ALSA: au88x0: use explicitly signed char ALSA: Use del_timer_sync() before freeing timer can: kvaser_usb: Fix possible completions during init_completion can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() Linux 5.10.152 udp: Update reuse->has_conns under reuseport_lock. mm: /proc/pid/smaps_rollup: fix no vma's null-deref blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() mmc: core: Add SD card quirk for broken discard Makefile.debug: re-enable debug info for .S files x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB ACPI: video: Force backlight native for more TongFang devices hv_netvsc: Fix race between VF offering and VF association message from host perf/x86/intel/pt: Relax address filter validation riscv: topology: fix default topology reporting arm64: topology: move store_cpu_topology() to shared code arm64: dts: qcom: sc7180-trogdor: Fixup modem memory region fcntl: fix potential deadlocks for &fown_struct.lock fcntl: make F_GETOWN(EX) return 0 on dead owner task perf: Skip and warn on unknown format 'configN' attrs perf pmu: Validate raw event with sysfs exported format bits riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb riscv: Add machine name to kernel boot log and stack dump output mmc: sdhci-tegra: Use actual clock rate for SW tuning correction xen/gntdev: Accommodate VMA splitting xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests tracing: Do not free snapshot if tracer is on cmdline tracing: Simplify conditional compilation code in tracing_set_tracer() dmaengine: mxs: use platform_driver_register dmaengine: mxs-dma: Remove the unused .id_table drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() iommu/vt-d: Clean up si_domain in the init_dmars() error path iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() net: phy: dp83822: disable MDI crossover status change interrupt net: sched: fix race condition in qdisc_graft() net: hns: fix possible memory leak in hnae_ae_register() sfc: include vport_id in filter spec hash and equal() net: sched: sfb: fix null pointer access issue when sfb_init() fails net: sched: delete duplicate cleanup of backlog and qlen net: sched: cake: fix null pointer access issue when cake_init() fails nvme-hwmon: kmalloc the NVME SMART log buffer nvme-hwmon: consistently ignore errors from nvme_hwmon_init nvme-hwmon: Return error code when registration fails nvme-hwmon: rework to avoid devm allocation ionic: catch NULL pointer issue on reconfig net: hsr: avoid possible NULL deref in skb_clone() cifs: Fix xid leak in cifs_ses_add_channel() cifs: Fix xid leak in cifs_flock() cifs: Fix xid leak in cifs_copy_file_range() net: phy: dp83867: Extend RX strap quirk for SGMII mode net/atm: fix proc_mpc_write incorrect return value sfc: Change VF mac via PF as first preference if available. HID: magicmouse: Do not set BTN_MOUSE on double report i40e: Fix DMA mappings leak tipc: fix an information leak in tipc_topsrv_kern_subscr tipc: Fix recognition of trial period ACPI: extlog: Handle multiple records btrfs: fix processing of delayed tree block refs during backref walking btrfs: fix processing of delayed data refs during backref walking r8152: add PID for the Lenovo OneLink+ Dock arm64: errata: Remove AES hwcap for COMPAT tasks blk-wbt: call rq_qos_add() after wb_normal is initialized block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init media: venus: dec: Handle the case where find_format fails media: mceusb: set timeout to at least timeout provided KVM: arm64: vgic: Fix exit condition in scan_its_table() kvm: Add support for arch compat vm ioctls cpufreq: qcom: fix memory leak in error path ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS ata: ahci-imx: Fix MODULE_ALIAS hwmon/coretemp: Handle large core ID value x86/microcode/AMD: Apply the patch early on every logical thread i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter cpufreq: qcom: fix writes in read-only memory region selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() ocfs2: fix BUG when iput after ocfs2_mknod fails ocfs2: clear dinode links count in case of error Linux 5.10.151 kbuild: Add skip_encoding_btf_enum64 option to pahole kbuild: Unify options for BTF generation for vmlinux and modules kbuild: skip per-CPU BTF generation for pahole v1.18-v1.21 kbuild: Quote OBJCOPY var to avoid a pahole call break the build bpf: Generate BTF_KIND_FLOAT when linking vmlinux Linux 5.10.150 Revert "drm/amdgpu: make sure to init common IP before gmc" gcov: support GCC 12.1 and newer compilers f2fs: fix wrong condition to trigger background checkpoint correctly thermal: intel_powerclamp: Use first online CPU as control_cpu inet: fully convert sk->sk_rx_dst to RCU rules ext4: continue to expand file system when the target size doesn't reach Revert "drm/amdgpu: use dirty framebuffer helper" Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega" net/ieee802154: don't warn zero-sized raw_sendmsg() Revert "net/ieee802154: reject zero-sized raw_sendmsg()" net: ieee802154: return -EINVAL for unknown addr type mm: hugetlb: fix UAF in hugetlb_handle_userfault io_uring/af_unix: defer registered files gc to io_uring release io_uring: correct pinned_vm accounting arm64: topology: fix possible overflow in amu_fie_setup() perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc clk: bcm2835: Make peripheral PLLC critical usb: idmouse: fix an uninit-value in idmouse_open nvmet-tcp: add bounds check on Transfer Tag nvme: copy firmware_rev on each init staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() Revert "usb: storage: Add quirk for Samsung Fit flash" usb: musb: Fix musb_gadget.c rxstate overflow bug usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d HID: roccat: Fix use-after-free in roccat_read() soundwire: intel: fix error handling on dai registration issues soundwire: cadence: Don't overwrite msg->buf during write commands bcache: fix set_at_max_writeback_rate() for multiple attached devices ata: libahci_platform: Sanity check the DT child nodes number blk-throttle: prevent overflow while calculating wait time staging: vt6655: fix potential memory leak power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() nbd: Fix hung when signal interrupts nbd_start_device_ioctl() scsi: 3w-9xxx: Avoid disabling device if failing to enable it usb: host: xhci-plat: suspend/resume clks for brcm usb: host: xhci-plat: suspend and resume clocks clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate media: cx88: Fix a null-ptr-deref bug in buffer_prepare() clk: zynqmp: Fix stack-out-of-bounds in strncpy` btrfs: scrub: try to fix super block errors arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT ARM: dts: imx6sx: add missing properties for sram ARM: dts: imx6sll: add missing properties for sram ARM: dts: imx6sl: add missing properties for sram ARM: dts: imx6qp: add missing properties for sram ARM: dts: imx6dl: add missing properties for sram ARM: dts: imx6q: add missing properties for sram ARM: dts: imx7d-sdb: config the max pressure for tsc2046 drm/amd/display: Remove interface for periodic interrupt 1 drm/dp: Don't rewrite link config when setting phy test pattern mmc: sdhci-msm: add compatible string check for sdm670 drm/meson: explicitly remove aggregate driver at module unload time drm/amdgpu: fix initial connector audio value ASoC: SOF: pci: Change DMI match info to support all Chrome platforms platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading platform/chrome: cros_ec: Notify the PM of wake events during resume drm: panel-orientation-quirks: Add quirk for Anbernic Win600 drm/vc4: vec: Fix timings for VEC modes drm: bridge: dw_hdmi: only trigger hotplug event on link change udmabuf: Set ubuf->sg = NULL if the creation of sg table fails drm/amd/display: fix overflow on MIN_I64 definition gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() drm: Prevent drm_copy_field() to attempt copying a NULL pointer drm: Use size_t type for len variable in drm_copy_field() drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() r8152: Rate limit overflow messages Bluetooth: L2CAP: Fix user-after-free net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory wifi: rt2x00: correctly set BBP register 86 for MT7620 wifi: rt2x00: set SoC wmac clock register wifi: rt2x00: set VGC gain for both chains of MT7620 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 can: bcm: check the result of can_send() in bcm_can_tx() Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() regulator: core: Prevent integer underflow wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() xfrm: Update ipcomp_scratches with NULL when freed wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() tcp: annotate data-race around tcp_md5sig_pool_populated openvswitch: Fix overreporting of drops in dropwatch openvswitch: Fix double reporting of drops in dropwatch bpftool: Clear errno after libcap's checks wifi: brcmfmac: fix invalid address access when enabling SCAN log level NFSD: fix use-after-free on source server when doing inter-server copy NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data x86/entry: Work around Clang __bdos() bug thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue MIPS: BCM47XX: Cast memcmp() of function to (void *) ACPI: video: Add Toshiba Satellit…
- Loading branch information
