- Linux-stable-mirror - lists.linaro.org

by Greg Kroah-Hartman

I'm announcing the release of the 6.11.8 kernel. All users of the 6.11 kernel series must upgrade. The updated 6.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.11.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml | 2 Documentation/netlink/specs/mptcp_pm.yaml | 1 Makefile | 2 arch/arm/boot/dts/rockchip/rk3036-kylin.dts | 4 arch/arm/boot/dts/rockchip/rk3036.dtsi | 14 arch/arm64/Kconfig | 1 arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi | 4 arch/arm64/boot/dts/freescale/imx8mp-phyboard-pollux-rdk.dts | 12 arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 8 arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 arch/arm64/boot/dts/rockchip/Makefile | 1 arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 1 arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 30 ++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 2 arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts | 2 arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts | 2 arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts | 6 arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 6 arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts | 1 arch/arm64/boot/dts/rockchip/rk3568-roc-pc.dts | 3 arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 20 - arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 arch/arm64/boot/dts/rockchip/rk3588-toybrick-x0.dts | 1 arch/arm64/boot/dts/rockchip/rk3588-turing-rk1.dtsi | 1 arch/arm64/kernel/fpsimd.c | 1 arch/arm64/kernel/smccc-call.S | 35 -- arch/powerpc/kvm/book3s_hv.c | 12 arch/xtensa/Kconfig | 1 arch/xtensa/include/asm/cmpxchg.h | 2 block/blk-map.c | 56 +-- block/blk-merge.c | 146 +++------- block/blk-mq.c | 11 block/blk.h | 63 +++- drivers/char/tpm/tpm-chip.c | 4 drivers/char/tpm/tpm-interface.c | 32 +- drivers/clk/qcom/clk-alpha-pll.c | 2 drivers/clk/qcom/gcc-x1e80100.c | 12 drivers/clk/qcom/videocc-sm8350.c | 4 drivers/edac/qcom_edac.c | 8 drivers/firmware/arm_scmi/bus.c | 7 drivers/firmware/qcom/Kconfig | 11 drivers/firmware/qcom/qcom_scm.c | 77 ++++- drivers/firmware/smccc/smccc.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 2 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 15 + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 4 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 49 ++- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 4 drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 5 drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 5 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 5 drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 4 drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 4 drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 20 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 5 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 74 ----- drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 8 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h | 2 drivers/gpu/drm/imagination/pvr_context.c | 33 ++ drivers/gpu/drm/imagination/pvr_context.h | 21 + drivers/gpu/drm/imagination/pvr_device.h | 10 drivers/gpu/drm/imagination/pvr_drv.c | 3 drivers/gpu/drm/imagination/pvr_vm.c | 22 + drivers/gpu/drm/imagination/pvr_vm.h | 1 drivers/gpu/drm/panthor/panthor_device.c | 4 drivers/gpu/drm/panthor/panthor_mmu.c | 2 drivers/gpu/drm/xe/regs/xe_gt_regs.h | 2 drivers/gpu/drm/xe/xe_device.h | 14 drivers/gpu/drm/xe/xe_exec.c | 13 drivers/gpu/drm/xe/xe_gt_ccs_mode.c | 6 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 2 drivers/gpu/drm/xe/xe_guc_ct.c | 9 drivers/gpu/drm/xe/xe_wait_user_fence.c | 7 drivers/hid/hid-core.c | 2 drivers/i2c/busses/i2c-designware-common.c | 6 drivers/i2c/busses/i2c-designware-core.h | 1 drivers/irqchip/irq-gic-v3.c | 7 drivers/md/dm-cache-target.c | 59 ++-- drivers/md/dm-unstripe.c | 4 drivers/md/dm.c | 4 drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 drivers/media/dvb-core/dvb_frontend.c | 4 drivers/media/dvb-core/dvb_vb2.c | 8 drivers/media/dvb-core/dvbdev.c | 17 + drivers/media/dvb-frontends/cx24116.c | 7 drivers/media/dvb-frontends/stb0899_algo.c | 2 drivers/media/i2c/adv7604.c | 26 + drivers/media/i2c/ar0521.c | 4 drivers/media/pci/mgb4/mgb4_cmt.c | 2 drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 - drivers/media/test-drivers/vivid/vivid-core.c | 2 drivers/media/test-drivers/vivid/vivid-core.h | 4 drivers/media/test-drivers/vivid/vivid-ctrls.c | 2 drivers/media/test-drivers/vivid/vivid-vid-cap.c | 2 drivers/media/usb/uvc/uvc_driver.c | 2 drivers/media/v4l2-core/v4l2-ctrls-api.c | 17 - drivers/net/can/c_can/c_can_main.c | 7 drivers/net/can/cc770/Kconfig | 2 drivers/net/can/m_can/m_can.c | 3 drivers/net/can/sja1000/Kconfig | 2 drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 8 drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 10 drivers/net/ethernet/arc/emac_main.c | 27 + drivers/net/ethernet/arc/emac_mdio.c | 9 drivers/net/ethernet/freescale/dpaa/dpaa_eth_trace.h | 2 drivers/net/ethernet/freescale/enetc/enetc_pf.c | 18 - drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 - drivers/net/ethernet/intel/i40e/i40e.h | 1 drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 drivers/net/ethernet/intel/i40e/i40e_main.c | 12 drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 3 drivers/net/ethernet/intel/ice/ice_fdir.h | 4 drivers/net/ethernet/intel/idpf/idpf.h | 4 drivers/net/ethernet/intel/idpf/idpf_ethtool.c | 11 drivers/net/ethernet/intel/idpf/idpf_lib.c | 5 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 3 drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 drivers/net/ethernet/vertexcom/mse102x.c | 5 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 drivers/net/phy/dp83848.c | 2 drivers/net/virtio_net.c | 119 ++++++-- drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 drivers/platform/x86/amd/pmc/pmc.c | 5 drivers/platform/x86/amd/pmf/core.c | 21 - drivers/platform/x86/amd/pmf/pmf.h | 55 +++ drivers/platform/x86/amd/pmf/spc.c | 52 ++- drivers/pwm/pwm-imx-tpm.c | 4 drivers/regulator/rtq2208-regulator.c | 2 drivers/rpmsg/qcom_glink_native.c | 10 drivers/scsi/sd_zbc.c | 3 drivers/soc/qcom/llcc-qcom.c | 3 drivers/staging/media/av7110/av7110.h | 4 drivers/staging/media/av7110/av7110_ca.c | 25 + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 6 drivers/thermal/qcom/lmh.c | 7 drivers/thermal/thermal_of.c | 21 - drivers/thunderbolt/retimer.c | 2 drivers/thunderbolt/usb4.c | 2 drivers/ufs/core/ufshcd.c | 10 drivers/usb/dwc3/core.c | 25 - drivers/usb/musb/sunxi.c | 2 drivers/usb/serial/io_edgeport.c | 8 drivers/usb/serial/option.c | 6 drivers/usb/serial/qcserial.c | 2 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 8 drivers/usb/typec/ucsi/ucsi_ccg.c | 2 fs/btrfs/bio.c | 30 +- fs/btrfs/delayed-ref.c | 2 fs/btrfs/inode.c | 2 fs/btrfs/super.c | 25 - fs/nfs/inode.c | 70 +++- fs/nfs/nfs4proc.c | 4 fs/nfs/super.c | 10 fs/ocfs2/xattr.c | 3 fs/proc/vmcore.c | 9 fs/smb/server/connection.c | 1 fs/smb/server/connection.h | 1 fs/smb/server/mgmt/user_session.c | 15 - fs/smb/server/server.c | 20 - fs/smb/server/smb_common.c | 10 fs/smb/server/smb_common.h | 2 fs/tracefs/inode.c | 12 include/linux/arm-smccc.h | 32 -- include/linux/bio.h | 4 include/linux/soc/qcom/llcc-qcom.h | 2 include/linux/user_namespace.h | 3 include/net/netfilter/nf_tables.h | 4 include/trace/events/rxrpc.h | 1 kernel/signal.c | 3 kernel/ucount.c | 9 lib/objpool.c | 18 - mm/damon/core.c | 42 +- mm/filemap.c | 2 mm/huge_memory.c | 35 +- mm/internal.h | 10 mm/memcontrol-v1.c | 25 + mm/memcontrol.c | 8 mm/migrate.c | 4 mm/mlock.c | 9 mm/page_alloc.c | 1 mm/slab_common.c | 31 +- mm/swap.c | 4 mm/vmscan.c | 4 net/mptcp/mptcp_pm_gen.c | 1 net/mptcp/pm_userspace.c | 3 net/netfilter/nf_tables_api.c | 41 ++ net/rxrpc/conn_client.c | 4 net/sctp/sm_statefuns.c | 2 net/smc/af_smc.c | 4 net/sunrpc/xprtsock.c | 1 net/vmw_vsock/hyperv_transport.c | 1 net/vmw_vsock/virtio_transport_common.c | 1 security/keys/keyring.c | 7 security/keys/trusted-keys/trusted_dcp.c | 9 sound/firewire/tascam/amdtp-tascam.c | 2 sound/pci/hda/patch_conexant.c | 2 sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/sof/sof-client-probes-ipc4.c | 1 sound/soc/stm/stm32_spdifrx.c | 2 sound/usb/mixer.c | 1 sound/usb/quirks.c | 2 tools/lib/thermal/sampling.c | 2 tools/testing/selftests/mm/hugetlb_dio.c | 19 - 218 files changed, 1514 insertions(+), 861 deletions(-) Abel Vesa (1): clk: qcom: gcc-x1e80100: Fix USB MP SS1 PHY GDSC pwrsts flags Aleksandr Loktionov (1): i40e: fix race condition by adding filter's intermediate sync state Alex Deucher (3): drm/amdgpu: Adjust debugfs eviction and IB access permissions drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() drm/amdgpu: Adjust debugfs register access permissions Alexander Stein (1): arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs Amelie Delaunay (1): ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove Andrei Vagin (1): ucounts: fix counter leak in inc_rlimit_get_ucounts() Andrew Kanner (1): ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Antonio Quartulli (1): drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported Aurabindo Pillai (1): drm/amd/display: parse umc_info or vram_info based on ASIC Badal Nilawar (1): drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout Balasubramani Vivekanandan (1): drm/xe: Set mask bits for CCS_MODE register Barnabás Czémán (1): clk: qcom: clk-alpha-pll: Fix pll post div mask when width is not set Bart Van Assche (1): scsi: ufs: core: Start the RTC update work later Bartosz Golaszewski (1): firmware: qcom: scm: fix a NULL-pointer dereference Benoit Sevens (1): media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Benoît Monin (1): USB: serial: option: add Quectel RG650V Bjorn Andersson (1): rpmsg: glink: Handle rejected intent request better Brendan King (2): drm/imagination: Add a per-file PVR context list drm/imagination: Break an object reference loop Chen Ridong (1): security/keys: fix slab-out-of-bounds in key_task_permission ChiYuan Huang (1): regulator: rtq2208: Fix uninitialized use of regulator_config Christoph Hellwig (2): block: rework bio splitting block: fix queue limits checks in blk_rq_map_user_bvec for real Corey Hickey (1): platform/x86/amd/pmc: Detect when STB is not available Dan Carpenter (2): usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() USB: serial: io_edgeport: fix use after free in debug printk Dario Binacchi (1): can: c_can: fix {rx,tx}_errors statistics David Gstir (1): KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation David Howells (1): rxrpc: Fix missing locking causing hanging calls Diederik de Haas (4): arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes Diogo Silva (1): net: phy: ti: add PHY_RST_AFTER_CLK_EN flag Dmitry Baryshkov (2): arm64: dts: qcom: sm8450 fix PIPE clock specification for pcie1 thermal/drivers/qcom/lmh: Remove false lockdep backtrace Dragan Simic (2): arm64: dts: rockchip: Move L3 cache outside CPUs in RK3588(S) SoC dtsi arm64: dts: rockchip: Start cooling maps numbering from zero on ROCK 5B Emil Dahl Juhl (1): tools/lib/thermal: Fix sampling handler context ptr Eric Dumazet (1): net/smc: do not leave a dangling sk pointer in __smc_create() Erik Schumacher (1): pwm: imx-tpm: Use correct MODULO value for EPWM mode Filipe Manana (1): btrfs: reinitialize delayed ref list after deleting it from the list Gautam Menghani (1): KVM: PPC: Book3S HV: Mask off LPCR_MER for a vCPU before running it to avoid spurious interrupts Geert Uytterhoeven (2): arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator Geliang Tang (1): mptcp: use sock_kfree_s instead of kfree Greg Kroah-Hartman (1): Linux 6.11.8 Haisu Wang (1): btrfs: fix the length of reserved qgroup to free Hans Verkuil (2): media: dvb-core: add missing buffer index check media: vivid: fix buffer overwrite when using > 32 buffers Heiko Stuebner (13): arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v arm64: dts: rockchip: Drop regulator-init-microvolt from two boards arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards arm64: dts: rockchip: Remove undocumented supports-emmc property arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro ARM: dts: rockchip: fix rk3036 acodec node ARM: dts: rockchip: drop grf reference from rk3036 hdmi ARM: dts: rockchip: Fix the spi controller on rk3036 ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin Hugh Dickins (1): mm/thp: fix deferred split unqueue naming and locking Hyunwoo Kim (2): hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Icenowy Zheng (1): thermal/of: support thermal zones w/o trips subnode Jack Wu (1): USB: serial: qcserial: add support for Sierra Wireless EM86xx Jann Horn (1): drm/panthor: Be stricter about IO mapping flags Jarkko Sakkinen (1): tpm: Lock TPM chip in tpm_pm_suspend() first Jarosław Janik (1): Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" Jinjie Ruan (2): ksmbd: Fix the missing xa_store error check net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() Jiri Kosina (1): HID: core: zero-initialize the report buffer Johan Hovold (2): clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs firmware: qcom: scm: suppress download mode error Johan Jonker (2): net: arc: fix the device for dma_map_single/dma_unmap_single net: arc: rockchip: fix emac mdio node support Johannes Thumshirn (1): scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer Jyri Sarha (1): ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits Kalesh Singh (1): tracing: Fix tracefs mount options Kenneth Feng (2): drm/amd/pm: always pick the pptable from IFWI drm/amd/pm: correct the workload setting Koichiro Den (1): mm/slab: fix warning caused by duplicate kmem_cache creation in kmem_buckets_create Lijo Lazar (1): drm/amdgpu: Fix DPX valid mode check on GC 9.4.3 Liu Peibao (1): i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set Liviu Dudau (1): drm/panthor: Lock XArray when getting entries for the VM Marc Kleine-Budde (3): can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when switching CAN modes Marc Zyngier (1): irqchip/gic-v3: Force propagation of the active state with a read-back Marek Vasut (1): arm64: dts: imx8mp-phyboard-pollux: Set Video PLL1 frequency to 506.8 MHz Mark Brown (1): arm64/sve: Discard stale CPU state when handling SVE traps Mark Rutland (2): arm64: Kconfig: Make SME depend on BROKEN for now arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint Masami Hiramatsu (Google) (1): objpool: fix to make percpu slot allocation more robust Mateusz Polchlopek (1): ice: change q_index variable type to s16 to store -1 value Matthew Brost (2): drm/xe: Fix possible exec queue leak in exec IOCTL drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL Matthieu Baerts (NGI0) (1): mptcp: no admin perm to list endpoints Mauro Carvalho Chehab (12): media: stb0899_algo: initialize cfr before using it media: dvbdev: prevent the risk of out of memory access media: dvb_frontend: don't play tricks with underflow values media: adv7604: prevent underflow condition when reporting colorspace media: mgb4: protect driver against spectre media: ar0521: don't overflow when checking PLL values media: s5p-jpeg: prevent buffer overflows media: cx24116: prevent overflows on SNR calculus media: av7110: fix a spectre vulnerability media: pulse8-cec: fix data timestamp at pulse8_setup() media: v4l2-tpg: prevent the risk of a division by zero media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Mika Westerberg (2): thunderbolt: Add only on-board retimers when !CONFIG_USB4_DEBUGFS_MARGINING thunderbolt: Fix connection issue with Pluggable UD-4VPD dock Mike Snitzer (1): nfs: avoid i_lock contention in nfs_clear_invalid_mapping Mikulas Patocka (1): dm: fix a crash if blk_alloc_disk fails Ming-Hung Tsai (5): dm cache: correct the number of origin blocks to match the target length dm cache: fix flushing uninitialized delayed_work on cache_ctr error dm cache: fix out-of-bounds access to the dirty bitset when resizing dm cache: optimize dirty bit checking with find_next_bit when resizing dm cache: fix potential out-of-bounds access on the first resume Mingcong Bai (1): ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022 Muhammad Usama Anjum (1): selftests: hugetlb_dio: check for initial conditions to skip in the start Mukesh Ojha (1): firmware: qcom: scm: Refactor code to support multiple dload mode Murad Masimov (1): ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() Namjae Jeon (3): ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create ksmbd: check outstanding simultaneous SMB operations ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp NeilBrown (2): sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() NFSv3: only use NFS timeout for MOUNT when protocols are compatible Nirmoy Das (3): drm/xe: Move LNL scheduling WA to xe_device.h drm/xe/ufence: Flush xe ordered_wq in case of ufence timeout drm/xe/guc/tlb: Flush g2h worker in case of tlb timeout Nícolas F. R. A. Prado (1): net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case Pablo Neira Ayuso (1): netfilter: nf_tables: wait for rcu grace period on net_device removal Paul E. McKenney (1): xtensa: Emulate one-byte cmpxchg Pavan Kumar Linga (2): idpf: avoid vport access in idpf_get_link_ksettings idpf: fix idpf_vc_core_init error path Peiyang Wang (1): net: hns3: fix kernel crash when uninstalling driver Peng Fan (1): arm64: dts: imx8mp: correct sdhc ipg clk Philo Lu (4): virtio_net: Support dynamic rss indirection table size virtio_net: Add hash_key_length check virtio_net: Sync rss config to device when virtnet_probe virtio_net: Update rss when set queue Qi Xi (1): fs/proc: fix compile warning about variable 'vmcore_mmap_ops' Qiang Yu (1): clk: qcom: gcc-x1e80100: Fix halt_check for pipediv2 clocks Qingqing Zhou (1): firmware: qcom: scm: Return -EOPNOTSUPP for unsupported SHM bridge enabling Qu Wenruo (1): btrfs: fix per-subvolume RO/RW flags with new mount API Rajendra Nayak (1): EDAC/qcom: Make irq configuration optional Reinhard Speyerer (1): USB: serial: option: add Fibocom FG132 0x0112 composition Rex Nie (1): usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier Roberto Sassu (1): nfs: Fix KMSAN warning in decode_getfattr_attrs() Roger Quadros (1): usb: dwc3: fix fault at system suspend if device was already runtime suspended Roman Gushchin (1): signal: restore the override_rlimit logic Sam Edwards (1): arm64: dts: rockchip: Designate Turing RK1's system power controller SeongJae Park (3): mm/damon/core: avoid overflow in damon_feed_loop_next_input() mm/damon/core: handle zero {aggregation,ops_update} intervals mm/damon/core: handle zero schemes apply interval Sergey Bostandzhyan (1): arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus Shyam Sundar S K (3): platform/x86/amd/pmf: Relocate CPU ID macros to the PMF header platform/x86/amd/pmf: Update SMU metrics table for 1AH family series platform/x86/amd/pmf: Add SMU metrics table support for 1Ah family 60h model Stefan Wahren (1): net: vertexcom: mse102x: Fix possible double free of TX skb Suraj Gupta (2): dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Takashi Iwai (1): ALSA: usb-audio: Add quirk for HP 320 FHD Webcam Thomas Mühlbacher (1): can: {cc770,sja1000}_isa: allow building on x86_64 Tom Chung (1): drm/amd/display: Fix brightness level not retained over reboot Trond Myklebust (3): NFS: Fix attribute delegation behaviour on exclusive create NFS: Further fixes to attribute delegation a/mtime changes filemap: Fix bounds checking in filemap_read() Umang Jain (2): staging: vchiq_arm: Use devm_kzalloc() for drv_mgmt allocation staging: vchiq_arm: Use devm_kzalloc() for vchiq_arm_state allocation Vitaly Lifshits (1): e1000e: Remove Meteor Lake SMBUS workarounds Vladimir Oltean (1): net: dpaa_eth: print FD status in CPU endianness in dpaa_eth_fd tracepoint Wei Fang (2): net: enetc: set MAC address to the VF net_device net: enetc: allocate vf_state during PF probes Wei Yang (1): mm/mlock: set the correct prev on failure Wentao Liang (1): drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path Xin Long (1): sctp: properly validate chunk size in sctp_sf_ootb() Xinqi Zhang (1): firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() Zichen Xie (1): dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow Zijun Hu (1): usb: musb: sunxi: Fix accessing an released usb phy

3 months, 1 week

1
1
0 0

Linux 6.1.117

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.117 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/rk3036-kylin.dts | 4 arch/arm/boot/dts/rk3036.dtsi | 14 - arch/arm64/Kconfig | 1 arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi | 4 arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 25 ++ arch/arm64/boot/dts/freescale/imx8qxp.dtsi | 6 arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 4 arch/riscv/purgatory/entry.S | 3 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 8 drivers/hid/hid-core.c | 2 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 drivers/irqchip/irq-gic-v3.c | 7 drivers/md/dm-cache-target.c | 59 +++--- drivers/md/dm-unstripe.c | 4 drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 drivers/media/dvb-core/dvb_frontend.c | 4 drivers/media/dvb-core/dvbdev.c | 17 + drivers/media/dvb-frontends/cx24116.c | 7 drivers/media/dvb-frontends/stb0899_algo.c | 2 drivers/media/i2c/adv7604.c | 26 +- drivers/media/i2c/ar0521.c | 4 drivers/media/platform/amphion/vpu_core.c | 2 drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 + drivers/media/usb/uvc/uvc_driver.c | 2 drivers/media/v4l2-core/v4l2-ctrls-api.c | 17 + drivers/net/can/c_can/c_can_main.c | 7 drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 8 drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 10 - drivers/net/ethernet/arc/emac_main.c | 27 +- drivers/net/ethernet/arc/emac_mdio.c | 9 drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 drivers/net/ethernet/intel/i40e/i40e.h | 1 drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 drivers/net/ethernet/intel/i40e/i40e_main.c | 12 + drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 3 drivers/net/ethernet/intel/ice/ice_fdir.h | 4 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 drivers/net/ethernet/vertexcom/mse102x.c | 5 drivers/net/phy/dp83848.c | 2 drivers/net/virtio_net.c | 6 drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 drivers/platform/x86/amd/pmc.c | 5 drivers/pwm/pwm-imx-tpm.c | 4 drivers/scsi/sd_zbc.c | 3 drivers/thermal/qcom/lmh.c | 7 drivers/thermal/thermal_of.c | 21 +- drivers/usb/dwc3/core.c | 25 +- drivers/usb/musb/sunxi.c | 2 drivers/usb/serial/io_edgeport.c | 8 drivers/usb/serial/option.c | 6 drivers/usb/serial/qcserial.c | 2 drivers/usb/typec/ucsi/ucsi_ccg.c | 2 fs/btrfs/delayed-ref.c | 2 fs/nfs/inode.c | 125 +++++++++++-- fs/nfs/super.c | 10 - fs/ocfs2/xattr.c | 3 fs/proc/vmcore.c | 9 fs/smb/server/mgmt/user_session.c | 15 + fs/smb/server/server.c | 4 include/linux/nfs_fs.h | 47 ++++ include/linux/tick.h | 8 include/linux/user_namespace.h | 3 kernel/fork.c | 2 kernel/signal.c | 3 kernel/ucount.c | 9 mm/filemap.c | 2 net/core/dst.c | 17 + net/mac80211/chan.c | 4 net/mac80211/mlme.c | 2 net/mac80211/scan.c | 2 net/mac80211/util.c | 4 net/mptcp/pm_userspace.c | 3 net/sched/sch_taprio.c | 18 + net/sctp/sm_statefuns.c | 2 net/sunrpc/xprtsock.c | 1 net/vmw_vsock/hyperv_transport.c | 1 net/vmw_vsock/virtio_transport_common.c | 1 security/keys/keyring.c | 7 sound/firewire/tascam/amdtp-tascam.c | 2 sound/pci/hda/patch_conexant.c | 2 sound/pci/hda/patch_realtek.c | 1 sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/stm/stm32_spdifrx.c | 2 sound/usb/mixer.c | 1 sound/usb/quirks.c | 2 tools/lib/thermal/sampling.c | 2 tools/testing/selftests/arm64/signal/test_signals.c | 4 98 files changed, 569 insertions(+), 228 deletions(-) Aleksandr Loktionov (1): i40e: fix race condition by adding filter's intermediate sync state Alex Deucher (2): drm/amdgpu: Adjust debugfs eviction and IB access permissions drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Alexander Stein (4): arm64: dts: imx8qm: Fix VPU core alias name arm64: dts: imx8qxp: Add VPU subsystem file arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs media: amphion: Fix VPU core alias name Amelie Delaunay (1): ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove Andrei Vagin (1): ucounts: fix counter leak in inc_rlimit_get_ucounts() Andrew Kanner (1): ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Antonio Quartulli (1): drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported Benjamin Segall (1): posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone Benoit Sevens (1): media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Benoît Monin (1): USB: serial: option: add Quectel RG650V Chen Ridong (1): security/keys: fix slab-out-of-bounds in key_task_permission Christoffer Sandberg (1): ALSA: hda/realtek: Fix headset mic on TUXEDO Gemini 17 Gen3 Corey Hickey (1): platform/x86/amd/pmc: Detect when STB is not available Dan Carpenter (2): usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() USB: serial: io_edgeport: fix use after free in debug printk Daniel Maslowski (1): riscv/purgatory: align riscv_kernel_entry Dario Binacchi (1): can: c_can: fix {rx,tx}_errors statistics Diederik de Haas (2): arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node Diogo Silva (1): net: phy: ti: add PHY_RST_AFTER_CLK_EN flag Dmitry Antipov (1): net: sched: use RCU read-side critical section in taprio_dump() Dmitry Baryshkov (1): thermal/drivers/qcom/lmh: Remove false lockdep backtrace Emil Dahl Juhl (1): tools/lib/thermal: Fix sampling handler context ptr Eric Dumazet (1): net: do not delay dst_entries_add() in dst_release() Erik Schumacher (1): pwm: imx-tpm: Use correct MODULO value for EPWM mode Filipe Manana (1): btrfs: reinitialize delayed ref list after deleting it from the list Geert Uytterhoeven (2): arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator Geliang Tang (1): mptcp: use sock_kfree_s instead of kfree Greg Kroah-Hartman (2): Revert "wifi: mac80211: fix RCU list iterations" Linux 6.1.117 Heiko Stuebner (7): arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc ARM: dts: rockchip: fix rk3036 acodec node ARM: dts: rockchip: drop grf reference from rk3036 hdmi ARM: dts: rockchip: Fix the spi controller on rk3036 ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin Hyunwoo Kim (2): hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Icenowy Zheng (1): thermal/of: support thermal zones w/o trips subnode Jack Wu (1): USB: serial: qcserial: add support for Sierra Wireless EM86xx Jarosław Janik (1): Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" Jinjie Ruan (2): ksmbd: Fix the missing xa_store error check net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() Jiri Kosina (1): HID: core: zero-initialize the report buffer Johan Jonker (2): net: arc: fix the device for dma_map_single/dma_unmap_single net: arc: rockchip: fix emac mdio node support Johannes Thumshirn (1): scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer Marc Kleine-Budde (2): can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when switching CAN modes Marc Zyngier (1): irqchip/gic-v3: Force propagation of the active state with a read-back Mark Brown (1): kselftest/arm64: Initialise current at build time in signal tests Mark Rutland (1): arm64: Kconfig: Make SME depend on BROKEN for now Mateusz Polchlopek (1): ice: change q_index variable type to s16 to store -1 value Mauro Carvalho Chehab (10): media: stb0899_algo: initialize cfr before using it media: dvbdev: prevent the risk of out of memory access media: dvb_frontend: don't play tricks with underflow values media: adv7604: prevent underflow condition when reporting colorspace media: ar0521: don't overflow when checking PLL values media: s5p-jpeg: prevent buffer overflows media: cx24116: prevent overflows on SNR calculus media: pulse8-cec: fix data timestamp at pulse8_setup() media: v4l2-tpg: prevent the risk of a division by zero media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Michal Schmidt (1): bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Mike Snitzer (1): nfs: avoid i_lock contention in nfs_clear_invalid_mapping Ming-Hung Tsai (5): dm cache: correct the number of origin blocks to match the target length dm cache: fix flushing uninitialized delayed_work on cache_ctr error dm cache: fix out-of-bounds access to the dirty bitset when resizing dm cache: optimize dirty bit checking with find_next_bit when resizing dm cache: fix potential out-of-bounds access on the first resume Mingcong Bai (1): ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022 Murad Masimov (1): ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() Namjae Jeon (2): ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp NeilBrown (3): sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() NFSv3: only use NFS timeout for MOUNT when protocols are compatible NFSv3: handle out-of-order write replies. Nícolas F. R. A. Prado (1): net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case Peiyang Wang (1): net: hns3: fix kernel crash when uninstalling driver Peng Fan (1): arm64: dts: imx8mp: correct sdhc ipg clk Philo Lu (1): virtio_net: Add hash_key_length check Qi Xi (1): fs/proc: fix compile warning about variable 'vmcore_mmap_ops' Reinhard Speyerer (1): USB: serial: option: add Fibocom FG132 0x0112 composition Roberto Sassu (1): nfs: Fix KMSAN warning in decode_getfattr_attrs() Roger Quadros (1): usb: dwc3: fix fault at system suspend if device was already runtime suspended Roman Gushchin (1): signal: restore the override_rlimit logic Stefan Wahren (1): net: vertexcom: mse102x: Fix possible double free of TX skb Takashi Iwai (1): ALSA: usb-audio: Add quirk for HP 320 FHD Webcam Trond Myklebust (1): filemap: Fix bounds checking in filemap_read() Wei Fang (1): net: enetc: set MAC address to the VF net_device Xin Long (1): sctp: properly validate chunk size in sctp_sf_ootb() Zichen Xie (1): dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow Zijun Hu (1): usb: musb: sunxi: Fix accessing an released usb phy

3 months, 1 week

1
1
0 0

Linux 5.15.172

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.172 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/rk3036-kylin.dts | 4 arch/arm/boot/dts/rk3036.dtsi | 14 - arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 drivers/acpi/prmt.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 8 drivers/hid/hid-core.c | 2 drivers/irqchip/irq-gic-v3.c | 7 drivers/md/dm-cache-target.c | 35 +- drivers/md/dm-unstripe.c | 4 drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 drivers/media/dvb-core/dvb_frontend.c | 4 drivers/media/dvb-core/dvbdev.c | 17 + drivers/media/dvb-frontends/cx24116.c | 7 drivers/media/dvb-frontends/stb0899_algo.c | 2 drivers/media/i2c/adv7604.c | 26 + drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 - drivers/media/usb/uvc/uvc_driver.c | 2 drivers/media/v4l2-core/v4l2-ctrls-api.c | 17 - drivers/net/can/c_can/c_can_main.c | 7 drivers/net/ethernet/arc/emac_main.c | 27 +- drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 drivers/net/ethernet/intel/i40e/i40e.h | 1 drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 drivers/net/ethernet/intel/i40e/i40e_main.c | 12 drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 2 drivers/net/ethernet/intel/ice/ice_fdir.h | 3 drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 16 + drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h | 1 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 drivers/net/phy/dp83848.c | 2 drivers/pwm/pwm-imx-tpm.c | 4 drivers/scsi/sd_zbc.c | 3 drivers/thermal/qcom/lmh.c | 7 drivers/usb/dwc3/core.c | 25 - drivers/usb/musb/sunxi.c | 2 drivers/usb/serial/io_edgeport.c | 8 drivers/usb/serial/option.c | 6 drivers/usb/serial/qcserial.c | 2 drivers/usb/typec/ucsi/ucsi_ccg.c | 2 fs/btrfs/delayed-ref.c | 2 fs/nfs/inode.c | 126 ++++++++- fs/nfs/nfstrace.h | 1 fs/nfs/super.c | 10 fs/ocfs2/xattr.c | 3 fs/proc/vmcore.c | 9 include/linux/fs.h | 36 ++ include/linux/nfs_fs.h | 47 +++ include/linux/tick.h | 8 io_uring/io_uring.c | 50 ++- kernel/fork.c | 2 kernel/ucount.c | 3 net/bridge/br_device.c | 5 net/core/dst.c | 17 - net/sctp/sm_statefuns.c | 2 net/vmw_vsock/hyperv_transport.c | 1 net/vmw_vsock/virtio_transport_common.c | 1 security/keys/keyring.c | 7 sound/firewire/tascam/amdtp-tascam.c | 2 sound/pci/hda/patch_conexant.c | 2 sound/soc/stm/stm32_spdifrx.c | 2 sound/usb/mixer.c | 1 sound/usb/mixer_quirks.c | 170 +++++++++++++ sound/usb/quirks.c | 2 72 files changed, 673 insertions(+), 179 deletions(-) Ahmed Zaki (1): ice: Add a per-VF limit on number of FDIR filters Aleksandr Loktionov (1): i40e: fix race condition by adding filter's intermediate sync state Alex Deucher (2): drm/amdgpu: Adjust debugfs eviction and IB access permissions drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Amelie Delaunay (1): ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove Amir Goldstein (3): io_uring: rename kiocb_end_write() local helper fs: create kiocb_{start,end}_write() helpers io_uring: use kiocb_{start,end}_write() helpers Andrei Vagin (1): ucounts: fix counter leak in inc_rlimit_get_ucounts() Andrew Kanner (1): ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Antonio Quartulli (1): drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported Benjamin Coddington (1): NFS: Add a tracepoint to show the results of nfs_set_cache_invalid() Benjamin Segall (1): posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone Benoit Sevens (1): media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Benoît Monin (1): USB: serial: option: add Quectel RG650V Chen Ridong (1): security/keys: fix slab-out-of-bounds in key_task_permission Dan Carpenter (3): usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() USB: serial: io_edgeport: fix use after free in debug printk ACPI: PRM: Clean up guid type in struct prm_handler_info Dario Binacchi (1): can: c_can: fix {rx,tx}_errors statistics Diederik de Haas (1): arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 Diogo Silva (1): net: phy: ti: add PHY_RST_AFTER_CLK_EN flag Dmitry Baryshkov (1): thermal/drivers/qcom/lmh: Remove false lockdep backtrace Eric Dumazet (1): net: do not delay dst_entries_add() in dst_release() Erik Schumacher (1): pwm: imx-tpm: Use correct MODULO value for EPWM mode Filipe Manana (1): btrfs: reinitialize delayed ref list after deleting it from the list Geert Uytterhoeven (1): arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator Greg Kroah-Hartman (1): Linux 5.15.172 Heiko Stuebner (7): arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc ARM: dts: rockchip: fix rk3036 acodec node ARM: dts: rockchip: drop grf reference from rk3036 hdmi ARM: dts: rockchip: Fix the spi controller on rk3036 ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin Hyunwoo Kim (2): hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Jack Wu (1): USB: serial: qcserial: add support for Sierra Wireless EM86xx Jan Schär (3): ALSA: usb-audio: Support jack detection on Dell dock ALSA: usb-audio: Add quirks for Dell WD19 dock ALSA: usb-audio: Add endianness annotations Jarosław Janik (1): Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" Jens Axboe (1): io_uring/rw: fix missing NOWAIT check for O_DIRECT start write Jiri Kosina (1): HID: core: zero-initialize the report buffer Johan Jonker (1): net: arc: fix the device for dma_map_single/dma_unmap_single Johannes Thumshirn (1): scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer Marc Zyngier (1): irqchip/gic-v3: Force propagation of the active state with a read-back Mauro Carvalho Chehab (9): media: stb0899_algo: initialize cfr before using it media: dvbdev: prevent the risk of out of memory access media: dvb_frontend: don't play tricks with underflow values media: adv7604: prevent underflow condition when reporting colorspace media: s5p-jpeg: prevent buffer overflows media: cx24116: prevent overflows on SNR calculus media: pulse8-cec: fix data timestamp at pulse8_setup() media: v4l2-tpg: prevent the risk of a division by zero media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Mike Snitzer (1): nfs: avoid i_lock contention in nfs_clear_invalid_mapping Ming-Hung Tsai (4): dm cache: correct the number of origin blocks to match the target length dm cache: fix out-of-bounds access to the dirty bitset when resizing dm cache: optimize dirty bit checking with find_next_bit when resizing dm cache: fix potential out-of-bounds access on the first resume Murad Masimov (1): ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() NeilBrown (2): NFSv3: only use NFS timeout for MOUNT when protocols are compatible NFSv3: handle out-of-order write replies. Nikolay Aleksandrov (1): net: bridge: xmit: make sure we have at least eth header len bytes Nícolas F. R. A. Prado (1): net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case Peiyang Wang (1): net: hns3: fix kernel crash when uninstalling driver Peng Fan (1): arm64: dts: imx8mp: correct sdhc ipg clk Qi Xi (1): fs/proc: fix compile warning about variable 'vmcore_mmap_ops' Reinhard Speyerer (1): USB: serial: option: add Fibocom FG132 0x0112 composition Roberto Sassu (1): nfs: Fix KMSAN warning in decode_getfattr_attrs() Roger Quadros (1): usb: dwc3: fix fault at system suspend if device was already runtime suspended Takashi Iwai (1): ALSA: usb-audio: Add quirk for HP 320 FHD Webcam Wei Fang (1): net: enetc: set MAC address to the VF net_device Xin Long (1): sctp: properly validate chunk size in sctp_sf_ootb() Zichen Xie (1): dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow Zijun Hu (1): usb: musb: sunxi: Fix accessing an released usb phy

3 months, 1 week

1
1
0 0

FAILED: patch "[PATCH] mm: refactor map_deny_write_exec()" failed to apply to 5.10-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 0fb4a7ad270b3b209e510eb9dc5b07bf02b7edaf # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024111112-follicle-scapegoat-c6bf@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 0fb4a7ad270b3b209e510eb9dc5b07bf02b7edaf Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Date: Tue, 29 Oct 2024 18:11:46 +0000 Subject: [PATCH] mm: refactor map_deny_write_exec() Refactor the map_deny_write_exec() to not unnecessarily require a VMA parameter but rather to accept VMA flags parameters, which allows us to use this function early in mmap_region() in a subsequent commit. While we're here, we refactor the function to be more readable and add some additional documentation. Link: https://lkml.kernel.org/r/6be8bb59cd7c68006ebb006eb9d8dc27104b1f70.17302246… Fixes: deb0f6562884 ("mm/mmap: undo ->mmap() when arch_validate_flags() fails") Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Reported-by: Jann Horn <jannh(a)google.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Reviewed-by: Jann Horn <jannh(a)google.com> Cc: Andreas Larsson <andreas(a)gaisler.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Helge Deller <deller(a)gmx.de> Cc: James E.J. Bottomley <James.Bottomley(a)HansenPartnership.com> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Mark Brown <broonie(a)kernel.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> diff --git a/include/linux/mman.h b/include/linux/mman.h index bcb201ab7a41..8ddca62d6460 100644 --- a/include/linux/mman.h +++ b/include/linux/mman.h @@ -188,16 +188,31 @@ static inline bool arch_memory_deny_write_exec_supported(void) * * d) mmap(PROT_READ | PROT_EXEC) * mmap(PROT_READ | PROT_EXEC | PROT_BTI) + * + * This is only applicable if the user has set the Memory-Deny-Write-Execute + * (MDWE) protection mask for the current process. + * + * @old specifies the VMA flags the VMA originally possessed, and @new the ones + * we propose to set. + * + * Return: false if proposed change is OK, true if not ok and should be denied. */ -static inline bool map_deny_write_exec(struct vm_area_struct *vma, unsigned long vm_flags) +static inline bool map_deny_write_exec(unsigned long old, unsigned long new) { + /* If MDWE is disabled, we have nothing to deny. */ if (!test_bit(MMF_HAS_MDWE, &current->mm->flags)) return false; - if ((vm_flags & VM_EXEC) && (vm_flags & VM_WRITE)) + /* If the new VMA is not executable, we have nothing to deny. */ + if (!(new & VM_EXEC)) + return false; + + /* Under MDWE we do not accept newly writably executable VMAs... */ + if (new & VM_WRITE) return true; - if (!(vma->vm_flags & VM_EXEC) && (vm_flags & VM_EXEC)) + /* ...nor previously non-executable VMAs becoming executable. */ + if (!(old & VM_EXEC)) return true; return false; diff --git a/mm/mmap.c b/mm/mmap.c index ac0604f146f6..ab71d4c3464c 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1505,7 +1505,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, vma_set_anonymous(vma); } - if (map_deny_write_exec(vma, vma->vm_flags)) { + if (map_deny_write_exec(vma->vm_flags, vma->vm_flags)) { error = -EACCES; goto close_and_free_vma; } diff --git a/mm/mprotect.c b/mm/mprotect.c index 0c5d6d06107d..6f450af3252e 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -810,7 +810,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len, break; } - if (map_deny_write_exec(vma, newflags)) { + if (map_deny_write_exec(vma->vm_flags, newflags)) { error = -EACCES; break; } diff --git a/mm/vma.h b/mm/vma.h index 75558b5e9c8c..d58068c0ff2e 100644 --- a/mm/vma.h +++ b/mm/vma.h @@ -42,7 +42,7 @@ struct vma_munmap_struct { int vma_count; /* Number of vmas that will be removed */ bool unlock; /* Unlock after the munmap */ bool clear_ptes; /* If there are outstanding PTE to be cleared */ - /* 1 byte hole */ + /* 2 byte hole */ unsigned long nr_pages; /* Number of pages being removed */ unsigned long locked_vm; /* Number of locked pages */ unsigned long nr_accounted; /* Number of VM_ACCOUNT pages */

3 months, 1 week

2
1
0 0

[PATCH] arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled

by Will Deacon

Commit 18011eac28c7 ("arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks") tried to optimise the context switching of tpidrro_el0 by eliding the clearing of the register when switching to a native task with kpti enabled, on the erroneous assumption that the kpti trampoline entry code would already have taken care of the write. Although the kpti trampoline does zero the register on entry from a native task, the check in tls_thread_switch() is on the *next* task and so we can end up leaving a stale, non-zero value in the register if the previous task was 32-bit. Drop the broken optimisation and zero tpidrro_el0 unconditionally when switching to a native 64-bit task. Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: <stable(a)vger.kernel.org> Fixes: 18011eac28c7 ("arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks") Signed-off-by: Will Deacon <will(a)kernel.org> --- You fix one side-channel and introduce another... :( arch/arm64/kernel/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c index 3e7c8c8195c3..2bbcbb11d844 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -442,7 +442,7 @@ static void tls_thread_switch(struct task_struct *next) if (is_compat_thread(task_thread_info(next))) write_sysreg(next->thread.uw.tp_value, tpidrro_el0); - else if (!arm64_kernel_unmapped_at_el0()) + else write_sysreg(0, tpidrro_el0); write_sysreg(*task_user_tls(next), tpidr_el0); -- 2.47.0.277.g8800431eea-goog

3 months, 1 week

4
3
0 0

[PATCH net v2] netfilter: ipset: add missing range check in bitmap_ip_uadt

by Jeongjun Park

When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+58c872f7790a4d2ac951(a)syzkaller.appspotmail.com Fixes: 72205fc68bd1 ("netfilter: ipset: bitmap:ip set type support") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> --- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c index e4fa00abde6a..5988b9bb9029 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ip.c +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c @@ -163,11 +163,8 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); if (ret) return ret; - if (ip > ip_to) { + if (ip > ip_to) swap(ip, ip_to); - if (ip < map->first_ip) - return -IPSET_ERR_BITMAP_RANGE; - } } else if (tb[IPSET_ATTR_CIDR]) { u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); @@ -178,7 +175,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ip_to = ip; } - if (ip_to > map->last_ip) + if (ip < map->first_ip || ip_to > map->last_ip) return -IPSET_ERR_BITMAP_RANGE; for (; !before(ip_to, ip); ip += map->hosts) { --

3 months, 1 week

5
5
0 0

[PATCH] drm/panthor: Fix memory leak in panthor_ioctl_group_create()

by Jann Horn

When bailing out due to group_priority_permit() failure, the queue_args need to be freed. Fix it by rearranging the function to use the goto-on-error pattern, such that the success case flows straight without indentation while error cases jump forward to cleanup. Cc: stable(a)vger.kernel.org Fixes: 5f7762042f8a ("drm/panthor: Restrict high priorities on group_create") Signed-off-by: Jann Horn <jannh(a)google.com> --- testcase: ``` #include <err.h> #include <fcntl.h> #include <stddef.h> #include <sys/ioctl.h> #include <drm/panthor_drm.h> #define SYSCHK(x) ({ \ typeof(x) __res = (x); \ if (__res == (typeof(x))-1) \ err(1, "SYSCHK(" #x ")"); \ __res; \ }) #define GPU_PATH "/dev/dri/by-path/platform-fb000000.gpu-card" int main(void) { int fd = SYSCHK(open(GPU_PATH, O_RDWR)); while (1) { struct drm_panthor_queue_create qc[16] = {}; struct drm_panthor_group_create gc = { .queues = { .stride = sizeof(struct drm_panthor_queue_create), .count = 16, .array = (unsigned long)qc }, .priority = PANTHOR_GROUP_PRIORITY_HIGH+1/*invalid*/ }; ioctl(fd, DRM_IOCTL_PANTHOR_GROUP_CREATE, &gc); } } ``` I have tested that without this patch, after running the testcase for a few seconds and then manually killing it, 2G of RAM in kmalloc-128 have been leaked. With the patch applied, the memory leak is gone. (By the way, get_maintainer.pl suggests that I also send this patch to the general DRM maintainers and the DRM-misc maintainers; looking at MAINTAINERS, it looks like it is normal that the general DRM maintainers are listed for everything under drivers/gpu/, but DRM-misc has exclusion rules for a bunch of drivers but not panthor. I don't know if that is intentional.) --- drivers/gpu/drm/panthor/panthor_drv.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/panthor/panthor_drv.c b/drivers/gpu/drm/panthor/panthor_drv.c index c520f156e2d73f7e735f8bf2d6d8e8efacec9362..815c23cff25f305d884e8e3e263fa22888f7d5ce 100644 --- a/drivers/gpu/drm/panthor/panthor_drv.c +++ b/drivers/gpu/drm/panthor/panthor_drv.c @@ -1032,14 +1032,15 @@ static int panthor_ioctl_group_create(struct drm_device *ddev, void *data, ret = group_priority_permit(file, args->priority); if (ret) - return ret; + goto out; ret = panthor_group_create(pfile, args, queue_args); - if (ret >= 0) { - args->group_handle = ret; - ret = 0; - } + if (ret < 0) + goto out; + args->group_handle = ret; + ret = 0; +out: kvfree(queue_args); return ret; } --- base-commit: 9f8e716d46c68112484a23d1742d9ec725e082fc change-id: 20241113-panthor-fix-gcq-bailout-2d9ac36590ed -- Jann Horn <jannh(a)google.com>

3 months, 1 week

4
3
0 0

[PATCH 6.6 000/119] 6.6.61-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 6.6.61 release. There are 119 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 Nov 2024 10:18:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.61-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 6.6.61-rc1 Hyunwoo Kim <v4bel(a)theori.io> vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Hyunwoo Kim <v4bel(a)theori.io> hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer Mingcong Bai <jeffbai(a)aosc.io> ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022 Andrei Vagin <avagin(a)google.com> ucounts: fix counter leak in inc_rlimit_get_ucounts() Andrew Kanner <andrew.kanner(a)gmail.com> ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Marc Zyngier <maz(a)kernel.org> irqchip/gic-v3: Force propagation of the active state with a read-back Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add Quectel RG650V Reinhard Speyerer <rspmn(a)arcor.de> USB: serial: option: add Fibocom FG132 0x0112 composition Jack Wu <wojackbb(a)gmail.com> USB: serial: qcserial: add support for Sierra Wireless EM86xx Dan Carpenter <dan.carpenter(a)linaro.org> USB: serial: io_edgeport: fix use after free in debug printk Dan Carpenter <dan.carpenter(a)linaro.org> usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Rex Nie <rex.nie(a)jaguarmicro.com> usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier Roger Quadros <rogerq(a)kernel.org> usb: dwc3: fix fault at system suspend if device was already runtime suspended Zijun Hu <quic_zijuhu(a)quicinc.com> usb: musb: sunxi: Fix accessing an released usb phy Roman Gushchin <roman.gushchin(a)linux.dev> signal: restore the override_rlimit logic Qi Xi <xiqi2(a)huawei.com> fs/proc: fix compile warning about variable 'vmcore_mmap_ops' Liu Peibao <loven.liu(a)jaguarmicro.com> i2c: designware: do not hold SCL low when I2C_DYNAMIC_TAR_UPDATE is not set Trond Myklebust <trond.myklebust(a)hammerspace.com> filemap: Fix bounds checking in filemap_read() Benoit Sevens <bsevens(a)google.com> media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Pu Lehui <pulehui(a)huawei.com> Revert "selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size" Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Revert "wifi: mac80211: fix RCU list iterations" Daniel Maslowski <cyrevolt(a)googlemail.com> riscv/purgatory: align riscv_kernel_entry Filipe Manana <fdmanana(a)suse.com> btrfs: reinitialize delayed ref list after deleting it from the list Mark Rutland <mark.rutland(a)arm.com> arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint Mark Rutland <mark.rutland(a)arm.com> arm64: Kconfig: Make SME depend on BROKEN for now Mark Brown <broonie(a)kernel.org> arm64/sve: Discard stale CPU state when handling SVE traps Geliang Tang <tanggeliang(a)kylinos.cn> mptcp: use sock_kfree_s instead of kfree Stefan Wahren <wahrenst(a)gmx.net> net: vertexcom: mse102x: Fix possible double free of TX skb Jinjie Ruan <ruanjinjie(a)huawei.com> net: wwan: t7xx: Fix off-by-one error in t7xx_dpmaif_rx_buf_alloc() Roberto Sassu <roberto.sassu(a)huawei.com> nfs: Fix KMSAN warning in decode_getfattr_attrs() Benjamin Segall <bsegall(a)google.com> posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Add quirk for HP 320 FHD Webcam Zichen Xie <zichenxie0106(a)gmail.com> dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix potential out-of-bounds access on the first resume Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: optimize dirty bit checking with find_next_bit when resizing Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix out-of-bounds access to the dirty bitset when resizing Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix flushing uninitialized delayed_work on cache_ctr error Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: correct the number of origin blocks to match the target length Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> thermal/drivers/qcom/lmh: Remove false lockdep backtrace Antonio Quartulli <antonio(a)mandelbit.com> drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported Lijo Lazar <lijo.lazar(a)amd.com> drm/amdgpu: Fix DPX valid mode check on GC 9.4.3 Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Adjust debugfs register access permissions Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Adjust debugfs eviction and IB access permissions Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> rpmsg: glink: Handle rejected intent request better Erik Schumacher <erik.schumacher(a)iris-sensing.com> pwm: imx-tpm: Use correct MODULO value for EPWM mode Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp Jinjie Ruan <ruanjinjie(a)huawei.com> ksmbd: Fix the missing xa_store error check Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: check outstanding simultaneous SMB operations Namjae Jeon <linkinjeon(a)kernel.org> ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create Marc Kleine-Budde <mkl(a)pengutronix.de> can: mcp251xfd: mcp251xfd_ring_alloc(): fix coalescing configuration when switching CAN modes Marc Kleine-Budde <mkl(a)pengutronix.de> can: mcp251xfd: mcp251xfd_get_tef_len(): fix length calculation Marc Kleine-Budde <mkl(a)pengutronix.de> can: m_can: m_can_close(): don't call free_irq() for IRQ-less devices Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: v4l2-tpg: prevent the risk of a division by zero Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: pulse8-cec: fix data timestamp at pulse8_setup() Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: cx24116: prevent overflows on SNR calculus Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: s5p-jpeg: prevent buffer overflows Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: ar0521: don't overflow when checking PLL values Jyri Sarha <jyri.sarha(a)linux.intel.com> ASoC: SOF: sof-client-probes-ipc4: Set param_size extension bits Amelie Delaunay <amelie.delaunay(a)foss.st.com> ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove Icenowy Zheng <uwu(a)icenowy.me> thermal/of: support thermal zones w/o trips subnode Emil Dahl Juhl <emdj(a)bang-olufsen.dk> tools/lib/thermal: Fix sampling handler context ptr Murad Masimov <m.masimov(a)maxima.ru> ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() Johannes Thumshirn <johannes.thumshirn(a)wdc.com> scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: adv7604: prevent underflow condition when reporting colorspace Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: dvb_frontend: don't play tricks with underflow values Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: dvbdev: prevent the risk of out of memory access Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: stb0899_algo: initialize cfr before using it Jarosław Janik <jaroslaw.janik(a)gmail.com> Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" Wentao Liang <Wentao_liang_g(a)163.com> drivers: net: ionic: add missed debugfs cleanup to ionic_probe() error path David Howells <dhowells(a)redhat.com> rxrpc: Fix missing locking causing hanging calls Johan Jonker <jbx6244(a)gmail.com> net: arc: rockchip: fix emac mdio node support Johan Jonker <jbx6244(a)gmail.com> net: arc: fix the device for dma_map_single/dma_unmap_single Philo Lu <lulie(a)linux.alibaba.com> virtio_net: Add hash_key_length check Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nf_tables: wait for rcu grace period on net_device removal Florian Westphal <fw(a)strlen.de> netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx George Guo <guodongtai(a)kylinos.cn> netfilter: nf_tables: cleanup documentation Nícolas F. R. A. Prado <nfraprado(a)collabora.com> net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case Diogo Silva <diogompaissilva(a)gmail.com> net: phy: ti: add PHY_RST_AFTER_CLK_EN flag Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: fix kernel crash when uninstalling driver Vitaly Lifshits <vitaly.lifshits(a)intel.com> e1000e: Remove Meteor Lake SMBUS workarounds Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> i40e: fix race condition by adding filter's intermediate sync state Mateusz Polchlopek <mateusz.polchlopek(a)intel.com> ice: change q_index variable type to s16 to store -1 value Dario Binacchi <dario.binacchi(a)amarulasolutions.com> can: c_can: fix {rx,tx}_errors statistics Wei Fang <wei.fang(a)nxp.com> net: enetc: allocate vf_state during PF probes Xin Long <lucien.xin(a)gmail.com> sctp: properly validate chunk size in sctp_sf_ootb() Suraj Gupta <suraj.gupta2(a)amd.com> dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value Wei Fang <wei.fang(a)nxp.com> net: enetc: set MAC address to the VF net_device ChiYuan Huang <cy_huang(a)richtek.com> regulator: rtq2208: Fix uninitialized use of regulator_config Chen Ridong <chenridong(a)huawei.com> security/keys: fix slab-out-of-bounds in key_task_permission Mike Snitzer <snitzer(a)kernel.org> nfs: avoid i_lock contention in nfs_clear_invalid_mapping NeilBrown <neilb(a)suse.de> NFSv3: only use NFS timeout for MOUNT when protocols are compatible NeilBrown <neilb(a)suse.de> sunrpc: handle -ENOTCONN in xs_tcp_setup_socket() Corey Hickey <bugfood-c(a)fatooh.org> platform/x86/amd/pmc: Detect when STB is not available Jiri Kosina <jkosina(a)suse.com> HID: core: zero-initialize the report buffer Diederik de Haas <didi.debian(a)cknow.org> arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: Fix the spi controller on rk3036 Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: drop grf reference from rk3036 hdmi Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: fix rk3036 acodec node Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone pro Xinqi Zhang <quic_xinqzhan(a)quicinc.com> firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp: correct sdhc ipg clk Alexander Stein <alexander.stein(a)ew.tq-group.com> arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs Alexander Stein <alexander.stein(a)ew.tq-group.com> arm64: dts: imx8qxp: Add VPU subsystem file Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: remove num-slots property from rk3328-nanopi-r2s-plus Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Remove undocumented supports-emmc property Sergey Bostandzhyan <jin(a)mediatomb.cc> arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: fix i2c2 pinctrl-names property on anbernic-rg353p/v Diederik de Haas <didi.debian(a)cknow.org> arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes Diederik de Haas <didi.debian(a)cknow.org> arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node Diederik de Haas <didi.debian(a)cknow.org> arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 Geert Uytterhoeven <geert+renesas(a)glider.be> arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator Geert Uytterhoeven <geert+renesas(a)glider.be> arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610 ------------- Diffstat: .../devicetree/bindings/net/xlnx,axi-ethernet.yaml | 2 +- Makefile | 4 +- arch/arm/boot/dts/rockchip/rk3036-kylin.dts | 4 +- arch/arm/boot/dts/rockchip/rk3036.dtsi | 14 ++--- arch/arm64/Kconfig | 1 + arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi | 4 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 +-- arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 25 +++++++++ arch/arm64/boot/dts/freescale/imx8qxp.dtsi | 2 +- arch/arm64/boot/dts/rockchip/Makefile | 1 + arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 1 - arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 +- .../boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 30 +++++++++++ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +- arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 - arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 +- .../boot/dts/rockchip/rk3399-pinephone-pro.dts | 2 - arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +- .../dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- .../boot/dts/rockchip/rk3566-anbernic-rg353p.dts | 2 +- .../boot/dts/rockchip/rk3566-anbernic-rg353v.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts | 6 +-- arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 - arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 6 +-- arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts | 1 - arch/arm64/kernel/fpsimd.c | 1 + arch/arm64/kernel/smccc-call.S | 35 ++----------- arch/riscv/purgatory/entry.S | 3 ++ drivers/firmware/arm_scmi/bus.c | 7 +-- drivers/firmware/smccc/smccc.c | 4 -- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 ++-- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 2 +- drivers/hid/hid-core.c | 2 +- drivers/i2c/busses/i2c-designware-common.c | 6 ++- drivers/i2c/busses/i2c-designware-core.h | 1 + drivers/irqchip/irq-gic-v3.c | 7 +++ drivers/md/dm-cache-target.c | 59 +++++++++++----------- drivers/md/dm-unstripe.c | 4 +- drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 +- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 ++ drivers/media/dvb-core/dvb_frontend.c | 4 +- drivers/media/dvb-core/dvbdev.c | 17 ++++++- drivers/media/dvb-frontends/cx24116.c | 7 ++- drivers/media/dvb-frontends/stb0899_algo.c | 2 +- drivers/media/i2c/adv7604.c | 26 ++++++---- drivers/media/i2c/ar0521.c | 4 +- .../media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 ++++--- drivers/media/usb/uvc/uvc_driver.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls-api.c | 17 ++++--- drivers/net/can/c_can/c_can_main.c | 7 ++- drivers/net/can/m_can/m_can.c | 3 +- drivers/net/can/spi/mcp251xfd/mcp251xfd-ring.c | 8 +-- drivers/net/can/spi/mcp251xfd/mcp251xfd-tef.c | 10 ++-- drivers/net/ethernet/arc/emac_main.c | 27 ++++++---- drivers/net/ethernet/arc/emac_mdio.c | 9 +++- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 18 +++---- drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 +++- drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 +- drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 ++----- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 12 ++++- drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 3 +- drivers/net/ethernet/intel/ice/ice_fdir.h | 4 +- .../net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + drivers/net/ethernet/vertexcom/mse102x.c | 5 +- drivers/net/phy/dp83848.c | 2 + drivers/net/virtio_net.c | 6 +++ drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 2 +- drivers/platform/x86/amd/pmc/pmc.c | 5 ++ drivers/pwm/pwm-imx-tpm.c | 4 +- drivers/regulator/rtq2208-regulator.c | 2 +- drivers/rpmsg/qcom_glink_native.c | 10 ++-- drivers/scsi/sd_zbc.c | 3 +- drivers/thermal/qcom/lmh.c | 7 +++ drivers/thermal/thermal_of.c | 21 ++++---- drivers/usb/dwc3/core.c | 25 +++++---- drivers/usb/musb/sunxi.c | 2 - drivers/usb/serial/io_edgeport.c | 8 +-- drivers/usb/serial/option.c | 6 +++ drivers/usb/serial/qcserial.c | 2 + .../usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 8 +-- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 + fs/btrfs/delayed-ref.c | 2 +- fs/nfs/inode.c | 21 ++++++-- fs/nfs/super.c | 10 +++- fs/ocfs2/xattr.c | 3 +- fs/proc/vmcore.c | 9 ++-- fs/smb/server/connection.c | 1 + fs/smb/server/connection.h | 1 + fs/smb/server/mgmt/user_session.c | 15 ++++-- fs/smb/server/server.c | 20 +++++--- fs/smb/server/smb_common.c | 10 ++-- fs/smb/server/smb_common.h | 2 +- include/linux/arm-smccc.h | 32 ++---------- include/linux/tick.h | 8 +++ include/linux/user_namespace.h | 3 +- include/net/netfilter/nf_tables.h | 55 ++++++++++++++++---- include/trace/events/rxrpc.h | 1 + kernel/fork.c | 2 + kernel/signal.c | 3 +- kernel/ucount.c | 9 ++-- mm/filemap.c | 2 +- net/mac80211/chan.c | 4 +- net/mac80211/mlme.c | 2 +- net/mac80211/scan.c | 2 +- net/mac80211/util.c | 4 +- net/mptcp/pm_userspace.c | 3 +- net/netfilter/nf_tables_api.c | 56 ++++++++++++++------ net/netfilter/nft_immediate.c | 2 +- net/rxrpc/conn_client.c | 4 ++ net/sctp/sm_statefuns.c | 2 +- net/sunrpc/xprtsock.c | 1 + net/vmw_vsock/hyperv_transport.c | 1 + net/vmw_vsock/virtio_transport_common.c | 1 + security/keys/keyring.c | 7 ++- sound/firewire/tascam/amdtp-tascam.c | 2 +- sound/pci/hda/patch_conexant.c | 2 - sound/soc/amd/yc/acp6x-mach.c | 7 +++ sound/soc/sof/sof-client-probes-ipc4.c | 1 + sound/soc/stm/stm32_spdifrx.c | 2 +- sound/usb/mixer.c | 1 + sound/usb/quirks.c | 2 + tools/lib/thermal/sampling.c | 2 + tools/testing/selftests/bpf/network_helpers.c | 24 --------- tools/testing/selftests/bpf/network_helpers.h | 4 -- .../selftests/bpf/prog_tests/flow_dissector.c | 1 + tools/testing/selftests/bpf/xdp_hw_metadata.c | 14 +++++ 131 files changed, 611 insertions(+), 381 deletions(-)

3 months, 1 week

10
128
0 0

[PATCH 5.15 00/76] 5.15.172-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.15.172 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 14 Nov 2024 10:18:19 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.172-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.15.172-rc1 Jan Schär <jan(a)jschaer.ch> ALSA: usb-audio: Add endianness annotations Hyunwoo Kim <v4bel(a)theori.io> vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Hyunwoo Kim <v4bel(a)theori.io> hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer Dan Carpenter <dan.carpenter(a)linaro.org> ACPI: PRM: Clean up guid type in struct prm_handler_info Jan Schär <jan(a)jschaer.ch> ALSA: usb-audio: Add quirks for Dell WD19 dock Jan Schär <jan(a)jschaer.ch> ALSA: usb-audio: Support jack detection on Dell dock Andrei Vagin <avagin(a)google.com> ucounts: fix counter leak in inc_rlimit_get_ucounts() Andrew Kanner <andrew.kanner(a)gmail.com> ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Marc Zyngier <maz(a)kernel.org> irqchip/gic-v3: Force propagation of the active state with a read-back Benoît Monin <benoit.monin(a)gmx.fr> USB: serial: option: add Quectel RG650V Reinhard Speyerer <rspmn(a)arcor.de> USB: serial: option: add Fibocom FG132 0x0112 composition Jack Wu <wojackbb(a)gmail.com> USB: serial: qcserial: add support for Sierra Wireless EM86xx Dan Carpenter <dan.carpenter(a)linaro.org> USB: serial: io_edgeport: fix use after free in debug printk Dan Carpenter <dan.carpenter(a)linaro.org> usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Roger Quadros <rogerq(a)kernel.org> usb: dwc3: fix fault at system suspend if device was already runtime suspended Zijun Hu <quic_zijuhu(a)quicinc.com> usb: musb: sunxi: Fix accessing an released usb phy Qi Xi <xiqi2(a)huawei.com> fs/proc: fix compile warning about variable 'vmcore_mmap_ops' Benoit Sevens <bsevens(a)google.com> media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format Eric Dumazet <edumazet(a)google.com> net: do not delay dst_entries_add() in dst_release() Ahmed Zaki <ahmed.zaki(a)intel.com> ice: Add a per-VF limit on number of FDIR filters Nikolay Aleksandrov <razor(a)blackwall.org> net: bridge: xmit: make sure we have at least eth header len bytes Filipe Manana <fdmanana(a)suse.com> btrfs: reinitialize delayed ref list after deleting it from the list Roberto Sassu <roberto.sassu(a)huawei.com> nfs: Fix KMSAN warning in decode_getfattr_attrs() Jens Axboe <axboe(a)kernel.dk> io_uring/rw: fix missing NOWAIT check for O_DIRECT start write Amir Goldstein <amir73il(a)gmail.com> io_uring: use kiocb_{start,end}_write() helpers Amir Goldstein <amir73il(a)gmail.com> fs: create kiocb_{start,end}_write() helpers Amir Goldstein <amir73il(a)gmail.com> io_uring: rename kiocb_end_write() local helper Benjamin Segall <bsegall(a)google.com> posix-cpu-timers: Clear TICK_DEP_BIT_POSIX_TIMER on clone Takashi Iwai <tiwai(a)suse.de> ALSA: usb-audio: Add quirk for HP 320 FHD Webcam Zichen Xie <zichenxie0106(a)gmail.com> dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix potential out-of-bounds access on the first resume Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: optimize dirty bit checking with find_next_bit when resizing Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: fix out-of-bounds access to the dirty bitset when resizing Ming-Hung Tsai <mtsai(a)redhat.com> dm cache: correct the number of origin blocks to match the target length Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> thermal/drivers/qcom/lmh: Remove false lockdep backtrace Antonio Quartulli <antonio(a)mandelbit.com> drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Alex Deucher <alexander.deucher(a)amd.com> drm/amdgpu: Adjust debugfs eviction and IB access permissions Erik Schumacher <erik.schumacher(a)iris-sensing.com> pwm: imx-tpm: Use correct MODULO value for EPWM mode Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: v4l2-tpg: prevent the risk of a division by zero Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: pulse8-cec: fix data timestamp at pulse8_setup() Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: cx24116: prevent overflows on SNR calculus Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: s5p-jpeg: prevent buffer overflows Amelie Delaunay <amelie.delaunay(a)foss.st.com> ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove Murad Masimov <m.masimov(a)maxima.ru> ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() Johannes Thumshirn <johannes.thumshirn(a)wdc.com> scsi: sd_zbc: Use kvzalloc() to allocate REPORT ZONES buffer Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: adv7604: prevent underflow condition when reporting colorspace Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: dvb_frontend: don't play tricks with underflow values Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: dvbdev: prevent the risk of out of memory access Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> media: stb0899_algo: initialize cfr before using it Jarosław Janik <jaroslaw.janik(a)gmail.com> Revert "ALSA: hda/conexant: Mute speakers at suspend / shutdown" Johan Jonker <jbx6244(a)gmail.com> net: arc: fix the device for dma_map_single/dma_unmap_single Nícolas F. R. A. Prado <nfraprado(a)collabora.com> net: stmmac: Fix unbalanced IRQ wake disable warning on single irq case Diogo Silva <diogompaissilva(a)gmail.com> net: phy: ti: add PHY_RST_AFTER_CLK_EN flag Peiyang Wang <wangpeiyang1(a)huawei.com> net: hns3: fix kernel crash when uninstalling driver Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> i40e: fix race condition by adding filter's intermediate sync state Dario Binacchi <dario.binacchi(a)amarulasolutions.com> can: c_can: fix {rx,tx}_errors statistics Xin Long <lucien.xin(a)gmail.com> sctp: properly validate chunk size in sctp_sf_ootb() Wei Fang <wei.fang(a)nxp.com> net: enetc: set MAC address to the VF net_device Chen Ridong <chenridong(a)huawei.com> security/keys: fix slab-out-of-bounds in key_task_permission Mike Snitzer <snitzer(a)kernel.org> nfs: avoid i_lock contention in nfs_clear_invalid_mapping NeilBrown <neilb(a)suse.de> NFSv3: handle out-of-order write replies. Benjamin Coddington <bcodding(a)redhat.com> NFS: Add a tracepoint to show the results of nfs_set_cache_invalid() NeilBrown <neilb(a)suse.de> NFSv3: only use NFS timeout for MOUNT when protocols are compatible Jiri Kosina <jkosina(a)suse.com> HID: core: zero-initialize the report buffer Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: Fix the spi controller on rk3036 Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: drop grf reference from rk3036 hdmi Heiko Stuebner <heiko(a)sntech.de> ARM: dts: rockchip: fix rk3036 acodec node Peng Fan <peng.fan(a)nxp.com> arm64: dts: imx8mp: correct sdhc ipg clk Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion Heiko Stuebner <heiko(a)sntech.de> arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards Diederik de Haas <didi.debian(a)cknow.org> arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328 Geert Uytterhoeven <geert+renesas(a)glider.be> arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/rk3036-kylin.dts | 4 +- arch/arm/boot/dts/rk3036.dtsi | 14 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 +- arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +- arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 - arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +- .../dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- drivers/acpi/prmt.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 8 +- drivers/hid/hid-core.c | 2 +- drivers/irqchip/irq-gic-v3.c | 7 + drivers/md/dm-cache-target.c | 35 ++--- drivers/md/dm-unstripe.c | 4 +- drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 +- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 + drivers/media/dvb-core/dvb_frontend.c | 4 +- drivers/media/dvb-core/dvbdev.c | 17 ++- drivers/media/dvb-frontends/cx24116.c | 7 +- drivers/media/dvb-frontends/stb0899_algo.c | 2 +- drivers/media/i2c/adv7604.c | 26 ++-- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 ++- drivers/media/usb/uvc/uvc_driver.c | 2 +- drivers/media/v4l2-core/v4l2-ctrls-api.c | 17 ++- drivers/net/can/c_can/c_can_main.c | 7 +- drivers/net/ethernet/arc/emac_main.c | 27 ++-- drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 +- drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 +- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +- drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 2 +- drivers/net/ethernet/intel/ice/ice_fdir.h | 3 + drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 16 ++ drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.h | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + drivers/net/phy/dp83848.c | 2 + drivers/pwm/pwm-imx-tpm.c | 4 +- drivers/scsi/sd_zbc.c | 3 +- drivers/thermal/qcom/lmh.c | 7 + drivers/usb/dwc3/core.c | 25 ++- drivers/usb/musb/sunxi.c | 2 - drivers/usb/serial/io_edgeport.c | 8 +- drivers/usb/serial/option.c | 6 + drivers/usb/serial/qcserial.c | 2 + drivers/usb/typec/ucsi/ucsi_ccg.c | 2 + fs/btrfs/delayed-ref.c | 2 +- fs/nfs/inode.c | 126 +++++++++++++-- fs/nfs/nfstrace.h | 1 + fs/nfs/super.c | 10 +- fs/ocfs2/xattr.c | 3 +- fs/proc/vmcore.c | 9 +- include/linux/fs.h | 36 +++++ include/linux/nfs_fs.h | 47 ++++++ include/linux/tick.h | 8 + io_uring/io_uring.c | 50 +++--- kernel/fork.c | 2 + kernel/ucount.c | 3 +- net/bridge/br_device.c | 5 + net/core/dst.c | 17 ++- net/sctp/sm_statefuns.c | 2 +- net/vmw_vsock/hyperv_transport.c | 1 + net/vmw_vsock/virtio_transport_common.c | 1 + security/keys/keyring.c | 7 +- sound/firewire/tascam/amdtp-tascam.c | 2 +- sound/pci/hda/patch_conexant.c | 2 - sound/soc/stm/stm32_spdifrx.c | 2 +- sound/usb/mixer.c | 1 + sound/usb/mixer_quirks.c | 170 +++++++++++++++++++++ sound/usb/quirks.c | 2 + 72 files changed, 674 insertions(+), 180 deletions(-)

3 months, 1 week

9
84
0 0

[PATCH v2] Revert "usb: gadget: composite: fix OS descriptors w_value logic"

by Elson Roy Serrao

From: Michal Vrastil <michal.vrastil(a)hidglobal.com> This reverts commit ec6ce7075ef879b91a8710829016005dc8170f17. Fix installation of WinUSB driver using OS descriptors. Without the fix the drivers are not installed correctly and the property 'DeviceInterfaceGUID' is missing on host side. The original change was based on the assumption that the interface number is in the high byte of wValue but it is in the low byte, instead. Unfortunately, the fix is based on MS documentation which is also wrong. The actual USB request for OS descriptors (using USB analyzer) looks like: Offset 0 1 2 3 4 5 6 7 0x000 C1 A1 02 00 05 00 0A 00 C1: bmRequestType (device to host, vendor, interface) A1: nas magic number 0002: wValue (2: nas interface) 0005: wIndex (5: get extended property i.e. nas interface GUID) 008E: wLength (142) The fix was tested on Windows 10 and Windows 11. Cc: stable(a)vger.kernel.org Fixes: ec6ce7075ef8 ("usb: gadget: composite: fix OS descriptors w_value logic") Signed-off-by: Michal Vrastil <michal.vrastil(a)hidglobal.com> Signed-off-by: Elson Roy Serrao <quic_eserrao(a)quicinc.com> --- Changes in v2: - Added comments to explain wValue byte ordering discrepancy in MS OS Descriptor Spec. - Link to v1: https://lore.kernel.org/all/9918669c-3bfd-4d42-93c4-218e9364b7cc@quicinc.co… drivers/usb/gadget/composite.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 0e151b54aae8..9225c21d1184 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -2111,8 +2111,20 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) memset(buf, 0, w_length); buf[5] = 0x01; switch (ctrl->bRequestType & USB_RECIP_MASK) { + /* + * The Microsoft CompatID OS Descriptor Spec(w_index = 0x4) and + * Extended Prop OS Desc Spec(w_index = 0x5) state that the + * HighByte of wValue is the InterfaceNumber and the LowByte is + * the PageNumber. This high/low byte ordering is incorrectly + * documented in the Spec. USB analyzer output on the below + * request packets show the high/low byte inverted i.e LowByte + * is the InterfaceNumber and the HighByte is the PageNumber. + * Since we dont support >64KB CompatID/ExtendedProp descriptors, + * PageNumber is set to 0. Hence verify that the HighByte is 0 + * for below two cases. + */ case USB_RECIP_DEVICE: - if (w_index != 0x4 || (w_value & 0xff)) + if (w_index != 0x4 || (w_value >> 8)) break; buf[6] = w_index; /* Number of ext compat interfaces */ @@ -2128,9 +2140,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) } break; case USB_RECIP_INTERFACE: - if (w_index != 0x5 || (w_value & 0xff)) + if (w_index != 0x5 || (w_value >> 8)) break; - interface = w_value >> 8; + interface = w_value & 0xFF; if (interface >= MAX_CONFIG_INTERFACES || !os_desc_cfg->interface[interface]) break; -- 2.17.1

3 months, 1 week

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror