25 Jan, 2021

1 commit

• 2259bc93f   Merge remote-tracking branch 'lts/lf-5.10.y' into lf-5.10.y_android ... Browse Code »

  Change-Id: I173bc0325c93daaf82bb894f77ba35fa827864de

  zhang sanshan

  2021-01-25 16:19:35 +0800  

06 Jan, 2021

2 commits

• 6d63cc42b   jffs2: Fix NULL pointer dereference in rp_size fs option parsing ... Browse Code »

  [ Upstream commit a61df3c413e49b0042f9caf774c58512d1cc71b7 ]

  syzkaller found the following JFFS2 splat:

  Unable to handle kernel paging request at virtual address dfffa00000000001
  Mem abort info:
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
  [dfffa00000000001] address between user and kernel address ranges
  Internal error: Oops: 96000004 [#1] SMP
  Dumping ftrace buffer:
  (ftrace buffer empty)
  Modules linked in:
  CPU: 0 PID: 12745 Comm: syz-executor.5 Tainted: G S 5.9.0-rc8+ #98
  Hardware name: linux,dummy-virt (DT)
  pstate: 20400005 (nzCv daif +PAN -UAO BTYPE=--)
  pc : jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
  lr : jffs2_parse_param+0x108/0x308 fs/jffs2/super.c:205
  sp : ffff000022a57910
  x29: ffff000022a57910 x28: 0000000000000000
  x27: ffff000057634008 x26: 000000000000d800
  x25: 000000000000d800 x24: ffff0000271a9000
  x23: ffffa0001adb5dc0 x22: ffff000023fdcf00
  x21: 1fffe0000454af2c x20: ffff000024cc9400
  x19: 0000000000000000 x18: 0000000000000000
  x17: 0000000000000000 x16: ffffa000102dbdd0
  x15: 0000000000000000 x14: ffffa000109e44bc
  x13: ffffa00010a3a26c x12: ffff80000476e0b3
  x11: 1fffe0000476e0b2 x10: ffff80000476e0b2
  x9 : ffffa00010a3ad60 x8 : ffff000023b70593
  x7 : 0000000000000003 x6 : 00000000f1f1f1f1
  x5 : ffff000023fdcf00 x4 : 0000000000000002
  x3 : ffffa00010000000 x2 : 0000000000000001
  x1 : dfffa00000000000 x0 : 0000000000000008
  Call trace:
  jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
  vfs_parse_fs_param+0x234/0x4e8 fs/fs_context.c:117
  vfs_parse_fs_string+0xe8/0x148 fs/fs_context.c:161
  generic_parse_monolithic+0x17c/0x208 fs/fs_context.c:201
  parse_monolithic_mount_data+0x7c/0xa8 fs/fs_context.c:649
  do_new_mount fs/namespace.c:2871 [inline]
  path_mount+0x548/0x1da8 fs/namespace.c:3192
  do_mount+0x124/0x138 fs/namespace.c:3205
  __do_sys_mount fs/namespace.c:3413 [inline]
  __se_sys_mount fs/namespace.c:3390 [inline]
  __arm64_sys_mount+0x164/0x238 fs/namespace.c:3390
  __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
  invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
  el0_svc_common.constprop.0+0x15c/0x598 arch/arm64/kernel/syscall.c:149
  do_el0_svc+0x60/0x150 arch/arm64/kernel/syscall.c:195
  el0_svc+0x34/0xb0 arch/arm64/kernel/entry-common.c:226
  el0_sync_handler+0xc8/0x5b4 arch/arm64/kernel/entry-common.c:236
  el0_sync+0x15c/0x180 arch/arm64/kernel/entry.S:663
  Code: d2d40001 f2fbffe1 91002260 d343fc02 (38e16841)
  ---[ end trace 4edf690313deda44 ]---

  This is because since ec10a24f10c8, the option parsing happens before
  fill_super and so the MTD device isn't associated with the filesystem.
  Defer the size check until there is a valid association.

  Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
  Cc:
  Cc: David Howells
  Signed-off-by: Jamie Iles
  Signed-off-by: Richard Weinberger
  Signed-off-by: Sasha Levin

  Jamie Iles

  2021-01-06 21:56:49 +0800  
• 58dc34446   jffs2: Allow setting rp_size to zero during remounting ... Browse Code »

  [ Upstream commit cd3ed3c73ac671ff6b0230ccb72b8300292d3643 ]

  Set rp_size to zero will be ignore during remounting.

  The method to identify whether we input a remounting option of
  rp_size is to check if the rp_size input is zero. It can not work
  well if we pass "rp_size=0".

  This patch add a bool variable "set_rp_size" to fix this problem.

  Reported-by: Jubin Zhong
  Signed-off-by: lizhe
  Signed-off-by: Richard Weinberger
  Signed-off-by: Sasha Levin

  lizhe

  2021-01-06 21:56:49 +0800  

30 Dec, 2020

3 commits

• 19057a6a6   Merge 5.10.4 into android12-5.10 ... Browse Code »

  Changes in 5.10.4
  hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs
  drm/gma500: fix double free of gma_connector
  iio: adc: at91_adc: add Kconfig dep on the OF symbol and remove of_match_ptr()
  drm/aspeed: Fix Kconfig warning & subsequent build errors
  drm/mcde: Fix handling of platform_get_irq() error
  drm/tve200: Fix handling of platform_get_irq() error
  arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from ethernet-phy node
  arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy node
  soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
  soc: mediatek: Check if power domains can be powered on at boot time
  arm64: dts: mediatek: mt8183: fix gce incorrect mbox-cells value
  arm64: dts: ipq6018: update the reserved-memory node
  arm64: dts: qcom: sc7180: Fix one forgotten interconnect reference
  soc: qcom: geni: More properly switch to DMA mode
  Revert "i2c: i2c-qcom-geni: Fix DMA transfer race"
  RDMA/bnxt_re: Set queue pair state when being queried
  rtc: pcf2127: fix pcf2127_nvmem_read/write() returns
  RDMA/bnxt_re: Fix entry size during SRQ create
  selinux: fix error initialization in inode_doinit_with_dentry()
  ARM: dts: aspeed-g6: Fix the GPIO memory size
  ARM: dts: aspeed: s2600wf: Fix VGA memory region location
  RDMA/core: Fix error return in _ib_modify_qp()
  RDMA/rxe: Compute PSN windows correctly
  x86/mm/ident_map: Check for errors from ident_pud_init()
  ARM: p2v: fix handling of LPAE translation in BE mode
  RDMA/rtrs-clt: Remove destroy_con_cq_qp in case route resolving failed
  RDMA/rtrs-clt: Missing error from rtrs_rdma_conn_established
  RDMA/rtrs-srv: Don't guard the whole __alloc_srv with srv_mutex
  x86/apic: Fix x2apic enablement without interrupt remapping
  ASoC: qcom: fix unsigned int bitwidth compared to less than zero
  sched/deadline: Fix sched_dl_global_validate()
  sched: Reenable interrupts in do_sched_yield()
  drm/amdgpu: fix incorrect enum type
  crypto: talitos - Endianess in current_desc_hdr()
  crypto: talitos - Fix return type of current_desc_hdr()
  crypto: inside-secure - Fix sizeof() mismatch
  ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode
  drm/msm: Add missing stub definition
  ARM: dts: aspeed: tiogapass: Remove vuart
  drm/amdgpu: fix build_coefficients() argument
  powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
  spi: img-spfi: fix reference leak in img_spfi_resume
  f2fs: call f2fs_get_meta_page_retry for nat page
  RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr()
  perf test: Use generic event for expand_libpfm_events()
  drm/msm/dp: DisplayPort PHY compliance tests fixup
  drm/msm/dsi_pll_7nm: restore VCO rate during restore_state
  drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
  drm/msm/dpu: fix clock scaling on non-sc7180 board
  spi: spi-mem: fix reference leak in spi_mem_access_start
  scsi: aacraid: Improve compat_ioctl handlers
  pinctrl: core: Add missing #ifdef CONFIG_GPIOLIB
  ASoC: pcm: DRAIN support reactivation
  drm/bridge: tpd12s015: Fix irq registering in tpd12s015_probe
  crypto: arm64/poly1305-neon - reorder PAC authentication with SP update
  crypto: arm/aes-neonbs - fix usage of cbc(aes) fallback
  crypto: caam - fix printing on xts fallback allocation error path
  selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  nl80211/cfg80211: fix potential infinite loop
  spi: stm32: fix reference leak in stm32_spi_resume
  bpf: Fix tests for local_storage
  x86/mce: Correct the detection of invalid notifier priorities
  drm/edid: Fix uninitialized variable in drm_cvt_modes()
  ath11k: Initialize complete alpha2 for regulatory change
  ath11k: Fix number of rules in filtered ETSI regdomain
  ath11k: fix wmi init configuration
  brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free}
  arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
  arm64: dts: exynos: Correct psci compatible used on Exynos7
  drm/panel: simple: Add flags to boe_nv133fhm_n61
  Bluetooth: Fix null pointer dereference in hci_event_packet()
  Bluetooth: Fix: LL PRivacy BLE device fails to connect
  Bluetooth: hci_h5: fix memory leak in h5_close
  spi: stm32-qspi: fix reference leak in stm32 qspi operations
  spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
  spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
  spi: tegra20-slink: fix reference leak in slink ops of tegra20
  spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
  spi: tegra114: fix reference leak in tegra spi ops
  spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
  spi: imx: fix reference leak in two imx operations
  ASoC: qcom: common: Fix refcounting in qcom_snd_parse_of()
  ath11k: Handle errors if peer creation fails
  mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
  drm/msm/a6xx: Clear shadow on suspend
  drm/msm/a5xx: Clear shadow on suspend
  firmware: tegra: fix strncpy()/strncat() confusion
  drm/msm/dp: return correct connection status after suspend
  drm/msm/dp: skip checking LINK_STATUS_UPDATED bit
  drm/msm/dp: do not notify audio subsystem if sink doesn't support audio
  selftests/run_kselftest.sh: fix dry-run typo
  selftest/bpf: Add missed ip6ip6 test back
  ASoC: wm8994: Fix PM disable depth imbalance on error
  ASoC: wm8998: Fix PM disable depth imbalance on error
  spi: sprd: fix reference leak in sprd_spi_remove
  virtiofs fix leak in setup
  ASoC: arizona: Fix a wrong free in wm8997_probe
  RDMa/mthca: Work around -Wenum-conversion warning
  ASoC: SOF: Intel: fix Kconfig dependency for SND_INTEL_DSP_CONFIG
  arm64: dts: ti: k3-am65*/j721e*: Fix unit address format error for dss node
  MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
  drm/amdgpu: fix compute queue priority if num_kcq is less than 4
  soc: ti: omap-prm: Do not check rstst bit on deassert if already deasserted
  crypto: Kconfig - CRYPTO_MANAGER_EXTRA_TESTS requires the manager
  crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
  firmware: arm_scmi: Fix missing destroy_workqueue()
  drm/udl: Fix missing error code in udl_handle_damage()
  staging: greybus: codecs: Fix reference counter leak in error handling
  staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
  scripts: kernel-doc: Restore anonymous enum parsing
  drm/amdkfd: Put ACPI table after using it
  ionic: use mc sync for multicast filters
  ionic: flatten calls to ionic_lif_rx_mode
  ionic: change set_rx_mode from_ndo to can_sleep
  media: tm6000: Fix sizeof() mismatches
  media: platform: add missing put_device() call in mtk_jpeg_clk_init()
  media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_dec_pm()
  media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
  media: mtk-vcodec: add missing put_device() call in mtk_vcodec_init_enc_pm()
  media: v4l2-fwnode: Return -EINVAL for invalid bus-type
  media: v4l2-fwnode: v4l2_fwnode_endpoint_parse caller must init vep argument
  media: ov5640: fix support of BT656 bus mode
  media: staging: rkisp1: cap: fix runtime PM imbalance on error
  media: cedrus: fix reference leak in cedrus_start_streaming
  media: platform: add missing put_device() call in mtk_jpeg_probe() and mtk_jpeg_remove()
  media: venus: core: change clk enable and disable order in resume and suspend
  media: venus: core: vote for video-mem path
  media: venus: core: vote with average bandwidth and peak bandwidth as zero
  RDMA/cma: Add missing error handling of listen_id
  ASoC: meson: fix COMPILE_TEST error
  spi: dw: fix build error by selecting MULTIPLEXER
  scsi: core: Fix VPD LUN ID designator priorities
  media: venus: put dummy vote on video-mem path after last session release
  media: solo6x10: fix missing snd_card_free in error handling case
  video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
  mmc: sdhci: tegra: fix wrong unit with busy_timeout
  drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
  drm/meson: Free RDMA resources after tearing down DRM
  drm/meson: Unbind all connectors on module removal
  drm/meson: dw-hdmi: Register a callback to disable the regulator
  drm/meson: dw-hdmi: Ensure that clocks are enabled before touching the TOP registers
  ASoC: intel: SND_SOC_INTEL_KEEMBAY should depend on ARCH_KEEMBAY
  iommu/vt-d: include conditionally on CONFIG_INTEL_IOMMU_SVM
  Input: ads7846 - fix race that causes missing releases
  Input: ads7846 - fix integer overflow on Rt calculation
  Input: ads7846 - fix unaligned access on 7845
  bus: mhi: core: Remove double locking from mhi_driver_remove()
  bus: mhi: core: Fix null pointer access when parsing MHI configuration
  usb/max3421: fix return error code in max3421_probe()
  spi: mxs: fix reference leak in mxs_spi_probe
  selftests/bpf: Fix broken riscv build
  powerpc: Avoid broken GCC __attribute__((optimize))
  powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
  ARM: dts: tacoma: Fix node vs reg mismatch for flash memory
  Revert "powerpc/pseries/hotplug-cpu: Remove double free in error path"
  powerpc/powernv/sriov: fix unsigned int win compared to less than zero
  mfd: htc-i2cpld: Add the missed i2c_put_adapter() in htcpld_register_chip_i2c()
  mfd: MFD_SL28CPLD should depend on ARCH_LAYERSCAPE
  mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()
  mfd: cpcap: Fix interrupt regression with regmap clear_ack
  EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId
  scsi: ufs: Avoid to call REQ_CLKS_OFF to CLKS_OFF
  scsi: ufs: Fix clkgating on/off
  rcu: Allow rcu_irq_enter_check_tick() from NMI
  rcu,ftrace: Fix ftrace recursion
  rcu/tree: Defer kvfree_rcu() allocation to a clean context
  crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
  crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
  crypto: sun8i-ce - fix two error path's memory leak
  spi: fix resource leak for drivers without .remove callback
  drm/meson: dw-hdmi: Disable clocks on driver teardown
  drm/meson: dw-hdmi: Enable the iahb clock early enough
  PCI: Disable MSI for Pericom PCIe-USB adapter
  PCI: brcmstb: Initialize "tmp" before use
  soc: ti: knav_qmss: fix reference leak in knav_queue_probe
  soc: ti: Fix reference imbalance in knav_dma_probe
  drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
  soc: qcom: initialize local variable
  arm64: dts: qcom: sm8250: correct compatible for sm8250-mtp
  arm64: dts: qcom: msm8916-samsung-a2015: Disable muic i2c pin bias
  Input: omap4-keypad - fix runtime PM error handling
  clk: meson: Kconfig: fix dependency for G12A
  staging: mfd: hi6421-spmi-pmic: fix error return code in hi6421_spmi_pmic_probe()
  ath11k: Fix the rx_filter flag setting for peer rssi stats
  RDMA/cxgb4: Validate the number of CQEs
  soundwire: Fix DEBUG_LOCKS_WARN_ON for uninitialized attribute
  pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller
  memstick: fix a double-free bug in memstick_check
  ARM: dts: at91: sam9x60: add pincontrol for USB Host
  ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
  ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
  mmc: pxamci: Fix error return code in pxamci_probe
  brcmfmac: fix error return code in brcmf_cfg80211_connect()
  orinoco: Move context allocation after processing the skb
  qtnfmac: fix error return code in qtnf_pcie_probe()
  rsi: fix error return code in rsi_reset_card()
  cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
  dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
  arm64: dts: qcom: sdm845: Limit ipa iommu streams
  leds: netxbig: add missing put_device() call in netxbig_leds_get_of_pdata()
  leds: lp50xx: Fix an error handling path in 'lp50xx_probe_dt()'
  leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI
  arm64: tegra: Fix DT binding for IO High Voltage entry
  RDMA/cma: Fix deadlock on &lock in rdma_cma_listen_on_all() error unwind
  soundwire: qcom: Fix build failure when slimbus is module
  drm/imx/dcss: fix rotations for Vivante tiled formats
  media: siano: fix memory leak of debugfs members in smsdvb_hotplug
  platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
  platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
  arm64: dts: qcom: sc7180: limit IPA iommu streams
  RDMA/hns: Only record vlan info for HIP08
  RDMA/hns: Fix missing fields in address vector
  RDMA/hns: Avoid setting loopback indicator when smac is same as dmac
  serial: 8250-mtk: Fix reference leak in mtk8250_probe
  samples: bpf: Fix lwt_len_hist reusing previous BPF map
  media: imx214: Fix stop streaming
  mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
  media: max2175: fix max2175_set_csm_mode() error code
  slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
  RDMA/core: Track device memory MRs
  drm/mediatek: Use correct aliases name for ovl
  HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
  ARM: dts: Remove non-existent i2c1 from 98dx3236
  arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name
  power: supply: bq25890: Use the correct range for IILIM register
  arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
  power: supply: max17042_battery: Fix current_{avg,now} hiding with no current sense
  power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
  power: supply: bq24190_charger: fix reference leak
  genirq/irqdomain: Don't try to free an interrupt that has no mapping
  arm64: dts: ls1028a: fix ENETC PTP clock input
  arm64: dts: ls1028a: fix FlexSPI clock input
  arm64: dts: freescale: sl28: combine SPI MTD partitions
  phy: tegra: xusb: Fix usb_phy device driver field
  arm64: dts: qcom: c630: Polish i2c-hid devices
  arm64: dts: qcom: c630: Fix pinctrl pins properties
  PCI: Bounds-check command-line resource alignment requests
  PCI: Fix overflow in command-line resource alignment requests
  PCI: iproc: Fix out-of-bound array accesses
  PCI: iproc: Invalidate correct PAXB inbound windows
  arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
  arm64: dts: meson-sm1: fix typo in opp table
  soc: amlogic: canvas: add missing put_device() call in meson_canvas_get()
  scsi: hisi_sas: Fix up probe error handling for v3 hw
  scsi: pm80xx: Do not sleep in atomic context
  spi: spi-fsl-dspi: Use max_native_cs instead of num_chipselect to set SPI_MCR
  ARM: dts: at91: at91sam9rl: fix ADC triggers
  RDMA/hns: Fix 0-length sge calculation error
  RDMA/hns: Bugfix for calculation of extended sge
  mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree
  soundwire: master: use pm_runtime_set_active() on add
  platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
  ASoC: Intel: Boards: tgl_max98373: update TDM slot_width
  media: max9271: Fix GPIO enable/disable
  media: rdacm20: Enable GPIO1 explicitly
  media: i2c: imx219: Selection compliance fixes
  ath11k: Don't cast ath11k_skb_cb to ieee80211_tx_info.control
  ath11k: Reset ath11k_skb_cb before setting new flags
  ath11k: Fix an error handling path
  ath10k: Fix the parsing error in service available event
  ath10k: Fix an error handling path
  ath10k: Release some resources in an error handling path
  SUNRPC: rpc_wake_up() should wake up tasks in the correct order
  NFSv4.2: condition READDIR's mask for security label based on LSM state
  SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
  NFSv4: Fix the alignment of page data in the getdeviceinfo reply
  net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs'
  lockd: don't use interval-based rebinding over TCP
  NFS: switch nfsiod to be an UNBOUND workqueue.
  selftests/seccomp: Update kernel config
  vfio-pci: Use io_remap_pfn_range() for PCI IO memory
  hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable
  f2fs: fix double free of unicode map
  media: tvp5150: Fix wrong return value of tvp5150_parse_dt()
  media: saa7146: fix array overflow in vidioc_s_audio()
  powerpc/perf: Fix crash with is_sier_available when pmu is not set
  powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S
  powerpc/xmon: Fix build failure for 8xx
  powerpc/perf: Fix to update radix_scope_qual in power10
  powerpc/perf: Update the PMU group constraints for l2l3 events in power10
  powerpc/perf: Fix the PMU group constraints for threshold events in power10
  clocksource/drivers/orion: Add missing clk_disable_unprepare() on error path
  clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
  clocksource/drivers/ingenic: Fix section mismatch
  clocksource/drivers/riscv: Make RISCV_TIMER depends on RISCV_SBI
  arm64: mte: fix prctl(PR_GET_TAGGED_ADDR_CTRL) if TCF0=NONE
  iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context
  libbpf: Sanitise map names before pinning
  ARM: dts: at91: sam9x60ek: remove bypass property
  ARM: dts: at91: sama5d2: map securam as device
  scripts: kernel-doc: fix parsing function-like typedefs
  bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address()
  selftests/bpf: Fix invalid use of strncat in test_sockmap
  pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
  soc: rockchip: io-domain: Fix error return code in rockchip_iodomain_probe()
  arm64: dts: rockchip: Fix UART pull-ups on rk3328
  memstick: r592: Fix error return in r592_probe()
  MIPS: Don't round up kernel sections size for memblock_add()
  mt76: mt7663s: fix a possible ple quota underflow
  mt76: mt7915: set fops_sta_stats.owner to THIS_MODULE
  mt76: set fops_tx_stats.owner to THIS_MODULE
  mt76: dma: fix possible deadlock running mt76_dma_cleanup
  net/mlx5: Properly convey driver version to firmware
  mt76: fix memory leak if device probing fails
  mt76: fix tkip configuration for mt7615/7663 devices
  ASoC: jz4740-i2s: add missed checks for clk_get()
  ASoC: q6afe-clocks: Add missing parent clock rate
  dm ioctl: fix error return code in target_message
  ASoC: cros_ec_codec: fix uninitialized memory read
  ASoC: atmel: mchp-spdifrx needs COMMON_CLK
  ASoC: qcom: fix QDSP6 dependencies, attempt #3
  phy: mediatek: allow compile-testing the hdmi phy
  phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure
  memory: ti-emif-sram: only build for ARMv7
  memory: jz4780_nemc: Fix potential NULL dereference in jz4780_nemc_probe()
  drm/msm: a5xx: Make preemption reset case reentrant
  drm/msm: add IOMMU_SUPPORT dependency
  clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne
  clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
  cpufreq: ap806: Add missing MODULE_DEVICE_TABLE
  cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
  cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
  cpufreq: qcom: Add missing MODULE_DEVICE_TABLE
  cpufreq: st: Add missing MODULE_DEVICE_TABLE
  cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE
  cpufreq: loongson1: Add missing MODULE_ALIAS
  cpufreq: scpi: Add missing MODULE_ALIAS
  cpufreq: vexpress-spc: Add missing MODULE_ALIAS
  cpufreq: imx: fix NVMEM_IMX_OCOTP dependency
  macintosh/adb-iop: Always wait for reply message from IOP
  macintosh/adb-iop: Send correct poll command
  staging: bcm2835: fix vchiq_mmal dependencies
  staging: greybus: audio: Fix possible leak free widgets in gbaudio_dapm_free_controls
  spi: dw: Fix error return code in dw_spi_bt1_probe()
  Bluetooth: btusb: Add the missed release_firmware() in btusb_mtk_setup_firmware()
  Bluetooth: btmtksdio: Add the missed release_firmware() in mtk_setup_firmware()
  Bluetooth: sco: Fix crash when using BT_SNDMTU/BT_RCVMTU option
  block/rnbd-clt: Dynamically alloc buffer for pathname & blk_symlink_name
  block/rnbd: fix a null pointer dereference on dev->blk_symlink_name
  Bluetooth: btusb: Fix detection of some fake CSR controllers with a bcdDevice val of 0x0134
  platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on some HP x360 models
  adm8211: fix error return code in adm8211_probe()
  mtd: spi-nor: sst: fix BPn bits for the SST25VF064C
  mtd: spi-nor: ignore errors in spi_nor_unlock_all()
  mtd: spi-nor: atmel: remove global protection flag
  mtd: spi-nor: atmel: fix unlock_all() for AT25FS010/040
  arm64: dts: meson: g12b: odroid-n2: fix PHY deassert timing requirements
  arm64: dts: meson: fix PHY deassert timing requirements
  ARM: dts: meson: fix PHY deassert timing requirements
  arm64: dts: meson: g12a: x96-max: fix PHY deassert timing requirements
  arm64: dts: meson: g12b: w400: fix PHY deassert timing requirements
  clk: fsl-sai: fix memory leak
  scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
  scsi: pm80xx: Fix error return in pm8001_pci_probe()
  scsi: iscsi: Fix inappropriate use of put_device()
  seq_buf: Avoid type mismatch for seq_buf_init
  scsi: fnic: Fix error return code in fnic_probe()
  platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
  platform/x86: mlx-platform: Fix item counter assignment for MSN2700/ComEx system
  ARM: 9030/1: entry: omit FP emulation for UND exceptions taken in kernel mode
  powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
  powerpc/pseries/hibernation: remove redundant cacheinfo update
  powerpc/powermac: Fix low_sleep_handler with CONFIG_VMAP_STACK
  drm/mediatek: avoid dereferencing a null hdmi_phy on an error message
  ASoC: amd: change clk_get() to devm_clk_get() and add missed checks
  coresight: remove broken __exit annotations
  ASoC: max98390: Fix error codes in max98390_dsm_init()
  powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S
  usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
  usb: oxu210hp-hcd: Fix memory leak in oxu_create
  speakup: fix uninitialized flush_lock
  nfsd: Fix message level for normal termination
  NFSD: Fix 5 seconds delay when doing inter server copy
  nfs_common: need lock during iterate through the list
  x86/kprobes: Restore BTF if the single-stepping is cancelled
  scsi: qla2xxx: Fix FW initialization error on big endian machines
  scsi: qla2xxx: Fix N2N and NVMe connect retry failure
  platform/chrome: cros_ec_spi: Don't overwrite spi::mode
  misc: pci_endpoint_test: fix return value of error branch
  bus: fsl-mc: add back accidentally dropped error check
  bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
  fsi: Aspeed: Add mutex to protect HW access
  s390/cio: fix use-after-free in ccw_device_destroy_console
  iwlwifi: dbg-tlv: fix old length in is_trig_data_contained()
  iwlwifi: mvm: hook up missing RX handlers
  erofs: avoid using generic_block_bmap
  clk: renesas: r8a779a0: Fix R and OSC clocks
  can: m_can: m_can_config_endisable(): remove double clearing of clock stop request bit
  powerpc/sstep: Emulate prefixed instructions only when CPU_FTR_ARCH_31 is set
  powerpc/sstep: Cover new VSX instructions under CONFIG_VSX
  slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew()
  ALSA: hda/hdmi: fix silent stream for first playback to DP
  RDMA/core: Do not indicate device ready when device enablement fails
  RDMA/uverbs: Fix incorrect variable type
  remoteproc/mediatek: change MT8192 CFG register base
  remoteproc/mtk_scp: surround DT device IDs with CONFIG_OF
  remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable
  remoteproc: qcom: fix reference leak in adsp_start
  remoteproc: qcom: pas: fix error handling in adsp_pds_enable
  remoteproc: k3-dsp: Fix return value check in k3_dsp_rproc_of_get_memories()
  remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio()
  remoteproc/mediatek: unprepare clk if scp_before_load fails
  clk: qcom: gcc-sc7180: Use floor ops for sdcc clks
  clk: tegra: Fix duplicated SE clock entry
  mtd: rawnand: gpmi: fix reference count leak in gpmi ops
  mtd: rawnand: meson: Fix a resource leak in init
  mtd: rawnand: gpmi: Fix the random DMA timeout issue
  samples/bpf: Fix possible hang in xdpsock with multiple threads
  fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
  extcon: max77693: Fix modalias string
  crypto: atmel-i2c - select CONFIG_BITREVERSE
  mac80211: don't set set TDLS STA bandwidth wider than possible
  mac80211: fix a mistake check for rx_stats update
  ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
  irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
  irqchip/ti-sci-inta: Fix printing of inta id on probe success
  irqchip/ti-sci-intr: Fix freeing of irqs
  dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0
  RDMA/hns: Limit the length of data copied between kernel and userspace
  RDMA/hns: Normalization the judgment of some features
  RDMA/hns: Do shift on traffic class when using RoCEv2
  gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask
  ath11k: Fix incorrect tlvs in scan start command
  irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling
  watchdog: armada_37xx: Add missing dependency on HAS_IOMEM
  watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
  watchdog: sprd: remove watchdog disable from resume fail path
  watchdog: sprd: check busy bit before new loading rather than after that
  watchdog: Fix potential dereferencing of null pointer
  ubifs: Fix error return code in ubifs_init_authentication()
  um: Monitor error events in IRQ controller
  um: tty: Fix handling of close in tty lines
  um: chan_xterm: Fix fd leak
  sunrpc: fix xs_read_xdr_buf for partial pages receive
  RDMA/mlx5: Fix MR cache memory leak
  RDMA/cma: Don't overwrite sgid_attr after device is released
  nfc: s3fwrn5: Release the nfc firmware
  drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge
  powerpc/perf: Fix Threshold Event Counter Multiplier width for P10
  powerpc/ps3: use dma_mapping_error()
  perf test: Fix metric parsing test
  drm/amdgpu: fix regression in vbios reservation handling on headless
  mm/gup: reorganize internal_get_user_pages_fast()
  mm/gup: prevent gup_fast from racing with COW during fork
  mm/gup: combine put_compound_head() and unpin_user_page()
  mm: memcg/slab: fix return of child memcg objcg for root memcg
  mm: memcg/slab: fix use after free in obj_cgroup_charge
  mm/rmap: always do TTU_IGNORE_ACCESS
  sparc: fix handling of page table constructor failure
  mm/vmalloc: Fix unlock order in s_stop()
  mm/vmalloc.c: fix kasan shadow poisoning size
  mm,memory_failure: always pin the page in madvise_inject_error
  hugetlb: fix an error code in hugetlb_reserve_pages()
  mm: don't wake kswapd prematurely when watermark boosting is disabled
  proc: fix lookup in /proc/net subdirectories after setns(2)
  checkpatch: fix unescaped left brace
  s390/test_unwind: fix CALL_ON_STACK tests
  lan743x: fix rx_napi_poll/interrupt ping-pong
  ice, xsk: clear the status bits for the next_to_use descriptor
  i40e, xsk: clear the status bits for the next_to_use descriptor
  net: dsa: qca: ar9331: fix sleeping function called from invalid context bug
  dpaa2-eth: fix the size of the mapped SGT buffer
  net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
  net: mscc: ocelot: Fix a resource leak in the error handling path of the probe function
  net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
  block/rnbd-clt: Get rid of warning regarding size argument in strlcpy
  block/rnbd-clt: Fix possible memleak
  NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
  net: korina: fix return value
  devlink: use _BITUL() macro instead of BIT() in the UAPI header
  libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
  powerpc/32s: Fix cleanup_cpu_mmu_context() compile bug
  watchdog: qcom: Avoid context switch in restart handler
  watchdog: coh901327: add COMMON_CLK dependency
  clk: ti: Fix memleak in ti_fapll_synth_setup
  pwm: zx: Add missing cleanup in error path
  pwm: lp3943: Dynamically allocate PWM chip base
  pwm: imx27: Fix overflow for bigger periods
  pwm: sun4i: Remove erroneous else branch
  io_uring: cancel only requests of current task
  tools build: Add missing libcap to test-all.bin target
  perf record: Fix memory leak when using '--user-regs=?' to list registers
  qlcnic: Fix error code in probe
  nfp: move indirect block cleanup to flower app stop callback
  vdpa/mlx5: Use write memory barrier after updating CQ index
  virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()
  virtio_net: Fix error code in probe()
  virtio_ring: Fix two use after free bugs
  vhost scsi: fix error return code in vhost_scsi_set_endpoint()
  epoll: check for events when removing a timed out thread from the wait queue
  clk: bcm: dvp: Add MODULE_DEVICE_TABLE()
  clk: at91: sama7g5: fix compilation error
  clk: at91: sam9x60: remove atmel,osc-bypass support
  clk: s2mps11: Fix a resource leak in error handling paths in the probe function
  clk: sunxi-ng: Make sure divider tables have sentinel
  clk: vc5: Use "idt,voltage-microvolt" instead of "idt,voltage-microvolts"
  kconfig: fix return value of do_error_if()
  powerpc/boot: Fix build of dts/fsl
  powerpc/smp: Add __init to init_big_cores()
  ARM: 9044/1: vfp: use undef hook for VFP support detection
  ARM: 9036/1: uncompress: Fix dbgadtb size parameter name
  perf probe: Fix memory leak when synthesizing SDT probes
  io_uring: fix racy IOPOLL flush overflow
  io_uring: cancel reqs shouldn't kill overflow list
  Smack: Handle io_uring kernel thread privileges
  proc mountinfo: make splice available again
  io_uring: fix io_cqring_events()'s noflush
  io_uring: fix racy IOPOLL completions
  io_uring: always let io_iopoll_complete() complete polled io
  vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
  vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU
  media: gspca: Fix memory leak in probe
  io_uring: fix io_wqe->work_list corruption
  io_uring: fix 0-iov read buffer select
  io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()
  io_uring: fix ignoring xa_store errors
  io_uring: fix double io_uring free
  io_uring: make ctx cancel on exit targeted to actual ctx
  media: sunxi-cir: ensure IR is handled when it is continuous
  media: netup_unidvb: Don't leak SPI master in probe error path
  media: ipu3-cio2: Remove traces of returned buffers
  media: ipu3-cio2: Return actual subdev format
  media: ipu3-cio2: Serialise access to pad format
  media: ipu3-cio2: Validate mbus format in setting subdev format
  media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
  Input: cyapa_gen6 - fix out-of-bounds stack access
  ALSA: hda/ca0132 - Change Input Source enum strings.
  ACPI: NFIT: Fix input validation of bus-family
  PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
  Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
  ACPI: PNP: compare the string length in the matching_id()
  ALSA: hda: Fix regressions on clear and reconfig sysfs
  ALSA: hda/ca0132 - Fix AE-5 rear headphone pincfg.
  ALSA: hda/realtek: make bass spk volume adjustable on a yoga laptop
  ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
  ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
  ALSA: hda/realtek - Add supported for more Lenovo ALC285 Headset Button
  ALSA: pcm: oss: Fix a few more UBSAN fixes
  ALSA/hda: apply jack fixup for the Acer Veriton N4640G/N6640G/N2510G
  ALSA: hda/realtek: Add quirk for MSI-GP73
  ALSA: hda/realtek: Apply jack fixup for Quanta NL3
  ALSA: hda/realtek: Remove dummy lineout on Acer TravelMate P648/P658
  ALSA: hda/realtek - Supported Dell fixed type headset
  ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
  ALSA: usb-audio: Disable sample read check if firmware doesn't give back
  ALSA: usb-audio: Add alias entry for ASUS PRIME TRX40 PRO-S
  ALSA: core: memalloc: add page alignment for iram
  s390/smp: perform initial CPU reset also for SMT siblings
  s390/kexec_file: fix diag308 subcode when loading crash kernel
  s390/idle: add missing mt_cycles calculation
  s390/idle: fix accounting with machine checks
  s390/dasd: fix hanging device offline processing
  s390/dasd: prevent inconsistent LCU device data
  s390/dasd: fix list corruption of pavgroup group list
  s390/dasd: fix list corruption of lcu list
  binder: add flag to clear buffer on txn complete
  ASoC: cx2072x: Fix doubly definitions of Playback and Capture streams
  ASoC: AMD Renoir - add DMI table to avoid the ACP mic probe (broken BIOS)
  ASoC: AMD Raven/Renoir - fix the PCI probe (PCI revision)
  staging: comedi: mf6x4: Fix AI end-of-conversion detection
  z3fold: simplify freeing slots
  z3fold: stricter locking and more careful reclaim
  perf/x86/intel: Add event constraint for CYCLE_ACTIVITY.STALLS_MEM_ANY
  perf/x86/intel: Fix rtm_abort_event encoding on Ice Lake
  perf/x86/intel/lbr: Fix the return type of get_lbr_cycles()
  powerpc/perf: Exclude kernel samples while counting events in user space.
  cpufreq: intel_pstate: Use most recent guaranteed performance values
  crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
  crypto: arm/aes-ce - work around Cortex-A57/A72 silion errata
  m68k: Fix WARNING splat in pmac_zilog driver
  Documentation: seqlock: s/LOCKTYPE/LOCKNAME/g
  EDAC/i10nm: Use readl() to access MMIO registers
  EDAC/amd64: Fix PCI component registration
  cpuset: fix race between hotplug work and later CPU offline
  dyndbg: fix use before null check
  USB: serial: mos7720: fix parallel-port state restore
  USB: serial: digi_acceleport: fix write-wakeup deadlocks
  USB: serial: keyspan_pda: fix dropped unthrottle interrupts
  USB: serial: keyspan_pda: fix write deadlock
  USB: serial: keyspan_pda: fix stalled writes
  USB: serial: keyspan_pda: fix write-wakeup use-after-free
  USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
  USB: serial: keyspan_pda: fix write unthrottling
  btrfs: do not shorten unpin len for caching block groups
  btrfs: update last_byte_to_unpin in switch_commit_roots
  btrfs: fix race when defragmenting leads to unnecessary IO
  ext4: fix an IS_ERR() vs NULL check
  ext4: fix a memory leak of ext4_free_data
  ext4: fix deadlock with fs freezing and EA inodes
  ext4: don't remount read-only with errors=continue on reboot
  RISC-V: Fix usage of memblock_enforce_memory_limit
  arm64: dts: ti: k3-am65: mark dss as dma-coherent
  arm64: dts: marvell: keep SMMU disabled by default for Armada 7040 and 8040
  KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
  KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits
  KVM: SVM: Remove the call to sev_platform_status() during setup
  iommu/arm-smmu: Allow implementation specific write_s2cr
  iommu/arm-smmu-qcom: Read back stream mappings
  iommu/arm-smmu-qcom: Implement S2CR quirk
  ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
  ARM: dts: at91: sama5d2: fix CAN message ram offset and size
  ARM: tegra: Populate OPP table for Tegra20 Ventana
  xprtrdma: Fix XDRBUF_SPARSE_PAGES support
  powerpc/32: Fix vmap stack - Properly set r1 before activating MMU on syscall too
  powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
  powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
  powerpc/bitops: Fix possible undefined behaviour with fls() and fls64()
  powerpc/feature: Add CPU_FTR_NOEXECUTE to G2_LE
  powerpc/xmon: Change printk() to pr_cont()
  powerpc/8xx: Fix early debug when SMC1 is relocated
  powerpc/mm: Fix verification of MMU_FTR_TYPE_44x
  powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU
  powerpc/powernv/memtrace: Don't leak kernel memory to user space
  powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
  ovl: make ioctl() safe
  ima: Don't modify file descriptor mode on the fly
  um: Remove use of asprinf in umid.c
  um: Fix time-travel mode
  ceph: fix race in concurrent __ceph_remove_cap invocations
  SMB3: avoid confusing warning message on mount to Azure
  SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp
  SMB3.1.1: do not log warning message if server doesn't populate salt
  ubifs: wbuf: Don't leak kernel memory to flash
  jffs2: Fix GC exit abnormally
  jffs2: Fix ignoring mounting options problem during remounting
  fsnotify: generalize handle_inode_event()
  inotify: convert to handle_inode_event() interface
  fsnotify: fix events reported to watching parent and child
  jfs: Fix array index bounds check in dbAdjTree
  drm/panfrost: Fix job timeout handling
  drm/panfrost: Move the GPU reset bits outside the timeout handler
  platform/x86: mlx-platform: remove an unused variable
  drm/amdgpu: only set DP subconnector type on DP and eDP connectors
  drm/amd/display: Fix memory leaks in S3 resume
  drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
  drm/i915: Fix mismatch between misplaced vma check and vma insert
  iio: ad_sigma_delta: Don't put SPI transfer buffer on the stack
  spi: pxa2xx: Fix use-after-free on unbind
  spi: spi-sh: Fix use-after-free on unbind
  spi: atmel-quadspi: Fix use-after-free on unbind
  spi: spi-mtk-nor: Don't leak SPI master in probe error path
  spi: ar934x: Don't leak SPI master in probe error path
  spi: davinci: Fix use-after-free on unbind
  spi: fsl: fix use of spisel_boot signal on MPC8309
  spi: gpio: Don't leak SPI master in probe error path
  spi: mxic: Don't leak SPI master in probe error path
  spi: npcm-fiu: Disable clock in probe error path
  spi: pic32: Don't leak DMA channels in probe error path
  spi: rb4xx: Don't leak SPI master in probe error path
  spi: rpc-if: Fix use-after-free on unbind
  spi: sc18is602: Don't leak SPI master in probe error path
  spi: spi-geni-qcom: Fix use-after-free on unbind
  spi: spi-qcom-qspi: Fix use-after-free on unbind
  spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
  spi: synquacer: Disable clock in probe error path
  spi: mt7621: Disable clock in probe error path
  spi: mt7621: Don't leak SPI master in probe error path
  spi: atmel-quadspi: Disable clock in probe error path
  spi: atmel-quadspi: Fix AHB memory accesses
  soc: qcom: smp2p: Safely acquire spinlock without IRQs
  mtd: spinand: Fix OOB read
  mtd: parser: cmdline: Fix parsing of part-names with colons
  mtd: core: Fix refcounting for unpartitioned MTDs
  mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
  mtd: rawnand: meson: fix meson_nfc_dma_buffer_release() arguments
  scsi: qla2xxx: Fix crash during driver load on big endian machines
  scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
  scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi
  scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
  openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
  iio: buffer: Fix demux update
  iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
  iio: imu: st_lsm6dsx: fix edge-trigger interrupts
  iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
  iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
  iio:magnetometer:mag3110: Fix alignment and data leak issues.
  iio:pressure:mpl3115: Force alignment of buffer
  iio:imu:bmi160: Fix too large a buffer.
  iio:imu:bmi160: Fix alignment and data leak issues
  iio:adc:ti-ads124s08: Fix buffer being too long.
  iio:adc:ti-ads124s08: Fix alignment and data leak issues.
  md/cluster: block reshape with remote resync job
  md/cluster: fix deadlock when node is doing resync job
  pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
  clk: ingenic: Fix divider calculation with div tables
  clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
  clk: tegra: Do not return 0 on failure
  counter: microchip-tcb-capture: Fix CMR value check
  device-dax/core: Fix memory leak when rmmod dax.ko
  dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.
  driver: core: Fix list corruption after device_del()
  xen-blkback: set ring->xenblkd to NULL after kthread_stop()
  xen/xenbus: Allow watches discard events before queueing
  xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
  xen/xenbus/xen_bus_type: Support will_handle watch callback
  xen/xenbus: Count pending messages for each watch
  xenbus/xenbus_backend: Disallow pending watch messages
  memory: jz4780_nemc: Fix an error pointer vs NULL check in probe()
  memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe()
  memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer()
  memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm
  libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
  platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
  tracing: Disable ftrace selftests when any tracer is running
  mt76: add back the SUPPORTS_REORDERING_BUFFER flag
  of: fix linker-section match-table corruption
  PCI: Fix pci_slot_release() NULL pointer dereference
  regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x
  remoteproc: sysmon: Ensure remote notification ordering
  thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed
  rtc: ep93xx: Fix NULL pointer dereference in ep93xx_rtc_read_time
  Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"
  null_blk: Fix zone size initialization
  null_blk: Fail zone append to conventional zones
  drm/edid: fix objtool warning in drm_cvt_modes()
  x86/CPU/AMD: Save AMD NodeId as cpu_die_id
  Linux 5.10.4

  Signed-off-by: Greg Kroah-Hartman
  Change-Id: I25209e79d8b9faf5382087955a29b7404bdefe38

  Greg Kroah-Hartman

  2020-12-30 19:47:03 +0800  
• 1aa8e7801   jffs2: Fix ignoring mounting options problem during remounting ... Browse Code »

  commit 08cd274f9b8283a1da93e2ccab216a336da83525 upstream.

  The jffs2 mount options will be ignored when remounting jffs2.
  It can be easily reproduced with the steps listed below.
  1. mount -t jffs2 -o compr=none /dev/mtdblockx /mnt
  2. mount -o remount compr=zlib /mnt

  Since ec10a24f10c8, the option parsing happens before fill_super and
  then pass fc, which contains the options parsing results, to function
  jffs2_reconfigure during remounting. But function jffs2_reconfigure do
  not update c->mount_opts.

  This patch add a function jffs2_update_mount_opts to fix this problem.

  By the way, I notice that tmpfs use the same way to update remounting
  options. If it is necessary to unify them?

  Cc:
  Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
  Signed-off-by: lizhe
  Signed-off-by: Richard Weinberger
  Signed-off-by: Greg Kroah-Hartman

  lizhe

  2020-12-30 18:54:18 +0800  
• ecdb868ac   jffs2: Fix GC exit abnormally ... Browse Code »

  commit 9afc9a8a4909fece0e911e72b1060614ba2f7969 upstream.

  The log of this problem is:
  jffs2: Error garbage collecting node at 0x***!
  jffs2: No space for garbage collection. Aborting GC thread

  This is because GC believe that it do nothing, so it abort.

  After going over the image of jffs2, I find a scene that
  can trigger this problem stably.
  The scene is: there is a normal dirent node at summary-area,
  but abnormal at corresponding not-summary-area with error
  name_crc.

  The reason that GC exit abnormally is because it find that
  abnormal dirent node to GC, but when it goes to function
  jffs2_add_fd_to_list, it cannot meet the condition listed
  below:

  if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name))

  So no node is marked obsolete, statistical information of
  erase_block do not change, which cause GC exit abnormally.

  The root cause of this problem is: we do not check the
  name_crc of the abnormal dirent node with summary is enabled.

  Noticed that in function jffs2_scan_dirent_node, we use
  function jffs2_scan_dirty_space to deal with the dirent
  node with error name_crc. So this patch add a checking
  code in function read_direntry to ensure the correctness
  of dirent node. If checked failed, the dirent node will
  be marked obsolete so GC will pass this node and this
  problem will be fixed.

  Cc:
  Signed-off-by: Zhe Li
  Signed-off-by: Richard Weinberger
  Signed-off-by: Greg Kroah-Hartman

  Zhe Li

  2020-12-30 18:54:18 +0800  

01 Sep, 2020

1 commit

• f022c0602   Merge 5.9-rc3 into android-mainline ... Browse Code »

  Linux 5.9-rc3

  Signed-off-by: Greg Kroah-Hartman
  Change-Id: Ic7758bc57a7d91861657388ddd015db5c5db5480

  Greg Kroah-Hartman

  2020-09-01 01:51:25 +0800  

24 Aug, 2020

1 commit

• df561f668   treewide: Use fallthrough pseudo-keyword ... Browse Code »

  Replace the existing /* fall through */ comments and its variants with
  the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
  fall-through markings when it is the case.

  [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

  Signed-off-by: Gustavo A. R. Silva

  Gustavo A. R. Silva

  2020-08-24 06:36:59 +0800  

11 Aug, 2020

2 commits

• d7b0856ea   Merge 00e4db51259a ("Merge tag 'perf-tools-2020-08-10' of git://git.kernel.org/p… ... Browse Code »

  …ub/scm/linux/kernel/git/acme/linux") into android-mainline

  Tiny steps on the way to 5.9-rc1.

  Fixes conflicts in:
  fs/f2fs/inline.c

  Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
  Change-Id: I16d863ae44a51156499458e8c3486587cbe2babe

  Greg Kroah-Hartman

  2020-08-11 16:57:46 +0800  
• 163c3e3dc   Merge tag 'for-linus-5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs ... Browse Code »

  Pull JFFS2, UBI and UBIFS updates from Richard Weinberger:
  "JFFS2:
  - Fix for a corner case while mounting
  - Fix for an use-after-free issue

  UBI:
  - Fix for a memory load while attaching
  - Don't produce an anchor PEB with fastmap being disabled

  UBIFS:
  - Fix for orphan inode logic
  - Spelling fixes
  - New mount option to specify filesystem version"

  * tag 'for-linus-5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  jffs2: fix UAF problem
  jffs2: fix jffs2 mounting failure
  ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
  ubi: fastmap: Free fastmap next anchor peb during detach
  ubi: fastmap: Don't produce the initial next anchor PEB when fastmap is disabled
  ubifs: misc.h: delete a duplicated word
  ubifs: add option to specify version for new file systems

  Linus Torvalds

  2020-08-11 09:20:04 +0800  

07 Aug, 2020

1 commit

• f04a11ac9   Merge 7b4ea9456dd3 ("Revert "x86/mm/64: Do not sync vmalloc/ioremap mappings"") … ... Browse Code »

  …into android-mainline

  Steps on the way to 5.9-rc1

  Resolves conflicts in:
  drivers/irqchip/qcom-pdc.c
  include/linux/device.h
  net/xfrm/xfrm_state.c
  security/lsm_audit.c

  Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
  Change-Id: I4aeb3d04f4717714a421721eb3ce690c099bb30a

  Greg Kroah-Hartman

  2020-08-07 22:01:35 +0800  

03 Aug, 2020

2 commits

• 798b7347e   jffs2: fix UAF problem ... Browse Code »

  The log of UAF problem is listed below.
  BUG: KASAN: use-after-free in jffs2_rmdir+0xa4/0x1cc [jffs2] at addr c1f165fc
  Read of size 4 by task rm/8283
  =============================================================================
  BUG kmalloc-32 (Tainted: P B O ): kasan: bad access detected
  -----------------------------------------------------------------------------

  INFO: Allocated in 0xbbbbbbbb age=3054364 cpu=0 pid=0
  0xb0bba6ef
  jffs2_write_dirent+0x11c/0x9c8 [jffs2]
  __slab_alloc.isra.21.constprop.25+0x2c/0x44
  __kmalloc+0x1dc/0x370
  jffs2_write_dirent+0x11c/0x9c8 [jffs2]
  jffs2_do_unlink+0x328/0x5fc [jffs2]
  jffs2_rmdir+0x110/0x1cc [jffs2]
  vfs_rmdir+0x180/0x268
  do_rmdir+0x2cc/0x300
  ret_from_syscall+0x0/0x3c
  INFO: Freed in 0x205b age=3054364 cpu=0 pid=0
  0x2e9173
  jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
  jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
  jffs2_garbage_collect_dirent.isra.3+0x21c/0x288 [jffs2]
  jffs2_garbage_collect_live+0x16bc/0x1800 [jffs2]
  jffs2_garbage_collect_pass+0x678/0x11d4 [jffs2]
  jffs2_garbage_collect_thread+0x1e8/0x3b0 [jffs2]
  kthread+0x1a8/0x1b0
  ret_from_kernel_thread+0x5c/0x64
  Call Trace:
  [c17ddd20] [c02452d4] kasan_report.part.0+0x298/0x72c (unreliable)
  [c17ddda0] [d2509680] jffs2_rmdir+0xa4/0x1cc [jffs2]
  [c17dddd0] [c026da04] vfs_rmdir+0x180/0x268
  [c17dde00] [c026f4e4] do_rmdir+0x2cc/0x300
  [c17ddf40] [c001a658] ret_from_syscall+0x0/0x3c

  The root cause is that we don't get "jffs2_inode_info.sem" before
  we scan list "jffs2_inode_info.dents" in function jffs2_rmdir.
  This patch add codes to get "jffs2_inode_info.sem" before we scan
  "jffs2_inode_info.dents" to slove the UAF problem.

  Signed-off-by: Zhe Li
  Reviewed-by: Hou Tao
  Signed-off-by: Richard Weinberger

  Zhe Li

  2020-08-03 05:56:13 +0800  
• a68005a36   jffs2: fix jffs2 mounting failure ... Browse Code »

  Thanks for the advice mentioned in the email.
  This is my v3 patch for this problem.

  Mounting jffs2 on nand flash will get message "failed: I/O error"
  with the steps listed below.
  1.umount jffs2
  2.erase nand flash
  3.mount jffs2 on it (this mounting operation will be successful)
  4.do chown or chmod to the mount point directory
  5.umount jffs2
  6.mount jffs2 on nand flash
  After step 6, we will get message "mount ... failed: I/O error".

  Typical image of this problem is like:
  Empty space found from 0x00000000 to 0x008a0000
  Inode node at xx, totlen 0x00000044, #ino 1, version 1, isize 0...

  The reason for this mounting failure is that at the end of function
  jffs2_scan_medium(), jffs2 will check the used_size and some info
  of nr_blocks.If conditions are met, it will return -EIO.

  The detail is that, in the steps listed above, step 4 will write
  jffs2_raw_inode into flash without jffs2_raw_dirent, which will
  cause that there are some jffs2_raw_inode but no jffs2_raw_dirent
  on flash. This will meet the condition at the end of function
  jffs2_scan_medium() and return -EIO if we umount jffs2 and mount it
  again.

  We notice that jffs2 add the value of c->unchecked_size if we find
  an inode node while mounting. And jffs2 will never add the value of
  c->unchecked_size in other situations. So this patch add one more
  condition about c->unchecked_size of the judgement to fix this problem.

  Signed-off-by: Zhe Li
  Signed-off-by: Richard Weinberger

  Zhe Li

  2020-08-03 05:56:13 +0800  

17 Jul, 2020

1 commit

• 3f649ab72   treewide: Remove uninitialized_var() usage ... Browse Code »

  Using uninitialized_var() is dangerous as it papers over real bugs[1]
  (or can in the future), and suppresses unrelated compiler warnings
  (e.g. "unused variable"). If the compiler thinks it is uninitialized,
  either simply initialize the variable or make compiler changes.

  In preparation for removing[2] the[3] macro[4], remove all remaining
  needless uses with the following script:

  git grep '\buninitialized_var\b' | cut -d: -f1 | sort -u | \
  xargs perl -pi -e \
  's/\buninitialized_var\(([^\)]+)\)/\1/g;
  s:\s*/\* (GCC be quiet|to make compiler happy) \*/$::g;'

  drivers/video/fbdev/riva/riva_hw.c was manually tweaked to avoid
  pathological white-space.

  No outstanding warnings were found building allmodconfig with GCC 9.3.0
  for x86_64, i386, arm64, arm, powerpc, powerpc64le, s390x, mips, sparc64,
  alpha, and m68k.

  [1] https://lore.kernel.org/lkml/20200603174714.192027-1-glider@google.com/
  [2] https://lore.kernel.org/lkml/CA+55aFw+Vbj0i=1TGqCR5vQkCzWJ0QxK6CernOU6eedsudAixw@mail.gmail.com/
  [3] https://lore.kernel.org/lkml/CA+55aFwgbgqhbp1fkxvRKEpzyR5J8n1vKT1VZdz9knmPuXhOeg@mail.gmail.com/
  [4] https://lore.kernel.org/lkml/CA+55aFz2500WfbKXAx8s67wrm9=yVJu65TpLgN_ybYNv0VEOKA@mail.gmail.com/

  Reviewed-by: Leon Romanovsky # drivers/infiniband and mlx4/mlx5
  Acked-by: Jason Gunthorpe # IB
  Acked-by: Kalle Valo # wireless drivers
  Reviewed-by: Chao Yu # erofs
  Signed-off-by: Kees Cook

  Kees Cook

  2020-07-17 03:35:15 +0800  

27 Jun, 2020

1 commit

• 1d722fa8e   Merge 5.8-rc2 into android-mainline ... Browse Code »

  Linux 5.8-rc2

  Signed-off-by: Greg Kroah-Hartman
  Change-Id: I0e2f0302387539982d5577ad72079621c35c5f61

  Greg Kroah-Hartman

  2020-06-27 15:48:57 +0800  

16 Jun, 2020

1 commit

• 6112bad79   jffs2: Replace zero-length array with flexible-array ... Browse Code »

  There is a regular need in the kernel to provide a way to declare having a
  dynamically sized set of trailing elements in a structure. Kernel code should
  always use “flexible array members”[1] for these cases. The older style of
  one-element or zero-length arrays should no longer be used[2].

  [1] https://en.wikipedia.org/wiki/Flexible_array_member
  [2] https://github.com/KSPP/linux/issues/21

  Signed-off-by: Gustavo A. R. Silva

  Gustavo A. R. Silva

  2020-06-16 12:08:31 +0800  

11 Feb, 2020

1 commit

• aa601dde6   Merge c9d35ee049b4 ("Merge branch 'merge.nfs-fs_parse.1' of git://git.kernel.org… ... Browse Code »

  …/pub/scm/linux/kernel/git/viro/vfs") into android-mainline

  Tiny steps to deal with merge issues in sdcardfs due to fs param passing
  api changes.

  Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
  Change-Id: I03ba8763e8cc324c25fb6316c363b59957103474

  Greg Kroah-Hartman

  2020-02-11 00:39:09 +0800  

08 Feb, 2020

2 commits

• d7167b149   fs_parse: fold fs_parameter_desc/fs_parameter_spec ... Browse Code »

  The former contains nothing but a pointer to an array of the latter...

  Signed-off-by: Al Viro

  Al Viro

  2020-02-08 03:48:37 +0800  
• 96cafb9cc   fs_parser: remove fs_parameter_description name field ... Browse Code »

  Unused now.

  Signed-off-by: Eric Sandeen
  Acked-by: David Howells
  Signed-off-by: Al Viro

  Eric Sandeen

  2020-02-08 03:48:36 +0800  

07 Feb, 2020

2 commits

• 5eede6252   fold struct fs_parameter_enum into struct constant_table ... Browse Code »

  no real difference now

  Signed-off-by: Al Viro

  Al Viro

  2020-02-07 13:12:50 +0800  
• 2710c957a   fs_parse: get rid of ->enums ... Browse Code »

  Don't do a single array; attach them to fsparam_enum() entry
  instead. And don't bother trying to embed the names into those -
  it actually loses memory, with no real speedup worth mentioning.

  Simplifies validation as well.

  Signed-off-by: Al Viro

  Al Viro

  2020-02-07 13:12:50 +0800  

09 Dec, 2019

1 commit

• d3a196a37   Merge 5.5-rc1 into android-mainline ... Browse Code »

  Linux 5.5-rc1

  Signed-off-by: Greg Kroah-Hartman
  Change-Id: I6f952ebdd40746115165a2f99bab340482f5c237

  Greg Kroah-Hartman

  2019-12-09 19:12:00 +0800  

29 Nov, 2019

1 commit

• 6e78c01fd   Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()" ... Browse Code »

  This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a. The patch
  stopped JFFS2 from being able to mount an existing filesystem with the
  following errors:

  jffs2: error: (77) jffs2_build_inode_fragtree: Add node to tree failed -22
  jffs2: error: (77) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #5377: error -22

  Fixes: f2538f999345 ("jffs2: Fix possible null-pointer dereferences...")
  Cc: stable@vger.kernel.org
  Suggested-by: Hou Tao
  Signed-off-by: Joel Stanley
  Signed-off-by: Richard Weinberger

  Joel Stanley

  2019-11-29 18:29:58 +0800  

06 Nov, 2019

1 commit

• 3484eba91   FROMLIST: Add flags option to get xattr method paired to __vfs_getxattr ... Browse Code »

  Add a flag option to get xattr method that could have a bit flag of
  XATTR_NOSECURITY passed to it. XATTR_NOSECURITY is generally then
  set in the __vfs_getxattr path when called by security
  infrastructure.

  This handles the case of a union filesystem driver that is being
  requested by the security layer to report back the xattr data.

  For the use case where access is to be blocked by the security layer.

  The path then could be security(dentry) ->
  __vfs_getxattr(dentry...XATTR_NOSECURITY) ->
  handler->get(dentry...XATTR_NOSECURITY) ->
  __vfs_getxattr(lower_dentry...XATTR_NOSECURITY) ->
  lower_handler->get(lower_dentry...XATTR_NOSECURITY)
  which would report back through the chain data and success as
  expected, the logging security layer at the top would have the
  data to determine the access permissions and report back the target
  context that was blocked.

  Without the get handler flag, the path on a union filesystem would be
  the errant security(dentry) -> __vfs_getxattr(dentry) ->
  handler->get(dentry) -> vfs_getxattr(lower_dentry) -> nested ->
  security(lower_dentry, log off) -> lower_handler->get(lower_dentry)
  which would report back through the chain no data, and -EACCES.

  For selinux for both cases, this would translate to a correctly
  determined blocked access. In the first case with this change a correct avc
  log would be reported, in the second legacy case an incorrect avc log
  would be reported against an uninitialized u:object_r:unlabeled:s0
  context making the logs cosmetically useless for audit2allow.

  This patch series is inert and is the wide-spread addition of the
  flags option for xattr functions, and a replacement of __vfs_getxattr
  with __vfs_getxattr(...XATTR_NOSECURITY).

  Signed-off-by: Mark Salyzyn
  Reviewed-by: Jan Kara
  Acked-by: Jan Kara
  Acked-by: Jeff Layton
  Acked-by: David Sterba
  Acked-by: Darrick J. Wong
  Acked-by: Mike Marshall
  Cc: Stephen Smalley
  Cc: linux-kernel@vger.kernel.org
  Cc: kernel-team@android.com
  Cc: linux-security-module@vger.kernel.org

  (cherry picked from (rejected from archive because of too many recipients))
  Signed-off-by: Mark Salyzyn
  Bug: 133515582
  Bug: 136124883
  Bug: 129319403
  Change-Id: Iabbb8771939d5f66667a26bb23ddf4c562c349a1

  Mark Salyzyn

  2019-11-06 05:50:57 +0800  

27 Sep, 2019

1 commit

• dadedd856   Merge branch 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

  Pull jffs2 fix from Al Viro:
  "braino fix for mount API conversion for jffs2"

  * 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  jffs2: Fix mounting under new mount API

  Linus Torvalds

  2019-09-27 02:33:30 +0800  

26 Sep, 2019

1 commit

• a3bc18a48   jffs2: Fix mounting under new mount API ... Browse Code »

  The mounting of jffs2 is broken due to the changes from the new mount API
  because it specifies a "source" operation, but then doesn't actually
  process it. But because it specified it, it doesn't return -ENOPARAM and
  the caller doesn't process it either and the source gets lost.

  Fix this by simply removing the source parameter from jffs2 and letting the
  VFS deal with it in the default manner.

  To test it, enable CONFIG_MTD_MTDRAM and allow the default size and erase
  block size parameters, then try and mount the /dev/mtdblock file that
  that creates as jffs2. No need to initialise it.

  Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
  Reported-by: Al Viro
  Signed-off-by: David Howells
  cc: David Woodhouse
  cc: Richard Weinberger
  cc: linux-mtd@lists.infradead.org
  Signed-off-by: Al Viro

  David Howells

  2019-09-26 22:26:55 +0800  

22 Sep, 2019

1 commit

• 104c0d6bc   Merge tag 'upstream-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs ... Browse Code »

  Pull UBI, UBIFS and JFFS2 updates from Richard Weinberger:
  "UBI:
  - Be less stupid when placing a fastmap anchor
  - Try harder to get an empty PEB in case of contention
  - Make ubiblock to warn if image is not a multiple of 512

  UBIFS:
  - Various fixes in error paths

  JFFS2:
  - Various fixes in error paths"

  * tag 'upstream-5.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  jffs2: Fix memory leak in jffs2_scan_eraseblock() error path
  jffs2: Remove jffs2_gc_fetch_page and jffs2_gc_release_page
  jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()
  ubi: block: Warn if volume size is not multiple of 512
  ubifs: Fix memory leak bug in alloc_ubifs_info() error path
  ubifs: Fix memory leak in __ubifs_node_verify_hmac error path
  ubifs: Fix memory leak in read_znode() error path
  ubi: ubi_wl_get_peb: Increase the number of attempts while getting PEB
  ubi: Don't do anchor move within fastmap area
  ubifs: Remove redundant assignment to pointer fname

  Linus Torvalds

  2019-09-22 02:10:16 +0800  

20 Sep, 2019

1 commit

• bc7d9aee3   Merge branch 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

  Pull misc mount API conversions from Al Viro:
  "Conversions to new API for shmem and friends and for mount_mtd()-using
  filesystems.

  As for the rest of the mount API conversions in -next, some of them
  belong in the individual trees (e.g. binderfs one should definitely go
  through android folks, after getting redone on top of their changes).
  I'm going to drop those and send the rest (trivial ones + stuff ACKed
  by maintainers) in a separate series - by that point they are
  independent from each other.

  Some stuff has already migrated into individual trees (NFS conversion,
  for example, or FUSE stuff, etc.); those presumably will go through
  the regular merges from corresponding trees."

  * 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  vfs: Make fs_parse() handle fs_param_is_fd-type params better
  vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API
  shmem_parse_one(): switch to use of fs_parse()
  shmem_parse_options(): take handling a single option into a helper
  shmem_parse_options(): don't bother with mpol in separate variable
  shmem_parse_options(): use a separate structure to keep the results
  make shmem_fill_super() static
  make ramfs_fill_super() static
  devtmpfs: don't mix {ramfs,shmem}_fill_super() with mount_single()
  vfs: Convert squashfs to use the new mount API
  mtd: Kill mount_mtd()
  vfs: Convert jffs2 to use the new mount API
  vfs: Convert cramfs to use the new mount API
  vfs: Convert romfs to use the new mount API
  vfs: Add a single-or-reconfig keying to vfs_get_super()

  Linus Torvalds

  2019-09-20 01:06:57 +0800  

16 Sep, 2019

3 commits

• 6a379f674   jffs2: Fix memory leak in jffs2_scan_eraseblock() error path ... Browse Code »

  In jffs2_scan_eraseblock(), 'sumptr' is allocated through kmalloc() if
  'sumlen' is larger than 'buf_size'. However, it is not deallocated in the
  following execution if jffs2_fill_scan_buf() fails, leading to a memory
  leak bug. To fix this issue, free 'sumptr' before returning the error.

  Signed-off-by: Wenwen Wang
  Signed-off-by: Richard Weinberger

  Wenwen Wang

  2019-09-16 04:42:41 +0800  
• 61b875e88   jffs2: Remove jffs2_gc_fetch_page and jffs2_gc_release_page ... Browse Code »

  Merge these two helpers into the only callers to get rid of some
  amazingly bad calling conventions.

  Suggested-by: Al Viro
  Signed-off-by: Christoph Hellwig
  Signed-off-by: Richard Weinberger

  Christoph Hellwig

  2019-09-16 04:42:33 +0800  
• f2538f999   jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree() ... Browse Code »

  In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
  check whether "this" is NULL:
  if (this)

  When "this" is NULL, it is used at several places, such as on line 249:
  if (this->node)
  and on line 260:
  if (newfrag->ofs > this->ofs)

  Thus possible null-pointer dereferences may occur.

  To fix these bugs, -EINVAL is returned when "this" is NULL.

  These bugs are found by a static analysis tool STCheck written by us.

  Signed-off-by: Jia-Ju Bai
  Signed-off-by: Richard Weinberger

  Jia-Ju Bai

  2019-09-16 04:42:10 +0800  

06 Sep, 2019

1 commit

• ec10a24f1   vfs: Convert jffs2 to use the new mount API ... Browse Code »

  Convert the jffs2 filesystem to the new internal mount API as the old
  one will be obsoleted and removed. This allows greater flexibility in
  communication of mount parameters between userspace, the VFS and the
  filesystem.

  See Documentation/filesystems/mount_api.txt for more information.

  Signed-off-by: David Howells
  cc: David Woodhouse
  cc: linux-mtd@lists.infradead.org
  Signed-off-by: Al Viro

  David Howells

  2019-09-06 02:34:25 +0800  

30 Aug, 2019

1 commit

• 22b139691   fs: Fill in max and min timestamps in superblock ... Browse Code »

  Fill in the appropriate limits to avoid inconsistencies
  in the vfs cached inode times when timestamps are
  outside the permitted range.

  Even though some filesystems are read-only, fill in the
  timestamps to reflect the on-disk representation.

  Signed-off-by: Deepa Dinamani
  Reviewed-by: Darrick J. Wong
  Acked-By: Tigran Aivazian
  Acked-by: Jeff Layton
  Cc: aivazian.tigran@gmail.com
  Cc: al@alarsen.net
  Cc: coda@cs.cmu.edu
  Cc: darrick.wong@oracle.com
  Cc: dushistov@mail.ru
  Cc: dwmw2@infradead.org
  Cc: hch@infradead.org
  Cc: jack@suse.com
  Cc: jaharkes@cs.cmu.edu
  Cc: luisbg@kernel.org
  Cc: nico@fluxnic.net
  Cc: phillip@squashfs.org.uk
  Cc: richard@nod.at
  Cc: salah.triki@gmail.com
  Cc: shaggy@kernel.org
  Cc: linux-xfs@vger.kernel.org
  Cc: codalist@coda.cs.cmu.edu
  Cc: linux-ext4@vger.kernel.org
  Cc: linux-mtd@lists.infradead.org
  Cc: jfs-discussion@lists.sourceforge.net
  Cc: reiserfs-devel@vger.kernel.org

  Deepa Dinamani

  2019-08-30 22:27:17 +0800  

13 Jul, 2019

1 commit

• 265de8ce3   jffs2: pass the correct prototype to read_cache_page ... Browse Code »

  Fix the callback jffs2 passes to read_cache_page to actually have the
  proper type expected. Casting around function pointers can easily hide
  typing bugs, and defeats control flow protection.

  Link: http://lkml.kernel.org/r/20190520055731.24538-4-hch@lst.de
  Signed-off-by: Christoph Hellwig
  Reviewed-by: Kees Cook
  Cc: Nick Desaulniers
  Cc: Sami Tolvanen
  Signed-off-by: Andrew Morton
  Signed-off-by: Linus Torvalds

  Christoph Hellwig

  2019-07-13 02:05:43 +0800  

21 May, 2019

1 commit

• ec8f24b7f   treewide: Add SPDX license identifier - Makefile/Kconfig ... Browse Code »

  Add SPDX license identifiers to all Make/Kconfig files which:

  - Have no license information of any form

  These files fall under the project license, GPL v2 only. The resulting SPDX
  license identifier is:

  GPL-2.0-only

  Signed-off-by: Thomas Gleixner
  Signed-off-by: Greg Kroah-Hartman

  Thomas Gleixner

  2019-05-21 16:50:46 +0800  

08 May, 2019

1 commit

• b4b52b881   Merge tag 'Wimplicit-fallthrough-5.2-rc1' of git://git.kernel.org/pub/scm/linux/… ... Browse Code »

  …kernel/git/gustavoars/linux

  Pull Wimplicit-fallthrough updates from Gustavo A. R. Silva:
  "Mark switch cases where we are expecting to fall through.

  This is part of the ongoing efforts to enable -Wimplicit-fallthrough.

  Most of them have been baking in linux-next for a whole development
  cycle. And with Stephen Rothwell's help, we've had linux-next
  nag-emails going out for newly introduced code that triggers
  -Wimplicit-fallthrough to avoid gaining more of these cases while we
  work to remove the ones that are already present.

  We are getting close to completing this work. Currently, there are
  only 32 of 2311 of these cases left to be addressed in linux-next. I'm
  auditing every case; I take a look into the code and analyze it in
  order to determine if I'm dealing with an actual bug or a false
  positive, as explained here:

  https://lore.kernel.org/lkml/c2fad584-1705-a5f2-d63c-824e9b96cf50@embeddedor.com/

  While working on this, I've found and fixed the several missing
  break/return bugs, some of them introduced more than 5 years ago.

  Once this work is finished, we'll be able to universally enable
  "-Wimplicit-fallthrough" to avoid any of these kinds of bugs from
  entering the kernel again"

  * tag 'Wimplicit-fallthrough-5.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: (27 commits)
  memstick: mark expected switch fall-throughs
  drm/nouveau/nvkm: mark expected switch fall-throughs
  NFC: st21nfca: Fix fall-through warnings
  NFC: pn533: mark expected switch fall-throughs
  block: Mark expected switch fall-throughs
  ASN.1: mark expected switch fall-through
  lib/cmdline.c: mark expected switch fall-throughs
  lib: zstd: Mark expected switch fall-throughs
  scsi: sym53c8xx_2: sym_nvram: Mark expected switch fall-through
  scsi: sym53c8xx_2: sym_hipd: mark expected switch fall-throughs
  scsi: ppa: mark expected switch fall-through
  scsi: osst: mark expected switch fall-throughs
  scsi: lpfc: lpfc_scsi: Mark expected switch fall-throughs
  scsi: lpfc: lpfc_nvme: Mark expected switch fall-through
  scsi: lpfc: lpfc_nportdisc: Mark expected switch fall-through
  scsi: lpfc: lpfc_hbadisc: Mark expected switch fall-throughs
  scsi: lpfc: lpfc_els: Mark expected switch fall-throughs
  scsi: lpfc: lpfc_ct: Mark expected switch fall-throughs
  scsi: imm: mark expected switch fall-throughs
  scsi: csiostor: csio_wr: mark expected switch fall-through
  ...

  Linus Torvalds

  2019-05-08 03:48:10 +0800  

02 May, 2019

1 commit

• db0bd7b71   jffs2: switch to ->free_inode() ... Browse Code »

  Signed-off-by: Al Viro

  Al Viro

  2019-05-02 10:43:25 +0800  

09 Apr, 2019

1 commit

• 0a4c92657   fs: mark expected switch fall-throughs ... Browse Code »

  In preparation to enabling -Wimplicit-fallthrough, mark switch cases
  where we are expecting to fall through.

  This patch fixes the following warnings:

  fs/affs/affs.h:124:38: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/configfs/dir.c:1692:11: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/configfs/dir.c:1694:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ceph/file.c:249:3: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/hash.c:233:15: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/hash.c:246:15: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext2/inode.c:1237:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext2/inode.c:1244:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/indirect.c:1182:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/indirect.c:1188:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/indirect.c:1432:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ext4/indirect.c:1440:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/f2fs/node.c:618:8: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/f2fs/node.c:620:8: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/btrfs/ref-verify.c:522:15: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/gfs2/bmap.c:711:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/gfs2/bmap.c:722:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/jffs2/fs.c:339:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/nfsd/nfs4proc.c:429:12: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ufs/util.h:62:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/ufs/util.h:43:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/fcntl.c:770:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/seq_file.c:319:10: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/libfs.c:148:11: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/libfs.c:150:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/signalfd.c:178:7: warning: this statement may fall through [-Wimplicit-fallthrough=]
  fs/locks.c:1473:16: warning: this statement may fall through [-Wimplicit-fallthrough=]

  Warning level 3 was used: -Wimplicit-fallthrough=3

  This patch is part of the ongoing efforts to enabling
  -Wimplicit-fallthrough.

  Reviewed-by: Kees Cook
  Signed-off-by: Gustavo A. R. Silva

  Gustavo A. R. Silva

  2019-04-09 07:21:02 +0800  

01 Apr, 2019

1 commit

• 4fdcfab5b   jffs2: fix use-after-free on symlink traversal ... Browse Code »

  free the symlink body after the same RCU delay we have for freeing the
  struct inode itself, so that traversal during RCU pathwalk wouldn't step
  into freed memory.

  Signed-off-by: Al Viro

  Al Viro

  2019-04-01 12:31:02 +0800  

02 Dec, 2018

1 commit

• a788c5272   jffs2: Fix use of uninitialized delayed_work, lockdep breakage ... Browse Code »

  jffs2_sync_fs makes the assumption that if CONFIG_JFFS2_FS_WRITEBUFFER
  is defined then a write buffer is available and has been initialized.
  However, this does is not the case when the mtd device has no
  out-of-band buffer:

  int jffs2_nand_flash_setup(struct jffs2_sb_info *c)
  {
  if (!c->mtd->oobsize)
  return 0;
  ...

  The resulting call to cancel_delayed_work_sync passing a uninitialized
  (but zeroed) delayed_work struct forces lockdep to become disabled.

  [ 90.050639] overlayfs: upper fs does not support tmpfile.
  [ 90.652264] INFO: trying to register non-static key.
  [ 90.662171] the code is fine but needs lockdep annotation.
  [ 90.673090] turning off the locking correctness validator.
  [ 90.684021] CPU: 0 PID: 1762 Comm: mount_root Not tainted 4.14.63 #0
  [ 90.696672] Stack : 00000000 00000000 80d8f6a2 00000038 805f0000 80444600 8fe364f4 805dfbe7
  [ 90.713349] 80563a30 000006e2 8068370c 00000001 00000000 00000001 8e2fdc48 ffffffff
  [ 90.730020] 00000000 00000000 80d90000 00000000 00000106 00000000 6465746e 312e3420
  [ 90.746690] 6b636f6c 03bf0000 f8000000 20676e69 00000000 80000000 00000000 8e2c2a90
  [ 90.763362] 80d90000 00000001 00000000 8e2c2a90 00000003 80260dc0 08052098 80680000
  [ 90.780033] ...
  [ 90.784902] Call Trace:
  [ 90.789793] [] show_stack+0xb8/0x148
  [ 90.798659] [] register_lock_class+0x270/0x55c
  [ 90.809247] [] __lock_acquire+0x13c/0xf7c
  [ 90.818964] [] lock_acquire+0x194/0x1dc
  [ 90.828345] [] flush_work+0x200/0x24c
  [ 90.837374] [] __cancel_work_timer+0x158/0x210
  [ 90.847958] [] jffs2_sync_fs+0x20/0x54
  [ 90.857173] [] iterate_supers+0xf4/0x120
  [ 90.866729] [] sys_sync+0x44/0x9c
  [ 90.875067] [] syscall_common+0x34/0x58

  Signed-off-by: Daniel Santos
  Reviewed-by: Hou Tao
  Signed-off-by: Boris Brezillon

  Daniel Santos

  2018-12-02 16:20:34 +0800