Commit Graph

474 Commits

Author SHA1 Message Date
Greg Kroah-Hartman 910b540ffa This is the 5.15.41 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmKErdYACgkQONu9yGCS
 aT4LIg//bqU/qlVBJq3v3QCfN93SOXwECuPXi0e8p3aG/ptn1pzV0A5+rDD4TXeU
 mpw8oWSNQC0Wn8mag9poCvLFaSHuMIo2wPoPOwpRyb0BfhXCaWE4s1HbX49dNi2l
 9V76KC4JH69zaHtEmnBy83zzr4nyRG6q3bTd1hD3uJaSg6+2E+DfIK7MUSAyhyPU
 DSi2CSHgxZkBEJIVncCPPhz4HX7RJIav51EwAZlnqW6eX3osEe9Qh1b82qcatXIF
 rC/w74mQoRnghL0FRwQ5Z4mTEcgBI3lYoKJMkt8iZgOm9nBq1F62gXysKojmjDYc
 AvP97Jt+hF9hDFUfR2wW/sA/rsRhw1mx0LoFu96fc15Nxiyh8b/MFD+b3a2CqtN9
 szggwoezx90RbGOsc1zNhoX3VmZ2xMeVyAVg4RCscxXiO5FR1DqV4mUlbXoQx9ah
 I9+GYtc0vs9BP9pucK2kx7fzJ+eW93jIZVXHuh6mcspu7sdTBQam+ERH1gMIyCki
 OXcg0HCTLQi26MNMkrdX+RebwHxB7tbLXUXqYzQKEWjsLtCyv7LYmsRV+RZSyZ1p
 vqKs4gTjLPmcINebsT80mYZSH560lXkjl6Z0H5U23NQO8RG3QewrKZkHqwOn5zyQ
 aF5fnmVTVcMbT8BK3qCadr00Giz5usnw8R9am5EY1ELzo48207A=
 =35Fl
 -----END PGP SIGNATURE-----

Merge 5.15.41 into android13-5.15

Changes in 5.15.41
	batman-adv: Don't skb_split skbuffs with frag_list
	iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
	hwmon: (tmp401) Add OF device ID table
	mac80211: Reset MBSSID parameters upon connection
	net: Fix features skip in for_each_netdev_feature()
	net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
	net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
	net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
	net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
	fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
	fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
	fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove
	platform/surface: aggregator: Fix initialization order when compiling as builtin module
	ice: Fix race during aux device (un)plugging
	ice: fix PTP stale Tx timestamps cleanup
	ipv4: drop dst in multicast routing path
	drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
	netlink: do not reset transport header in netlink_recvmsg()
	net: chelsio: cxgb4: Avoid potential negative array offset
	fbdev: efifb: Fix a use-after-free due early fb_info cleanup
	sfc: Use swap() instead of open coding it
	net: sfc: fix memory leak due to ptp channel
	mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
	nfs: fix broken handling of the softreval mount option
	ionic: fix missing pci_release_regions() on error in ionic_probe()
	dim: initialize all struct fields
	hwmon: (ltq-cputemp) restrict it to SOC_XWAY
	procfs: prevent unprivileged processes accessing fdinfo dir
	selftests: vm: Makefile: rename TARGETS to VMTARGETS
	arm64: vdso: fix makefile dependency on vdso.so
	virtio: fix virtio transitional ids
	s390/ctcm: fix variable dereferenced before check
	s390/ctcm: fix potential memory leak
	s390/lcs: fix variable dereferenced before check
	net/sched: act_pedit: really ensure the skb is writable
	net: ethernet: mediatek: ppe: fix wrong size passed to memset()
	net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
	drm/vc4: hdmi: Fix build error for implicit function declaration
	net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
	net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
	net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
	tls: Fix context leak on tls_device_down
	drm/vmwgfx: Fix fencing on SVGAv3
	gfs2: Fix filesystem block deallocation for short writes
	hwmon: (f71882fg) Fix negative temperature
	RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core()
	iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu
	ASoC: max98090: Reject invalid values in custom control put()
	ASoC: max98090: Generate notifications on changes for custom control
	ASoC: ops: Validate input values in snd_soc_put_volsw_range()
	s390: disable -Warray-bounds
	ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback
	net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
	net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
	secure_seq: use the 64 bits of the siphash for port offset calculation
	tcp: use different parts of the port_offset for index and offset
	tcp: resalt the secret every 10 seconds
	tcp: add small random increments to the source port
	tcp: dynamically allocate the perturb table used by source ports
	tcp: increase source port perturb table to 2^16
	tcp: drop the hash_32() part from the index calculation
	interconnect: Restore sync state by ignoring ipa-virt in provider count
	firmware_loader: use kernel credentials when reading firmware
	KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context()
	usb: xhci-mtk: fix fs isoc's transfer error
	x86/mm: Fix marking of unused sub-pmd ranges
	tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
	tty: n_gsm: fix buffer over-read in gsm_dlci_data()
	tty: n_gsm: fix mux activation issues in gsm_config()
	usb: cdc-wdm: fix reading stuck on device close
	usb: typec: tcpci: Don't skip cleanup in .remove() on error
	usb: typec: tcpci_mt6360: Update for BMC PHY setting
	USB: serial: pl2303: add device id for HP LM930 Display
	USB: serial: qcserial: add support for Sierra Wireless EM7590
	USB: serial: option: add Fibocom L610 modem
	USB: serial: option: add Fibocom MA510 modem
	slimbus: qcom: Fix IRQ check in qcom_slim_probe
	fsl_lpuart: Don't enable interrupts too early
	serial: 8250_mtk: Fix UART_EFR register address
	serial: 8250_mtk: Fix register address for XON/XOFF character
	ceph: fix setting of xattrs on async created inodes
	Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()"
	mm/huge_memory: do not overkill when splitting huge_zero_page
	drm/vmwgfx: Disable command buffers on svga3 without gbobjects
	drm/nouveau/tegra: Stop using iommu_present()
	i40e: i40e_main: fix a missing check on list iterator
	net: atlantic: always deep reset on pm op, fixing up my null deref regression
	net: phy: Fix race condition on link status change
	writeback: Avoid skipping inode writeback
	cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
	arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
	net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061
	net: phy: micrel: Pass .probe for KS8737
	SUNRPC: Ensure that the gssproxy client can start in a connected state
	drm/vmwgfx: Initialize drm_mode_fb_cmd2
	Revert "drm/amd/pm: keep the BACO feature enabled for suspend"
	dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
	mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()
	SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
	ping: fix address binding wrt vrf
	usb: gadget: uvc: rename function to be more consistent
	usb: gadget: uvc: allow for application to cleanly shutdown
	Linux 5.15.41

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia65cdbbddf553237d6a3a38efb9bcb2fcc3990ec
2022-05-18 11:31:34 +02:00
Waiman Long 8e1716993b cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
commit 2685027fca387b602ae565bff17895188b803988 upstream.

There are 3 places where the cpu and node masks of the top cpuset can
be initialized in the order they are executed:
 1) start_kernel -> cpuset_init()
 2) start_kernel -> cgroup_init() -> cpuset_bind()
 3) kernel_init_freeable() -> do_basic_setup() -> cpuset_init_smp()

The first cpuset_init() call just sets all the bits in the masks.
The second cpuset_bind() call sets cpus_allowed and mems_allowed to the
default v2 values. The third cpuset_init_smp() call sets them back to
v1 values.

For systems with cgroup v2 setup, cpuset_bind() is called once.  As a
result, cpu and memory node hot add may fail to update the cpu and node
masks of the top cpuset to include the newly added cpu or node in a
cgroup v2 environment.

For systems with cgroup v1 setup, cpuset_bind() is called again by
rebind_subsystem() when the v1 cpuset filesystem is mounted as shown
in the dmesg log below with an instrumented kernel.

  [    2.609781] cpuset_bind() called - v2 = 1
  [    3.079473] cpuset_init_smp() called
  [    7.103710] cpuset_bind() called - v2 = 0

smp_init() is called after the first two init functions.  So we don't
have a complete list of active cpus and memory nodes until later in
cpuset_init_smp() which is the right time to set up effective_cpus
and effective_mems.

To fix this cgroup v2 mask setup problem, the potentially incorrect
cpus_allowed & mems_allowed setting in cpuset_init_smp() are removed.
For cgroup v2 systems, the initial cpuset_bind() call will set the masks
correctly.  For cgroup v1 systems, the second call to cpuset_bind()
will do the right setup.

cc: stable@vger.kernel.org
Signed-off-by: Waiman Long <longman@redhat.com>
Tested-by: Feng Tang <feng.tang@intel.com>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-18 10:26:56 +02:00
Yu Zhao 76f7f07cbf FROMLIST: mm: multi-gen LRU: kill switch
Add /sys/kernel/mm/lru_gen/enabled as a kill switch. Components that
can be disabled include:
  0x0001: the multi-gen LRU core
  0x0002: walking page table, when arch_has_hw_pte_young() returns
          true
  0x0004: clearing the accessed bit in non-leaf PMD entries, when
          CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y
  [yYnN]: apply to all the components above
E.g.,
  echo y >/sys/kernel/mm/lru_gen/enabled
  cat /sys/kernel/mm/lru_gen/enabled
  0x0007
  echo 5 >/sys/kernel/mm/lru_gen/enabled
  cat /sys/kernel/mm/lru_gen/enabled
  0x0005

NB: the page table walks happen on the scale of seconds under heavy
memory pressure, in which case the mmap_lock contention is a lesser
concern, compared with the LRU lock contention and the I/O congestion.
So far the only well-known case of the mmap_lock contention happens on
Android, due to Scudo [1] which allocates several thousand VMAs for
merely a few hundred MBs. The SPF and the Maple Tree also have
provided their own assessments [2][3]. However, if walking page tables
does worsen the mmap_lock contention, the kill switch can be used to
disable it. In this case the multi-gen LRU will suffer a minor
performance degradation, as shown previously.

Clearing the accessed bit in non-leaf PMD entries can also be
disabled, since this behavior was not tested on x86 varieties other
than Intel and AMD.

[1] https://source.android.com/devices/tech/debug/scudo
[2] https://lore.kernel.org/lkml/20220128131006.67712-1-michel@lespinasse.org/
[3] https://lore.kernel.org/lkml/20220202024137.2516438-1-Liam.Howlett@oracle.com/

Link: https://lore.kernel.org/lkml/20220309021230.721028-11-yuzhao@google.com/
Signed-off-by: Yu Zhao <yuzhao@google.com>
Acked-by: Brian Geffon <bgeffon@google.com>
Acked-by: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Acked-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Acked-by: Steven Barrett <steven@liquorix.net>
Acked-by: Suleiman Souhlal <suleiman@google.com>
Tested-by: Daniel Byrne <djbyrne@mtu.edu>
Tested-by: Donald Carr <d@chaos-reins.com>
Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
Tested-by: Konstantin Kharlamov <Hi-Angel@yandex.ru>
Tested-by: Shuang Zhai <szhai2@cs.rochester.edu>
Tested-by: Sofia Trinh <sofia.trinh@edi.works>
Tested-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Bug: 227651406
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I71801d9470a2588cad8bfd14fbcfafc7b010aa03
2022-04-20 17:38:56 +00:00
Greg Kroah-Hartman 26481b5161 Merge 5.15.26 into android13-5.15
Changes in 5.15.26
	mm/filemap: Fix handling of THPs in generic_file_buffered_read()
	cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
	cgroup-v1: Correct privileges check in release_agent writes
	x86/ptrace: Fix xfpregs_set()'s incorrect xmm clearing
	btrfs: tree-checker: check item_size for inode_item
	btrfs: tree-checker: check item_size for dev_item
	clk: jz4725b: fix mmc0 clock gating
	io_uring: don't convert to jiffies for waiting on timeouts
	io_uring: disallow modification of rsrc_data during quiesce
	selinux: fix misuse of mutex_is_locked()
	vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
	parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel
	parisc/unaligned: Fix ldw() and stw() unalignment handlers
	KVM: x86/mmu: make apf token non-zero to fix bug
	drm/amd/display: Protect update_bw_bounding_box FPU code.
	drm/amd/pm: fix some OEM SKU specific stability issues
	drm/amd: Check if ASPM is enabled from PCIe subsystem
	drm/amdgpu: disable MMHUB PG for Picasso
	drm/amdgpu: do not enable asic reset for raven2
	drm/i915: Widen the QGV point mask
	drm/i915: Correctly populate use_sagv_wm for all pipes
	drm/i915: Fix bw atomic check when switching between SAGV vs. no SAGV
	sr9700: sanity check for packet length
	USB: zaurus: support another broken Zaurus
	CDC-NCM: avoid overflow in sanity checking
	netfilter: xt_socket: fix a typo in socket_mt_destroy()
	netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency
	netfilter: nf_tables_offload: incorrect flow offload action array size
	tee: export teedev_open() and teedev_close_context()
	optee: use driver internal tee_context for some rpc
	ping: remove pr_err from ping_lookup
	Revert "i40e: Fix reset bw limit when DCB enabled with 1 TC"
	gpu: host1x: Always return syncpoint value when waiting
	perf evlist: Fix failed to use cpu list for uncore events
	perf data: Fix double free in perf_session__delete()
	mptcp: fix race in incoming ADD_ADDR option processing
	mptcp: add mibs counter for ignored incoming options
	selftests: mptcp: fix diag instability
	selftests: mptcp: be more conservative with cookie MPJ limits
	bnx2x: fix driver load from initrd
	bnxt_en: Fix active FEC reporting to ethtool
	bnxt_en: Fix offline ethtool selftest with RDMA enabled
	bnxt_en: Fix incorrect multicast rx mask setting when not requested
	hwmon: Handle failure to register sensor with thermal zone correctly
	net/mlx5: Fix tc max supported prio for nic mode
	ice: check the return of ice_ptp_gettimex64
	ice: initialize local variable 'tlv'
	net/mlx5: Update the list of the PCI supported devices
	bpf: Fix crash due to incorrect copy_map_value
	bpf: Do not try bpf_msg_push_data with len 0
	selftests: bpf: Check bpf_msg_push_data return value
	bpf: Fix a bpf_timer initialization issue
	bpf: Add schedule points in batch ops
	io_uring: add a schedule point in io_add_buffers()
	net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
	nvme: also mark passthrough-only namespaces ready in nvme_update_ns_info
	tipc: Fix end of loop tests for list_for_each_entry()
	gso: do not skip outer ip header in case of ipip and net_failover
	net: mv643xx_eth: process retval from of_get_mac_address
	openvswitch: Fix setting ipv6 fields causing hw csum failure
	drm/edid: Always set RGB444
	net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
	drm/vc4: crtc: Fix runtime_pm reference counting
	drm/i915/dg2: Print PHY name properly on calibration error
	net/sched: act_ct: Fix flow table lookup after ct clear or switching zones
	net: ll_temac: check the return value of devm_kmalloc()
	net: Force inlining of checksum functions in net/checksum.h
	netfilter: nf_tables: unregister flowtable hooks on netns exit
	nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()
	net: mdio-ipq4019: add delay after clock enable
	netfilter: nf_tables: fix memory leak during stateful obj update
	net/smc: Use a mutex for locking "struct smc_pnettable"
	surface: surface3_power: Fix battery readings on batteries without a serial number
	udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister()
	net/mlx5: DR, Cache STE shadow memory
	ibmvnic: schedule failover only if vioctl fails
	net/mlx5: DR, Don't allow match on IP w/o matching on full ethertype/ip_version
	net/mlx5: Fix possible deadlock on rule deletion
	net/mlx5: Fix wrong limitation of metadata match on ecpf
	net/mlx5: DR, Fix the threshold that defines when pool sync is initiated
	net/mlx5e: MPLSoUDP decap, fix check for unsupported matches
	net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets
	net/mlx5: Update log_max_qp value to be 17 at most
	spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()
	gpio: rockchip: Reset int_bothedge when changing trigger
	regmap-irq: Update interrupt clear register for proper reset
	net-timestamp: convert sk->sk_tskey to atomic_t
	RDMA/rtrs-clt: Fix possible double free in error case
	RDMA/rtrs-clt: Move free_permit from free_clt to rtrs_clt_close
	bnxt_en: Increase firmware message response DMA wait time
	configfs: fix a race in configfs_{,un}register_subsystem()
	RDMA/ib_srp: Fix a deadlock
	tracing: Dump stacktrace trigger to the corresponding instance
	tracing: Have traceon and traceoff trigger honor the instance
	iio:imu:adis16480: fix buffering for devices with no burst mode
	iio: adc: men_z188_adc: Fix a resource leak in an error handling path
	iio: adc: tsc2046: fix memory corruption by preventing array overflow
	iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits
	iio: accel: fxls8962af: add padding to regmap for SPI
	iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot
	iio: Fix error handling for PM
	sc16is7xx: Fix for incorrect data being transmitted
	ata: pata_hpt37x: disable primary channel on HPT371
	Revert "USB: serial: ch341: add new Product ID for CH341A"
	usb: gadget: rndis: add spinlock for rndis response list
	USB: gadget: validate endpoint index for xilinx udc
	tracefs: Set the group ownership in apply_options() not parse_options()
	USB: serial: option: add support for DW5829e
	USB: serial: option: add Telit LE910R1 compositions
	usb: dwc2: drd: fix soft connect when gadget is unconfigured
	usb: dwc3: pci: Add "snps,dis_u2_susphy_quirk" for Intel Bay Trail
	usb: dwc3: pci: Fix Bay Trail phy GPIO mappings
	usb: dwc3: gadget: Let the interrupt handler disable bottom halves.
	xhci: re-initialize the HC during resume if HCE was set
	xhci: Prevent futile URB re-submissions due to incorrect return value.
	nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property
	mtd: core: Fix a conflict between MTD and NVMEM on wp-gpios property
	driver core: Free DMA range map when device is released
	btrfs: prevent copying too big compressed lzo segment
	RDMA/cma: Do not change route.addr.src_addr outside state checks
	thermal: int340x: fix memory leak in int3400_notify()
	staging: fbtft: fb_st7789v: reset display before initialization
	tps6598x: clear int mask on probe failure
	IB/qib: Fix duplicate sysfs directory name
	riscv: fix nommu_k210_sdcard_defconfig
	riscv: fix oops caused by irqsoff latency tracer
	tty: n_gsm: fix encoding of control signal octet bit DV
	tty: n_gsm: fix proper link termination after failed open
	tty: n_gsm: fix NULL pointer access due to DLCI release
	tty: n_gsm: fix wrong tty control line for flow control
	tty: n_gsm: fix wrong modem processing in convergence layer type 2
	tty: n_gsm: fix deadlock in gsmtty_open()
	pinctrl: fix loop in k210_pinconf_get_drive()
	pinctrl: k210: Fix bias-pull-up
	gpio: tegra186: Fix chip_data type confusion
	memblock: use kfree() to release kmalloced memblock regions
	ice: Fix race conditions between virtchnl handling and VF ndo ops
	ice: fix concurrent reset and removal of VFs
	Linux 5.15.26

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ied0cc9bd48b7af71a064107676f37b0dd39ce3cf
2022-03-16 12:53:52 +01:00
Michal Koutný ebeb7b7357 cgroup-v1: Correct privileges check in release_agent writes
commit 467a726b754f474936980da793b4ff2ec3e382a7 upstream.

The idea is to check: a) the owning user_ns of cgroup_ns, b)
capabilities in init_user_ns.

The commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") got this wrong in the write handler of release_agent
since it checked user_ns of the opener (may be different from the owning
user_ns of cgroup_ns).
Secondly, to avoid possibly confused deputy, the capability of the
opener must be checked.

Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/stable/20220216121142.GB30035@blackbody.suse.cz/
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Reviewed-by: Masami Ichikawa(CIP) <masami.ichikawa@cybertrust.co.jp>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-02 11:47:47 +01:00
Zhang Qiao ffed0bf6a6 cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug
commit 05c7b7a92cc87ff8d7fde189d0fade250697573c upstream.

As previously discussed(https://lkml.org/lkml/2022/1/20/51),
cpuset_attach() is affected with similar cpu hotplug race,
as follow scenario:

     cpuset_attach()				cpu hotplug
    ---------------------------            ----------------------
    down_write(cpuset_rwsem)
    guarantee_online_cpus() // (load cpus_attach)
					sched_cpu_deactivate
					  set_cpu_active()
					  // will change cpu_active_mask
    set_cpus_allowed_ptr(cpus_attach)
      __set_cpus_allowed_ptr_locked()
       // (if the intersection of cpus_attach and
         cpu_active_mask is empty, will return -EINVAL)
    up_write(cpuset_rwsem)

To avoid races such as described above, protect cpuset_attach() call
with cpu_hotplug_lock.

Fixes: be367d0992 ("cgroups: let ss->can_attach and ss->attach do whole threadgroups at a time")
Cc: stable@vger.kernel.org # v2.6.32+
Reported-by: Zhao Gongyi <zhaogongyi@huawei.com>
Signed-off-by: Zhang Qiao <zhangqiao22@huawei.com>
Acked-by: Waiman Long <longman@redhat.com>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-02 11:47:47 +01:00
Greg Kroah-Hartman a74d4e284c This is the 5.15.22 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmICqZ0ACgkQONu9yGCS
 aT7glhAAhsuvuAZuMa3B+Ea5vDiHbPprk/so56zZ0mnvR2cre/CEah5ZSqB8WQt0
 JjGqEDCaFogbdymZeI9L54tuW+4Pe2dpyZVS6ssyOv9RWMU5MnHBEWxJ34onRQCo
 aESzxDKFNj30ZXtFT75EsAXNtDg0B+qMG5RYBmbn9W7EU9cI7ePmOWabuCJq4QMx
 N0uKluEMvfDdrZI6hZn3RstwkPkR1R4eFCHKyRT2CC6BCiBi0leB/5joPXzPhiGy
 +ctLPU8tkUPYE6XJWJpv8VxzwFgqFDMaqMOKuKtrITI4icLVc5X/cG9iEbr9/vRl
 xdiuTYbXOEEBSRX5DbLvcQzj5qF7m+Ufn5o7E+JAwUTvMU4VPXmQimRdTWcvlHXo
 qVfm6YZBf/GVOjJzXJosrBcBMHkBcDarhuzJiC1EC1MHUMFEc73xzPiud1z3J0UZ
 VSdv41InHITJSsMtMyYoBqDXW3SP+nqKE87ZCMyC5MC2wnKQazGXhOrulVxGuy0G
 xsfj8HvR2tlsHKJbcJzPccRxwTf9/5tHq0Kw7FcsFCYHiHamyx+mXrdj0v3h18Ec
 fR+8ZodiS9aRF5B9tf+CaRAMen/29RcFh3WRXALHJKB3SQ7RQxlyzgZai/qfRKwd
 JcaVMR/RUs7F/l+MsluO1Tlv9F24Gpo28OmwXVji1KGYP97jz3c=
 =mPok
 -----END PGP SIGNATURE-----

Merge 5.15.22 into android13-5.15

Changes in 5.15.22
	drm/i915: Disable DSB usage for now
	selinux: fix double free of cond_list on error paths
	audit: improve audit queue handling when "audit=1" on cmdline
	ipc/sem: do not sleep with a spin lock held
	spi: stm32-qspi: Update spi registering
	ASoC: hdmi-codec: Fix OOB memory accesses
	ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
	ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
	ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
	ALSA: usb-audio: Correct quirk for VF0770
	ALSA: hda: Fix UAF of leds class devs at unbinding
	ALSA: hda: realtek: Fix race at concurrent COEF updates
	ALSA: hda/realtek: Add quirk for ASUS GU603
	ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks
	ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset)
	ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows
	btrfs: don't start transaction for scrub if the fs is mounted read-only
	btrfs: fix deadlock between quota disable and qgroup rescan worker
	btrfs: fix use-after-free after failure to create a snapshot
	Revert "fs/9p: search open fids first"
	drm/nouveau: fix off by one in BIOS boundary checking
	drm/i915/adlp: Fix TypeC PHY-ready status readout
	drm/amd/pm: correct the MGpuFanBoost support for Beige Goby
	drm/amd/display: watermark latencies is not enough on DCN31
	drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels
	nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts()
	mm/debug_vm_pgtable: remove pte entry from the page table
	mm/pgtable: define pte_index so that preprocessor could recognize it
	mm/kmemleak: avoid scanning potential huge holes
	block: bio-integrity: Advance seed correctly for larger interval sizes
	dma-buf: heaps: Fix potential spectre v1 gadget
	IB/hfi1: Fix AIP early init panic
	Revert "fbcon: Disable accelerated scrolling"
	fbcon: Add option to enable legacy hardware acceleration
	mptcp: fix msk traversal in mptcp_nl_cmd_set_flags()
	Revert "ASoC: mediatek: Check for error clk pointer"
	KVM: arm64: Avoid consuming a stale esr value when SError occur
	KVM: arm64: Stop handle_exit() from handling HVC twice when an SError occurs
	RDMA/cma: Use correct address when leaving multicast group
	RDMA/ucma: Protect mc during concurrent multicast leaves
	RDMA/siw: Fix refcounting leak in siw_create_qp()
	IB/rdmavt: Validate remote_addr during loopback atomic tests
	RDMA/siw: Fix broken RDMA Read Fence/Resume logic.
	RDMA/mlx4: Don't continue event handler after memory allocation failure
	ALSA: usb-audio: initialize variables that could ignore errors
	ALSA: hda: Fix signedness of sscanf() arguments
	ALSA: hda: Skip codec shutdown in case the codec is not registered
	iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
	iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
	spi: bcm-qspi: check for valid cs before applying chip select
	spi: mediatek: Avoid NULL pointer crash in interrupt
	spi: meson-spicc: add IRQ check in meson_spicc_probe
	spi: uniphier: fix reference count leak in uniphier_spi_probe()
	IB/hfi1: Fix tstats alloc and dealloc
	IB/cm: Release previously acquired reference counter in the cm_id_priv
	net: ieee802154: hwsim: Ensure proper channel selection at probe time
	net: ieee802154: mcr20a: Fix lifs/sifs periods
	net: ieee802154: ca8210: Stop leaking skb's
	netfilter: nft_reject_bridge: Fix for missing reply from prerouting
	net: ieee802154: Return meaningful error codes from the netlink helpers
	net/smc: Forward wakeup to smc socket waitqueue after fallback
	net: stmmac: dwmac-visconti: No change to ETHER_CLOCK_SEL for unexpected speed request.
	net: stmmac: properly handle with runtime pm in stmmac_dvr_remove()
	net: macsec: Fix offload support for NETDEV_UNREGISTER event
	net: macsec: Verify that send_sci is on when setting Tx sci explicitly
	net: stmmac: dump gmac4 DMA registers correctly
	net: stmmac: ensure PTP time register reads are consistent
	drm/kmb: Fix for build errors with Warray-bounds
	drm/i915/overlay: Prevent divide by zero bugs in scaling
	drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled
	ASoC: fsl: Add missing error handling in pcm030_fabric_probe
	ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes
	ASoC: simple-card: fix probe failure on platform component
	ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name
	ASoC: max9759: fix underflow in speaker_gain_control_put()
	ASoC: codecs: wcd938x: fix incorrect used of portid
	ASoC: codecs: lpass-rx-macro: fix sidetone register offsets
	ASoC: codecs: wcd938x: fix return value of mixer put function
	pinctrl: sunxi: Fix H616 I2S3 pin data
	pinctrl: intel: Fix a glitch when updating IRQ flags on a preconfigured line
	pinctrl: intel: fix unexpected interrupt
	pinctrl: bcm2835: Fix a few error paths
	scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
	nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
	gve: fix the wrong AdminQ buffer queue index check
	bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
	selftests/exec: Remove pipe from TEST_GEN_FILES
	selftests: futex: Use variable MAKE instead of make
	tools/resolve_btfids: Do not print any commands when building silently
	e1000e: Separate ADP board type from TGP
	rtc: cmos: Evaluate century appropriate
	kvm: add guest_state_{enter,exit}_irqoff()
	kvm/arm64: rework guest entry logic
	perf: Copy perf_event_attr::sig_data on modification
	perf stat: Fix display of grouped aliased events
	perf/x86/intel/pt: Fix crash with stop filters in single-range mode
	x86/perf: Default set FREEZE_ON_SMI for all
	EDAC/altera: Fix deferred probing
	EDAC/xgene: Fix deferred probing
	ext4: prevent used blocks from being allocated during fast commit replay
	ext4: modify the logic of ext4_mb_new_blocks_simple
	ext4: fix error handling in ext4_restore_inline_data()
	ext4: fix error handling in ext4_fc_record_modified_inode()
	ext4: fix incorrect type issue during replay_del_range
	net: dsa: mt7530: make NET_DSA_MT7530 select MEDIATEK_GE_PHY
	cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
	tools include UAPI: Sync sound/asound.h copy with the kernel sources
	gpio: idt3243x: Fix an ignored error return from platform_get_irq()
	gpio: mpc8xxx: Fix an ignored error return from platform_get_irq()
	selftests: nft_concat_range: add test for reload with no element add/del
	selftests: netfilter: check stateless nat udp checksum fixup
	Linux 5.15.22

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9143b858b768a8497c1df9440a74d8c105c32271
2022-02-09 08:15:44 +01:00
Waiman Long f5afdefe18 cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning
commit 2bdfd2825c9662463371e6691b1a794e97fa36b4 upstream.

It was found that a "suspicious RCU usage" lockdep warning was issued
with the rcu_read_lock() call in update_sibling_cpumasks().  It is
because the update_cpumasks_hier() function may sleep. So we have
to release the RCU lock, call update_cpumasks_hier() and reacquire
it afterward.

Also add a percpu_rwsem_assert_held() in update_sibling_cpumasks()
instead of stating that in the comment.

Fixes: 4716909cc5 ("cpuset: Track cpusets that use parent's effective_cpus")
Signed-off-by: Waiman Long <longman@redhat.com>
Tested-by: Phil Auld <pauld@redhat.com>
Reviewed-by: Phil Auld <pauld@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-08 18:34:14 +01:00
Greg Kroah-Hartman 344a3ff87c This is the 5.15.20 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmH+YdoACgkQONu9yGCS
 aT7aCA//RL82KKP5/Ny2Y8ae0R3ObmeWwOhNOFdqaEKGYLKRB2pzZBMmZhm7tIZe
 /+Isj4xaEp1VKnNtQcmLlGo25BBzLx68cdgcJz423rWZsi0F8a20jqo+KZ/vjkuu
 sseI0cXkdVKCHw7sfDyqhNSajJdq/DUPRgpBNj+TLTQcviBb7lYd2gUUYWVZ3qJ5
 gn6+b4etvkV6w5v/I0KZ+AQ0jftCErEtDiQuiQzcNlL2dDjJdtzlEqaZuiAiEnA0
 ZFSqoyr4c6TU3mOhcfLxDj/YXLUFs7WEd9KLnH9da0rfbF+da8A/glKSwU1rUK4j
 kYsGUdEi3aQR0FgZpiVQ6T3o+so5ptKeJ9eGuGCQzvrYcxytUm3haIuLLMpzHV1G
 0e7VXLUz6/PcjxxwWtXVuqUyCopBY6djZ4MPiD7NvfDbwrob50aATkcETlr8IcfJ
 ii6YQnvhwvC8jtQQbJJNykQ6W8GMH5W7d7yUlwkGDVdpNS0PYtlkOR/PXEX8mBaq
 HxXt81d/YSeOmCfhSLjGnznnzacv4XCAXrLCAh52lm1ivw19wlGV1tzWUL9CJfvR
 8XoklnIVDCrSY7YFrIHGAm0o7r2BQWnfZoE/8ykTCGdpfzeghDrnfA4H4eDHxW6p
 5KsMJsZl4ofo4p4+FMV6AJ/ZbZvlRQd3OxD4uf8wFbPGhWQ3z54=
 =sEcs
 -----END PGP SIGNATURE-----

Merge 5.15.20 into android13-5.15

Changes in 5.15.20
	PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
	selftests: mptcp: fix ipv6 routing setup
	net: ipa: use a bitmap for endpoint replenish_enabled
	net: ipa: prevent concurrent replenish
	drm/vc4: hdmi: Make sure the device is powered with CEC
	cgroup-v1: Require capabilities to set release_agent
	Revert "mm/gup: small refactoring: simplify try_grab_page()"
	ovl: don't fail copy up if no fileattr support on upper
	lockd: fix server crash on reboot of client holding lock
	lockd: fix failure to cleanup client locks
	net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic
	net/mlx5: Bridge, take rtnl lock in init error handler
	net/mlx5: Bridge, ensure dev_name is null-terminated
	net/mlx5e: Fix handling of wrong devices during bond netevent
	net/mlx5: Use del_timer_sync in fw reset flow of halting poll
	net/mlx5e: Fix module EEPROM query
	net/mlx5: Fix offloading with ESWITCH_IPV4_TTL_MODIFY_ENABLE
	net/mlx5e: Don't treat small ceil values as unlimited in HTB offload
	net/mlx5: Bridge, Fix devlink deadlock on net namespace deletion
	net/mlx5: E-Switch, Fix uninitialized variable modact
	ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
	i40e: Fix reset bw limit when DCB enabled with 1 TC
	i40e: Fix reset path while removing the driver
	net: amd-xgbe: ensure to reset the tx_timer_active flag
	net: amd-xgbe: Fix skb data length underflow
	fanotify: Fix stale file descriptor in copy_event_to_user()
	net: sched: fix use-after-free in tc_new_tfilter()
	rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
	cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
	e1000e: Handshake with CSME starts from ADL platforms
	af_packet: fix data-race in packet_setsockopt / packet_setsockopt
	tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
	ovl: fix NULL pointer dereference in copy up warning
	Linux 5.15.20

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia50333eff81881fac62eb52455b502e6c46ff3d9
2022-02-05 13:22:13 +01:00
Tianchen Ding 6be2349177 cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask()
commit c80d401c52a2d1baf2a5afeb06f0ffe678e56d23 upstream.

subparts_cpus should be limited as a subset of cpus_allowed, but it is
updated wrongly by using cpumask_andnot(). Use cpumask_and() instead to
fix it.

Fixes: ee8dde0cd2 ("cpuset: Add new v2 cpuset.sched.partition flag")
Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-05 12:38:59 +01:00
Eric W. Biederman 4b1c32bfaa cgroup-v1: Require capabilities to set release_agent
commit 24f6008564183aa120d07c03d9289519c2fe02af upstream.

The cgroup release_agent is called with call_usermodehelper.  The function
call_usermodehelper starts the release_agent with a full set fo capabilities.
Therefore require capabilities when setting the release_agaent.

Reported-by: Tabitha Sable <tabitha.c.sable@gmail.com>
Tested-by: Tabitha Sable <tabitha.c.sable@gmail.com>
Fixes: 81a6a5cdd2 ("Task Control Groups: automatic userspace notification of idle cgroups")
Cc: stable@vger.kernel.org # v2.6.24+
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-05 12:38:57 +01:00
Greg Kroah-Hartman 8222792e8e Merge 5.15.19 into android13-5.15
Changes in 5.15.19
	can: m_can: m_can_fifo_{read,write}: don't read or write from/to FIFO if length is 0
	net: sfp: ignore disabled SFP node
	net: stmmac: configure PTP clock source prior to PTP initialization
	net: stmmac: skip only stmmac_ptp_register when resume from suspend
	ARM: 9179/1: uaccess: avoid alignment faults in copy_[from|to]_kernel_nofault
	ARM: 9180/1: Thumb2: align ALT_UP() sections in modules sufficiently
	KVM: arm64: Use shadow SPSR_EL1 when injecting exceptions on !VHE
	s390/module: fix loading modules with a lot of relocations
	s390/hypfs: include z/VM guests with access control group set
	s390/nmi: handle guarded storage validity failures for KVM guests
	s390/nmi: handle vector validity failures for KVM guests
	bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
	powerpc32/bpf: Fix codegen for bpf-to-bpf calls
	powerpc/bpf: Update ldimm64 instructions during extra pass
	ucount: Make get_ucount a safe get_user replacement
	scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
	udf: Restore i_lenAlloc when inode expansion fails
	udf: Fix NULL ptr deref when converting from inline format
	efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
	PM: wakeup: simplify the output logic of pm_show_wakelocks()
	tracing/histogram: Fix a potential memory leak for kstrdup()
	tracing: Don't inc err_log entry count if entry allocation fails
	ceph: properly put ceph_string reference after async create attempt
	ceph: set pool_ns in new inode layout for async creates
	fsnotify: fix fsnotify hooks in pseudo filesystems
	Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
	psi: Fix uaf issue when psi trigger is destroyed while being polled
	powerpc/audit: Fix syscall_get_arch()
	perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
	perf/x86/intel: Add a quirk for the calculation of the number of counters on Alder Lake
	drm/etnaviv: relax submit size limits
	drm/atomic: Add the crtc to affected crtc only if uapi.enable = true
	drm/amd/display: Fix FP start/end for dcn30_internal_validate_bw.
	KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
	KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
	KVM: SVM: Don't intercept #GP for SEV guests
	KVM: x86: nSVM: skip eax alignment check for non-SVM instructions
	KVM: x86: Forcibly leave nested virt when SMM state is toggled
	KVM: x86: Keep MSR_IA32_XSS unchanged for INIT
	KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
	KVM: x86: Sync the states size with the XCR0/IA32_XSS at, any time
	KVM: PPC: Book3S HV Nested: Fix nested HFSCR being clobbered with multiple vCPUs
	dm: revert partial fix for redundant bio-based IO accounting
	block: add bio_start_io_acct_time() to control start_time
	dm: properly fix redundant bio-based IO accounting
	serial: pl011: Fix incorrect rs485 RTS polarity on set_mctrl
	serial: 8250: of: Fix mapped region size when using reg-offset property
	serial: stm32: fix software flow control transfer
	tty: n_gsm: fix SW flow control encoding/handling
	tty: Partially revert the removal of the Cyclades public API
	tty: Add support for Brainboxes UC cards.
	kbuild: remove include/linux/cyclades.h from header file check
	usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
	usb: xhci-plat: fix crash when suspend if remote wake enable
	usb: common: ulpi: Fix crash in ulpi_match()
	usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
	usb: cdnsp: Fix segmentation fault in cdns_lost_power function
	usb: dwc3: xilinx: Skip resets and USB3 register settings for USB2.0 mode
	usb: dwc3: xilinx: Fix error handling when getting USB3 PHY
	USB: core: Fix hang in usb_kill_urb by adding memory barriers
	usb: typec: tcpci: don't touch CC line if it's Vconn source
	usb: typec: tcpm: Do not disconnect while receiving VBUS off
	usb: typec: tcpm: Do not disconnect when receiving VSAFE0V
	ucsi_ccg: Check DEV_INT bit only when starting CCG4
	mm, kasan: use compare-exchange operation to set KASAN page tag
	jbd2: export jbd2_journal_[grab|put]_journal_head
	ocfs2: fix a deadlock when commit trans
	sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask
	PCI/sysfs: Find shadow ROM before static attribute initialization
	x86/MCE/AMD: Allow thresholding interface updates after init
	x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
	powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs
	powerpc/32s: Fix kasan_init_region() for KASAN
	powerpc/32: Fix boot failure with GCC latent entropy plugin
	i40e: Increase delay to 1 s after global EMP reset
	i40e: Fix issue when maximum queues is exceeded
	i40e: Fix queues reservation for XDP
	i40e: Fix for failed to init adminq while VF reset
	i40e: fix unsigned stat widths
	usb: roles: fix include/linux/usb/role.h compile issue
	rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
	rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
	scsi: elx: efct: Don't use GFP_KERNEL under spin lock
	scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
	ipv6_tunnel: Rate limit warning messages
	ARM: 9170/1: fix panic when kasan and kprobe are enabled
	net: fix information leakage in /proc/net/ptype
	hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
	hwmon: (lm90) Mark alert as broken for MAX6680
	ping: fix the sk_bound_dev_if match in ping_lookup
	ipv4: avoid using shared IP generator for connected sockets
	hwmon: (lm90) Reduce maximum conversion rate for G781
	NFSv4: Handle case where the lookup of a directory fails
	NFSv4: nfs_atomic_open() can race when looking up a non-regular file
	net-procfs: show net devices bound packet types
	drm/msm: Fix wrong size calculation
	drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
	drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
	ipv6: annotate accesses to fn->fn_sernum
	NFS: Ensure the server has an up to date ctime before hardlinking
	NFS: Ensure the server has an up to date ctime before renaming
	KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance
	SUNRPC: Use BIT() macro in rpc_show_xprt_state()
	SUNRPC: Don't dereference xprt->snd_task if it's a cookie
	powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
	netfilter: conntrack: don't increment invalid counter on NF_REPEAT
	powerpc/64s: Mask SRR0 before checking against the masked NIP
	perf: Fix perf_event_read_local() time
	sched/pelt: Relax the sync of util_sum with util_avg
	net: phy: broadcom: hook up soft_reset for BCM54616S
	net: stmmac: dwmac-visconti: Fix bit definitions for ETHER_CLK_SEL
	net: stmmac: dwmac-visconti: Fix clock configuration for RMII mode
	phylib: fix potential use-after-free
	octeontx2-af: Do not fixup all VF action entries
	octeontx2-af: Fix LBK backpressure id count
	octeontx2-af: Retry until RVU block reset complete
	octeontx2-pf: cn10k: Ensure valid pointers are freed to aura
	octeontx2-af: verify CQ context updates
	octeontx2-af: Increase link credit restore polling timeout
	octeontx2-af: cn10k: Do not enable RPM loopback for LPC interfaces
	octeontx2-pf: Forward error codes to VF
	rxrpc: Adjust retransmission backoff
	efi/libstub: arm64: Fix image check alignment at entry
	io_uring: fix bug in slow unregistering of nodes
	Drivers: hv: balloon: account for vmbus packet header in max_pkt_size
	hwmon: (lm90) Re-enable interrupts after alert clears
	hwmon: (lm90) Mark alert as broken for MAX6654
	hwmon: (lm90) Fix sysfs and udev notifications
	hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write()
	powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending
	ipv4: fix ip option filtering for locally generated fragments
	ibmvnic: Allow extra failures before disabling
	ibmvnic: init ->running_cap_crqs early
	ibmvnic: don't spin in tasklet
	net/smc: Transitional solution for clcsock race issue
	video: hyperv_fb: Fix validation of screen resolution
	can: tcan4x5x: regmap: fix max register value
	drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
	drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
	drm/msm/a6xx: Add missing suspend_count increment
	yam: fix a memory leak in yam_siocdevprivate()
	net: cpsw: Properly initialise struct page_pool_params
	net: hns3: handle empty unknown interrupt for VF
	sch_htb: Fail on unsupported parameters when offload is requested
	Revert "drm/ast: Support 1600x900 with 108MHz PCLK"
	KVM: selftests: Don't skip L2's VMCALL in SMM test for SVM guest
	ceph: put the requests/sessions when it fails to alloc memory
	gve: Fix GFP flags when allocing pages
	Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
	net: bridge: vlan: fix single net device option dumping
	ipv4: raw: lock the socket in raw_bind()
	ipv4: tcp: send zero IPID in SYNACK messages
	ipv4: remove sparse error in ip_neigh_gw4()
	net: bridge: vlan: fix memory leak in __allowed_ingress
	Bluetooth: refactor malicious adv data check
	irqchip/realtek-rtl: Map control data to virq
	irqchip/realtek-rtl: Fix off-by-one in routing
	dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
	perf/core: Fix cgroup event list management
	psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
	psi: fix "defined but not used" warnings when CONFIG_PROC_FS=n
	usb: dwc3: xilinx: fix uninitialized return value
	usr/include/Makefile: add linux/nfc.h to the compile-test coverage
	fsnotify: invalidate dcache before IN_DELETE event
	block: Fix wrong offset in bio_truncate()
	mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
	Linux 5.15.19

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I66399d45af362fa8e1672ba38c0d672e21afc716
2022-02-02 09:32:24 +01:00
Suren Baghdasaryan d3e4c61e14 psi: Fix uaf issue when psi trigger is destroyed while being polled
commit a06247c6804f1a7c86a2e5398a4c1f1db1471848 upstream.

With write operation on psi files replacing old trigger with a new one,
the lifetime of its waitqueue is totally arbitrary. Overwriting an
existing trigger causes its waitqueue to be freed and pending poll()
will stumble on trigger->event_wait which was destroyed.
Fix this by disallowing to redefine an existing psi trigger. If a write
operation is used on a file descriptor with an already existing psi
trigger, the operation will fail with EBUSY error.
Also bypass a check for psi_disabled in the psi_trigger_destroy as the
flag can be flipped after the trigger is created, leading to a memory
leak.

Fixes: 0e94682b73 ("psi: introduce psi monitor")
Reported-by: syzbot+cdb5dd11c97cc532efad@syzkaller.appspotmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Analyzed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220111232309.1786347-1-surenb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:01 +01:00
Greg Kroah-Hartman 173de0c81d Merge 5.15.14 into android13-5.15
Changes in 5.15.14
	fscache_cookie_enabled: check cookie is valid before accessing it
	selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv()
	tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
	tracing: Tag trace_percpu_buffer as a percpu pointer
	Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow"
	ieee802154: atusb: fix uninit value in atusb_set_extended_addr
	i40e: Fix to not show opcode msg on unsuccessful VF MAC change
	iavf: Fix limit of total number of queues to active queues of VF
	RDMA/core: Don't infoleak GRH fields
	Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo Docks"
	netrom: fix copying in user data in nr_setsockopt
	RDMA/uverbs: Check for null return of kmalloc_array
	mac80211: initialize variable have_higher_than_11mbit
	mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh
	sfc: The RX page_ring is optional
	i40e: fix use-after-free in i40e_sync_filters_subtask()
	i40e: Fix for displaying message regarding NVM version
	i40e: Fix incorrect netdev's real number of RX/TX queues
	ftrace/samples: Add missing prototypes direct functions
	ipv4: Check attribute length for RTA_GATEWAY in multipath route
	ipv4: Check attribute length for RTA_FLOW in multipath route
	ipv6: Check attribute length for RTA_GATEWAY in multipath route
	ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
	lwtunnel: Validate RTA_ENCAP_TYPE attribute length
	selftests: net: udpgro_fwd.sh: explicitly checking the available ping feature
	sctp: hold endpoint before calling cb in sctp_transport_lookup_process
	batman-adv: mcast: don't send link-local multicast to mcast routers
	sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
	net: ena: Fix undefined state when tx request id is out of bounds
	net: ena: Fix wrong rx request id by resetting device
	net: ena: Fix error handling when calculating max IO queues number
	md/raid1: fix missing bitmap update w/o WriteMostly devices
	EDAC/i10nm: Release mdev/mbase when failing to detect HBM
	KVM: x86: Check for rmaps allocation
	cgroup: Use open-time credentials for process migraton perm checks
	cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
	cgroup: Use open-time cgroup namespace for process migration perm checks
	Revert "i2c: core: support bus regulator controlling in adapter"
	i2c: mpc: Avoid out of bounds memory access
	xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
	power: supply: core: Break capacity loop
	power: reset: ltc2952: Fix use of floating point literals
	reset: renesas: Fix Runtime PM usage
	rndis_host: support Hytera digital radios
	gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler
	net ticp:fix a kernel-infoleak in __tipc_sendmsg()
	phonet: refcount leak in pep_sock_accep
	fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb
	drm/amdgpu: disable runpm if we are the primary adapter
	power: bq25890: Enable continuous conversion for ADC at charging
	ipv6: Continue processing multipath route even if gateway attribute is invalid
	ipv6: Do cleanup if attribute validation fails in multipath route
	auxdisplay: charlcd: checking for pointer reference before dereferencing
	drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify
	drm/amd/pm: Fix xgmi link control on aldebaran
	usb: mtu3: fix interval value for intr and isoc
	scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
	ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
	net: udp: fix alignment problem in udp4_seq_show()
	atlantic: Fix buff_ring OOB in aq_ring_rx_clean
	drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume
	drm/amdgpu: always reset the asic in suspend (v2)
	drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform
	mISDN: change function names to avoid conflicts
	drm/amd/display: fix B0 TMDS deepcolor no dislay issue
	drm/amd/display: Added power down for DCN10
	ipv6: raw: check passed optlen before reading
	userfaultfd/selftests: fix hugetlb area allocations
	ARM: dts: gpio-ranges property is now required
	Input: zinitix - make sure the IRQ is allocated before it gets enabled
	Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)"
	drm/amd/pm: keep the BACO feature enabled for suspend
	Linux 5.15.14

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifc22d4db0c3aa2164c4769981847e0634f2ad463
2022-01-12 09:00:42 +01:00
Tejun Heo 43fa0b3639 cgroup: Use open-time cgroup namespace for process migration perm checks
commit e57457641613fef0d147ede8bd6a3047df588b95 upstream.

cgroup process migration permission checks are performed at write time as
whether a given operation is allowed or not is dependent on the content of
the write - the PID. This currently uses current's cgroup namespace which is
a potential security weakness as it may allow scenarios where a less
privileged process tricks a more privileged one into writing into a fd that
it created.

This patch makes cgroup remember the cgroup namespace at the time of open
and uses it for migration permission checks instad of current's. Note that
this only applies to cgroup2 as cgroup1 doesn't have namespace support.

This also fixes a use-after-free bug on cgroupns reported in

 https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com

Note that backporting this fix also requires the preceding patch.

Reported-by: "Eric W. Biederman" <ebiederm@xmission.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Cc: Michal Koutný <mkoutny@suse.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Reported-by: syzbot+50f5cf33a284ce738b62@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com
Fixes: 5136f6365c ("cgroup: implement "nsdelegate" mount option")
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-11 15:35:15 +01:00
Tejun Heo 50273128d6 cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
commit 0d2b5955b36250a9428c832664f2079cbf723bec upstream.

of->priv is currently used by each interface file implementation to store
private information. This patch collects the current two private data usages
into struct cgroup_file_ctx which is allocated and freed by the common path.
This allows generic private data which applies to multiple files, which will
be used to in the following patch.

Note that cgroup_procs iterator is now embedded as procs.iter in the new
cgroup_file_ctx so that it doesn't need to be allocated and freed
separately.

v2: union dropped from cgroup_file_ctx and the procs iterator is embedded in
    cgroup_file_ctx as suggested by Linus.

v3: Michal pointed out that cgroup1's procs pidlist uses of->priv too.
    Converted. Didn't change to embedded allocation as cgroup1 pidlists get
    stored for caching.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-11 15:35:15 +01:00
Tejun Heo c6ebc35298 cgroup: Use open-time credentials for process migraton perm checks
commit 1756d7994ad85c2479af6ae5a9750b92324685af upstream.

cgroup process migration permission checks are performed at write time as
whether a given operation is allowed or not is dependent on the content of
the write - the PID. This currently uses current's credentials which is a
potential security weakness as it may allow scenarios where a less
privileged process tricks a more privileged one into writing into a fd that
it created.

This patch makes both cgroup2 and cgroup1 process migration interfaces to
use the credentials saved at the time of open (file->f_cred) instead of
current's.

Reported-by: "Eric W. Biederman" <ebiederm@xmission.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Fixes: 187fe84067 ("cgroup: require write perm on common ancestor when moving processes on the default hierarchy")
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-11 15:35:15 +01:00
Greg Kroah-Hartman 36de88a855 This is the 5.15.3 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGWmRMACgkQONu9yGCS
 aT6/3w//V4rgBcCq6IEifxZy+taULwzCwPPaXP+9bGSyMtGhZJIhPisssf/T/tVR
 G1rsN/R2gkFoJynAJ+HZ4tm8wADZjv3yMsuPdRdEAYF4QX10nkz5AQ1lPNfxEVEp
 HtC4C8eALVqNcvleGqeHsKI/6bjt83qVTYc+EyrAbUMkXm0rGqB03tYv3RoL3lh9
 ALD/U4PMqXRuPp/LONpNOwDxIfPWP5STf3mXRH5So2lOn58mGy0kitvehdF3A8Qw
 QKzVhQKdQNxJybuKm2asd5i90eRrQFefixulVdBJbean5fIzsVMUhJltwX/tngVI
 7sHrqn3CDpSaFCEPrrdEt0Dfu86IarRieM8WHakxw+joovnI6YyDtS+ZH9WpjnS6
 TR0a7I6C5uVNUl+8z/9BTDZ1hqNa6TZooZFqfWxs55ZlTKPs88jco/WGw0w7M6E+
 PInxZHGgYEO6+ZN5DmMf+7s/ujPAtZhuAwvus4gbOV12FQ3DDZffv9DUkC1yTCpl
 wcP++xRK6U+nKFvQ6/Mi1gmmqfrGLYvjMPi6QpQLuBuhmevsNEjXf7tPPUE4x+ni
 BAvq3NvEMTHVUCHvTwri3iT3ATUH2pd2uXfC9XbstCWpg6CbR0prByzFiYILLDN8
 zkMtAfJcvX3d1d8JKj/ZRZZX3C37XoVxNFeZ9hNhflhPG5kOCHA=
 =T0Hj
 -----END PGP SIGNATURE-----

Merge 5.15.3 into android13-5.15

Changes in 5.15.3
	xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
	usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
	Input: iforce - fix control-message timeout
	Input: elantench - fix misreporting trackpoint coordinates
	Input: i8042 - Add quirk for Fujitsu Lifebook T725
	libata: fix read log timeout value
	ocfs2: fix data corruption on truncate
	scsi: scsi_ioctl: Validate command size
	scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run
	scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd()
	scsi: lpfc: Don't release final kref on Fport node while ABTS outstanding
	scsi: lpfc: Fix FCP I/O flush functionality for TMF routines
	scsi: qla2xxx: Fix crash in NVMe abort path
	scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
	scsi: qla2xxx: Fix use after free in eh_abort path
	ce/gf100: fix incorrect CE0 address calculation on some GPUs
	char: xillybus: fix msg_ep UAF in xillyusb_probe()
	mmc: mtk-sd: Add wait dma stop done flow
	mmc: dw_mmc: Dont wait for DRTO on Write RSP error
	exfat: fix incorrect loading of i_blocks for large files
	io-wq: remove worker to owner tw dependency
	parisc: Fix set_fixmap() on PA1.x CPUs
	parisc: Fix ptrace check on syscall return
	tpm: Check for integer overflow in tpm2_map_response_body()
	firmware/psci: fix application of sizeof to pointer
	crypto: s5p-sss - Add error handling in s5p_aes_probe()
	media: rkvdec: Do not override sizeimage for output format
	media: ite-cir: IR receiver stop working after receive overflow
	media: rkvdec: Support dynamic resolution changes
	media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
	media: v4l2-ioctl: Fix check_ext_ctrls
	ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14
	ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED
	ALSA: hda/realtek: Add quirk for Clevo PC70HS
	ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ
	ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
	ALSA: hda/realtek: Add quirk for ASUS UX550VE
	ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
	ALSA: ua101: fix division by zero at probe
	ALSA: 6fire: fix control and bulk message timeouts
	ALSA: line6: fix control and interrupt message timeouts
	ALSA: mixer: oss: Fix racy access to slots
	ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
	ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk
	ALSA: usb-audio: Add registration quirk for JBL Quantum 400
	ALSA: hda: Free card instance properly at probe errors
	ALSA: synth: missing check for possible NULL after the call to kstrdup
	ALSA: pci: rme: Fix unaligned buffer addresses
	ALSA: PCM: Fix NULL dereference at mmap checks
	ALSA: timer: Fix use-after-free problem
	ALSA: timer: Unconditionally unlink slave instances, too
	Revert "ext4: enforce buffer head state assertion in ext4_da_map_blocks"
	ext4: fix lazy initialization next schedule time computation in more granular unit
	ext4: ensure enough credits in ext4_ext_shift_path_extents
	ext4: refresh the ext4_ext_path struct after dropping i_data_sem.
	fuse: fix page stealing
	x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
	x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
	x86/irq: Ensure PI wakeup handler is unregistered before module unload
	x86/iopl: Fake iopl(3) CLI/STI usage
	btrfs: clear MISSING device status bit in btrfs_close_one_device
	btrfs: fix lost error handling when replaying directory deletes
	btrfs: call btrfs_check_rw_degradable only if there is a missing device
	KVM: x86/mmu: Drop a redundant, broken remote TLB flush
	KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup
	KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
	ia64: kprobes: Fix to pass correct trampoline address to the handler
	selinux: fix race condition when computing ocontext SIDs
	ipmi:watchdog: Set panic count to proper value on a panic
	md/raid1: only allocate write behind bio for WriteMostly device
	hwmon: (pmbus/lm25066) Add offset coefficients
	regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
	regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
	EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
	mwifiex: fix division by zero in fw download path
	ath6kl: fix division by zero in send path
	ath6kl: fix control-message timeout
	ath10k: fix control-message timeout
	ath10k: fix division by zero in send path
	PCI: Mark Atheros QCA6174 to avoid bus reset
	rtl8187: fix control-message timeouts
	evm: mark evm_fixmode as __ro_after_init
	ifb: Depend on netfilter alternatively to tc
	platform/surface: aggregator_registry: Add support for Surface Laptop Studio
	mt76: mt7615: fix skb use-after-free on mac reset
	HID: surface-hid: Use correct event registry for managing HID events
	HID: surface-hid: Allow driver matching for target ID 1 devices
	wcn36xx: Fix HT40 capability for 2Ghz band
	wcn36xx: Fix tx_status mechanism
	wcn36xx: Fix (QoS) null data frame bitrate/modulation
	PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions
	mwifiex: Read a PCI register after writing the TX ring write pointer
	mwifiex: Try waking the firmware until we get an interrupt
	libata: fix checking of DMA state
	dma-buf: fix and rework dma_buf_poll v7
	wcn36xx: handle connection loss indication
	rsi: fix occasional initialisation failure with BT coex
	rsi: fix key enabled check causing unwanted encryption for vap_id > 0
	rsi: fix rate mask set leading to P2P failure
	rsi: Fix module dev_oper_mode parameter description
	perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server
	perf/x86/intel/uncore: Fix invalid unit check
	perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
	RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
	ASoC: tegra: Set default card name for Trimslice
	ASoC: tegra: Restore AC97 support
	signal: Remove the bogus sigkill_pending in ptrace_stop
	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode
	signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
	signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed
	soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE
	soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id
	soc: fsl: dpio: use the combined functions to protect critical zone
	mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines
	mctp: handle the struct sockaddr_mctp padding fields
	power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
	power: supply: max17042_battery: use VFSOC for capacity when no rsns
	iio: core: fix double free in iio_device_unregister_sysfs()
	iio: core: check return value when calling dev_set_name()
	KVM: arm64: Extract ESR_ELx.EC only
	KVM: x86: Fix recording of guest steal time / preempted status
	KVM: x86: Add helper to consolidate core logic of SET_CPUID{2} flows
	KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
	KVM: nVMX: Handle dynamic MSR intercept toggling
	can: peak_usb: always ask for BERR reporting for PCAN-USB devices
	can: mcp251xfd: mcp251xfd_irq(): add missing can_rx_offload_threaded_irq_finish() in case of bus off
	can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
	can: j1939: j1939_can_recv(): ignore messages with invalid source address
	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
	iio: adc: tsc2046: fix scan interval warning
	powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
	io_uring: honour zeroes as io-wq worker limits
	ring-buffer: Protect ring_buffer_reset() from reentrancy
	serial: core: Fix initializing and restoring termios speed
	ifb: fix building without CONFIG_NET_CLS_ACT
	xen/balloon: add late_initcall_sync() for initial ballooning done
	ovl: fix use after free in struct ovl_aio_req
	ovl: fix filattr copy-up failure
	PCI: pci-bridge-emul: Fix emulation of W1C bits
	PCI: cadence: Add cdns_plat_pcie_probe() missing return
	cxl/pci: Fix NULL vs ERR_PTR confusion
	PCI: aardvark: Do not clear status bits of masked interrupts
	PCI: aardvark: Fix checking for link up via LTSSM state
	PCI: aardvark: Do not unmask unused interrupts
	PCI: aardvark: Fix reporting Data Link Layer Link Active
	PCI: aardvark: Fix configuring Reference clock
	PCI: aardvark: Fix return value of MSI domain .alloc() method
	PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
	PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge
	PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
	PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge
	PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge
	quota: check block number when reading the block in quota file
	quota: correct error number in free_dqentry()
	cifs: To match file servers, make sure the server hostname matches
	cifs: set a minimum of 120s for next dns resolution
	mfd: simple-mfd-i2c: Select MFD_CORE to fix build error
	pinctrl: core: fix possible memory leak in pinctrl_enable()
	coresight: cti: Correct the parameter for pm_runtime_put
	coresight: trbe: Fix incorrect access of the sink specific data
	coresight: trbe: Defer the probe on offline CPUs
	iio: buffer: check return value of kstrdup_const()
	iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
	iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
	iio: buffer: Fix memory leak in iio_buffer_register_legacy_sysfs_groups()
	drivers: iio: dac: ad5766: Fix dt property name
	iio: dac: ad5446: Fix ad5622_write() return value
	iio: ad5770r: make devicetree property reading consistent
	Documentation:devicetree:bindings:iio:dac: Fix val
	USB: serial: keyspan: fix memleak on probe errors
	serial: 8250: fix racy uartclk update
	ksmbd: set unique value to volume serial field in FS_VOLUME_INFORMATION
	io-wq: serialize hash clear with wakeup
	serial: 8250: Fix reporting real baudrate value in c_ospeed field
	Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
	most: fix control-message timeouts
	USB: iowarrior: fix control-message timeouts
	USB: chipidea: fix interrupt deadlock
	power: supply: max17042_battery: Clear status bits in interrupt handler
	component: do not leave master devres group open after bind
	dma-buf: WARN on dmabuf release with pending attachments
	drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
	drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
	drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
	Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
	Bluetooth: fix use-after-free error in lock_sock_nested()
	Bluetooth: call sock_hold earlier in sco_conn_del
	drm/panel-orientation-quirks: add Valve Steam Deck
	rcutorture: Avoid problematic critical section nesting on PREEMPT_RT
	platform/x86: wmi: do not fail if disabling fails
	drm/amdgpu: move iommu_resume before ip init/resume
	MIPS: lantiq: dma: add small delay after reset
	MIPS: lantiq: dma: reset correct number of channel
	locking/lockdep: Avoid RCU-induced noinstr fail
	net: sched: update default qdisc visibility after Tx queue cnt changes
	ACPI: resources: Add DMI-based legacy IRQ override quirk
	rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop
	smackfs: Fix use-after-free in netlbl_catmap_walk()
	ath11k: Align bss_chan_info structure with firmware
	crypto: aesni - check walk.nbytes instead of err
	x86/mm/64: Improve stack overflow warnings
	x86: Increase exception stack sizes
	mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
	mwifiex: Properly initialize private structure on interface type changes
	spi: Check we have a spi_device_id for each DT compatible
	fscrypt: allow 256-bit master keys with AES-256-XTS
	drm/amdgpu: Fix MMIO access page fault
	drm/amd/display: Fix null pointer dereference for encoders
	selftests: net: fib_nexthops: Wait before checking reported idle time
	ath11k: Avoid reg rules update during firmware recovery
	ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
	ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets
	ath10k: high latency fixes for beacon buffer
	octeontx2-pf: Enable promisc/allmulti match MCAM entries.
	media: mt9p031: Fix corrupted frame after restarting stream
	media: netup_unidvb: handle interrupt properly according to the firmware
	media: atomisp: Fix error handling in probe
	media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
	media: uvcvideo: Set capability in s_param
	media: uvcvideo: Return -EIO for control errors
	media: uvcvideo: Set unique vdev name based in type
	media: vidtv: Fix memory leak in remove
	media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
	media: s5p-mfc: Add checking to s5p_mfc_probe().
	media: videobuf2: rework vb2_mem_ops API
	media: imx: set a media_device bus_info string
	media: rcar-vin: Use user provided buffers when starting
	media: mceusb: return without resubmitting URB in case of -EPROTO error.
	ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
	rtw88: fix RX clock gate setting while fifo dump
	brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
	media: rcar-csi2: Add checking to rcsi2_start_receiver()
	ipmi: Disable some operations during a panic
	fs/proc/uptime.c: Fix idle time reporting in /proc/uptime
	kselftests/sched: cleanup the child processes
	ACPICA: Avoid evaluating methods too early during system resume
	cpufreq: Make policy min/max hard requirements
	ice: Move devlink port to PF/VF struct
	media: imx-jpeg: Fix possible null pointer dereference
	media: ipu3-imgu: imgu_fmt: Handle properly try
	media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
	media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
	net-sysfs: try not to restart the syscall if it will fail eventually
	drm/amdkfd: rm BO resv on validation to avoid deadlock
	tracefs: Have tracefs directories not set OTH permission bits by default
	tracing: Disable "other" permission bits in the tracefs files
	ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
	KVM: arm64: Propagate errors from __pkvm_prot_finalize hypercall
	mmc: moxart: Fix reference count leaks in moxart_probe
	iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
	ACPI: battery: Accept charges over the design capacity as full
	ACPI: scan: Release PM resources blocked by unused objects
	drm/amd/display: fix null pointer deref when plugging in display
	drm/amdkfd: fix resume error when iommu disabled in Picasso
	net: phy: micrel: make *-skew-ps check more lenient
	leaking_addresses: Always print a trailing newline
	thermal/core: Fix null pointer dereference in thermal_release()
	drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture()
	thermal/drivers/tsens: Add timeout to get_temp_tsens_valid
	block: bump max plugged deferred size from 16 to 32
	floppy: fix calling platform_device_unregister() on invalid drives
	md: update superblock after changing rdev flags in state_store
	memstick: r592: Fix a UAF bug when removing the driver
	locking/rwsem: Disable preemption for spinning region
	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
	lib/xz: Validate the value before assigning it to an enum variable
	workqueue: make sysfs of unbound kworker cpumask more clever
	tracing/cfi: Fix cmp_entries_* functions signature mismatch
	mt76: mt7915: fix an off-by-one bound check
	mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
	iwlwifi: change all JnP to NO-160 configuration
	block: remove inaccurate requeue check
	media: allegro: ignore interrupt if mailbox is not initialized
	drm/amdgpu/pm: properly handle sclk for profiling modes on vangogh
	nvmet: fix use-after-free when a port is removed
	nvmet-rdma: fix use-after-free when a port is removed
	nvmet-tcp: fix use-after-free when a port is removed
	nvme: drop scan_lock and always kick requeue list when removing namespaces
	samples/bpf: Fix application of sizeof to pointer
	arm64: vdso32: suppress error message for 'make mrproper'
	PM: hibernate: Get block device exclusively in swsusp_check()
	selftests: kvm: fix mismatched fclose() after popen()
	selftests/bpf: Fix perf_buffer test on system with offline cpus
	iwlwifi: mvm: disable RX-diversity in powersave
	smackfs: use __GFP_NOFAIL for smk_cipso_doi()
	ARM: clang: Do not rely on lr register for stacktrace
	gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
	can: bittiming: can_fixup_bittiming(): change type of tseg1 and alltseg to unsigned int
	gfs2: Cancel remote delete work asynchronously
	gfs2: Fix glock_hash_walk bugs
	ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
	tools/latency-collector: Use correct size when writing queue_full_warning
	vrf: run conntrack only in context of lower/physdev for locally generated packets
	net: annotate data-race in neigh_output()
	ACPI: AC: Quirk GK45 to skip reading _PSR
	ACPI: resources: Add one more Medion model in IRQ override quirk
	btrfs: reflink: initialize return value to 0 in btrfs_extent_same()
	btrfs: do not take the uuid_mutex in btrfs_rm_device
	spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
	wcn36xx: Correct band/freq reporting on RX
	wcn36xx: Fix packet drop on resume
	Revert "wcn36xx: Enable firmware link monitoring"
	ftrace: do CPU checking after preemption disabled
	inet: remove races in inet{6}_getname()
	x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
	drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled
	selftests/core: fix conflicting types compile error for close_range()
	perf/x86/intel: Fix ICL/SPR INST_RETIRED.PREC_DIST encodings
	parisc: fix warning in flush_tlb_all
	task_stack: Fix end_of_stack() for architectures with upwards-growing stack
	erofs: don't trigger WARN() when decompression fails
	parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
	parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
	netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state
	selftests/bpf: Fix strobemeta selftest regression
	fbdev/efifb: Release PCI device's runtime PM ref during FB destroy
	drm/bridge: anx7625: Propagate errors from sp_tx_rst_aux()
	perf/x86/intel/uncore: Fix Intel SPR CHA event constraints
	perf/x86/intel/uncore: Fix Intel SPR IIO event constraints
	perf/x86/intel/uncore: Fix Intel SPR M2PCIE event constraints
	perf/x86/intel/uncore: Fix Intel SPR M3UPI event constraints
	drm/bridge: it66121: Initialize {device,vendor}_ids
	drm/bridge: it66121: Wait for next bridge to be probed
	Bluetooth: fix init and cleanup of sco_conn.timeout_work
	libbpf: Don't crash on object files with no symbol tables
	Bluetooth: hci_uart: fix GPF in h5_recv
	rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
	MIPS: lantiq: dma: fix burst length for DEU
	x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
	objtool: Handle __sanitize_cov*() tail calls
	net/mlx5: Publish and unpublish all devlink parameters at once
	drm/v3d: fix wait for TMU write combiner flush
	crypto: sm4 - Do not change section of ck and sbox
	virtio-gpu: fix possible memory allocation failure
	lockdep: Let lock_is_held_type() detect recursive read as read
	net: net_namespace: Fix undefined member in key_remove_domain()
	net: phylink: don't call netif_carrier_off() with NULL netdev
	drm: bridge: it66121: Fix return value it66121_probe
	spi: Fixed division by zero warning
	cgroup: Make rebind_subsystems() disable v2 controllers all at once
	wcn36xx: Fix Antenna Diversity Switching
	wilc1000: fix possible memory leak in cfg_scan_result()
	Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
	drm/amdgpu: Fix crash on device remove/driver unload
	drm/amd/display: Pass display_pipe_params_st as const in DML
	drm/amdgpu: move amdgpu_virt_release_full_gpu to fini_early stage
	crypto: caam - disable pkc for non-E SoCs
	crypto: qat - power up 4xxx device
	Bluetooth: hci_h5: Fix (runtime)suspend issues on RTL8723BS HCIs
	bnxt_en: Check devlink allocation and registration status
	qed: Don't ignore devlink allocation failures
	rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
	mptcp: do not shrink snd_nxt when recovering
	fortify: Fix dropped strcpy() compile-time write overflow check
	mac80211: twt: don't use potentially unaligned pointer
	cfg80211: always free wiphy specific regdomain
	net/mlx5: Accept devlink user input after driver initialization complete
	net: dsa: rtl8366rb: Fix off-by-one bug
	net: dsa: rtl8366: Fix a bug in deleting VLANs
	bpf/tests: Fix error in tail call limit tests
	ath11k: fix some sleeping in atomic bugs
	ath11k: Avoid race during regd updates
	ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status
	ath11k: Fix memory leak in ath11k_qmi_driver_event_work
	gve: DQO: avoid unused variable warnings
	ath10k: Fix missing frame timestamp for beacon/probe-resp
	ath10k: sdio: Add missing BH locking around napi_schdule()
	drm/ttm: stop calling tt_swapin in vm_access
	arm64: mm: update max_pfn after memory hotplug
	drm/amdgpu: fix warning for overflow check
	libbpf: Fix skel_internal.h to set errno on loader retval < 0
	media: em28xx: add missing em28xx_close_extension
	media: meson-ge2d: Fix rotation parameter changes detection in 'ge2d_s_ctrl()'
	media: cxd2880-spi: Fix a null pointer dereference on error handling path
	media: ttusb-dec: avoid release of non-acquired mutex
	media: dvb-usb: fix ununit-value in az6027_rc_query
	media: imx258: Fix getting clock frequency
	media: v4l2-ioctl: S_CTRL output the right value
	media: mtk-vcodec: venc: fix return value when start_streaming fails
	media: TDA1997x: handle short reads of hdmi info frame.
	media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
	media: imx-jpeg: Fix the error handling path of 'mxc_jpeg_probe()'
	media: i2c: ths8200 needs V4L2_ASYNC
	media: sun6i-csi: Allow the video device to be open multiple times
	media: radio-wl1273: Avoid card name truncation
	media: si470x: Avoid card name truncation
	media: tm6000: Avoid card name truncation
	media: cx23885: Fix snd_card_free call on null card pointer
	media: atmel: fix the ispck initialization
	scs: Release kasan vmalloc poison in scs_free process
	kprobes: Do not use local variable when creating debugfs file
	crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
	drm: fb_helper: fix CONFIG_FB dependency
	cpuidle: Fix kobject memory leaks in error paths
	media: em28xx: Don't use ops->suspend if it is NULL
	ath10k: Don't always treat modem stop events as crashes
	ath9k: Fix potential interrupt storm on queue reset
	PM: EM: Fix inefficient states detection
	x86/insn: Use get_unaligned() instead of memcpy()
	EDAC/amd64: Handle three rank interleaving mode
	rcu: Always inline rcu_dynticks_task*_{enter,exit}()
	rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr
	netfilter: nft_dynset: relax superfluous check on set updates
	media: venus: fix vpp frequency calculation for decoder
	media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
	crypto: ccree - avoid out-of-range warnings from clang
	crypto: qat - detect PFVF collision after ACK
	crypto: qat - disregard spurious PFVF interrupts
	hwrng: mtk - Force runtime pm ops for sleep ops
	ima: fix deadlock when traversing "ima_default_rules".
	b43legacy: fix a lower bounds test
	b43: fix a lower bounds test
	gve: Recover from queue stall due to missed IRQ
	gve: Track RX buffer allocation failures
	mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
	mmc: sdhci-omap: Fix context restore
	memstick: avoid out-of-range warning
	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
	net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
	hwmon: Fix possible memleak in __hwmon_device_register()
	hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
	ath10k: fix max antenna gain unit
	kernel/sched: Fix sched_fork() access an invalid sched_task_group
	net: fealnx: fix build for UML
	net: intel: igc_ptp: fix build for UML
	net: tulip: winbond-840: fix build for UML
	tcp: switch orphan_count to bare per-cpu counters
	crypto: octeontx2 - set assoclen in aead_do_fallback()
	thermal/core: fix a UAF bug in __thermal_cooling_device_register()
	drm/msm/dsi: do not enable irq handler before powering up the host
	drm/msm: Fix potential Oops in a6xx_gmu_rpmh_init()
	drm/msm: potential error pointer dereference in init()
	drm/msm: unlock on error in get_sched_entity()
	drm/msm: fix potential NULL dereference in cleanup
	drm/msm: uninitialized variable in msm_gem_import()
	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
	thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM
	mailbox: Remove WARN_ON for async_cb.cb in cmdq_exec_done
	media: ivtv: fix build for UML
	media: ir_toy: assignment to be16 should be of correct type
	mmc: mxs-mmc: disable regulator on error and in the remove function
	io-wq: Remove duplicate code in io_workqueue_create()
	block: ataflop: fix breakage introduced at blk-mq refactoring
	blk-wbt: prevent NULL pointer dereference in wb_timer_fn
	platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
	mailbox: mtk-cmdq: Validate alias_id on probe
	mailbox: mtk-cmdq: Fix local clock ID usage
	ACPI: PM: Turn off unused wakeup power resources
	ACPI: PM: Fix sharing of wakeup power resources
	drm/amdkfd: Fix an inappropriate error handling in allloc memory of gpu
	mt76: mt7921: fix endianness in mt7921_mcu_tx_done_event
	mt76: mt7915: fix endianness warning in mt7915_mac_add_txs_skb
	mt76: mt7921: fix endianness warning in mt7921_update_txs
	mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi
	mt76: mt7915: fix info leak in mt7915_mcu_set_pre_cal()
	mt76: connac: fix mt76_connac_gtk_rekey_tlv usage
	mt76: fix build error implicit enumeration conversion
	mt76: mt7921: fix survey-dump reporting
	mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
	mt76: mt7921: Fix out of order process by invalid event pkt
	mt76: mt7915: fix potential overflow of eeprom page index
	mt76: mt7915: fix bit fields for HT rate idx
	mt76: mt7921: fix dma hang in rmmod
	mt76: connac: fix GTK rekey offload failure on WPA mixed mode
	mt76: overwrite default reg_ops if necessary
	mt76: mt7921: report HE MU radiotap
	mt76: mt7921: fix firmware usage of RA info using legacy rates
	mt76: mt7921: fix kernel warning from cfg80211_calculate_bitrate
	mt76: mt7921: always wake device if necessary in debugfs
	mt76: mt7915: fix hwmon temp sensor mem use-after-free
	mt76: mt7615: fix hwmon temp sensor mem use-after-free
	mt76: mt7915: fix possible infinite loop release semaphore
	mt76: mt7921: fix retrying release semaphore without end
	mt76: mt7615: fix monitor mode tear down crash
	mt76: connac: fix possible NULL pointer dereference in mt76_connac_get_phy_mode_v2
	mt76: mt7915: fix sta_rec_wtbl tag len
	mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req()
	rsi: stop thread firstly in rsi_91x_init() error handling
	mwifiex: Send DELBA requests according to spec
	iwlwifi: mvm: reset PM state on unsuccessful resume
	iwlwifi: pnvm: don't kmemdup() more than we have
	iwlwifi: pnvm: read EFI data only if long enough
	net: enetc: unmap DMA in enetc_send_cmd()
	phy: micrel: ksz8041nl: do not use power down mode
	nbd: Fix use-after-free in pid_show
	nvme-rdma: fix error code in nvme_rdma_setup_ctrl
	PM: hibernate: fix sparse warnings
	clocksource/drivers/timer-ti-dm: Select TIMER_OF
	x86/sev: Fix stack type check in vc_switch_off_ist()
	drm/msm: Fix potential NULL dereference in DPU SSPP
	drm/msm/dsi: fix wrong type in msm_dsi_host
	crypto: tcrypt - fix skcipher multi-buffer tests for 1420B blocks
	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
	KVM: selftests: Fix nested SVM tests when built with clang
	libbpf: Fix memory leak in btf__dedup()
	bpftool: Avoid leaking the JSON writer prepared for program metadata
	libbpf: Fix overflow in BTF sanity checks
	libbpf: Fix BTF header parsing checks
	mt76: mt7615: mt7622: fix ibss and meshpoint
	s390/gmap: validate VMA in __gmap_zap()
	s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
	s390/mm: validate VMA in PGSTE manipulation functions
	s390/mm: fix VMA and page table handling code in storage key handling functions
	s390/uv: fully validate the VMA before calling follow_page()
	KVM: s390: pv: avoid double free of sida page
	KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm
	irq: mips: avoid nested irq_enter()
	net: dsa: avoid refcount warnings when ->port_{fdb,mdb}_del returns error
	ARM: 9142/1: kasan: work around LPAE build warning
	ath10k: fix module load regression with iram-recovery feature
	block: ataflop: more blk-mq refactoring fixes
	blk-cgroup: synchronize blkg creation against policy deactivation
	libbpf: Fix off-by-one bug in bpf_core_apply_relo()
	tpm: fix Atmel TPM crash caused by too frequent queries
	tpm_tis_spi: Add missing SPI ID
	libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED()
	tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
	tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks
	cpufreq: intel_pstate: Fix cpu->pstate.turbo_freq initialization
	spi: spi-rpc-if: Check return value of rpcif_sw_init()
	samples/kretprobes: Fix return value if register_kretprobe() failed
	KVM: s390: Fix handle_sske page fault handling
	libertas_tf: Fix possible memory leak in probe and disconnect
	libertas: Fix possible memory leak in probe and disconnect
	wcn36xx: add proper DMA memory barriers in rx path
	wcn36xx: Fix discarded frames due to wrong sequence number
	bpf: Avoid races in __bpf_prog_run() for 32bit arches
	bpf: Fixes possible race in update_prog_stats() for 32bit arches
	wcn36xx: Channel list update before hardware scan
	drm/amdgpu: fix a potential memory leak in amdgpu_device_fini_sw()
	drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
	selftests/bpf: Fix fd cleanup in sk_lookup test
	selftests/bpf: Fix memory leak in test_ima
	sctp: allow IP fragmentation when PLPMTUD enters Error state
	sctp: reset probe_timer in sctp_transport_pl_update
	sctp: subtract sctphdr len in sctp_transport_pl_hlen
	sctp: return true only for pathmtu update in sctp_transport_pl_toobig
	net: amd-xgbe: Toggle PLL settings during rate change
	ipmi: kcs_bmc: Fix a memory leak in the error handling path of 'kcs_bmc_serio_add_device()'
	nfp: fix NULL pointer access when scheduling dim work
	nfp: fix potential deadlock when canceling dim work
	net: phylink: avoid mvneta warning when setting pause parameters
	net: bridge: fix uninitialized variables when BRIDGE_CFM is disabled
	selftests: net: bridge: update IGMP/MLD membership interval value
	crypto: pcrypt - Delay write to padata->info
	selftests/bpf: Fix fclose/pclose mismatch in test_progs
	udp6: allow SO_MARK ctrl msg to affect routing
	ibmvnic: don't stop queue in xmit
	ibmvnic: Process crqs after enabling interrupts
	ibmvnic: delay complete()
	selftests: mptcp: fix proto type in link_failure tests
	skmsg: Lose offset info in sk_psock_skb_ingress
	cgroup: Fix rootcg cpu.stat guest double counting
	bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
	bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.
	of: unittest: fix EXPECT text for gpio hog errors
	cpufreq: Fix parameter in parse_perf_domain()
	staging: r8188eu: fix memory leak in rtw_set_key
	arm64: dts: meson: sm1: add Ethernet PHY reset line for ODROID-C4/HC4
	iio: st_sensors: disable regulators after device unregistration
	RDMA/rxe: Fix wrong port_cap_flags
	ARM: dts: BCM5301X: Fix memory nodes names
	arm64: dts: broadcom: bcm4908: Fix UART clock name
	clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
	scsi: pm80xx: Fix lockup in outbound queue management
	scsi: qla2xxx: edif: Use link event to wake up app
	scsi: lpfc: Fix NVMe I/O failover to non-optimized path
	ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
	arm64: dts: rockchip: Fix GPU register width for RK3328
	ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
	RDMA/bnxt_re: Fix query SRQ failure
	arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes
	arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: ti: j7200-main: Fix "vendor-id"/"device-id" properties of pcie node
	arm64: dts: ti: j7200-main: Fix "bus-range" upto 256 bus number for PCIe
	arm64: dts: meson-g12a: Fix the pwm regulator supply properties
	arm64: dts: meson-g12b: Fix the pwm regulator supply properties
	arm64: dts: meson-sm1: Fix the pwm regulator supply properties
	bus: ti-sysc: Fix timekeeping_suspended warning on resume
	ARM: dts: at91: tse850: the emac<->phy interface is rmii
	arm64: dts: qcom: sc7180: Base dynamic CPU power coefficients in reality
	soc: qcom: llcc: Disable MMUHWT retention
	arm64: dts: qcom: sc7280: fix display port phy reg property
	scsi: dc395: Fix error case unwinding
	MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
	JFS: fix memleak in jfs_mount
	pinctrl: renesas: rzg2l: Fix missing port register 21h
	ASoC: wcd9335: Use correct version to initialize Class H
	arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock
	arm64: dts: renesas: beacon: Fix Ethernet PHY mode
	iommu/mediatek: Fix out-of-range warning with clang
	arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000
	iommu/dma: Fix sync_sg with swiotlb
	iommu/dma: Fix arch_sync_dma for map
	ALSA: hda: Reduce udelay() at SKL+ position reporting
	ALSA: hda: Use position buffer for SKL+ again
	ALSA: usb-audio: Fix possible race at sync of urb completions
	soundwire: debugfs: use controller id and link_id for debugfs
	power: reset: at91-reset: check properly the return value of devm_of_iomap
	scsi: ufs: core: Fix ufshcd_probe_hba() prototype to match the definition
	scsi: ufs: core: Stop clearing UNIT ATTENTIONS
	scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt
	scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp()
	driver core: Fix possible memory leak in device_link_add()
	arm: dts: omap3-gta04a4: accelerometer irq fix
	ASoC: SOF: topology: do not power down primary core during topology removal
	iio: st_pressure_spi: Add missing entries SPI to device ID table
	soc/tegra: Fix an error handling path in tegra_powergate_power_up()
	memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
	clk: at91: check pmc node status before registering syscore ops
	powerpc/mem: Fix arch/powerpc/mm/mem.c:53:12: error: no previous prototype for 'create_section_mapping'
	video: fbdev: chipsfb: use memset_io() instead of memset()
	powerpc: fix unbalanced node refcount in check_kvm_guest()
	powerpc/paravirt: correct preempt debug splat in vcpu_is_preempted()
	serial: 8250_dw: Drop wrong use of ACPI_PTR()
	usb: gadget: hid: fix error code in do_config()
	power: supply: rt5033_battery: Change voltage values to µV
	power: supply: max17040: fix null-ptr-deref in max17040_probe()
	scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
	RDMA/mlx4: Return missed an error if device doesn't support steering
	usb: musb: select GENERIC_PHY instead of depending on it
	staging: most: dim2: do not double-register the same device
	staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
	RDMA/core: Set sgtable nents when using ib_dma_virt_map_sg()
	dyndbg: make dyndbg a known cli param
	powerpc/perf: Fix cycles/instructions as PM_CYC/PM_INST_CMPL in power10
	pinctrl: renesas: checker: Fix off-by-one bug in drive register check
	ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz
	ARM: dts: stm32: fix STUSB1600 Type-C irq level on stm32mp15xx-dkx
	ARM: dts: stm32: fix SAI sub nodes register range
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	ASoC: cs42l42: Always configure both ASP TX channels
	ASoC: cs42l42: Correct some register default values
	ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
	soc: qcom: rpmhpd: Make power_on actually enable the domain
	soc: qcom: socinfo: add two missing PMIC IDs
	iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()
	usb: typec: STUSB160X should select REGMAP_I2C
	iio: adis: do not disabe IRQs in 'adis_init()'
	soundwire: bus: stop dereferencing invalid slave pointer
	scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
	scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset
	serial: imx: fix detach/attach of serial console
	usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init
	usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled
	usb: dwc2: drd: reset current session before setting the new one
	powerpc/booke: Disable STRICT_KERNEL_RWX, DEBUG_PAGEALLOC and KFENCE
	usb: dwc3: gadget: Skip resizing EP's TX FIFO if already resized
	firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available()
	soc: qcom: rpmhpd: fix sm8350_mxc's peer domain
	soc: qcom: apr: Add of_node_put() before return
	arm64: dts: qcom: pmi8994: Fix "eternal"->"external" typo in WLED node
	arm64: dts: qcom: sdm845: Use RPMH_CE_CLK macro directly
	arm64: dts: qcom: sdm845: Fix Qualcomm crypto engine bus clock
	pinctrl: equilibrium: Fix function addition in multiple groups
	ASoC: topology: Fix stub for snd_soc_tplg_component_remove()
	phy: qcom-qusb2: Fix a memory leak on probe
	phy: ti: gmii-sel: check of_get_address() for failure
	phy: qcom-qmp: another fix for the sc8180x PCIe definition
	phy: qcom-snps: Correct the FSEL_MASK
	phy: Sparx5 Eth SerDes: Fix return value check in sparx5_serdes_probe()
	serial: xilinx_uartps: Fix race condition causing stuck TX
	clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL
	clk: at91: clk-master: check if div or pres is zero
	clk: at91: clk-master: fix prescaler logic
	HID: u2fzero: clarify error check and length calculations
	HID: u2fzero: properly handle timeouts in usb_submit_urb
	powerpc/nohash: Fix __ptep_set_access_flags() and ptep_set_wrprotect()
	powerpc/book3e: Fix set_memory_x() and set_memory_nx()
	powerpc/44x/fsp2: add missing of_node_put
	powerpc/xmon: fix task state output
	ALSA: oxfw: fix functional regression for Mackie Onyx 1640i in v5.14 or later
	iommu/dma: Fix incorrect error return on iommu deferred attach
	powerpc: Don't provide __kernel_map_pages() without ARCH_SUPPORTS_DEBUG_PAGEALLOC
	ASoC: cs42l42: Correct configuring of switch inversion from ts-inv
	RDMA/hns: Fix initial arm_st of CQ
	RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility
	ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()'
	serial: cpm_uart: Protect udbg definitions by CONFIG_SERIAL_CPM_CONSOLE
	virtio_ring: check desc == NULL when using indirect with packed
	vdpa/mlx5: Fix clearing of VIRTIO_NET_F_MAC feature bit
	mips: cm: Convert to bitfield API to fix out-of-bounds access
	power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
	RDMA/core: Require the driver to set the IOVA correctly during rereg_mr
	apparmor: fix error check
	rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
	mtd: rawnand: intel: Fix potential buffer overflow in probe
	nfsd: don't alloc under spinlock in rpc_parse_scope_id
	rtc: ds1302: Add SPI ID table
	rtc: ds1390: Add SPI ID table
	rtc: pcf2123: Add SPI ID table
	remoteproc: imx_rproc: Fix TCM io memory type
	i2c: i801: Use PCI bus rescan mutex to protect P2SB access
	dmaengine: idxd: move out percpu_ref_exit() to ensure it's outside submission
	rtc: mcp795: Add SPI ID table
	Input: ariel-pwrbutton - add SPI device ID table
	i2c: mediatek: fixing the incorrect register offset
	NFS: Default change_attr_type to NFS4_CHANGE_TYPE_IS_UNDEFINED
	NFS: Don't set NFS_INO_DATA_INVAL_DEFER and NFS_INO_INVALID_DATA
	NFS: Ignore the directory size when marking for revalidation
	NFS: Fix dentry verifier races
	pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
	drm/bridge/lontium-lt9611uxc: fix provided connector suport
	drm/plane-helper: fix uninitialized variable reference
	PCI: aardvark: Don't spam about PIO Response Status
	PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
	opp: Fix return in _opp_add_static_v2()
	NFS: Fix deadlocks in nfs_scan_commit_list()
	sparc: Add missing "FORCE" target when using if_changed
	fs: orangefs: fix error return code of orangefs_revalidate_lookup()
	Input: st1232 - increase "wait ready" timeout
	drm/bridge: nwl-dsi: Add atomic_get_input_bus_fmts
	mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
	PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation
	mtd: rawnand: arasan: Prevent an unsupported configuration
	mtd: core: don't remove debugfs directory if device is in use
	remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()'
	rtc: rv3032: fix error handling in rv3032_clkout_set_rate()
	dmaengine: at_xdmac: call at_xdmac_axi_config() on resume path
	dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
	dmaengine: stm32-dma: fix stm32_dma_get_max_width
	NFS: Fix up commit deadlocks
	NFS: Fix an Oops in pnfs_mark_request_commit()
	Fix user namespace leak
	auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
	auxdisplay: ht16k33: Connect backlight to fbdev
	auxdisplay: ht16k33: Fix frame buffer device blanking
	soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read
	netfilter: nfnetlink_queue: fix OOB when mac header was cleared
	dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
	dmaengine: tegra210-adma: fix pm runtime unbalance
	dmanegine: idxd: fix resource free ordering on driver removal
	dmaengine: idxd: reconfig device after device reset command
	signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
	m68k: set a default value for MEMORY_RESERVE
	watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
	ar7: fix kernel builds for compiler test
	scsi: target: core: Remove from tmr_list during LUN unlink
	scsi: qla2xxx: Relogin during fabric disturbance
	scsi: qla2xxx: Fix gnl list corruption
	scsi: qla2xxx: Turn off target reset during issue_lip
	scsi: qla2xxx: edif: Fix app start fail
	scsi: qla2xxx: edif: Fix app start delay
	scsi: qla2xxx: edif: Flush stale events and msgs on session down
	scsi: qla2xxx: edif: Increase ELS payload
	scsi: qla2xxx: edif: Fix EDIF bsg
	NFSv4: Fix a regression in nfs_set_open_stateid_locked()
	dmaengine: idxd: fix resource leak on dmaengine driver disable
	i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
	gpio: realtek-otto: fix GPIO line IRQ offset
	xen-pciback: Fix return in pm_ctrl_init()
	nbd: fix max value for 'first_minor'
	nbd: fix possible overflow for 'first_minor' in nbd_dev_add()
	io-wq: fix max-workers not correctly set on multi-node system
	net: davinci_emac: Fix interrupt pacing disable
	kselftests/net: add missed icmp.sh test to Makefile
	kselftests/net: add missed setup_loopback.sh/setup_veth.sh to Makefile
	kselftests/net: add missed SRv6 tests
	kselftests/net: add missed vrf_strict_mode_test.sh test to Makefile
	kselftests/net: add missed toeplitz.sh/toeplitz_client.sh to Makefile
	ethtool: fix ethtool msg len calculation for pause stats
	openrisc: fix SMP tlb flush NULL pointer dereference
	net: vlan: fix a UAF in vlan_dev_real_dev()
	net: dsa: felix: fix broken VLAN-tagged PTP under VLAN-aware bridge
	ice: Fix replacing VF hardware MAC to existing MAC filter
	ice: Fix not stopping Tx queues for VFs
	kdb: Adopt scheduler's task classification
	ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
	PCI: j721e: Fix j721e_pcie_probe() error path
	nvdimm/btt: do not call del_gendisk() if not needed
	scsi: bsg: Fix errno when scsi_bsg_register_queue() fails
	scsi: ufs: ufshpb: Use proper power management API
	scsi: ufs: core: Fix NULL pointer dereference
	scsi: ufs: ufshpb: Properly handle max-single-cmd
	selftests: net: properly support IPv6 in GSO GRE test
	drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
	nvdimm/pmem: cleanup the disk if pmem_release_disk() is yet assigned
	block/ataflop: use the blk_cleanup_disk() helper
	block/ataflop: add registration bool before calling del_gendisk()
	block/ataflop: provide a helper for cleanup up an atari disk
	ataflop: remove ataflop_probe_lock mutex
	PCI: Do not enable AtomicOps on VFs
	cpufreq: intel_pstate: Clear HWP desired on suspend/shutdown and offline
	net: phy: fix duplex out of sync problem while changing settings
	block: fix device_add_disk() kobject_create_and_add() error handling
	drm/ttm: remove ttm_bo_vm_insert_huge()
	bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
	octeontx2-pf: select CONFIG_NET_DEVLINK
	ALSA: memalloc: Catch call with NULL snd_dma_buffer pointer
	mfd: core: Add missing of_node_put for loop iteration
	mfd: cpcap: Add SPI device ID table
	mfd: sprd: Add SPI device ID table
	mfd: altera-sysmgr: Fix a mistake caused by resource_size conversion
	ACPI: PM: Fix device wakeup power reference counting error
	libbpf: Fix lookup_and_delete_elem_flags error reporting
	selftests/bpf/xdp_redirect_multi: Put the logs to tmp folder
	selftests/bpf/xdp_redirect_multi: Use arping to accurate the arp number
	selftests/bpf/xdp_redirect_multi: Give tcpdump a chance to terminate cleanly
	selftests/bpf/xdp_redirect_multi: Limit the tests in netns
	drm: fb_helper: improve CONFIG_FB dependency
	Revert "drm/imx: Annotate dma-fence critical section in commit path"
	drm/amdgpu/powerplay: fix sysfs_emit/sysfs_emit_at handling
	can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
	can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable()
	mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
	zram: off by one in read_block_state()
	perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
	llc: fix out-of-bound array index in llc_sk_dev_hash()
	nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
	litex_liteeth: Fix a double free in the remove function
	arm64: arm64_ftr_reg->name may not be a human-readable string
	arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
	bpf, sockmap: Remove unhash handler for BPF sockmap usage
	bpf, sockmap: Fix race in ingress receive verdict with redirect to self
	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
	bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg
	dmaengine: stm32-dma: fix burst in case of unaligned memory address
	dmaengine: stm32-dma: avoid 64-bit division in stm32_dma_get_max_width
	gve: Fix off by one in gve_tx_timeout()
	drm/i915/fb: Fix rounding error in subsampled plane size calculation
	init: make unknown command line param message clearer
	seq_file: fix passing wrong private data
	drm/amdgpu: fix uvd crash on Polaris12 during driver unloading
	net: dsa: mv88e6xxx: Don't support >1G speeds on 6191X on ports other than 10
	net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
	net: hns3: fix ROCE base interrupt vector initialization bug
	net: hns3: fix pfc packet number incorrect after querying pfc parameters
	net: hns3: fix kernel crash when unload VF while it is being reset
	net: hns3: allow configure ETS bandwidth of all TCs
	net: stmmac: allow a tc-taprio base-time of zero
	net: ethernet: ti: cpsw_ale: Fix access to un-initialized memory
	net: marvell: mvpp2: Fix wrong SerDes reconfiguration order
	vsock: prevent unnecessary refcnt inc for nonblocking connect
	net/smc: fix sk_refcnt underflow on linkdown and fallback
	cxgb4: fix eeprom len when diagnostics not implemented
	selftests/net: udpgso_bench_rx: fix port argument
	thermal: int340x: fix build on 32-bit targets
	smb3: do not error on fsync when readonly
	ARM: 9155/1: fix early early_iounmap()
	ARM: 9156/1: drop cc-option fallbacks for architecture selection
	parisc: Fix backtrace to always include init funtion names
	parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
	MIPS: fix duplicated slashes for Platform file path
	MIPS: fix *-pkg builds for loongson2ef platform
	MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
	x86/mce: Add errata workaround for Skylake SKX37
	PCI/MSI: Move non-mask check back into low level accessors
	PCI/MSI: Destroy sysfs before freeing entries
	KVM: x86: move guest_pv_has out of user_access section
	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()
	irqchip/sifive-plic: Fixup EOI failed when masked
	f2fs: should use GFP_NOFS for directory inodes
	f2fs: include non-compressed blocks in compr_written_block
	f2fs: fix UAF in f2fs_available_free_memory
	ceph: fix mdsmap decode when there are MDS's beyond max_mds
	erofs: fix unsafe pagevec reuse of hooked pclusters
	drm/i915/guc: Fix blocked context accounting
	block: Hold invalidate_lock in BLKDISCARD ioctl
	block: Hold invalidate_lock in BLKZEROOUT ioctl
	block: Hold invalidate_lock in BLKRESETZONE ioctl
	ksmbd: Fix buffer length check in fsctl_validate_negotiate_info()
	ksmbd: don't need 8byte alignment for request length in ksmbd_check_message
	dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail
	dmaengine: ti: k3-udma: Set r/tchan or rflow to NULL if request fail
	dmaengine: bestcomm: fix system boot lockups
	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
	9p/net: fix missing error check in p9_check_errors
	mm/filemap.c: remove bogus VM_BUG_ON
	memcg: prohibit unconditional exceeding the limit of dying tasks
	mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
	mm, oom: do not trigger out_of_memory from the #PF
	mm, thp: lock filemap when truncating page cache
	mm, thp: fix incorrect unmap behavior for private pages
	mfd: dln2: Add cell for initializing DLN2 ADC
	video: backlight: Drop maximum brightness override for brightness zero
	bcache: fix use-after-free problem in bcache_device_free()
	bcache: Revert "bcache: use bvec_virt"
	PM: sleep: Avoid calling put_device() under dpm_list_mtx
	s390/cpumf: cpum_cf PMU displays invalid value after hotplug remove
	s390/cio: check the subchannel validity for dev_busid
	s390/tape: fix timer initialization in tape_std_assign()
	s390/ap: Fix hanging ioctl caused by orphaned replies
	s390/cio: make ccw_device_dma_* more robust
	remoteproc: elf_loader: Fix loading segment when is_iomem true
	remoteproc: Fix the wrong default value of is_iomem
	remoteproc: imx_rproc: Fix ignoring mapping vdev regions
	remoteproc: imx_rproc: Fix rsc-table name
	mtd: rawnand: fsmc: Fix use of SM ORDER
	mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines
	mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines
	powerpc/vas: Fix potential NULL pointer dereference
	powerpc/bpf: Fix write protecting JIT code
	powerpc/32e: Ignore ESR in instruction storage interrupt handler
	powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
	powerpc/security: Use a mutex for interrupt exit code patching
	powerpc/64s/interrupt: Fix check_return_regs_valid() false positive
	powerpc/pseries/mobility: ignore ibm, platform-facilities updates
	powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n
	drm/sun4i: Fix macros in sun8i_csc.h
	PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
	PCI: aardvark: Fix PCIe Max Payload Size setting
	SUNRPC: Partial revert of commit 6f9f17287e
	drm/amd/display: Look at firmware version to determine using dmub on dcn21
	media: vidtv: move kfree(dvb) to vidtv_bridge_dev_release()
	cifs: fix memory leak of smb3_fs_context_dup::server_hostname
	ath10k: fix invalid dma_addr_t token assignment
	mmc: moxart: Fix null pointer dereference on pointer host
	selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage
	selftests/bpf: Fix also no-alu32 strobemeta selftest
	arch/cc: Introduce a function to check for confidential computing features
	x86/sev: Add an x86 version of cc_platform_has()
	x86/sev: Make the #VC exception stacks part of the default stacks storage
	media: videobuf2: always set buffer vb2 pointer
	media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
	Linux 5.15.3

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I09574eb6b4fbe930bd13f932cc618846972fcc27
2021-11-19 15:38:07 +01:00
Dan Schatzberg e3acd3a084 cgroup: Fix rootcg cpu.stat guest double counting
[ Upstream commit 81c49d39aea8a10e6d05d3aa1cb65ceb721e19b0 ]

In account_guest_time in kernel/sched/cputime.c guest time is
attributed to both CPUTIME_NICE and CPUTIME_USER in addition to
CPUTIME_GUEST_NICE and CPUTIME_GUEST respectively. Therefore, adding
both to calculate usage results in double counting any guest time at
the rootcg.

Fixes: 936f2a70f2 ("cgroup: add cpu.stat file to root cgroup")
Signed-off-by: Dan Schatzberg <schatzberg.dan@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 19:16:45 +01:00
Waiman Long 26d3bf38ae cgroup: Make rebind_subsystems() disable v2 controllers all at once
[ Upstream commit 7ee285395b211cad474b2b989db52666e0430daf ]

It was found that the following warning was displayed when remounting
controllers from cgroup v2 to v1:

[ 8042.997778] WARNING: CPU: 88 PID: 80682 at kernel/cgroup/cgroup.c:3130 cgroup_apply_control_disable+0x158/0x190
   :
[ 8043.091109] RIP: 0010:cgroup_apply_control_disable+0x158/0x190
[ 8043.096946] Code: ff f6 45 54 01 74 39 48 8d 7d 10 48 c7 c6 e0 46 5a a4 e8 7b 67 33 00 e9 41 ff ff ff 49 8b 84 24 e8 01 00 00 0f b7 40 08 eb 95 <0f> 0b e9 5f ff ff ff 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3
[ 8043.115692] RSP: 0018:ffffba8a47c23d28 EFLAGS: 00010202
[ 8043.120916] RAX: 0000000000000036 RBX: ffffffffa624ce40 RCX: 000000000000181a
[ 8043.128047] RDX: ffffffffa63c43e0 RSI: ffffffffa63c43e0 RDI: ffff9d7284ee1000
[ 8043.135180] RBP: ffff9d72874c5800 R08: ffffffffa624b090 R09: 0000000000000004
[ 8043.142314] R10: ffffffffa624b080 R11: 0000000000002000 R12: ffff9d7284ee1000
[ 8043.149447] R13: ffff9d7284ee1000 R14: ffffffffa624ce70 R15: ffffffffa6269e20
[ 8043.156576] FS:  00007f7747cff740(0000) GS:ffff9d7a5fc00000(0000) knlGS:0000000000000000
[ 8043.164663] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8043.170409] CR2: 00007f7747e96680 CR3: 0000000887d60001 CR4: 00000000007706e0
[ 8043.177539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8043.184673] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8043.191804] PKRU: 55555554
[ 8043.194517] Call Trace:
[ 8043.196970]  rebind_subsystems+0x18c/0x470
[ 8043.201070]  cgroup_setup_root+0x16c/0x2f0
[ 8043.205177]  cgroup1_root_to_use+0x204/0x2a0
[ 8043.209456]  cgroup1_get_tree+0x3e/0x120
[ 8043.213384]  vfs_get_tree+0x22/0xb0
[ 8043.216883]  do_new_mount+0x176/0x2d0
[ 8043.220550]  __x64_sys_mount+0x103/0x140
[ 8043.224474]  do_syscall_64+0x38/0x90
[ 8043.228063]  entry_SYSCALL_64_after_hwframe+0x44/0xae

It was caused by the fact that rebind_subsystem() disables
controllers to be rebound one by one. If more than one disabled
controllers are originally from the default hierarchy, it means that
cgroup_apply_control_disable() will be called multiple times for the
same default hierarchy. A controller may be killed by css_kill() in
the first round. In the second round, the killed controller may not be
completely dead yet leading to the warning.

To avoid this problem, we collect all the ssid's of controllers that
needed to be disabled from the default hierarchy and then disable them
in one go instead of one by one.

Fixes: 334c3679ec ("cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 19:16:24 +01:00
Greg Kroah-Hartman d1a66e7942 Linux 5.15
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmF/AjYeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiG1hkIAJ6sFDbvb4M4LMwf
 Slh2NVL9o5sLMBDzVwnVlyMSKDbMn1WBKreGssaLgZjGDc74lxsdSmw5l9MZm0JN
 xlq95Q6XFiuu+0qDHPWwfDz3JFO4TqW2ZLLPWk9NnkNbRXqccSrlVRi1RpgE1t3/
 NUtS8CQLu6A2BYMc6mkk3aV6IwSNKOkWbM5eBHSvU4j8B6lLbNQop0AfO/wyY1xB
 U6LiVE1RpN/b7Yv+75ITtNzuHzVIBx6305FvSnOlKbMKKvIClt96Vd2OeuoEkK+6
 wGU8JraB1+fc0GckAhynNrjWQWdvi0MAhFWWEJxjS20OGcV1rXDduNfkVNauO1Zn
 +dNyJ3s=
 =g9fz
 -----END PGP SIGNATURE-----

Merge tag 'v5.15' into android-mainline

Linux 5.15

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I81d96ada6b66bcf73d192ddde9018f1804e7d90b
2021-11-01 07:40:54 +01:00
Quanyang Wang 04f8ef5643 cgroup: Fix memory leak caused by missing cgroup_bpf_offline
When enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running
the command as below:

    $mount -t cgroup -o none,name=foo cgroup cgroup/
    $umount cgroup/

unreferenced object 0xc3585c40 (size 64):
  comm "mount", pid 425, jiffies 4294959825 (age 31.990s)
  hex dump (first 32 bytes):
    01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00  ......(.........
    00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00  ........lC......
  backtrace:
    [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c
    [<1f03679c>] cgroup_setup_root+0x174/0x37c
    [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0
    [<f85b12fd>] vfs_get_tree+0x24/0x108
    [<f55aec5c>] path_mount+0x384/0x988
    [<e2d5e9cd>] do_mount+0x64/0x9c
    [<208c9cfe>] sys_mount+0xfc/0x1f4
    [<06dd06e0>] ret_fast_syscall+0x0/0x48
    [<a8308cb3>] 0xbeb4daa8

This is because that since the commit 2b0d3d3e4f ("percpu_ref: reduce
memory footprint of percpu_ref in fast path") root_cgrp->bpf.refcnt.data
is allocated by the function percpu_ref_init in cgroup_bpf_inherit which
is called by cgroup_setup_root when mounting, but not freed along with
root_cgrp when umounting. Adding cgroup_bpf_offline which calls
percpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in
umount path.

This patch also fixes the commit 4bfc0bb2c6 ("bpf: decouple the lifetime
of cgroup_bpf from cgroup itself"). A cgroup_bpf_offline is needed to do a
cleanup that frees the resources which are allocated by cgroup_bpf_inherit
in cgroup_setup_root.

And inside cgroup_bpf_offline, cgroup_get() is at the beginning and
cgroup_put is at the end of cgroup_bpf_release which is called by
cgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of
cgroup's refcount.

Fixes: 2b0d3d3e4f ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
Fixes: 4bfc0bb2c6 ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself")
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20211018075623.26884-1-quanyang.wang@windriver.com
2021-10-22 17:23:54 -07:00
Greg Kroah-Hartman 8861ab35bc Merge f4d0cc426f ("Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux") into android-mainline
Steps on the way to 5.15-rc6

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I14a7282d4eb0640786f799e1e20e99454a32d846
2021-10-14 08:48:32 +02:00
Pavankumar Kondeti d4f032e36b ANDROID: cgroup: Add android_rvh_cgroup_force_kthread_migration
In Android GKI, CONFIG_FAIR_GROUP_SCHED is enabled [1] to help
prioritize important work. Given that CPU shares of root cgroup
can't be changed, leaving the tasks inside root cgroup will give
them higher share compared to the other tasks inside important
cgroups. This is mitigated by moving all tasks inside root cgroup to
a different cgroup after Android is booted. However, there are many
kernel tasks stuck in the root cgroup after the boot.

It is possible to relax kernel threads and kworkers migrations under
certain scenarios. However the patch [2] posted at upstream is not
accepted. Hence add a restricted vendor hook to notify modules when a
kernel thread is requested for cgroup migration. The modules can relax
the restrictions forced by the kernel and allow the cgroup migration.

[1] f08f049de1
[2] https://lore.kernel.org/lkml/1617714261-18111-1-git-send-email-pkondeti@codeaurora.org

Bug: 184594949
Change-Id: I445a170ba797c8bece3b4b59b7a42cdd85438f1f
Signed-off-by: Pavankumar Kondeti <quic_pkondeti@quicinc.com>
Signed-off-by: Shaleen Agrawal <shalagra@codeaurora.org>
2021-10-12 16:44:41 -07:00
Linus Torvalds 459ea72c6c Merge branch 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
 "All documentation / comment updates"

* 'for-5.15-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroupv2, docs: fix misinformation in "device controller" section
  cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem
  docs/cgroup: remove some duplicate words
2021-10-11 17:16:41 -07:00
Greg Kroah-Hartman 33b3f9797b Merge 7b66f4393a ("Merge tag 'hwmon-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging") into android-mainline
Steps on the way to 5.15-rc4

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If5015a5b66f89e6cb22c50b42f8567c586891968
2021-10-03 14:57:24 +02:00
Daniel Borkmann 78cc316e95 bpf, cgroup: Assign cgroup in cgroup_sk_alloc when called from interrupt
If cgroup_sk_alloc() is called from interrupt context, then just assign the
root cgroup to skcd->cgroup. Prior to commit 8520e224f5 ("bpf, cgroups:
Fix cgroup v2 fallback on v1/v2 mixed mode") we would just return, and later
on in sock_cgroup_ptr(), we were NULL-testing the cgroup in fast-path, and
iff indeed NULL returning the root cgroup (v ?: &cgrp_dfl_root.cgrp). Rather
than re-adding the NULL-test to the fast-path we can just assign it once from
cgroup_sk_alloc() given v1/v2 handling has been simplified. The migration from
NULL test with returning &cgrp_dfl_root.cgrp to assigning &cgrp_dfl_root.cgrp
directly does /not/ change behavior for callers of sock_cgroup_ptr().

syzkaller was able to trigger a splat in the legacy netrom code base, where
the RX handler in nr_rx_frame() calls nr_make_new() which calls sk_alloc()
and therefore cgroup_sk_alloc() with in_interrupt() condition. Thus the NULL
skcd->cgroup, where it trips over on cgroup_sk_free() side given it expects
a non-NULL object. There are a few other candidates aside from netrom which
have similar pattern where in their accept-like implementation, they just call
to sk_alloc() and thus cgroup_sk_alloc() instead of sk_clone_lock() with the
corresponding cgroup_sk_clone() which then inherits the cgroup from the parent
socket. None of them are related to core protocols where BPF cgroup programs
are running from. However, in future, they should follow to implement a similar
inheritance mechanism.

Additionally, with a !CONFIG_CGROUP_NET_PRIO and !CONFIG_CGROUP_NET_CLASSID
configuration, the same issue was exposed also prior to 8520e224f5 due to
commit e876ecc67d ("cgroup: memcg: net: do not associate sock with unrelated
cgroup") which added the early in_interrupt() return back then.

Fixes: 8520e224f5 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode")
Fixes: e876ecc67d ("cgroup: memcg: net: do not associate sock with unrelated cgroup")
Reported-by: syzbot+df709157a4ecaf192b03@syzkaller.appspotmail.com
Reported-by: syzbot+533f389d4026d86a2a95@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: syzbot+df709157a4ecaf192b03@syzkaller.appspotmail.com
Tested-by: syzbot+533f389d4026d86a2a95@syzkaller.appspotmail.com
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/bpf/20210927123921.21535-1-daniel@iogearbox.net
2021-09-28 09:29:19 +02:00
Greg Kroah-Hartman d47c37b3c1 Merge bdb575f872 ("Merge tag 'drm-fixes-2021-09-17' of git://anongit.freedesktop.org/drm/drm") into android-mainline
Steps on the way to 5.15-rc2

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id7ae8fe00ef75a10c28b62553ee8cf42a6db5729
2021-09-18 16:07:33 +02:00
Greg Kroah-Hartman c2b303f98f Merge 4e71add028 ("Merge branch 'stable/for-linus-5.15-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft") into android-mainline
Steps on the way to 5.15-rc1

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib3f181326491eb896547d802a6f0a1b3be54ce28
2021-09-14 14:35:23 +02:00
David S. Miller 2865ba8247 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says:

====================
pull-request: bpf 2021-09-14

The following pull-request contains BPF updates for your *net* tree.

We've added 7 non-merge commits during the last 13 day(s) which contain
a total of 18 files changed, 334 insertions(+), 193 deletions(-).

The main changes are:

1) Fix mmap_lock lockdep splat in BPF stack map's build_id lookup, from Yonghong Song.

2) Fix BPF cgroup v2 program bypass upon net_cls/prio activation, from Daniel Borkmann.

3) Fix kvcalloc() BTF line info splat on oversized allocation attempts, from Bixuan Cui.

4) Fix BPF selftest build of task_pt_regs test for arm64/s390, from Jean-Philippe Brucker.

5) Fix BPF's disasm.{c,h} to dual-license so that it is aligned with bpftool given the former
   is a build dependency for the latter, from Daniel Borkmann with ACKs from contributors.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2021-09-14 13:09:54 +01:00
Daniel Borkmann 8520e224f5 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
Fix cgroup v1 interference when non-root cgroup v2 BPF programs are used.
Back in the days, commit bd1060a1d6 ("sock, cgroup: add sock->sk_cgroup")
embedded per-socket cgroup information into sock->sk_cgrp_data and in order
to save 8 bytes in struct sock made both mutually exclusive, that is, when
cgroup v1 socket tagging (e.g. net_cls/net_prio) is used, then cgroup v2
falls back to the root cgroup in sock_cgroup_ptr() (&cgrp_dfl_root.cgrp).

The assumption made was "there is no reason to mix the two and this is in line
with how legacy and v2 compatibility is handled" as stated in bd1060a1d6.
However, with Kubernetes more widely supporting cgroups v2 as well nowadays,
this assumption no longer holds, and the possibility of the v1/v2 mixed mode
with the v2 root fallback being hit becomes a real security issue.

Many of the cgroup v2 BPF programs are also used for policy enforcement, just
to pick _one_ example, that is, to programmatically deny socket related system
calls like connect(2) or bind(2). A v2 root fallback would implicitly cause
a policy bypass for the affected Pods.

In production environments, we have recently seen this case due to various
circumstances: i) a different 3rd party agent and/or ii) a container runtime
such as [0] in the user's environment configuring legacy cgroup v1 net_cls
tags, which triggered implicitly mentioned root fallback. Another case is
Kubernetes projects like kind [1] which create Kubernetes nodes in a container
and also add cgroup namespaces to the mix, meaning programs which are attached
to the cgroup v2 root of the cgroup namespace get attached to a non-root
cgroup v2 path from init namespace point of view. And the latter's root is
out of reach for agents on a kind Kubernetes node to configure. Meaning, any
entity on the node setting cgroup v1 net_cls tag will trigger the bypass
despite cgroup v2 BPF programs attached to the namespace root.

Generally, this mutual exclusiveness does not hold anymore in today's user
environments and makes cgroup v2 usage from BPF side fragile and unreliable.
This fix adds proper struct cgroup pointer for the cgroup v2 case to struct
sock_cgroup_data in order to address these issues; this implicitly also fixes
the tradeoffs being made back then with regards to races and refcount leaks
as stated in bd1060a1d6, and removes the fallback, so that cgroup v2 BPF
programs always operate as expected.

  [0] https://github.com/nestybox/sysbox/
  [1] https://kind.sigs.k8s.io/

Fixes: bd1060a1d6 ("sock, cgroup: add sock->sk_cgroup")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/bpf/20210913230759.2313-1-daniel@iogearbox.net
2021-09-13 16:35:58 -07:00
Waiman Long b94f9ac79a cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem
Since commit 1243dc518c ("cgroup/cpuset: Convert cpuset_mutex to
percpu_rwsem"), cpuset_mutex has been replaced by cpuset_rwsem which is
a percpu rwsem. However, the comments in kernel/cgroup/cpuset.c still
reference cpuset_mutex which are now incorrect.

Change all the references of cpuset_mutex to cpuset_rwsem.

Fixes: 1243dc518c ("cgroup/cpuset: Convert cpuset_mutex to percpu_rwsem")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-09-13 08:06:17 -10:00
Greg Kroah-Hartman bc2f6edebd Merge 9e9fb7655e ("Merge tag 'net-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") into android-mainline
Steps on the way to 5.15-rc1

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I49577d606b2710975407eae3fee60bc331397810
2021-09-07 14:40:30 +02:00
Linus Torvalds 14726903c8 Merge branch 'akpm' (patches from Andrew)
Merge misc updates from Andrew Morton:
 "173 patches.

  Subsystems affected by this series: ia64, ocfs2, block, and mm (debug,
  pagecache, gup, swap, shmem, memcg, selftests, pagemap, mremap,
  bootmem, sparsemem, vmalloc, kasan, pagealloc, memory-failure,
  hugetlb, userfaultfd, vmscan, compaction, mempolicy, memblock,
  oom-kill, migration, ksm, percpu, vmstat, and madvise)"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (173 commits)
  mm/madvise: add MADV_WILLNEED to process_madvise()
  mm/vmstat: remove unneeded return value
  mm/vmstat: simplify the array size calculation
  mm/vmstat: correct some wrong comments
  mm/percpu,c: remove obsolete comments of pcpu_chunk_populated()
  selftests: vm: add COW time test for KSM pages
  selftests: vm: add KSM merging time test
  mm: KSM: fix data type
  selftests: vm: add KSM merging across nodes test
  selftests: vm: add KSM zero page merging test
  selftests: vm: add KSM unmerge test
  selftests: vm: add KSM merge test
  mm/migrate: correct kernel-doc notation
  mm: wire up syscall process_mrelease
  mm: introduce process_mrelease system call
  memblock: make memblock_find_in_range method private
  mm/mempolicy.c: use in_task() in mempolicy_slab_node()
  mm/mempolicy: unify the create() func for bind/interleave/prefer-many policies
  mm/mempolicy: advertise new MPOL_PREFERRED_MANY
  mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY
  ...
2021-09-03 10:08:28 -07:00
Vasily Averin 30acd0bdfb memcg: enable accounting for new namesapces and struct nsproxy
Container admin can create new namespaces and force kernel to allocate up
to several pages of memory for the namespaces and its associated
structures.

Net and uts namespaces have enabled accounting for such allocations.  It
makes sense to account for rest ones to restrict the host's memory
consumption from inside the memcg-limited container.

Link: https://lkml.kernel.org/r/5525bcbf-533e-da27-79b7-158686c64e13@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Jeff Layton <jlayton@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Yutian Yang <nglaive@gmail.com>
Cc: Zefan Li <lizefan.x@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-09-03 09:58:12 -07:00
Greg Kroah-Hartman 506f6a3567 Merge 5d3c0db459 ("Merge tag 'sched-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip") into android-mainline
Steps on the way to 5.15-rc1.

Resolves merge conflicts with:
	kernel/fork.c
	kernel/sched/core.c

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I73e7bfc310639dae4ca5df7b63d47fa32a171760
2021-09-02 11:02:37 +02:00
Linus Torvalds 69dc8010b8 Merge branch 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup updates from Tejun Heo:
 "Two cpuset behavior changes:

   - cpuset on cgroup2 is changed to enable memory migration based on
     nodemask by default.

   - A notification is generated when cpuset partition state changes.

  All other patches are minor fixes and cleanups"

* 'for-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: Avoid compiler warnings with no subsystems
  cgroup/cpuset: Avoid memory migration when nodemasks match
  cgroup/cpuset: Enable memory migration for cpuset v2
  cgroup/cpuset: Enable event notification when partition state changes
  cgroup: cgroup-v1: clean up kernel-doc notation
  cgroup: Replace deprecated CPU-hotplug functions.
  cgroup/cpuset: Fix violation of cpuset locking rule
  cgroup/cpuset: Fix a partition bug with hotplug
  cgroup/cpuset: Miscellaneous code cleanup
  cgroup: remove cgroup_mount from comments
2021-08-31 15:49:04 -07:00
Linus Torvalds 5d3c0db459 Scheduler changes for v5.15 are:
- The biggest change in this cycle is scheduler support for asymmetric
   scheduling affinity, to support the execution of legacy 32-bit tasks on
   AArch32 systems that also have 64-bit-only CPUs.
 
   Architectures can fill in this functionality by defining their
   own task_cpu_possible_mask(p). When this is done, the scheduler will
   make sure the task will only be scheduled on CPUs that support it.
 
   (The actual arm64 specific changes are not part of this tree.)
 
   For other architectures there will be no change in functionality.
 
 - Add cgroup SCHED_IDLE support
 
 - Increase node-distance flexibility & delay determining it until a CPU
   is brought online. (This enables platforms where node distance isn't
   final until the CPU is only.)
 
 - Deadline scheduler enhancements & fixes
 
 - Misc fixes & cleanups.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmEsrDgRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gMxBAAmzXPnDm1pDBBUaEwc+DynNGHNxZcBO5E
 CaNyfywp4GMA+OC3JzUgDg1B9uvKQRdBGtv6SZ8OcyhJMfmkEvjt5/wYUrcdtQVP
 TA2lt80/Is8LQMnvcz7X0gmsLt+fXWQTF8ik1KT4wsi/k03Xw8BH11zHct6sV2QN
 NNQ+7BEjqU1HA1UXJFiaoGtWF0gdh29VyE5dSzfAis79L0XUQadS512LJKin/AK0
 wYz8E+L7QIrjhfX9FQdOrR6da4TK6jAXyEY6a9dpaMHnFdtxuwhT4/BPtovNTeeY
 yxEZm3qSZbpghWHsMEa6Z4GIeLE6aNi3wcHt10fgdZDdotSRsNZuF6gi4A8nhRC+
 6wm+fCcFGEIBCL6eE/16Wms6YMdFfuiEAgtJGNy7GGyfH3/mS6u8eylXbLZncYXn
 DFHY+xUvmVZSzoPzcnYXEy4FB3kywNL7WBFxyhdXf5/EvWmmtHi4K3jVQ8jaqvhL
 MDk3NX9Hd0ariff3zUltWhMY5ouj6bIbBZmWWnD3s1xQT68VvE563cq0qH15dlnr
 j5M71eNRWvoOdZKzflgjRZzmdQtsZQ51tiMA6W6ZRfwYkHjb70qiia0r5GFf41X1
 MYelmcaA8+RjKrQ5etxzzDjoXl0xDXiZric6gRQHjG1Y1Zm2rVaoD+vkJGD5TQJ0
 2XTOGQgAxh4=
 =VdGE
 -----END PGP SIGNATURE-----

Merge tag 'sched-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler updates from Ingo Molnar:

 - The biggest change in this cycle is scheduler support for asymmetric
   scheduling affinity, to support the execution of legacy 32-bit tasks
   on AArch32 systems that also have 64-bit-only CPUs.

   Architectures can fill in this functionality by defining their own
   task_cpu_possible_mask(p). When this is done, the scheduler will make
   sure the task will only be scheduled on CPUs that support it.

   (The actual arm64 specific changes are not part of this tree.)

   For other architectures there will be no change in functionality.

 - Add cgroup SCHED_IDLE support

 - Increase node-distance flexibility & delay determining it until a CPU
   is brought online. (This enables platforms where node distance isn't
   final until the CPU is only.)

 - Deadline scheduler enhancements & fixes

 - Misc fixes & cleanups.

* tag 'sched-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits)
  eventfd: Make signal recursion protection a task bit
  sched/fair: Mark tg_is_idle() an inline in the !CONFIG_FAIR_GROUP_SCHED case
  sched: Introduce dl_task_check_affinity() to check proposed affinity
  sched: Allow task CPU affinity to be restricted on asymmetric systems
  sched: Split the guts of sched_setaffinity() into a helper function
  sched: Introduce task_struct::user_cpus_ptr to track requested affinity
  sched: Reject CPU affinity changes based on task_cpu_possible_mask()
  cpuset: Cleanup cpuset_cpus_allowed_fallback() use in select_fallback_rq()
  cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus()
  cpuset: Don't use the cpu_possible_mask as a last resort for cgroup v1
  sched: Introduce task_cpu_possible_mask() to limit fallback rq selection
  sched: Cgroup SCHED_IDLE support
  sched/topology: Skip updating masks for non-online nodes
  sched: Replace deprecated CPU-hotplug functions.
  sched: Skip priority checks with SCHED_FLAG_KEEP_PARAMS
  sched: Fix UCLAMP_FLAG_IDLE setting
  sched/deadline: Fix missing clock update in migrate_task_rq_dl()
  sched/fair: Avoid a second scan of target in select_idle_cpu
  sched/fair: Use prev instead of new target as recent_used_cpu
  sched: Don't report SCHED_FLAG_SUGOV in sched_getattr()
  ...
2021-08-30 13:42:10 -07:00
Kees Cook d20d30ebb1 cgroup: Avoid compiler warnings with no subsystems
As done before in commit cb4a316752 ("cgroup: use bitmask to filter
for_each_subsys"), avoid compiler warnings for the pathological case of
having no subsystems (i.e. CGROUP_SUBSYS_COUNT == 0). This condition is
hit for the arm multi_v7_defconfig config under -Wzero-length-bounds:

In file included from ./arch/arm/include/generated/asm/rwonce.h:1,
                 from include/linux/compiler.h:264,
                 from include/uapi/linux/swab.h:6,
                 from include/linux/swab.h:5,
                 from arch/arm/include/asm/opcodes.h:86,
                 from arch/arm/include/asm/bug.h:7,
                 from include/linux/bug.h:5,
                 from include/linux/thread_info.h:13,
                 from include/asm-generic/current.h:5,
                 from ./arch/arm/include/generated/asm/current.h:1,
                 from include/linux/sched.h:12,
                 from include/linux/cgroup.h:12,
                 from kernel/cgroup/cgroup-internal.h:5,
                 from kernel/cgroup/cgroup.c:31:
kernel/cgroup/cgroup.c: In function 'of_css':
kernel/cgroup/cgroup.c:651:42: warning: array subscript '<unknown>' is outside the bounds of an
interior zero-length array 'struct cgroup_subsys_state *[0]' [-Wzero-length-bounds]
  651 |   return rcu_dereference_raw(cgrp->subsys[cft->ss->id]);

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Tejun Heo <tj@kernel.org>
Cc: Zefan Li <lizefan.x@bytedance.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: cgroups@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-30 07:36:43 -10:00
Nicolas Saenz Julienne 9f72daf7ed cgroup/cpuset: Avoid memory migration when nodemasks match
With the introduction of ee9707e859 ("cgroup/cpuset: Enable memory
migration for cpuset v2") attaching a process to a different cgroup will
trigger a memory migration regardless of whether it's really needed.
Memory migration is an expensive operation, so bypass it if the
nodemasks passed to cpuset_migrate_mm() are equal.

Note that we're not only avoiding the migration work itself, but also a
call to lru_cache_disable(), which triggers and flushes an LRU drain
work on every online CPU.

Signed-off-by: Nicolas Saenz Julienne <nsaenzju@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-25 06:51:51 -10:00
Will Deacon 97c0054dbe cpuset: Cleanup cpuset_cpus_allowed_fallback() use in select_fallback_rq()
select_fallback_rq() only needs to recheck for an allowed CPU if the
affinity mask of the task has changed since the last check.

Return a 'bool' from cpuset_cpus_allowed_fallback() to indicate whether
the affinity mask was updated, and use this to elide the allowed check
when the mask has been left alone.

No functional change.

Suggested-by: Valentin Schneider <valentin.schneider@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lore.kernel.org/r/20210730112443.23245-5-will@kernel.org
2021-08-20 12:32:59 +02:00
Will Deacon 431c69fac0 cpuset: Honour task_cpu_possible_mask() in guarantee_online_cpus()
Asymmetric systems may not offer the same level of userspace ISA support
across all CPUs, meaning that some applications cannot be executed by
some CPUs. As a concrete example, upcoming arm64 big.LITTLE designs do
not feature support for 32-bit applications on both clusters.

Modify guarantee_online_cpus() to take task_cpu_possible_mask() into
account when trying to find a suitable set of online CPUs for a given
task. This will avoid passing an invalid mask to set_cpus_allowed_ptr()
during ->attach() and will subsequently allow the cpuset hierarchy to be
taken into account when forcefully overriding the affinity mask for a
task which requires migration to a compatible CPU.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <Valentin.Schneider@arm.com>
Link: https://lkml.kernel.org/r/20210730112443.23245-4-will@kernel.org
2021-08-20 12:32:59 +02:00
Will Deacon d4b96fb92a cpuset: Don't use the cpu_possible_mask as a last resort for cgroup v1
If the scheduler cannot find an allowed CPU for a task,
cpuset_cpus_allowed_fallback() will widen the affinity to cpu_possible_mask
if cgroup v1 is in use.

In preparation for allowing architectures to provide their own fallback
mask, just return early if we're either using cgroup v1 or we're using
cgroup v2 with a mask that contains invalid CPUs. This will allow
select_fallback_rq() to figure out the mask by itself.

Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Quentin Perret <qperret@google.com>
Link: https://lkml.kernel.org/r/20210730112443.23245-3-will@kernel.org
2021-08-20 12:32:58 +02:00
Lee Jones eba773ab53 Revert "Revert "CHROMIUM: cgroups: relax permissions on moving tasks between cgroups""
This reverts commit 631c0bba0a.

Although this boots and passes CI build/boot testing, it leaves a
dirty trail consisting of 1000's of failures in the log and probably
wouldn't function all that well on a real H/W platform.

  08-16 12:20:13.003   658   697 E libprocessgroup: AddTidToCgroup failed to write '3138'; fd=121: Permission denied
  08-16 12:20:13.003   658   697 E libprocessgroup: Failed to add task into cgroup

Change-Id: Ia0f1948b0e94c27e5cecae8691348e044b32f7d6
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2021-08-16 14:50:30 +01:00
Lee Jones 631c0bba0a Revert "CHROMIUM: cgroups: relax permissions on moving tasks between cgroups"
This reverts commit a88f616760.

After some recent discussions, it transpires that this is no longer
required.

Bug: 31790445
Change-Id: I3ec80e21e192caa9e62715d450036e8565a21509
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2021-08-16 12:53:58 +01:00
Lee Jones ab4d4efea8 Linux 5.14-rc6
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmEZpgUeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGhf8H/0RTjPIqTkHU4chH
 QDMbFGzW3AtUhll6UQXKtkU/WoaIV673PUfqBepn9kSYpB4U3gV69foh/yiRhR9K
 YgnVb8uO8xMVKSUi2GUjD4hc1Yyey7+S8a+uzTFtyfVv3p7j2+HKJ/sYz3jKshdC
 2QajP2YuAD4l86yMs3+Oxy92gwFJnVqw596YsvDk4pq0bIV9XZy/AyTw0I3ipPvl
 UMCUTMRTv2rX8YHS+nadWrmZlPCKcWeBxIzfbayl51Z1jkIx95QPic2bkDqXJDRS
 SPij10Nkugr4OpSF4H2KUVOo7IdKzCbH4/Fsk786xxSoiRHcZcX6Ja9l2NcL2rW0
 eSNmDb4=
 =gwko
 -----END PGP SIGNATURE-----

Merge tag 'v5.14-rc6' into android-mainline

Linux 5.14-rc6

Change-Id: I2a11e448621a8133f80acbc241a1851d33bc38fb
Signed-off-by: Lee Jones <lee.jones@linaro.org>
2021-08-16 09:30:23 +01:00
Waiman Long ee9707e859 cgroup/cpuset: Enable memory migration for cpuset v2
When a user changes cpuset.cpus, each task in a v2 cpuset will be moved
to one of the new cpus if it is not there already. For memory, however,
they won't be migrated to the new nodes when cpuset.mems changes. This is
an inconsistency in behavior.

In cpuset v1, there is a memory_migrate control file to enable such
behavior by setting the CS_MEMORY_MIGRATE flag. Make it the default
for cpuset v2 so that we have a consistent set of behavior for both
cpus and memory.

There is certainly a cost to make memory migration the default, but it
is a one time cost that shouldn't really matter as long as cpuset.mems
isn't changed frequenty.  Update the cgroup-v2.rst file to document the
new behavior and recommend against changing cpuset.mems frequently.

Since there won't be any concurrent access to the newly allocated cpuset
structure in cpuset_css_alloc(), we can use the cheaper non-atomic
__set_bit() instead of the more expensive atomic set_bit().

Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-12 11:40:20 -10:00
Waiman Long e7cc9888dc cgroup/cpuset: Enable event notification when partition state changes
A valid cpuset partition can become invalid if all its CPUs are offlined
or somehow removed. This can happen through external events without
"cpuset.cpus.partition" being touched at all.

Users that rely on the property of a partition being present do not
currently have a simple way to get such an event notified other than
constant periodic polling which is both inefficient and cumbersome.

To make life easier for those users, event notification is now enabled
for "cpuset.cpus.partition" whenever its state changes.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-11 08:04:43 -10:00
Randy Dunlap b4cc619608 cgroup: cgroup-v1: clean up kernel-doc notation
Fix kernel-doc warnings found in cgroup-v1.c:

kernel/cgroup/cgroup-v1.c:55: warning: No description found for return value of 'cgroup_attach_task_all'
kernel/cgroup/cgroup-v1.c:94: warning: expecting prototype for cgroup_trasnsfer_tasks(). Prototype was for cgroup_transfer_tasks() instead
cgroup-v1.c:96: warning: No description found for return value of 'cgroup_transfer_tasks'
kernel/cgroup/cgroup-v1.c:687: warning: No description found for return value of 'cgroupstats_build'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Zefan Li <lizefan.x@bytedance.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: cgroups@vger.kernel.org
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-11 07:57:43 -10:00
Sebastian Andrzej Siewior c5c63b9a6a cgroup: Replace deprecated CPU-hotplug functions.
The functions get_online_cpus() and put_online_cpus() have been
deprecated during the CPU hotplug rework. They map directly to
cpus_read_lock() and cpus_read_unlock().

Replace deprecated CPU-hotplug functions with the official version.
The behavior remains unchanged.

Cc: Zefan Li <lizefan.x@bytedance.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: cgroups@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Tejun Heo <tj@kernel.org>
2021-08-09 12:53:35 -10:00