On Mon, 27 Jul 2020 at 11:24, Ezequiel Garcia
wrote:
>
> On Mon, 27 Jul 2020 at 06:06, Alexandre Courbot wrote:
> >
> > On Thu, Jul 23, 2020 at 6:23 AM Ezequiel Garcia
> > wrote:
> > >
> > > On Mon, 13 Jul 2020 at 03:09, Alexandre Courbot
> > > wrote:
> > > >
> > > > From: Yunfei Dong
> > > >
From: Muchun Song
commit d38a2b7a9c939e6d7329ab92b96559ccebf7b135 upstream.
If the kmem_cache refcount is greater than one, we should not mark the
root kmem_cache as dying. If we mark the root kmem_cache dying
incorrectly, the non-root kmem_cache can never be destroyed. It
resulted in memory l
From: Qi Liu
[ Upstream commit f32ed8eb0e3f0d0ef4ddb854554d60ca5863a9f9 ]
Forcefully unbinding PMU drivers during perf sampling will lead to
a kernel panic, because the perf upper-layer framework call a NULL
pointer in this situation.
To solve this issue, "suppress_bind_attrs" should be set to
On Mon, 27 Jul 2020 at 06:06, Alexandre Courbot wrote:
>
> On Thu, Jul 23, 2020 at 6:23 AM Ezequiel Garcia
> wrote:
> >
> > On Mon, 13 Jul 2020 at 03:09, Alexandre Courbot
> > wrote:
> > >
> > > From: Yunfei Dong
> > >
> > > MT8183's codec firwmare is run by a different remote processor from
>
From: Eric Biggers
unlock_new_inode() is only meant to be called after a new inode has
already been inserted into the hash table. But nilfs_new_inode() can
call it even before it has inserted the inode, triggering the WARNING in
unlock_new_inode(). Fix this by only calling unlock_new_inode() if
From: Tetsuo Handa
commit f867c771f98891841c217fa8459244ed0dd28921 upstream.
syzbot is reporting that mmput() from shrinker function has a risk of
deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls
kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and
uprobe_clear_state() from _
From: Cristian Marussi
[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]
SMATCH detected a potential buffer overflow in the manipulation of
hwmon_attributes array inside the scmi_hwmon_probe function:
drivers/hwmon/scmi-hwmon.c:226
scmi_hwmon_probe() error: buffer overflow 'hwmon_at
From: Arnd Bergmann
[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]
The clang integrated assembler requires the 'cmp' instruction to
have a length prefix here:
arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an
explicit suffix (could be 'cmpb', 'cmpw', or
From: Derek Basehore
[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ]
This moves the wakeup increment for elan devices to the touch report.
This prevents the drivers from incorrectly reporting a wakeup when the
resume callback resets then device, which causes an interrupt to
occur.
From: Angelo Dureghello
[ Upstream commit 8678c71c17721e0f771f135967ef0cce8f69ce9a ]
Due to recent fixes in m68k arch-specific I/O accessor macros, this
driver is not working anymore for ColdFire. Fix wrong tcd endianness
removing additional swaps, since edma_writex() functions should already
ta
From: Srinivas Pandruvada
[ Upstream commit e1eea3f839f41368d7cb4eb2d872d5b288677e94 ]
Added new PCI device ids for supporting mailbox and MMIO interface for
Sapphire Rapids.
Signed-off-by: Srinivas Pandruvada
Signed-off-by: Andy Shevchenko
Signed-off-by: Sasha Levin
---
drivers/platform/x8
From: Joe Perches
Reduce object size a bit by removing the KERN_ as a
separate argument and adding it to the format string.
Reduce overall object size by about ~.5% (x86-64 defconfig w/ nilfs2)
old:
$ size -t fs/nilfs2/built-in.a | tail -1
1917388676 44 200458 30f0a (TOTALS)
new:
Hi Andrew,
Please queue the following changes for the next merge window:
Eric Biggers (1):
nilfs2: only call unlock_new_inode() if I_NEW
Joe Perches (2):
nilfs2: Convert __nilfs_msg to integrate the level and format
nilfs2: Use a more common logging style
In this series,
> nilfs2: only
From: Heikki Krogerus
[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ]
This patch adds the necessary PCI ID for TGP-H devices.
Signed-off-by: Heikki Krogerus
Signed-off-by: Felipe Balbi
Signed-off-by: Sasha Levin
---
drivers/usb/dwc3/dwc3-pci.c | 4
1 file changed, 4 insert
From: Rustam Kovhaev
commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.
As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type
Reported-and-tested-by: syzbot+c2a1fa67c02faa0de...@syzkaller.appspotmail.co
From: Peter Chen
[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ]
It is found by sparse.
Reported-by: kbuild test robot
Signed-off-by: Peter Chen
Signed-off-by: Felipe Balbi
Signed-off-by: Sasha Levin
---
drivers/usb/cdns3/trace.h | 6 +++---
1 file changed, 3 insertions(+), 3
From: Joe Perches
Add macros for nilfs_(sb, fmt, ...) and convert the uses of
'nilfs_msg(sb, KERN_, ...)' to 'nilfs_(sb, ...)' so nilfs2
uses a logging style more like the typical kernel logging style.
Miscellanea:
o Realign arguments for these uses
Signed-off-by: Joe Perches
Signed-off-by: R
From: Taehee Yoo
[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ]
In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
If nsim_bpf_init() is failed, rtnl_unlock() should be called,
but it isn't called.
So, unbalanced locking would occur.
Fixes: e05b2d141fef ("netdevsi
From: Leonid Ravich
[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
DMA transaction time to completion is a function of PCI bandwidth,
transaction size and a queue depth. So hard coded value for timeouts
might be wrong for some scenarios.
Signed-off-by: Leonid Ravich
Reviewed-by:
From: Jack Xiao
[ Upstream commit 7d65a577bb58d4f27a3398a4c0cb0b00ab7d0511 ]
During preemption test for gfx10, it uses kiq to trigger
gfx preemption, which would result in race condition
with flushing TLB for kiq.
Signed-off-by: Jack Xiao
Reviewed-by: Hawking Zhang
Acked-by: Christian König
From: guodeqing
[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ]
The sync_thread_backup only checks sk_receive_queue is empty or not,
there is a situation which cannot sync the connection entries when
sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf,
the sync pack
From: Dinghao Liu
[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ]
pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus a pairing decrement is needed on
the error handling path to keep the counter balanced.
Signed-off-by: Dinghao Liu
From: Merlijn Wajer
[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
This event code represents the state of a removable cover of a device.
Value 0 means that the cover is open or removed, value 1 means that the
cover is closed.
Reviewed-by: Sebastian Reichel
Acked-by: Tony Lindgre
Show /proc/self/net only for CAP_NET_ADMIN if procfs is mounted with
subset=pid option in user namespace. This is done to avoid possible
information leakage.
Signed-off-by: Alexey Gladkov
---
fs/proc/proc_net.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/fs/proc/proc_net.c b/fs/pro
On Mon, Jul 27, 2020 at 05:21:55PM +0800, Ooi, Joyce wrote:
> +/* ioctl to configure timestamping */
> +static int tse_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
> +{
> + struct altera_tse_private *priv = netdev_priv(dev);
> + struct hwtstamp_config config;
> +
> + if
From: leilk.liu
[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
this patch use correct SPI_CFG2_REG offset.
Signed-off-by: leilk.liu
Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk@mediatek.com
Signed-off-by: Mark Brown
Signed-off-by: Sasha Levin
---
drivers/spi
From: Maor Gottlieb
[ Upstream commit c3d6057e07a5d15be7c69ea545b3f91877808c96 ]
SRQ table is accessed both from interrupt and process context,
therefore we must use xa_lock_irq.
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
kworker/u17:9/8573 takes:
8883e3503d30 (&xa->xa_
From: Vinay Kumar Yadav
[ Upstream commit c271042eb6a031d1333cf57422ec1d20726901ab ]
When tls data skb is pending for Tx and tls alert comes , It
is wrongly overwrite the record type of tls data to tls alert
record type. fix the issue correcting it.
v1->v2:
- Correct submission tree.
- Add fixe
From: Yunsheng Lin
[ Upstream commit 48ae74c9d89f827b39b5c07a1f02fc13637a3cd6 ]
With GRO and fraglist support, the SKB can be aggregated to
a total size of 65535, and when that SKB is forwarded through
a bridge, the size of the SKB may be pushed to exceed the size
of 65535 when br_dev_queue_push
From: Shannon Nelson
[ Upstream commit bdff46665ee655600d0fe2a0e5f62ec7853d3b22 ]
Make sure the RSS hash key is kept across a fw update by not
de-initing it when an update is happening.
Fixes: c672412f6172 ("ionic: remove lifs on fw reset")
Signed-off-by: Shannon Nelson
Signed-off-by: David S.
From: Cong Wang
[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
Very similar to commit 544f287b8495
("bonding: check error value of register_netdevice() immediately"),
we should immediately check the return value of register_netdevice()
before doing anything else.
Fixes: 005db31d5f
From: Atish Patra
[ Upstream commit 4400231c8acc7e513204c8470c6d796ba47dc169 ]
Currently, initrd_start/end are computed during early_init_dt_scan
but used during arch_setup. We will get the following panic if initrd is used
and CONFIG_DEBUG_VIRTUAL is turned on.
[0.00] [ cut
From: Douglas Anderson
[ Upstream commit 02b9aec59243c6240fc42884acc958602146ddf6 ]
When I have KASAN enabled on my kernel and I start stressing the
touchscreen my system tends to hang. The touchscreen is one of the
only things that does a lot of big i2c transfers and ends up hitting
the DMA pa
From: Rodrigo Rivas Costa
[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ]
Using uhid and KASAN this driver crashed because it was getting
several connection events where it only expected one. Then the
device was added several times to the static device list and it got
corrupted.
Th
From: Masahiro Yamada
[ Upstream commit 20b1be59528295e5c2a8812059b8560753dd8e68 ]
Commit f566e1fbadb6 ("kbuild: make multiple directory targets work")
broke single target builds for external modules. Fix this.
Fixes: f566e1fbadb6 ("kbuild: make multiple directory targets work")
Reported-by: Bj
On Fri, Jul 24, 2020 at 10:22:36PM -0700, Pascal Bouchareine wrote:
> This command attaches a description to a file descriptor for
> troubleshooting purposes. The free string is displayed in the
> process fdinfo file for that fd /proc/pid/fdinfo/fd.
>
> One intended usage is to allow processes to
From: Vadim Pasternak
[ Upstream commit 9b8737788af6c76ef93e3161ee2cdc4ddcc034ca ]
Fix wrong reading of upper pages for SFP EEPROM. According to "Memory
Organization" figure in SFF-8472 spec: When reading upper pages 1, 2 and
3 the offset should be set relative to zero and I2C high address 0x51
From: Russell King
[ Upstream commit 7c6719a1aaca51ffd7cdf3905e70aa8313f6ef26 ]
The commit below caused a regression for clearfog-gt-8k, where the link
between the switch and the host does not come up.
Investigation revealed two issues:
- MV88E6xxx DSA no longer allows an in-band link to come u
From: Alessio Bonfiglio
[ Upstream commit b5ba46b81c2fef00bcf110777fb6d51befa4a23e ]
Fix the regression introduced by commit c8685937d07f ("iwlwifi: move
pu devices to new table") by adding the ids and the configurations of
two missing Killer 1550 cards in order to configure and let them work
co
From: Liu Jian
[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ]
When mlxsw_core_trap_register fails in mlxsw_emad_init,
destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq.
Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock")
Signed-off-by: Liu Jian
Reviewed-
From: Ming Lei
[ Upstream commit 85067747cf9888249fa11fa49ef75af5192d3988 ]
Given request-based DM now uses blk-mq's blk_mq_queue_inflight() to
determine if outstanding IO has completed (and DM has no control over
the blk-mq state machine used to track outstanding IO) it is unsafe to
wakeup wait
From: Russell King
[ Upstream commit fad58190c0ffd72c394722928cd3e919b6e18357 ]
If in-band negotiation or fixed-link modes are specified for a DSA
port, the DSA code will force the link down during initialisation. For
fixed-link mode, this is fine, as phylink will manage the link state.
However,
From: Ioana Ciornei
[ Upstream commit 841eb4012cef84820e5906527b31a854f42b0748 ]
The fsl_mc_get_endpoint() function can return an error or directly a
NULL pointer in case the peer device is not under the root DPRC
container. Treat this case also, otherwise it would lead to a NULL
pointer when tr
From: Jerry (Fangzhi) Zuo
[ Upstream commit 17bdb4a82fe5014c8aa5b2103c80c5729744a096 ]
Signed-off-by: Jerry (Fangzhi) Zuo
Reviewed-by: Hersen Wu
Acked-by: Aurabindo Pillai
Signed-off-by: Alex Deucher
Signed-off-by: Sasha Levin
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +
On Mon, Jul 27, 2020 at 04:13:38PM +0200, Christian Brauner wrote:
> On Mon, Jul 27, 2020 at 03:28:55PM +0200, Christoph Hellwig wrote:
> > On Mon, Jul 27, 2020 at 12:46:36PM +0200, Christian Brauner wrote:
> > > Hey Christoph,
> > >
> > > Seems that commit
> > > 6955a76fbcd5 ("bpfilter: switch to
From: Aaron Ma
[ Upstream commit 3b2e973dff59d88bee1d814ddf8762a24fc02b60 ]
RENOIR loads dmub fw not dmcu, check dmcu only will prevent loading iram,
it breaks backlight control.
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=208277
Acked-by: Alex Deucher
Reviewed-by: Nicholas Kazlauskas
Si
On Mon, Jul 27, 2020 at 4:14 PM Peilin Ye wrote:
> On Mon, Jul 27, 2020 at 04:05:38PM +0200, Arnd Bergmann wrote:
> > Peilin Ye, is this something you are interested in fixing for the other
> > drivers
> > as well? I'd be happy to help review any further patches if you Cc me.
>
> Yes, I would lik
From: Thomas Gleixner
[ Upstream commit e3beca48a45b5e0e6e6a4e0124276b8248dcc9bb ]
Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type
IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after
creating the irqdomain. The only purpose of these FW nodes is to
From: Vasundhara Volam
[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ]
The driver was modified to not rely on rtnl lock to protect link
settings about 2 years ago. The pause setting was missed when
making that change. Fix it by acquiring link_lock mutex before
calling bnxt_hwrm_se
From: Shannon Nelson
[ Upstream commit cbec2153a9a68d011454960ba84887e46e40b37d ]
Add in a couple of forgotten spinlocks and fix up some of
the debug messages around filter management.
Fixes: c1e329ebec8d ("ionic: Add management of rx filters")
Signed-off-by: Shannon Nelson
Signed-off-by: Davi
From: Filipe Manana
commit 580c079b5766ac706f56eec5c79aee4bf929fef6 upstream.
At btrfs_find_all_roots_safe() we allocate a ulist and set the **roots
argument to point to it. However if later we fail due to an error returned
by find_parent_nodes(), we free that ulist but leave a dangling pointer
From: Boris Burkov
commit 48cfa61b58a1fee0bc49eef04f8ccf31493b7cdd upstream.
It is possible to cause a btrfs mount to fail by racing it with a slow
umount. The crux of the sequence is generic_shutdown_super not yet
calling sop->put_super before btrfs_mount_root calls btrfs_open_devices.
If that
Hi all,
+Dafna for the thread discussion, as she's missed from the to/cc list.
On 24/07/2020 13:21, Kaaira Gupta wrote:
> On Fri, Jul 24, 2020 at 02:15:21PM +0200, Niklas Söderlund wrote:
> Hi,
>
>> Hi Kaaira,
>>
>> Thanks for your work.
>
> Thanks for yours :D
>
>>
>> On 2020-07-24 17:32:10
From: Michael Chan
[ Upstream commit 27640ce68d21e556b66bc5fa022aacd26e53c947 ]
The current completion ring sizing formula is wrong with TPA enabled.
The formula assumes that the number of TPA completions are bound by the
RX ring size, but that's not true. TPA_START completions are immediately
From: Christophe JAILLET
[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]
The size used when calling 'pci_alloc_consistent()' and
'pci_free_consistent()' should match.
Fix it and have it consistent with the corresponding call in 'rr_close()'.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2"
From: Namjae Jeon
commit d2fa0c337d97a5490190b9f3b9c73c8f9f3602a1 upstream.
We found the wrong hint_stat initialization in exfat_find_dir_entry().
It should be initialized when cluster is EXFAT_EOF_CLUSTER.
Fixes: ca06197382bd ("exfat: add directory operations")
Cc: sta...@vger.kernel.org # v5.
From: Takashi Iwai
commit 60379ba08532eca861e933b389526a4dc89e0c42 upstream.
snd_info_get_line() has a sanity check of NULL buffer -- both buffer
itself being NULL and buffer->buffer being NULL. Basically both
checks are valid and necessary, but the problem is that it's with
snd_BUG_ON() macro
From: Damien Le Moal
[ Upstream commit cb551b8dc079d2ef189145782627c99cb68c0255 ]
In BRM_status_show(), if the condition "!ioc->is_warpdrive" tested on entry
to the function is true, a "goto out" is called. This results in unlocking
ioc->pci_access_mutex without this mutex lock being taken. Thi
From: Markus Theil
[ Upstream commit 0b467b63870d9c05c81456aa9bfee894ab2db3b6 ]
Without this patch, eapol frames cannot be received in mesh
mode, when 802.1X should be used. Initially only a MGTK is
defined, which is found and set as rx->key, when there are
no other keys set. ieee80211_drop_unen
From: Olga Kornievskaia
commit 65caafd0d2145d1dd02072c4ced540624daeab40 upstream.
Reverting commit d03727b248d0 "NFSv4 fix CLOSE not waiting for
direct IO compeletion". This patch made it so that fput() by calling
inode_dio_done() in nfs_file_release() would wait uninterruptably
for any outstand
scheduler will be able to balance tasks accordingly,
> + i.e. put less load on throttled CPUs than on non/less throttled ones.
> +
> + This requires the architecture to implement
> + arch_set_thermal_pressure() and arch_get_thermal_pressure().
>
> config BSD_PR
From: Johannes Thumshirn
[ Upstream commit 0fd181456aa0826057adbfb6c79c40f4083cfd75 ]
BRM_status_show() has several error branches, but none of them record the
error in the error return.
Also while at it remove the manual mutex_unlock() of the pci_access_mutex
in case of an ongoing pci error re
From: Namjae Jeon
commit 43946b70494beefe40ec1b2ba4744c0f294d7736 upstream.
An overflow issue can occur while calculating sector in
exfat_cluster_to_sector(). It needs to cast clus's type to sector_t
before left shifting.
Fixes: 1acf1a564b60 ("exfat: add in-memory and on-disk structures and hea
From: Tom Rix
[ Upstream commit 5aee52c44d9170591df65fafa1cd408acc1225ce ]
clang static analysis flags several null function pointer problems.
drivers/scsi/scsi_transport_spi.c:374:1: warning: Called function pointer is
null (null dereference) [core.CallAndMessage]
spi_transport_max_attr(offse
From: Rustam Kovhaev
commit faaff9765664009c1c7c65551d32e9ed3b1dda8f upstream.
As syzkaller detected, wlan-ng driver does not do sanity check of
endpoints in prism2sta_probe_usb(), add check for xfer direction and type
Reported-and-tested-by: syzbot+c2a1fa67c02faa0de...@syzkaller.appspotmail.co
From: Johannes Berg
commit fbb1461ad1d6eacca9beb69a2f3ce1b5398d399b upstream.
iwl_mvm_free_inactive_queue() will sleep in synchronize_net() under
some circumstances, so don't call it under RCU. There doesn't appear
to be a need for RCU protection around this particular call.
Cc: sta...@vger.ker
From: Eddie James
commit ebd4050c6144b38098d8eed34df461e5e3fa82a9 upstream.
When calculating the clock divider, start dividing at 2 instead of 1.
The divider is divided by two at the end of the calculation, so starting
at 1 may result in a divider of 0, which shouldn't happen.
Signed-off-by: Ed
From: Johan Hovold
commit b374c562ee7ab3f3a1daf959c01868bae761571c upstream.
Commit 33ae787b74fc ("serial: tegra: add support to ignore read") added
support for dropping input in case CREAD isn't set, but for PIO the
ignore_status_mask wasn't checked until after the character had been
put in the
From: Serge Semin
commit 551e553f0d4ab623e2a6f424ab5834f9c7b5229c upstream.
Commit 7b668c064ec3 ("serial: 8250: Fix max baud limit in generic 8250
port") fixed limits of a baud rate setting for a generic 8250 port.
In other words since that commit the baud rate has been permitted to be
within [u
From: Ian Abbott
commit f07804ec77d77f8a9dcf570a24154e17747bc82f upstream.
`ni6527_intr_insn_config()` processes `INSN_CONFIG` comedi instructions
for the "interrupt" subdevice. When `data[0]` is
`INSN_CONFIG_DIGITAL_TRIG` it is configuring the digital trigger. When
`data[2]` is `COMEDI_DIGITA
From: Ian Abbott
commit 926234f1b8434c4409aa4c53637aa3362ca07cea upstream.
The `INSN_CONFIG` comedi instruction with sub-instruction code
`INSN_CONFIG_DIGITAL_TRIG` includes a base channel in `data[3]`. This is
used as a right shift amount for other bitmask values without being
checked. Shift a
From: Qi Liu
[ Upstream commit f32ed8eb0e3f0d0ef4ddb854554d60ca5863a9f9 ]
Forcefully unbinding PMU drivers during perf sampling will lead to
a kernel panic, because the perf upper-layer framework call a NULL
pointer in this situation.
To solve this issue, "suppress_bind_attrs" should be set to
From: Tetsuo Handa
commit 033724d6864245a11f8e04c066002e6ad22b3fd0 upstream.
syzbot is reporting general protection fault in bitfill_aligned() [1]
caused by integer underflow in bit_clear_margins(). The cause of this
problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.
If vc_do_re
From: Paweł Gronowski
commit 38e0c89a19fd13f28d2b4721035160a3e66e270b upstream.
NULL dereference occurs when string that is not ended with space or
newline is written to some dpm sysfs interface (for example pp_dpm_sclk).
This happens because strsep replaces the tmp with NULL if the delimiter
is
From: Pierre-Louis Bossart
commit 8edac489e7c3fce44208373bb3e7b5835a672c66 upstream.
we need to free all allocated tlvs, not just the one allocated in
the loop before releasing kcontrols - other the tlvs references will
leak.
Fixes: 9f90af3a995298 ('ASoC: topology: Consolidate and fix
asoc_tpl
From: Steve French
commit 0e6705182d4e1b77248a93470d6d7b3013d59b30 upstream.
This reverts commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2.
Upon additional testing with older servers, it was found that
the original commit introduced a regression when using the old SMB1
dialect and rsyncing over
From: Yang Yingliang
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual
address
[ 78.123778] Mem abort info:
[ 78.126560] ESR = 0x8607
[
From: Pierre-Louis Bossart
commit 6f0307df83f2aa6bdf656c2219c89ce96502d20e upstream.
When errors happens while loading graph components, the kernel oopses
while trying to remove all topology components. This can be
root-caused to a list pointing to memory that was already freed on
error.
remove
From: Qiujun Huang
commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
In ath9k_hif_usb_rx_cb interface number is assumed to be 0.
usb_ifnum_to_if(urb->dev, 0)
But it isn't always true.
The case reported by syzbot:
https://lore.kernel.org/linux-usb/666c9c05a1c05...@google.com
From: Kirill A. Shutemov
commit 246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c upstream.
VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under
mmap_read_lock(). It can lead to race with __do_munmap():
Thread AThread B
__do_munmap()
detach_vmas_to_
From: Muchun Song
commit d38a2b7a9c939e6d7329ab92b96559ccebf7b135 upstream.
If the kmem_cache refcount is greater than one, we should not mark the
root kmem_cache as dying. If we mark the root kmem_cache dying
incorrectly, the non-root kmem_cache can never be destroyed. It
resulted in memory l
From: Eric Biggers
commit b34e7e298d7a5ed76b3aa327c240c29f1ef6dd22 upstream.
WRITE_ONCE() isn't the correct way to publish a pointer to a data
structure, since it doesn't include a write memory barrier. Therefore
other tasks may see that the pointer has been set but not see that the
pointed-to
From: Matthew Howell
[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ]
Sealevel XR17V35X based devices are inoperable on kernel versions
4.11 and above due to a change in the GPIO preconfiguration introduced in
commit
7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Se
From: Heikki Krogerus
[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ]
This patch adds the necessary PCI ID for TGP-H devices.
Signed-off-by: Heikki Krogerus
Signed-off-by: Felipe Balbi
Signed-off-by: Sasha Levin
---
drivers/usb/dwc3/dwc3-pci.c | 4
1 file changed, 4 insert
From: Merlijn Wajer
[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
This event code represents the state of a removable cover of a device.
Value 0 means that the cover is open or removed, value 1 means that the
cover is closed.
Reviewed-by: Sebastian Reichel
Acked-by: Tony Lindgre
From: Heikki Krogerus
[ Upstream commit e25d1e8532c3d84f075deca1580a7d61e0f43ce6 ]
This patch adds the necessary PCI ID for Intel Jasper Lake
devices.
Signed-off-by: Heikki Krogerus
Signed-off-by: Felipe Balbi
Signed-off-by: Sasha Levin
---
drivers/usb/dwc3/dwc3-pci.c | 4
1 file chang
From: Will Deacon
[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]
Rather than open-code test_tsk_thread_flag() at each callsite, simply
replace the couple of offenders with calls to test_tsk_thread_flag()
directly.
Signed-off-by: Will Deacon
Signed-off-by: Sasha Levin
---
arch/a
From: Srinivas Pandruvada
[ Upstream commit e1eea3f839f41368d7cb4eb2d872d5b288677e94 ]
Added new PCI device ids for supporting mailbox and MMIO interface for
Sapphire Rapids.
Signed-off-by: Srinivas Pandruvada
Signed-off-by: Andy Shevchenko
Signed-off-by: Sasha Levin
---
drivers/platform/x8
From: Derek Basehore
[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ]
This moves the wakeup increment for elan devices to the touch report.
This prevents the drivers from incorrectly reporting a wakeup when the
resume callback resets then device, which causes an interrupt to
occur.
From: Peter Chen
[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ]
It is found by sparse.
Reported-by: kbuild test robot
Signed-off-by: Peter Chen
Signed-off-by: Felipe Balbi
Signed-off-by: Sasha Levin
---
drivers/usb/cdns3/trace.h | 6 +++---
1 file changed, 3 insertions(+), 3
From: Marc Kleine-Budde
[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]
This function is used by dev_get_regmap() to retrieve a regmap for the
specified device. If the device has more than one regmap, the name parameter
can be used to specify one.
The code here uses a pointer compa
On Wed, 22 Jul 2020, Alexander A. Klimov wrote:
> Rationale:
> Reduces attack surface on kernel devs opening the links for MITM
> as HTTPS traffic is much harder to manipulate.
>
> Deterministic algorithm:
> For each file:
> If not .svg:
> For each line:
> If doesn't contain `\bxmlns\
From: Cristian Marussi
[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]
SMATCH detected a potential buffer overflow in the manipulation of
hwmon_attributes array inside the scmi_hwmon_probe function:
drivers/hwmon/scmi-hwmon.c:226
scmi_hwmon_probe() error: buffer overflow 'hwmon_at
From: Evgeny Novikov
[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]
gr_ep_init() does not assign the allocated request anywhere if allocation
of memory for the buffer fails. This is a memory leak fixed by the given
patch.
Found by Linux Driver Verification project (linuxtesting.or
From: Jing Xiangfeng
[ Upstream commit b3df80ab6d147d4738be242e1c91e5fdbb6b03ef ]
snd_byt_cht_es8316_mc_probe() misses to call put_device() in an error
path. Add the missed function call to fix it.
Fixes: ba49cf6f8e4a ("ASoC: Intel: bytcht_es8316: Add quirk for inverted jack
detect")
Signed-of
From: Ilya Katsnelson
[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ]
Tested on my own laptop, touchpad feels slightly more responsive with
this on, though it might just be placebo.
Signed-off-by: Ilya Katsnelson
Reviewed-by: Lyude Paul
Link: https://lore.kernel.org/r/20200703143
From: Leonid Ravich
[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
DMA transaction time to completion is a function of PCI bandwidth,
transaction size and a queue depth. So hard coded value for timeouts
might be wrong for some scenarios.
Signed-off-by: Leonid Ravich
Reviewed-by:
From: leilk.liu
[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
this patch use correct SPI_CFG2_REG offset.
Signed-off-by: leilk.liu
Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk@mediatek.com
Signed-off-by: Mark Brown
Signed-off-by: Sasha Levin
---
drivers/spi
From: Matthew Gerlach
[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ]
When putting the port in reset, driver must wait for the soft reset
acknowledgment bit instead of the soft reset bit.
Fixes: 47c1b19c160f (fpga: dfl: afu: add port ops support)
Signed-off-by: Matthew Gerlach
Sig
From: Cong Wang
[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
Very similar to commit 544f287b8495
("bonding: check error value of register_netdevice() immediately"),
we should immediately check the return value of register_netdevice()
before doing anything else.
Fixes: 005db31d5f
901 - 1000 of 2108 matches
Mail list logo
