Currently, The event_seq_changed() handler processes a variable number
of properties sent by the firmware. The number of properties is indicated
by the firmware and used to iterate over the payload. However, the
payload size is not being validated against the actual message length.
This can lead to out-of-bounds memory access if the firmware provides a
property count that exceeds the data available in the payload. Such a
condition can result in kernel crashes or potential information leaks if
memory beyond the buffer is accessed.
Fix this by properly validating the remaining size of the payload before
each property access and updating bounds accordingly as properties are
parsed.
This ensures that property parsing is safely bounded within the received
message buffer and protects against malformed or malicious firmware
behavior.
Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com>
Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Co-developed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
(cherry picked from commit 06d6770ff0d8cc8dfd392329a8cc03e2a83e7289 https://gitlab.freedesktop.org/linux-media/media-committers.git master)
Change-Id: If1e48a3e439a1b0bf0c21860654dc08110f0fbbf
Signed-off-by: Gaviraju Doddabettahalli Bettegowda <quic_gdoddabe@quicinc.com>
GKI (arm64) relevant 87 out of 414 changes, affecting 112 files +738/-352
bdb71ee651 configfs: Do not override creating attribute file failure in populate_attrs() [1 file, +1/-1]
ba789be63d io_uring: account drain memory to cgroup [1 file, +1/-1]
c58b577cf7 io_uring/kbuf: account ring io_buffer_list memory [1 file, +1/-1]
f78b38af35 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() [1 file, +3/-2]
2429bb9fad media: v4l2-dev: fix error handling in __video_register_device() [1 file, +7/-7]
5d8b057ed7 media: videobuf2: use sgtable-based scatterlist wrappers [1 file, +2/-2]
b52dc88361 media: uvcvideo: Return the number of processed controls [1 file, +10/-1]
6d2b12e7c5 media: uvcvideo: Send control events for partial succeeds [1 file, +9/-3]
aac91ae06c media: uvcvideo: Fix deferred probing error [1 file, +19/-8]
86d9837e46 arm64/mm: Close theoretical race where stale TLB entry remains valid [1 file, +5/-4]
5538af3843 block: use plug request list tail for one-shot backmerge attempt [1 file, +13/-13]
943801c380 block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion [1 file, +1/-0]
1c71f3cf5f cgroup,freezer: fix incomplete freezing when attaching tasks [1 file, +1/-2]
a0890b7805 bus: firewall: Fix missing static inline annotations for stubs [1 file, +9/-6]
5766da2237 ext4: inline: fix len overflow in ext4_prepare_inline_data [1 file, +1/-1]
796632e6f8 ext4: fix calculation of credits for extent tree modification [1 file, +6/-5]
4b36399711 ext4: ensure i_size is smaller than maxbytes [1 file, +2/-1]
be5f3061a6 ext4: only dirty folios when data journaling regular files [1 file, +6/-1]
a0b1c91ada Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer() [1 file, +2/-0]
fed611bd8c f2fs: fix to do sanity check on ino and xnid [1 file, +6/-0]
aaa644e7ff f2fs: prevent kernel warning due to negative i_nlink from corrupted image [1 file, +9/-0]
ee1b421c46 f2fs: fix to do sanity check on sit_bitmap_size [1 file, +8/-0]
f16a797dce watchdog: fix watchdog may detect false positive of softlockup [1 file, +27/-14]
02137179ff mm: fix ratelimit_pages update error in dirty_ratio_handler() [1 file, +1/-1]
462eee6d42 firmware: arm_scmi: Ensure that the message-id supports fastchannel [2 files, +45/-33]
e3cf1ef571 dm-verity: fix a memory leak if some arguments are specified multiple times [3 files, +24/-5]
f2986bccf2 dm: lock limits when reading them [1 file, +7/-1]
ec5f0b4412 ovl: Fix nested backing file paths [1 file, +2/-2]
92776ca0cc remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() [1 file, +2/-3]
f4ef928ca5 remoteproc: core: Release rproc->clean_table after rproc_attach() fails [1 file, +1/-0]
68e58f5791 PCI: dwc: ep: Correct PBA offset in .set_msix() callback [1 file, +3/-2]
b20701d594 PCI: Add ACS quirk for Loongson PCIe [1 file, +23/-0]
be0cf75cbd PCI: Fix lock symmetry in pci_slot_unlock() [1 file, +2/-1]
7b45d2401d clocksource: Fix the CPUs' choice in the watchdog per CPU verification [1 file, +1/-1]
c05aba32a9 ACPICA: Avoid sequence overread in call to strncmp() [1 file, +1/-1]
66613b13cd ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case [1 file, +8/-1]
33cd650d38 pmdomain: core: Reset genpd->states to avoid freeing invalid data [1 file, +3/-1]
f34e0c1556 platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all() [1 file, +1/-0]
c519f81e9c gpiolib: of: Add polarity quirk for s5m8767 [1 file, +9/-0]
1f152ae557 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() [1 file, +1/-1]
6c1151d53c tipc: use kfree_sensitive() for aead cleanup [1 file, +1/-1]
b0e647442c f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx [2 files, +15/-13]
2d834477bb bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() [1 file, +2/-1]
77ff6aec7c cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs [1 file, +35/-1]
0a8446058c tcp: always seek for minimal rtt in tcp_rcv_rtt_update() [1 file, +8/-14]
f97085d365 tcp: remove zero TCP TS samples for autotuning [1 file, +5/-5]
89b20c406e tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows [1 file, +3/-3]
84c156a351 tcp: add receive queue awareness in tcp_rcv_space_adjust() [2 files, +5/-3]
3a9e74d158 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT [1 file, +4/-0]
5eb9c50e0c net: page_pool: Don't recycle into cache on PREEMPT_RT [1 file, +4/-0]
8b0741b167 xfrm: validate assignment of maximal possible SEQ number [1 file, +42/-10]
8fdf2f79eb bpf: Pass the same orig_call value to trampoline functions [1 file, +1/-1]
f0023d7a2a f2fs: fix to bail out in get_new_segment() [2 files, +6/-1]
448dc45eea bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index [1 file, +2/-2]
78f768e36c net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions [1 file, +69/-8]
4b3383110b software node: Correct a OOB check in software_node_get_reference_args() [1 file, +1/-1]
b7129ef57d sock: Correct error checking condition for (assign|release)_proto_idx() [1 file, +2/-2]
a58f0a0e99 f2fs: fix to set atomic write status more clear [3 files, +12/-2]
b8b4b8bb34 bpf, sockmap: Fix data lost during EAGAIN retries [1 file, +2/-1]
7c41f73b64 fs/xattr.c: fix simple_xattr_list() [1 file, +1/-0]
2e10dc9c2a io_uring/kbuf: don't truncate end buffer for multiple buffer peeks [1 file, +4/-1]
1a4254ab06 io_uring: fix task leak issue in io_wq_create() [1 file, +3/-1]
4220cc0b98 nvme: always punt polled uring_cmd end_io work to task_work [1 file, +7/-14]
f9b97d466e net_sched: sch_sfq: reject invalid perturb period [1 file, +8/-2]
2a3ad42a57 net: clear the dst when changing skb protocol [1 file, +13/-6]
510a29d776 mm: close theoretical race where stale TLB entries could linger [1 file, +2/-0]
57ec081869 sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() [3 files, +9/-2]
3d828519bd atm: Revert atm_account_tx() if copy_from_iter_full() fails. [3 files, +8/-1]
47f34289d1 arm64: Restrict pagetable teardown to avoid false warning [1 file, +2/-1]
9cf5b2a3b7 mm/hugetlb: unshare page tables during VMA split, not before [5 files, +57/-16]
dc5f0aef9e net: Fix checksum update for ILA adj-transport [4 files, +7/-7]
2516299184 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE [3 files, +7/-2]
50189d9c5e erofs: remove unused trace event erofs_destroy_inode [1 file, +0/-18]
348e541fef ipv6: remove leftover ip6 cookie initializer [1 file, +0/-2]
3c44ebad5a ipv6: replace ipcm6_init calls with ipcm6_init_sk [4 files, +3/-29]
6b358b3adf io_uring/sqpoll: don't put task_struct on tctx setup failure [1 file, +1/-4]
8873080b88 workqueue: Initialize wq_isolated_cpumask in workqueue_init_early() [1 file, +2/-1]
ac462a75fd net: netmem: fix skb_ensure_writable with unreadable skbs [1 file, +0/-3]
61b39e189d ptp: allow reading of currently dialed frequency to succeed on free-running clocks [1 file, +2/-1]
397c1faf8f tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior [1 file, +25/-12]
0d3d91c350 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer [1 file, +2/-2]
31d50dfe9c tcp: fix passive TFO socket having invalid NAPI ID [1 file, +3/-0]
0f8df5d6f2 ublk: santizize the arguments from userspace when adding a device [1 file, +3/-0]
456019adaa perf: Fix sample vs do_exit() [2 files, +16/-8]
7335c33d62 perf: Fix cgroup state vs ERROR [1 file, +30/-21]
fd199366bf perf/core: Fix WARN in perf_cgroup_switch() [1 file, +20/-2]
22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [1 file, +1/-1]
Changes in 6.12.35
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
s390/pci: Remove redundant bus removal and disable from zpci_release_device()
s390/pci: Prevent self deletion in disable_slot()
s390/pci: Allow re-add of a reserved but not yet removed device
s390/pci: Serialize device addition and removal
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
iommu/vt-d: Restore context entry setup order for aliased devices
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
ACPI: battery: negate current when discharging
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
iommu/amd: Allow matching ACPI HID devices without matching UIDs
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
net/mlx5: HWS, Fix IP version decision
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
net/mlx5: HWS, Harden IP version definer checks
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update
Input: sparcspkr - avoid unannotated fall-through
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path
wifi: cfg80211: init wiphy_work before allocating rfkill fails
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
ALSA: hda/realtek: Add quirk for Asus GU605C
iio: accel: fxls8962af: Fix temperature calculation
mm/hugetlb: unshare page tables during VMA split, not before
drm/amdgpu: read back register after written for VCN v4.0.5
kbuild: rust: add rustc-min-version support function
rust: compile libcore with edition 2024 for 1.87+
net: Fix checksum update for ILA adj-transport
bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: remove leftover ip6 cookie initializer
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
eth: bnxt: fix out-of-range access of vnic_info array
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe: Wire up device shutdown handler
drm/xe/gt: Update handling of xe_force_wake_get return
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
serial: sh-sci: Increment the runtime usage counter for the earlycon device
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
Linux 6.12.35
Change-Id: Ida57d269272a624bedb979bfad0b3c5e7df7e846
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
GKI (arm64) relevant 137 out of 624 changes, affecting 192 files +1647/-1035
a4f865ecdb nvmem: core: fix bit offsets of more than one byte [1 file, +17/-7]
4327479e55 nvmem: core: verify cell's raw_len [1 file, +12/-0]
410f8b72e0 nvmem: core: update raw_len if the bit reading is required [1 file, +3/-1]
7aea1517fb scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices [2 files, +35/-0]
b730cb1096 virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN [1 file, +1/-1]
2998813177 dma/mapping.c: dev_dbg support for dma_addressing_limited [1 file, +10/-1]
3eec42a17a dma-mapping: avoid potential unused data compilation warning [1 file, +8/-4]
97edaa0ec6 cgroup: Fix compilation issue due to cgroup_mutex not being exported [1 file, +1/-1]
f93675793b vhost_task: fix vhost_task_create() documentation [1 file, +1/-1]
e22034cbee dma-mapping: Fix warning reported for missing prototype [1 file, +8/-8]
4f5553a08f fs/buffer: split locking for pagecache lookups [1 file, +25/-16]
e138fc2316 fs/buffer: introduce sleeping flavors for pagecache lookups [2 files, +17/-0]
a49a4a87ce fs/buffer: use sleeping version of __find_get_block() [1 file, +9/-2]
f1c5aa614b fs/jbd2: use sleeping version of __find_get_block() [1 file, +9/-6]
9ece099e95 fs/ext4: use sleeping version of sb_find_get_block() [1 file, +2/-1]
64f505b08e block: fix race between set_blocksize and read paths [4 files, +43/-1]
218c838d03 io_uring: don't duplicate flushing in io_req_post_cqe [1 file, +8/-3]
8014d3e56e bpf: fix possible endless loop in BPF map iteration [1 file, +1/-1]
d40ca27602 fuse: Return EPERM rather than ENOSYS from link() [1 file, +2/-0]
bab0bd1389 exfat: call bh_read in get_block only when necessary [1 file, +77/-82]
01677e7ee1 io_uring/msg: initialise msg request opcode [1 file, +1/-0]
e506751b7d arm64: Add support for HIP09 Spectre-BHB mitigation [2 files, +3/-0]
4f427ca9ed tracing: Mark binary printing functions with __printf() attribute [4 files, +18/-21]
15787ab82a mailbox: use error ret code of of_parse_phandle_with_args() [1 file, +4/-3]
f48ee562c0 Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken [1 file, +3/-0]
44b79041c4 dql: Fix dql->limit value when reset. [1 file, +1/-1]
ac30595154 lockdep: Fix wait context check on softirq for PREEMPT_RT [1 file, +18/-0]
e63b634806 PCI: dwc: ep: Ensure proper iteration over outbound map windows [1 file, +1/-1]
37ac2434aa ext4: on a remount, only log the ro or r/w state when it has changed [1 file, +4/-3]
1d1e1efad1 libnvdimm/labels: Fix divide error in nd_label_data_init() [1 file, +2/-1]
123bcd8f42 pidfs: improve multi-threaded exec and premature thread-group leader exit polling [3 files, +9/-9]
8f82cf305e cgroup/rstat: avoid disabling irqs for O(num_cpu) [1 file, +5/-7]
a5a507fa5f blk-cgroup: improve policy registration error handling [1 file, +12/-10]
94c3cbc69a ext4: reorder capability check last [1 file, +2/-2]
e658f2d94a bpf: Return prog btf_id without capable check [1 file, +2/-2]
e2520cc19b PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() [1 file, +1/-1]
50452704ec jbd2: do not try to recover wiped journal [1 file, +6/-5]
dab35f4921 tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() [1 file, +32/-24]
555c0b713c bpf: Allow pre-ordering for bpf cgroup progs [5 files, +30/-9]
572ed3fb99 kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf [1 file, +12/-7]
174dedce64 dm: restrict dm device size to 2^63-512 bytes [1 file, +4/-0]
2f5f326214 ext4: reject the 'data_err=abort' option in nojournal mode [1 file, +12/-0]
d0dc233fe2 posix-timers: Add cond_resched() to posix_timer_add() search loop [1 file, +1/-0]
ae22452d15 posix-timers: Ensure that timer initialization is fully visible [1 file, +14/-7]
3fb9ee05ec timer_list: Don't use %pK through printk() [1 file, +2/-2]
21153e0974 netfilter: conntrack: Bound nf_conntrack sysctl writes [1 file, +9/-3]
236a87e9d2 PNP: Expand length of fixup id string [1 file, +1/-1]
6215143ad3 arm64/mm: Check pmd_table() in pmd_trans_huge() [1 file, +12/-12]
8ad58a7eba arm64/mm: Check PUD_TYPE_TABLE in pud_bad() [1 file, +2/-1]
28306c58da mmc: sdhci: Disable SD card clock before changing parameters [1 file, +7/-2]
3a75fe58a1 usb: xhci: Don't change the status of stalled TDs on failed Stop EP [1 file, +11/-1]
101a3b9920 printk: Check CON_SUSPEND when unblanking a console [1 file, +12/-2]
faba68a86a wifi: cfg80211: allow IR in 20 MHz configurations [5 files, +46/-25]
c1502fc84d ipv6: save dontfrag in cork [2 files, +6/-4]
75ae2a3553 badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 [1 file, +3/-2]
7caad075ac crypto: lzo - Fix compression buffer overrun [6 files, +106/-28]
73d01bcbf2 tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() [1 file, +26/-11]
1c17190880 usb: xhci: set page size to the xHCI-supported size [2 files, +22/-20]
93f581d763 drm/gem: Test for imported GEM buffers with helper [2 files, +16/-2]
c4525b513d net: phylink: use pl->link_interface in phylink_expects_phy() [1 file, +1/-1]
f29c876d72 perf/core: Clean up perf_try_init_event() [1 file, +38/-27]
af73c8fd73 ublk: enforce ublks_max only for unprivileged devices [1 file, +27/-15]
592ba27580 perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type [1 file, +3/-2]
3de322a98b scsi: logging: Fix scsi_logging_level bounds [1 file, +3/-1]
f33b310eac ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). [2 files, +16/-24]
564f03a797 block: mark bounce buffering as incompatible with integrity [2 files, +5/-2]
82209faa87 ublk: complete command synchronously on error [1 file, +6/-5]
b98aad5e5e media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map [1 file, +6/-0]
2d6231d5ce media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value [1 file, +32/-45]
e359d62886 perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters [1 file, +2/-2]
673dde8d3c bpf: Search and add kfuncs in struct_ops prologue and epilogue [1 file, +24/-1]
083383aba0 cpuidle: menu: Avoid discarding useful information [1 file, +12/-1]
20a53c3689 loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize [1 file, +1/-1]
b55a97d1bd dm: fix unconditional IO throttle caused by REQ_PREFLUSH [1 file, +6/-2]
9f27b38771 crypto: ahash - Set default reqsize from ahash_alg [2 files, +7/-0]
897c98fb32 crypto: skcipher - Zap type in crypto_alloc_sync_skcipher [1 file, +1/-0]
4d9fa2ebc0 net: ipv6: Init tunnel link-netns before registering dev [4 files, +9/-7]
53f42776e4 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie [2 files, +25/-36]
2b129e89b8 bpf: don't do clean_live_states when state->loop_entry->branches > 0 [1 file, +4/-0]
46ba5757a7 bpf: copy_verifier_state() should copy 'loop_entry' field [1 file, +3/-0]
82b54455b6 PCI: Fix old_size lower bound in calculate_iosize() too [1 file, +2/-4]
dc5f5c9d2b hrtimers: Replace hrtimer_clock_to_base_table with switch-case [1 file, +12/-17]
000dd6e344 ASoC: ops: Enforce platform maximum on initial value [1 file, +28/-1]
c4260bf83b ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() [1 file, +5/-3]
5b1b4cb46d pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map [1 file, +8/-2]
69689d1138 media: v4l: Memset argument to 0 before calling get_mbus_config pad op [2 files, +5/-1]
e6e31b0182 sched: Reduce the default slice to avoid tasks getting an extra tick [1 file, +3/-3]
ef31dc41cf phy: core: don't require set_mode() callback for phy_get_mode() to work [1 file, +4/-3]
06daedb443 xfrm: prevent high SEQ input in non-ESN mode [1 file, +12/-0]
9f2911868a ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). [2 files, +4/-4]
7fea5a9140 r8152: add vendor/device ID pair for Dell Alienware AW1022z [2 files, +2/-0]
16ddd67bb5 pstore: Change kmsg_bytes storage size to u32 [3 files, +9/-8]
73733c2fdb ext4: don't write back data before punch hole in nojournal mode [1 file, +5/-13]
1d15319323 f2fs: introduce f2fs_base_attr for global sysfs entries [1 file, +52/-22]
ded26f9e4c ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only [1 file, +10/-6]
76e56dbe50 net: flush_backlog() small changes [1 file, +8/-4]
58cdd1ee65 bridge: mdb: Allow replace of a host-joined group [2 files, +2/-2]
fcabb69674 rcu: handle unstable rdp in rcu_read_unlock_strict() [2 files, +11/-2]
d402437cde rcu: fix header guard for rcu_all_qs() [1 file, +1/-1]
887e39ac47 perf: Avoid the read if the count is already updated [3 files, +24/-18]
c80b2d159c bpf: Use kallsyms to find the function name of a struct_ops's stub function [1 file, +44/-54]
46f1c2b508 firmware: arm_scmi: Relax duplicate name constraint across protocol ids [1 file, +6/-13]
1351052877 drm/atomic: clarify the rules around drm_atomic_state->allow_modeset [1 file, +21/-2]
9fddd1f154 drm: Add valid clones check [1 file, +28/-0]
ff214b079d nvme-pci: add quirks for device 126f:1001 [1 file, +3/-0]
6d196cae4b nvme-pci: add quirks for WDC Blue SN550 15b7:5009 [1 file, +3/-0]
6a09b6bad0 ALSA: usb-audio: Fix duplicated name in MIDI substream names [1 file, +12/-4]
ad3e83a6c8 io_uring/fdinfo: annotate racy sq/cq head/tail reads [1 file, +2/-2]
7f7c8c03fe btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref [1 file, +1/-1]
8cafd7266f __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock [1 file, +1/-5]
28756f22de espintcp: fix skb leaks [3 files, +9/-3]
9cbca30102 espintcp: remove encap socket caching to avoid reference leak [4 files, +8/-94]
b1a687eb15 xfrm: Fix UDP GRO handling for some corner cases [2 files, +20/-16]
447c8f0c06 kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() [1 file, +5/-4]
252f78a931 xfrm: Sanitize marks before insert [2 files, +6/-0]
7207effe47 driver core: Split devres APIs to device/devres.h [2 files, +125/-118]
1e8b7e96f7 Bluetooth: L2CAP: Fix not checking l2cap_chan security level [1 file, +8/-7]
cd7f022296 loop: don't require ->write_iter for writable files in loop_configure [1 file, +0/-3]
873ebaf3c1 io_uring: fix overflow resched cqe reordering [1 file, +1/-0]
689a205cd9 net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done [1 file, +5/-0]
adb05149a9 can: slcan: allow reception of short error messages [1 file, +20/-6]
cc55dd28c2 can: bcm: add locking for bcm_op runtime updates [1 file, +45/-21]
63567ecd99 can: bcm: add missing rcu read protection for procfs content [1 file, +9/-4]
bf85e49aaf ALSA: pcm: Fix race of buffer access at PCM OSS layer [3 files, +14/-2]
e78908caf1 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() [1 file, +1/-1]
dc9bdfb9b0 drm/edid: fixed the bug that hdr metadata was not reset [1 file, +1/-0]
cb9a1019a6 Input: xpad - add more controllers [1 file, +3/-0]
9b8263cae6 highmem: add folio_test_partial_kmap() [2 files, +12/-5]
314bf771cb memcg: always call cond_resched() after fn() [1 file, +2/-4]
9da33ce114 mm/page_alloc.c: avoid infinite retries caused by cpuset race [1 file, +8/-0]
9f9517f156 mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled [1 file, +2/-0]
94efb0d656 mm: vmalloc: actually use the in-place vrealloc region [1 file, +1/-0]
483ac74183 mm: vmalloc: only zero-init on vrealloc shrink [1 file, +7/-5]
1d45e0170c spi: use container_of_cont() for to_spi_device() [1 file, +1/-4]
d28b0305f7 err.h: move IOMEM_ERR_PTR() to err.h [2 files, +3/-2]
80eb73778d bpf: abort verification if env->cur_state->loop_entry != NULL [1 file, +4/-2]
85fb1edd05 drm/gem: Internally test import_attach for imported objects [1 file, +1/-2]
Changes in 6.12.31
drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401
drm/amd/display: Do not enable replay when vtotal update is pending.
drm/amd/display: Correct timing_adjust_pending flag setting.
drm/amd/display: Defer BW-optimization-blocked DRR adjustments
i2c: designware: Use temporary variable for struct device
i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data
phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
nvmem: rockchip-otp: Move read-offset into variant-data
nvmem: rockchip-otp: add rk3576 variant data
nvmem: core: fix bit offsets of more than one byte
nvmem: core: verify cell's raw_len
nvmem: core: update raw_len if the bit reading is required
nvmem: qfprom: switch to 4-byte aligned reads
scsi: target: iscsi: Fix timeout on deleted connection
scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
dma/mapping.c: dev_dbg support for dma_addressing_limited
intel_th: avoid using deprecated page->mapping, index fields
mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
dma-mapping: avoid potential unused data compilation warning
cgroup: Fix compilation issue due to cgroup_mutex not being exported
vhost_task: fix vhost_task_create() documentation
vhost-scsi: protect vq->log_used with vq->mutex
scsi: mpi3mr: Add level check to control event logging
net: enetc: refactor bulk flipping of RX buffers to separate function
dma-mapping: Fix warning reported for missing prototype
ima: process_measurement() needlessly takes inode_lock() on MAY_READ
fs/buffer: split locking for pagecache lookups
fs/buffer: introduce sleeping flavors for pagecache lookups
fs/buffer: use sleeping version of __find_get_block()
fs/ocfs2: use sleeping version of __find_get_block()
fs/jbd2: use sleeping version of __find_get_block()
fs/ext4: use sleeping version of sb_find_get_block()
drm/amd/display: Enable urgent latency adjustment on DCN35
drm/amdgpu: Allow P2P access through XGMI
selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
block: fix race between set_blocksize and read paths
io_uring: don't duplicate flushing in io_req_post_cqe
bpf: fix possible endless loop in BPF map iteration
samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
kconfig: merge_config: use an empty file as initfile
x86/fred: Fix system hang during S4 resume with FRED enabled
s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log
cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
cifs: Fix querying and creating MF symlinks over SMB1
cifs: Fix negotiate retry functionality
smb: client: Store original IO parameters and prevent zero IO sizes
fuse: Return EPERM rather than ENOSYS from link()
exfat: call bh_read in get_block only when necessary
io_uring/msg: initialise msg request opcode
NFSv4: Check for delegation validity in nfs_start_delegation_return_locked()
NFS: Don't allow waiting for exiting tasks
SUNRPC: Don't allow waiting for exiting tasks
arm64: Add support for HIP09 Spectre-BHB mitigation
iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
tracing: Mark binary printing functions with __printf() attribute
ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
tpm: Convert warn to dbg in tpm2_start_auth_session()
mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
mailbox: use error ret code of of_parse_phandle_with_args()
riscv: Allow NOMMU kernels to access all of RAM
fbdev: fsl-diu-fb: add missing device_remove_file()
fbcon: Use correct erase colour for clearing in fbcon
fbdev: core: tileblit: Implement missing margin clearing for tileblit
cifs: Set default Netbios RFC1001 server name to hostname in UNC
cifs: add validation check for the fields in smb_aces
cifs: Fix establishing NetBIOS session for SMB2+ connection
NFSv4: Treat ENETUNREACH errors as fatal for state recovery
SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
SUNRPC: rpcbind should never reset the port to the value '0'
spi-rockchip: Fix register out of bounds access
ASoC: codecs: wsa884x: Correct VI sense channel mask
ASoC: codecs: wsa883x: Correct VI sense channel mask
mctp: Fix incorrect tx flow invalidation condition in mctp-i2c
net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards
net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus
thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
thermal/drivers/qoriq: Power down TMU on system suspend
Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
dql: Fix dql->limit value when reset.
lockdep: Fix wait context check on softirq for PREEMPT_RT
objtool: Properly disable uaccess validation
PCI: dwc: ep: Ensure proper iteration over outbound map windows
r8169: disable RTL8126 ZRX-DC timeout
tools/build: Don't pass test log files to linker
pNFS/flexfiles: Report ENETDOWN as a connection error
drm/amdgpu/discovery: check ip_discovery fw file available
drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
PCI: vmd: Disable MSI remapping bypass under Xen
xen/pci: Do not register devices with segments >= 0x10000
ext4: on a remount, only log the ro or r/w state when it has changed
libnvdimm/labels: Fix divide error in nd_label_data_init()
pidfs: improve multi-threaded exec and premature thread-group leader exit polling
staging: vchiq_arm: Create keep-alive thread during probe
mmc: host: Wait for Vdd to settle on card power off
drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
cgroup/rstat: avoid disabling irqs for O(num_cpu)
wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
wifi: mt76: mt7996: fix SER reset trigger on WED reset
wifi: mt76: mt7996: revise TXS size
wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
x86/smpboot: Fix INIT delay assignment for extended Intel Families
x86/microcode: Update the Intel processor flag scan check
x86/mm: Check return value from memblock_phys_alloc_range()
i2c: qup: Vote for interconnect bandwidth to DRAM
i2c: pxa: fix call balance of i2c->clk handling routines
btrfs: make btrfs_discard_workfn() block_group ref explicit
btrfs: avoid linker error in btrfs_find_create_tree_block()
btrfs: run btrfs_error_commit_super() early
btrfs: fix non-empty delayed iputs list on unmount due to async workers
btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work()
btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
blk-cgroup: improve policy registration error handling
drm/amdgpu: release xcp_mgr on exit
drm/amd/display: Guard against setting dispclk low for dcn31x
drm/amdgpu: adjust drm_firmware_drivers_only() handling
i3c: master: svc: Fix missing STOP for master request
s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
dlm: make tcp still work in multi-link env
clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
um: Store full CSGSFS and SS register from mcontext
um: Update min_low_pfn to match changes in uml_reserved
wifi: mwifiex: Fix HT40 bandwidth issue.
bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set
riscv: Call secondary mmu notifier when flushing the tlb
ext4: reorder capability check last
hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
scsi: st: Tighten the page format heuristics with MODE SELECT
scsi: st: ERASE does not change tape location
vfio/pci: Handle INTx IRQ_NOTCONNECTED
bpf: Return prog btf_id without capable check
PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off()
jbd2: do not try to recover wiped journal
tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
rtc: rv3032: fix EERD location
objtool: Fix error handling inconsistencies in check()
thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer
erofs: initialize decompression early
spi: spi-mux: Fix coverity issue, unchecked return value
ASoC: pcm6240: Drop bogus code handling IRQ as GPIO
ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
bpf: Allow pre-ordering for bpf cgroup progs
kbuild: fix argument parsing in scripts/config
kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf
crypto: octeontx2 - suppress auth failure screaming due to negative tests
dm: restrict dm device size to 2^63-512 bytes
net/smc: use the correct ndev to find pnetid by pnetid table
xen: Add support for XenServer 6.1 platform device
pinctrl-tegra: Restore SFSEL bit when freeing pins
mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
drm/amdgpu/gfx12: don't read registers in mqd init
drm/amdgpu/gfx11: don't read registers in mqd init
drm/amdgpu: Update SRIOV video codec caps
ASoC: sun4i-codec: support hp-det-gpios property
clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
ext4: reject the 'data_err=abort' option in nojournal mode
ext4: do not convert the unwritten extents if data writeback fails
RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
posix-timers: Add cond_resched() to posix_timer_add() search loop
posix-timers: Ensure that timer initialization is fully visible
net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
net: hsr: Fix PRP duplicate detection
timer_list: Don't use %pK through printk()
wifi: rtw89: set force HE TB mode when connecting to 11ax AP
netfilter: conntrack: Bound nf_conntrack sysctl writes
PNP: Expand length of fixup id string
phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set
arm64/mm: Check pmd_table() in pmd_trans_huge()
arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
mmc: dw_mmc: add exynos7870 DW MMC support
mmc: sdhci: Disable SD card clock before changing parameters
usb: xhci: Don't change the status of stalled TDs on failed Stop EP
wifi: iwlwifi: mvm: fix setting the TK when associated
hwmon: (dell-smm) Increment the number of fans
iommu: Keep dev->iommu state consistent
printk: Check CON_SUSPEND when unblanking a console
wifi: iwlwifi: don't warn when if there is a FW error
wifi: iwlwifi: w/a FW SMPS mode selection
wifi: iwlwifi: fix debug actions order
wifi: iwlwifi: mark Br device not integrated
wifi: iwlwifi: fix the ECKV UEFI variable name
wifi: mac80211: fix warning on disconnect during failed ML reconf
wifi: mac80211_hwsim: Fix MLD address translation
wifi: cfg80211: allow IR in 20 MHz configurations
ipv6: save dontfrag in cork
drm/amd/display: remove minimum Dispclk and apply oem panel timing.
drm/amd/display: calculate the remain segments for all pipes
drm/amd/display: not abort link train when bw is low
drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
gfs2: Check for empty queue in run_queue
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common"
ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0
coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
iommu/amd/pgtbl_v2: Improve error handling
cpufreq: tegra186: Share policy per cluster
watchdog: aspeed: Update bootstatus handling
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
misc: pci_endpoint_test: Give disabled BARs a distinct error code
crypto: lzo - Fix compression buffer overrun
crypto: mxs-dcp - Only set OTP_KEY bit for OTP key
drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
drm/amdkfd: Set per-process flags only once cik/vi
drm/amdgpu: Fix missing drain retry fault the last entry
arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
arm64: tegra: Resize aperture for the IGX PCIe C5 slot
powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
ALSA: seq: Improve data consistency at polling
tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
rtc: ds1307: stop disabling alarms on probe
ieee802154: ca8210: Use proper setters and getters for bitwise types
drm/xe: Nuke VM's mapping upon close
drm/xe: Retry BO allocation
soc: samsung: include linux/array_size.h where needed
ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
usb: xhci: set page size to the xHCI-supported size
dm cache: prevent BUG_ON by blocking retries on failed device resumes
soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
orangefs: Do not truncate file size
drm/gem: Test for imported GEM buffers with helper
net: phylink: use pl->link_interface in phylink_expects_phy()
blk-throttle: don't take carryover for prioritized processing of metadata
remoteproc: qcom_wcnss: Handle platforms with only single power domain
drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
drm/amd/display: Fix DMUB reset sequence for DCN401
drm/amd/display: Fix p-state type when p-state is unsupported
drm/amd/display: Request HW cursor on DCN3.2 with SubVP
perf/core: Clean up perf_try_init_event()
media: cx231xx: set device_caps for 417
pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
rcu: Fix get_state_synchronize_rcu_full() GP-start detection
net: ethernet: ti: cpsw_new: populate netdev of_node
net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
dpll: Add an assertion to check freq_supported_num
ublk: enforce ublks_max only for unprivileged devices
iommufd: Disallow allocating nested parent domain with fault ID
media: imx335: Set vblank immediately
net: pktgen: fix mpls maximum labels list parsing
perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
scsi: logging: Fix scsi_logging_level bounds
ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
drm/rockchip: vop2: Add uv swap for cluster window
block: mark bounce buffering as incompatible with integrity
ublk: complete command synchronously on error
media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
clk: imx8mp: inform CCF of maximum frequency of clocks
x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
hwmon: (gpio-fan) Add missing mutex locks
ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
fpga: altera-cvp: Increase credit timeout
perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
soc: apple: rtkit: Use high prio work queue
soc: apple: rtkit: Implement OSLog buffers properly
wifi: ath12k: Report proper tx completion status to mac80211
PCI: brcmstb: Expand inbound window size up to 64GB
PCI: brcmstb: Add a softdep to MIP MSI-X driver
firmware: arm_ffa: Set dma_mask for ffa devices
drm/xe/vf: Retry sending MMIO request to GUC on timeout error
drm/xe/pf: Create a link between PF and VF devices
net/mlx5: Avoid report two health errors on same syndrome
selftests/net: have `gro.sh -t` return a correct exit code
pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf
drm/amdkfd: KFD release_work possible circular locking
drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
leds: pwm-multicolor: Add check for fwnode_property_read_u32
net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
net: xgene-v2: remove incorrect ACPI_PTR annotation
bonding: report duplicate MAC address in all situations
wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
soc: ti: k3-socinfo: Do not use syscon helper to build regmap
bpf: Search and add kfuncs in struct_ops prologue and epilogue
Octeontx2-af: RPM: Register driver with PCI subsys IDs
x86/build: Fix broken copy command in genimage.sh when making isoimage
drm/amd/display: handle max_downscale_src_width fail check
drm/amd/display: fix dcn4x init failed
drm/amd/display: Fix mismatch type comparison
ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
ASoC: mediatek: mt8188: Add reference for dmic clocks
x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
vhost-scsi: Return queue full for page alloc failures during copy
vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
cpuidle: menu: Avoid discarding useful information
media: adv7180: Disable test-pattern control on adv7180
media: tc358746: improve calculation of the D-PHY timing registers
net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
scsi: mpi3mr: Update timestamp only for supervisor IOCs
loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize
libbpf: Fix out-of-bound read
dm: fix unconditional IO throttle caused by REQ_PREFLUSH
scsi: scsi_debug: First fixes for tapes
net/mlx5: Change POOL_NEXT_SIZE define value and make it global
x86/kaslr: Reduce KASLR entropy on most x86 systems
crypto: ahash - Set default reqsize from ahash_alg
crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
net: ipv6: Init tunnel link-netns before registering dev
drm/xe/oa: Ensure that polled read returns latest data
MIPS: Use arch specific syscall name match function
drm/amdgpu: remove all KFD fences from the BO on release
x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op()
genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
clocksource: mips-gic-timer: Enable counter when CPUs start
PCI: epf-mhi: Update device ID for SA8775P
scsi: mpt3sas: Send a diag reset if target reset fails
wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32()
wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware
wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree
EDAC/ie31200: work around false positive build warning
i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA)
mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs
eeprom: ee1004: Check chip before probing
irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector
drm/amd/pm: Fetch current power limit from PMFW
drm/amd/display: Add support for disconnected eDP streams
drm/amd/display: Guard against setting dispclk low when active
drm/amd/display: Fix BT2020 YCbCr limited/full range input
drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
Revert "drm/amd/display: Request HW cursor on DCN3.2 with SubVP"
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
RDMA/core: Fix best page size finding when it can cross SG entries
pmdomain: imx: gpcv2: use proper helper for property detection
can: c_can: Use of_property_present() to test existence of DT property
bpf: don't do clean_live_states when state->loop_entry->branches > 0
bpf: copy_verifier_state() should copy 'loop_entry' field
eth: mlx4: don't try to complete XDP frames in netpoll
PCI: Fix old_size lower bound in calculate_iosize() too
ACPI: HED: Always initialize before evged
vxlan: Join / leave MC group after remote changes
hrtimers: Replace hrtimer_clock_to_base_table with switch-case
irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base
media: test-drivers: vivid: don't call schedule in loop
net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
net/mlx5: Apply rate-limiting to high temperature warning
firmware: arm_ffa: Reject higher major version as incompatible
firmware: arm_ffa: Handle the presence of host partition in the partition info
firmware: xilinx: Dont send linux address to get fpga config get status
ASoC: ops: Enforce platform maximum on initial value
ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
ASoC: tas2764: Mark SW_RESET as volatile
ASoC: tas2764: Power up/down amp on mute ops
ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
smack: recognize ipv4 CIPSO w/o categories
smack: Revert "smackfs: Added check catlen"
kunit: tool: Use qboot on QEMU x86_64
media: i2c: imx219: Correct the minimum vblanking value
media: v4l: Memset argument to 0 before calling get_mbus_config pad op
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
drm/xe: Fix xe_tile_init_noalloc() error propagation
clk: qcom: ipq5018: allow it to be bulid on arm32
clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
drm/xe/debugfs: fixed the return value of wedged_mode_set
drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set
x86/ibt: Handle FineIBT in handle_cfi_failure()
x86/traps: Cleanup and robustify decode_bug()
sched: Reduce the default slice to avoid tasks getting an extra tick
serial: sh-sci: Update the suspend/resume support
pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF
phy: core: don't require set_mode() callback for phy_get_mode() to work
phy: exynos5-usbdrd: fix EDS distribution tuning (gs101)
soundwire: amd: change the soundwire wake enable/disable sequence
soundwire: cadence_master: set frame shape and divider based on actual clk freq
net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
drm/amdgpu/mes11: fix set_hw_resources_1 calculation
drm/amdkfd: fix missing L2 cache info in topology
drm/amdgpu: Set snoop bit for SDMA for MI series
drm/amd/display: pass calculated dram_speed_mts to dml2
drm/amd/display: Don't try AUX transactions on disconnected link
drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
drm/amd/pm: Skip P2S load for SMU v13.0.12
drm/amd/display: Support multiple options during psr entry.
Revert "drm/amd/display: Exit idle optimizations before attempt to access PHY"
drm/amd/display: Update CR AUX RD interval interpretation
drm/amd/display: Initial psr_version with correct setting
drm/amd/display: Increase block_sequence array size
drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It
drm/amd/display: Populate register address for dentist for dcn401
drm/amdgpu: Use active umc info from discovery
drm/amdgpu: enlarge the VBIOS binary size limit
drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
net/mlx5: XDP, Enable TX side XDP multi-buffer support
net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
net/mlx5e: set the tx_queue_len for pfifo_fast
net/mlx5e: reduce rep rxq depth to 256 for ECPF
net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
drm/v3d: Add clock handling
xfrm: prevent high SEQ input in non-ESN mode
wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
mptcp: pm: userspace: flags: clearer msg if no remote addr
wifi: iwlwifi: use correct IMR dump variable
wifi: iwlwifi: don't warn during reprobe
wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
net: fec: Refactor MAC reset to function
powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits
arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src
ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
r8152: add vendor/device ID pair for Dell Alienware AW1022z
iio: adc: ad7944: don't use storagebits for sizing
pstore: Change kmsg_bytes storage size to u32
leds: trigger: netdev: Configure LED blink interval for HW offload
ext4: don't write back data before punch hole in nojournal mode
ext4: remove writable userspace mappings before truncating page cache
wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
wifi: rtw89: fw: validate multi-firmware header before getting its size
wifi: rtw89: fw: validate multi-firmware header before accessing
wifi: rtw89: call power_on ahead before selecting firmware
clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
net: page_pool: avoid false positive warning if NAPI was never added
tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options
hwmon: (xgene-hwmon) use appropriate type for the latency value
f2fs: introduce f2fs_base_attr for global sysfs entries
media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available
media: qcom: camss: Add default case in vfe_src_pad_code
drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs
tools: ynl-gen: don't output external constants
net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost
vxlan: Annotate FDB data races
ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
r8169: don't scan PHY addresses > 0
net: flush_backlog() small changes
bridge: mdb: Allow replace of a host-joined group
ice: init flow director before RDMA
ice: treat dyn_allowed only as suggestion
rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
rcu: handle unstable rdp in rcu_read_unlock_strict()
rcu: fix header guard for rcu_all_qs()
perf: Avoid the read if the count is already updated
ice: count combined queues using Rx/Tx count
drm/xe/relay: Don't use GFP_KERNEL for new transactions
net/mana: fix warning in the writer of client oob
scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
scsi: lpfc: Ignore ndlp rport mismatch in dev_loss_tmo callbk
scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
scsi: st: Restore some drive settings after reset
wifi: ath12k: Avoid napi_sync() before napi_enable()
HID: usbkbd: Fix the bit shift number for LED_KANA
arm64: zynqmp: add clock-output-names property in clock nodes
ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
ASoC: rt722-sdca: Add some missing readable registers
irqchip/riscv-aplic: Add support for hart indexes
dm vdo indexer: prevent unterminated string warning
dm vdo: use a short static string for thread name prefix
drm/ast: Find VBIOS mode from regular display size
bpf: Use kallsyms to find the function name of a struct_ops's stub function
bpftool: Fix readlink usage in get_fd_type
firmware: arm_scmi: Relax duplicate name constraint across protocol ids
perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation
wifi: rtl8xxxu: retry firmware download on error
wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
spi: zynqmp-gqspi: Always acknowledge interrupts
regulator: ad5398: Add device tree support
wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
accel/qaic: Mask out SR-IOV PCI resources
drm/xe/pf: Reset GuC VF config when unprovisioning critical resource
wifi: ath9k: return by of_get_mac_address
wifi: ath12k: Fetch regdb.bin file from board-2.bin
wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
drm: bridge: adv7511: fill stream capabilities
drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
drm/xe: Move suballocator init to after display init
drm/xe: Do not attempt to bootstrap VF in execlists mode
wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event
drm/xe/sa: Always call drm_suballoc_manager_fini()
drm/xe: Reject BO eviction if BO is bound to current VM
drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
drm/buddy: fix issue that force_merge cannot free all roots
drm/panel-edp: Add Starry 116KHD024006
drm: Add valid clones check
ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
pinctrl: meson: define the pull up/down resistor value as 60 kOhm
smb: server: smb2pdu: check return value of xa_store()
platform/x86/intel: hid: Add Pantherlake support
platform/x86: asus-wmi: Disable OOBE state after resume from hibernation
platform/x86: ideapad-laptop: add support for some new buttons
ASoC: cs42l43: Disable headphone clamps during type detection
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
nvme-pci: add quirks for device 126f:1001
nvme-pci: add quirks for WDC Blue SN550 15b7:5009
ALSA: usb-audio: Fix duplicated name in MIDI substream names
nvmet-tcp: don't restore null sk_state_change
io_uring/fdinfo: annotate racy sq/cq head/tail reads
cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function
ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers
btrfs: compression: adjust cb->compressed_folios allocation type
btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
btrfs: handle empty eb->folios in num_extent_folios()
btrfs: avoid NULL pointer dereference if no valid csum tree
tools: ynl-gen: validate 0 len strings from kernel
block: only update request sector if needed
wifi: iwlwifi: add support for Killer on MTL
x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88
xenbus: Allow PVH dom0 a non-local xenstore
drm/amd/display: Call FP Protect Before Mode Programming/Mode Support
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
soundwire: bus: Fix race on the creation of the IRQ domain
espintcp: fix skb leaks
espintcp: remove encap socket caching to avoid reference leak
xfrm: Fix UDP GRO handling for some corner cases
dmaengine: idxd: Fix allowing write() from different address spaces
x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro
kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
xfrm: Sanitize marks before insert
dmaengine: idxd: Fix ->poll() return value
dmaengine: fsl-edma: Fix return code for unhandled interrupts
driver core: Split devres APIs to device/devres.h
devres: Introduce devm_kmemdup_array()
ASoC: SOF: Intel: hda: Fix UAF when reloading module
irqchip/riscv-imsic: Start local sync timer on correct CPU
perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling
ptp: ocp: Limit signal/freq counts in summary output functions
bridge: netfilter: Fix forwarding of fragmented packets
ice: fix vf->num_mac count with port representors
ice: Fix LACP bonds without SRIOV environment
idpf: fix null-ptr-deref in idpf_features_check
loop: don't require ->write_iter for writable files in loop_configure
pinctrl: qcom: switch to devm_register_sys_off_handler()
net: dwmac-sun8i: Use parsed internal PHY address instead of 1
net: lan743x: Restore SGMII CTRL register on resume
io_uring: fix overflow resched cqe reordering
idpf: fix idpf_vport_splitq_napi_poll()
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
octeontx2-pf: Add AF_XDP non-zero copy support
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
octeontx2-af: Set LMT_ENA bit for APR table entries
octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe()
crypto: algif_hash - fix double free in hash_accept
padata: do not leak refcount in reorder_work
can: slcan: allow reception of short error messages
can: bcm: add locking for bcm_op runtime updates
can: bcm: add missing rcu read protection for procfs content
ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
ASoc: SOF: topology: connect DAI to a single DAI link
ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
ALSA: pcm: Fix race of buffer access at PCM OSS layer
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
can: kvaser_pciefd: Fix echo_skb race
net: dsa: microchip: linearize skb for tail-tagging switches
vmxnet3: update MTU after device quiesce
pmdomain: renesas: rcar: Remove obsolete nullify checks
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
drm/edid: fixed the bug that hdr metadata was not reset
smb: client: Fix use-after-free in cifs_fill_dirent
arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
smb: client: Reset all search buffer pointers when releasing buffer
Revert "drm/amd: Keep display off while going into S4"
Input: xpad - add more controllers
highmem: add folio_test_partial_kmap()
memcg: always call cond_resched() after fn()
mm/page_alloc.c: avoid infinite retries caused by cpuset race
mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
mm: vmalloc: actually use the in-place vrealloc region
mm: vmalloc: only zero-init on vrealloc shrink
nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
Bluetooth: btmtksdio: Check function enabled before doing close
Bluetooth: btmtksdio: Do close if SDIO card removed without close
Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
ksmbd: fix stream write failure
platform/x86: think-lmi: Fix attribute name usage for non-compliant items
spi: use container_of_cont() for to_spi_device()
spi: spi-fsl-dspi: restrict register range for regmap access
spi: spi-fsl-dspi: Halt the module after a new message transfer
spi: spi-fsl-dspi: Reset SR flags before sending a new message
err.h: move IOMEM_ERR_PTR() to err.h
gcc-15: make 'unterminated string initialization' just a warning
gcc-15: disable '-Wunterminated-string-initialization' entirely for now
Fix mis-uses of 'cc-option' for warning disablement
kbuild: Properly disable -Wunterminated-string-initialization for clang
drm/amd/display: Exit idle optimizations before accessing PHY
bpf: abort verification if env->cur_state->loop_entry != NULL
serial: sh-sci: Save and restore more registers
drm/amdkfd: Correct F8_MODE for gfx950
watchdog: aspeed: fix 64-bit division
pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers
drm/gem: Internally test import_attach for imported objects
Linux 6.12.31
Change-Id: I017795966fb764f9320a6a0df1571d19e5e631fe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 523cea3a19f0b3b020a4745344c136a636e6ffd7 upstream.
Video device registering has been moved earlier in the probe function,
but the new order has not been propagated to error handling. This means
we can end with unreleased resources on error (e.g dangling video device
on missing firmware probe aborting).
Fixes: 08b1cf474b ("media: venus: core, venc, vdec: Fix probe dependency error")
Cc: stable@vger.kernel.org
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 2f4204bb00b32eca3391a468d3b37e87feb96fa9 ]
Add a default case in vfe_src_pad_code to get rid of a compile
warning if a new hw enum is added.
Signed-off-by: Depeng Shao <quic_depengs@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 2f1361f862a68063f37362f1beb400e78e289581 ]
There is no CSID TPG on some SoCs, so the v4l2 ctrl in CSID driver
shouldn't be registered. Checking the supported TPG modes to indicate
if the TPG hardware exists or not and only registering v4l2 ctrl for
CSID only when the TPG hardware is present.
Signed-off-by: Depeng Shao <quic_depengs@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
sfr->buf_size is in shared memory and can be modified by malicious user.
OOB write is possible when the size is made higher than actual sfr data
buffer. Cap the size to allocated size for such cases.
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
(cherry picked from commit f4b211714bcc70effa60c34d9fa613d182e3ef1e https://gitlab.freedesktop.org/linux-media/media-committers.git master)
Change-Id: I483a5feff3dfa35dae8f444e57601d2d1d85246f
Signed-off-by: Gaviraju Doddabettahalli Bettegowda <quic_gdoddabe@quicinc.com>
words_count denotes the number of words in total payload, while data
points to payload of various property within it. When words_count
reaches last word, data can access memory beyond the total payload. This
can lead to OOB access. With this patch, the utility api for handling
individual properties now returns the size of data consumed. Accordingly
remaining bytes are calculated before parsing the payload, thereby
eliminates the OOB access possibilities.
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
(cherry picked from commit 9edaaa8e3e15aab1ca413ab50556de1975bcb329 https://gitlab.freedesktop.org/linux-media/media-committers.git master)
Change-Id: I692e4a8dea110f0650fe26e07207408087a4d19b
Signed-off-by: Gaviraju Doddabettahalli Bettegowda <quic_gdoddabe@quicinc.com>
There is a possibility that init_codecs is invoked multiple times during
manipulated payload from video firmware. In such case, if codecs_count
can get incremented to value more than MAX_CODEC_NUM, there can be OOB
access. Reset the count so that it always starts from beginning.
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
(cherry picked from commit 172bf5a9ef70a399bb227809db78442dc01d9e48 https://gitlab.freedesktop.org/linux-media/media-committers.git master)
Change-Id: I6216e773af65082e4775b415789ffd549e0bed2d
Signed-off-by: Gaviraju Doddabettahalli Bettegowda <quic_gdoddabe@quicinc.com>
commit 9edaaa8e3e15aab1ca413ab50556de1975bcb329 upstream.
words_count denotes the number of words in total payload, while data
points to payload of various property within it. When words_count
reaches last word, data can access memory beyond the total payload. This
can lead to OOB access. With this patch, the utility api for handling
individual properties now returns the size of data consumed. Accordingly
remaining bytes are calculated before parsing the payload, thereby
eliminates the OOB access possibilities.
Cc: stable@vger.kernel.org
Fixes: 1a73374a04 ("media: venus: hfi_parser: add common capability parser")
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 172bf5a9ef70a399bb227809db78442dc01d9e48 upstream.
There is a possibility that init_codecs is invoked multiple times during
manipulated payload from video firmware. In such case, if codecs_count
can get incremented to value more than MAX_CODEC_NUM, there can be OOB
access. Reset the count so that it always starts from beginning.
Cc: stable@vger.kernel.org
Fixes: 1a73374a04 ("media: venus: hfi_parser: add common capability parser")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream.
qsize represents size of shared queued between driver and video
firmware. Firmware can modify this value to an invalid large value. In
such situation, empty_space will be bigger than the space actually
available. Since new_wr_idx is not checked, so the following code will
result in an OOB write.
...
qsize = qhdr->q_size
if (wr_idx >= rd_idx)
empty_space = qsize - (wr_idx - rd_idx)
....
if (new_wr_idx < qsize) {
memcpy(wr_ptr, packet, dwords << 2) --> OOB write
Add check to ensure qsize is within the allocated size while
reading and writing packets into the queue.
Cc: stable@vger.kernel.org
Fixes: d96d3f30c0 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f4b211714bcc70effa60c34d9fa613d182e3ef1e upstream.
sfr->buf_size is in shared memory and can be modified by malicious user.
OOB write is possible when the size is made higher than actual sfr data
buffer. Cap the size to allocated size for such cases.
Cc: stable@vger.kernel.org
Fixes: d96d3f30c0 ("[media] media: venus: hfi: add Venus HFI files")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add the capability of retrieving the min and max values of a
compound control.
[Ricardo: Added static to v4l2_ctrl_type_op_(maximum|minimum) proto]
[Ricardo: Fix documentation]
Signed-off-by: Yunke Cao <yunkec@google.com>
Tested-by: Yunke Cao <yunkec@google.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://lore.kernel.org/r/20250203-uvc-roi-v17-2-5900a9fed613@chromium.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: fix small alignment checkpatch warning]
(cherry picked from commit a5bd42aafb068427ecf4d6d34fa023944f211922)
Bug: 381493003
Bug: 408968367
Change-Id: I7dba61a9bc9fcf43efa26026f8a770042eb7e82f
Signed-off-by: Ricardo Ribalda <ribalda@google.com>
commit 4f45d65b781499d2a79eca12155532739c876aa2 upstream.
There is a chance to meet runtime issues during configuration of CAMSS
power domains, because on the error path dev_pm_domain_detach() is
unexpectedly called with NULL or error pointer.
One of the simplest ways to reproduce the problem is to probe CAMSS
driver before registration of CAMSS power domains, for instance if
a platform CAMCC driver is simply not built.
Warning backtrace example:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
<snip>
pc : dev_pm_domain_detach+0x8/0x48
lr : camss_probe+0x374/0x9c0
<snip>
Call trace:
dev_pm_domain_detach+0x8/0x48
platform_probe+0x70/0xf0
really_probe+0xc4/0x2a8
__driver_probe_device+0x80/0x140
driver_probe_device+0x48/0x170
__device_attach_driver+0xc0/0x148
bus_for_each_drv+0x88/0xf0
__device_attach+0xb0/0x1c0
device_initial_probe+0x1c/0x30
bus_probe_device+0xb4/0xc0
deferred_probe_work_func+0x90/0xd0
process_one_work+0x164/0x3e0
worker_thread+0x310/0x420
kthread+0x120/0x130
ret_from_fork+0x10/0x20
Fixes: 23aa4f0cd3 ("media: qcom: camss: Move VFE power-domain specifics into vfe.c")
Cc: <stable@vger.kernel.org>
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull media updates from Mauro Carvalho Chehab:
- New CEC driver: Extron DA HD 4K Plus
- Lots of driver fixes, cleanups and improvements
* tag 'media/v6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (179 commits)
media: atomisp: Use clamp() in ia_css_eed1_8_vmem_encode()
media: atomisp: Fix eed1_8 code assigning signed values to an unsigned variable
media: atomisp: set lock before calling vb2_queue_init()
media: atomisp: Improve binary finding debug logging
media: atomisp: Drop dev_dbg() calls from hmm_[alloc|free]()
media: atomisp: csi2-bridge: Add DMI quirk for t4ka3 on Xiaomi Mipad2
media: atomisp: add missing wait_prepare/finish ops
media: atomisp: Remove unused declaration
media: atomisp: use clamp() in compute_coring()
media: atomisp: use clamp() in ia_css_eed1_8_encode()
media: atomisp: Simplify ia_css_pipe_create_cas_scaler_desc_single_output()
media: atomisp: Replace rarely used macro from math_support.h
media: atomisp: Remove duplicated leftover, i.e. sh_css_dvs_info.h
media: atomisp: bnr: fix trailing statement
media: atomisp: move trailing */ to separate lines
media: atomisp: move trailing statement to next line.
media: atomisp: Fix trailing statement in ia_css_de.host.c
media: atomisp: Fix spelling mistakes in atomisp.h
media: atomisp: Fix spelling mistakes in atomisp_platform.h
media: atomisp: Fix spelling mistake in csi_rx_public.h
...
"struct dec_bufsize_ops and "struct enc_bufsize_ops" are not modified in
this driver.
Constifying these structures moves some data to a read-only section, so
increase overall security.
On a x86_64, with allmodconfig:
Before:
text data bss dec hex filename
12494 822 0 13316 3404 drivers/media/platform/qcom/venus/hfi_plat_bufs_v6.o
After:
text data bss dec hex filename
12766 566 0 13332 3414 drivers/media/platform/qcom/venus/hfi_plat_bufs_v6.o
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
in venus_probe, core->work is bound with venus_sys_error_handler, which is
used to handle error. The code use core->sys_err_done to make sync work.
The core->work is started in venus_event_notify.
If we call venus_remove, there might be an unfished work. The possible
sequence is as follows:
CPU0 CPU1
|venus_sys_error_handler
venus_remove |
hfi_destroy |
venus_hfi_destroy |
kfree(hdev); |
|hfi_reinit
|venus_hfi_queues_reinit
|//use hdev
Fix it by canceling the work in venus_remove.
Cc: stable@vger.kernel.org
Fixes: af2c3834c8 ("[media] media: venus: adding core part and helper functions")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
pm_runtime_enable() should happen prior to vfe_get() since vfe_get() calls
pm_runtime_resume_and_get().
This is a basic race condition that doesn't show up for most users so is
not widely reported. If you blacklist qcom-camss in modules.d and then
subsequently modprobe the module post-boot it is possible to reliably show
this error up.
The kernel log for this error looks like this:
qcom-camss ac5a000.camss: Failed to power up pipeline: -13
Fixes: 02afa816db ("media: camss: Add basic runtime PM support")
Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/lkml/ZoVNHOTI0PKMNt4_@hovoldconsulting.com/
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Konrad Dybcio <konradybcio@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
The use_count check was introduced so that multiple concurrent Raw Data
Interfaces RDIs could be driven by different virtual channels VCs on the
CSIPHY input driving the video pipeline.
This is an invalid use of use_count though as use_count pertains to the
number of times a video entity has been opened by user-space not the number
of active streams.
If use_count and stream-on count don't agree then stop_streaming() will
break as is currently the case and has become apparent when using CAMSS
with libcamera's released softisp 0.3.
The use of use_count like this is a bit hacky and right now breaks regular
usage of CAMSS for a single stream case. Stopping qcam results in the splat
below, and then it cannot be started again and any attempts to do so fails
with -EBUSY.
[ 1265.509831] WARNING: CPU: 5 PID: 919 at drivers/media/common/videobuf2/videobuf2-core.c:2183 __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]
...
[ 1265.510630] Call trace:
[ 1265.510636] __vb2_queue_cancel+0x230/0x2c8 [videobuf2_common]
[ 1265.510648] vb2_core_streamoff+0x24/0xcc [videobuf2_common]
[ 1265.510660] vb2_ioctl_streamoff+0x5c/0xa8 [videobuf2_v4l2]
[ 1265.510673] v4l_streamoff+0x24/0x30 [videodev]
[ 1265.510707] __video_do_ioctl+0x190/0x3f4 [videodev]
[ 1265.510732] video_usercopy+0x304/0x8c4 [videodev]
[ 1265.510757] video_ioctl2+0x18/0x34 [videodev]
[ 1265.510782] v4l2_ioctl+0x40/0x60 [videodev]
...
[ 1265.510944] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 0 in active state
[ 1265.511175] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 1 in active state
[ 1265.511398] videobuf2_common: driver bug: stop_streaming operation is leaving buffer 2 in active st
One CAMSS specific way to handle multiple VCs on the same RDI might be:
- Reference count each pipeline enable for CSIPHY, CSID, VFE and RDIx.
- The video buffers are already associated with msm_vfeN_rdiX so
release video buffers when told to do so by stop_streaming.
- Only release the power-domains for the CSIPHY, CSID and VFE when
their internal refcounts drop.
Either way refusing to release video buffers based on use_count is
erroneous and should be reverted. The silicon enabling code for selecting
VCs is perfectly fine. Its a "known missing feature" that concurrent VCs
won't work with CAMSS right now.
Initial testing with this code didn't show an error but, SoftISP and "real"
usage with Google Hangouts breaks the upstream code pretty quickly, we need
to do a partial revert and take another pass at VCs.
This commit partially reverts commit 89013969e2 ("media: camss: sm8250:
Pipeline starting and stopping for multiple virtual channels")
Fixes: 89013969e2 ("media: camss: sm8250: Pipeline starting and stopping for multiple virtual channels")
Reported-by: Johan Hovold <johan+linaro@kernel.org>
Closes: https://lore.kernel.org/lkml/ZoVNHOTI0PKMNt4_@hovoldconsulting.com/
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Pull media updates from Mauro Carvalho Chehab:
- New sensor drivers: gc05a2, gc08a3 and imx283
- New serializer/deserializer drivers: max96714 and max96717
- New JPEG encoder driver: e5010
- Support for Raspberry Pi PiSP Backend (BE) ISP driver
- Old documentation for av7110 driver removed, as a new version was
added as Documentation/userspace-api/media/dvb/legacy*.rst
- atompisp: Linux firmwares are now available, so drop firmware-related
task from TODO and update firmware logic
- The imx258 driver has gained several improvements
- wave5 driver has gained support for HEVC decoding
- em28xx gained support for MyGica UTV3
- av7110 budget-patch driver removed
- Lots of other cleanups, improvements and fixes
* tag 'media/v6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (301 commits)
media: raspberrypi: Switch to remove_new
media: uapi: pisp_be_config: Add extra config fields
media: uapi: pisp_be_config: Re-sort pisp_be_tiles_config
media: uapi: pisp_common: Capitalize all macros
media: uapi: pisp_common: Add 32 bpp format test
media: uapi: pisp_be_config: Drop BIT() from uAPI
media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs
media: atomisp: Fix spelling mistakes in sh_css_sp.c
media: atomisp: Fix spelling mistake in ia_css_debug.c
media: atomisp: Fix spelling mistake in hmm_bo.c
media: atomisp: Fix spelling mistake in ia_css_eed1_8.host.c
media: atomisp: Fix spelling mistake in sh_css_internal.h
media: atomisp: Fix spelling mistake "pipline" -> "pipeline"
media: atomisp: Remove unused GPIO related defines and APIs
media: atomisp: Replace COMPILATION_ERROR_IF() by static_assert()
media: atomisp: Clean up unused macros from math_support.h
media: atomisp: csi2-bridge: Add DMI quirk for OV5693 on Xiaomi Mipad2
media: atomisp: Update TODO
media: atomisp: Prefix firmware paths with "intel/ipu/"
media: atomisp: Remove firmware_name module parameter
...
The Venus driver requires vcodec GDSC to be ON in SW mode for clock
operations and move it back to HW mode to gain power benefits. Earlier,
as there is no interface to switch the GDSC mode from GenPD framework,
the GDSC is moved to HW control mode as part of GDSC enable callback and
venus driver is writing to its POWER_CONTROL register to keep the GDSC ON
from SW whereever required. But the POWER_CONTROL register addresses
are not constant and can vary across the variants.
Also as per the HW recommendation, the GDSC mode switching needs to be
controlled from respective GDSC register and this is a uniform approach
across all the targets. Hence use dev_pm_genpd_set_hwmode() API which
controls GDSC mode switching using its respective GDSC register.
In venus V6 variants, the vcodec gdsc gets enabled in SW mode by default
with new HW_CTRL_TRIGGER flag and there is no need to switch it to SW
mode again after enable, hence add check to avoid switching gdsc to SW mode
again after gdsc enable. Similarly add check to avoid switching GDSC to HW
mode before disabling the GDSC, so GDSC gets enabled in SW mode in the next
enable.
Signed-off-by: Jagadeesh Kona <quic_jkona@quicinc.com>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Taniya Das <quic_tdas@quicinc.com>
Link: https://lore.kernel.org/r/20240624044809.17751-6-quic_jkona@quicinc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
There appears to be a possible use after free with vdec_close().
The firmware will add buffer release work to the work queue through
HFI callbacks as a normal part of decoding. Randomly closing the
decoder device from userspace during normal decoding can incur
a read after free for inst.
Fix it by cancelling the work in vdec_close.
Cc: stable@vger.kernel.org
Fixes: af2c3834c8 ("[media] media: venus: adding core part and helper functions")
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Acked-by: Vikash Garodia <quic_vgarodia@quicinc.com>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Core dump is generated whenever there is system error reported
by firmware. Right now, multiple such dumps are generated if
recovery fails in first attempt, since the sys error handler is
invoked again for every failed recovery.
To avoid it, add conditional check to generate core dump only
once during every system error notification from firmware.
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: document new dump_core field]
For scenarios, when source change is followed by VIDIOC_STREAMOFF
on output plane, driver should discard any queued OUTPUT
buffers, which are not decoded or dequeued.
Flush with HFI_FLUSH_INPUT does not have any actual impact.
So, fix it, by invoking HFI_FLUSH_ALL, which will flush all
queued buffers.
Fixes: 85872f861d ("media: venus: Mark last capture buffer")
Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
Tested-by: Nathan Hebert <nhebert@chromium.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Add check for the return value of v4l2_fwnode_endpoint_parse() and
return the error if it fails in order to catch the error.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Decouple the direct calls to VFE's vfe_get/put in the CSID subdev
in order to prepare for the introduction of IFE subdev.
Also decouple CSID base address from VFE since on the Titan platform
CSID register base address resides within VFE's base address.
Signed-off-by: Milen Mitkov <quic_mmitkov@quicinc.com>
Signed-off-by: Gjorgji Rosikopulos <quic_grosikop@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # sc8280xp/sm8250/sdm845/apq8016
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Greg Kroah-Hartman
Gaviraju Doddabettahalli Bettegowda
Loic Poulain
Depeng Shao
Vikash Garodia
Hans Verkuil
Jinjie Ruan
Vladimir Zapolskiy
Linus Torvalds
Lu Baolu
Ricardo Ribalda
Christophe JAILLET
Zheng Wang
Kees Cook
Dikshita Agarwal
Bryan O'Donoghue
Jagadeesh Kona
Pierre-Hugues Husson
Chen Ni
Milen Mitkov
Atanas Filipov
Radoslav Tsvetkov