[5.7,233/477] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata

From: Suzuki K Poulose <suzuki.poulose@arm.com>

From: Suzuki K Poulose <suzuki.poulose@arm.com>

[ Upstream commit 3f4943d422c5febbb3c764670011a00eb2a86238 ]

etm probe could be deferred due to the dependency in the trace
path chain and may be retried. We need to clear the per-cpu
etmdrvdata entry for the etm in case of a failure to avoid
use-after-free cases as reported below:

KASAN use-after-free bug in etm4_cpu_pm_notify():

[    8.574566] coresight etm0: CPU0: ETM v4.2 initialized
[    8.581920] BUG: KASAN: use-after-free in etm4_cpu_pm_notify+0x580/0x2024
[    8.581925] Read of size 8 at addr ffffff813304f8c8 by task swapper/3/0
[    8.581927]
[    8.581934] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S      W         5.4.28 #314
[    8.587775] coresight etm1: CPU1: ETM v4.2 initialized
[    8.594195] Call trace:
[    8.594205]  dump_backtrace+0x0/0x188
[    8.594209]  show_stack+0x20/0x2c
[    8.594216]  dump_stack+0xdc/0x144
[    8.594227]  print_address_description+0x3c/0x494
[    8.594232]  __kasan_report+0x144/0x168
[    8.601598] coresight etm2: CPU2: ETM v4.2 initialized
[    8.602563]  kasan_report+0x10/0x18
[    8.602568]  check_memory_region+0x1a4/0x1b4
[    8.602572]  __kasan_check_read+0x18/0x24
[    8.602577]  etm4_cpu_pm_notify+0x580/0x2024
[    8.665945]  notifier_call_chain+0x5c/0x90
[    8.670166]  __atomic_notifier_call_chain+0x90/0xf8
[    8.675182]  cpu_pm_notify+0x40/0x6c
[    8.678858]  cpu_pm_enter+0x38/0x80
[    8.682451]  psci_enter_idle_state+0x34/0x70
[    8.686844]  cpuidle_enter_state+0xb8/0x20c
[    8.691143]  cpuidle_enter+0x38/0x4c
[    8.694820]  call_cpuidle+0x3c/0x68
[    8.698408]  do_idle+0x1a0/0x280
[    8.701729]  cpu_startup_entry+0x24/0x28
[    8.705768]  secondary_start_kernel+0x15c/0x170
[    8.710423]
[    8.711972] Allocated by task 242:
[    8.715473]  __kasan_kmalloc+0xf0/0x1ac
[    8.719426]  kasan_slab_alloc+0x14/0x1c
[    8.723375]  __kmalloc_track_caller+0x23c/0x388
[    8.728040]  devm_kmalloc+0x38/0x94
[    8.731632]  etm4_probe+0x48/0x3c8
[    8.735140]  amba_probe+0xbc/0x158
[    8.738645]  really_probe+0x144/0x408
[    8.742412]  driver_probe_device+0x70/0x140
[    8.746716]  __device_attach_driver+0x9c/0x110
[    8.751287]  bus_for_each_drv+0x90/0xd8
[    8.755236]  __device_attach+0xb4/0x164
[    8.759188]  device_initial_probe+0x20/0x2c
[    8.763490]  bus_probe_device+0x34/0x94
[    8.767436]  device_add+0x34c/0x3e0
[    8.771029]  amba_device_try_add+0x68/0x440
[    8.775332]  amba_deferred_retry_func+0x48/0xc8
[    8.779997]  process_one_work+0x344/0x648
[    8.784127]  worker_thread+0x2ac/0x47c
[    8.787987]  kthread+0x128/0x138
[    8.791313]  ret_from_fork+0x10/0x18
[    8.794993]
[    8.796532] Freed by task 242:
[    8.799684]  __kasan_slab_free+0x15c/0x22c
[    8.803897]  kasan_slab_free+0x10/0x1c
[    8.807761]  kfree+0x25c/0x4bc
[    8.810913]  release_nodes+0x240/0x2b0
[    8.814767]  devres_release_all+0x3c/0x54
[    8.818887]  really_probe+0x178/0x408
[    8.822661]  driver_probe_device+0x70/0x140
[    8.826963]  __device_attach_driver+0x9c/0x110
[    8.831539]  bus_for_each_drv+0x90/0xd8
[    8.835487]  __device_attach+0xb4/0x164
[    8.839431]  device_initial_probe+0x20/0x2c
[    8.843732]  bus_probe_device+0x34/0x94
[    8.847678]  device_add+0x34c/0x3e0
[    8.851274]  amba_device_try_add+0x68/0x440
[    8.855576]  amba_deferred_retry_func+0x48/0xc8
[    8.860240]  process_one_work+0x344/0x648
[    8.864366]  worker_thread+0x2ac/0x47c
[    8.868228]  kthread+0x128/0x138
[    8.871557]  ret_from_fork+0x10/0x18
[    8.875231]
[    8.876782] The buggy address belongs to the object at ffffff813304f800
[    8.876782]  which belongs to the cache kmalloc-1k of size 1024
[    8.889632] The buggy address is located 200 bytes inside of
[    8.889632]  1024-byte region [ffffff813304f800, ffffff813304fc00)
[    8.901761] The buggy address belongs to the page:
[    8.906695] page:ffffffff04ac1200 refcount:1 mapcount:0 mapping:ffffff8146c03800 index:0x0 compound_mapcount: 0
[    8.917047] flags: 0x4000000000010200(slab|head)
[    8.921799] raw: 4000000000010200 dead000000000100 dead000000000122 ffffff8146c03800
[    8.929753] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[    8.937703] page dumped because: kasan: bad access detected
[    8.943433]
[    8.944974] Memory state around the buggy address:
[    8.949903]  ffffff813304f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    8.957320]  ffffff813304f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.964742] >ffffff813304f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.972157]                                               ^
[    8.977886]  ffffff813304f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.985298]  ffffff813304f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.992713] ==================================================================

Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states")
Reported-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Mike Leach <mike.leach@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>

Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

Link: https://lore.kernel.org/r/20200518180242.7916-22-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <sashal@kernel.org>

---
 drivers/hwtracing/coresight/coresight-etm4x.c | 1 +
 1 file changed, 1 insertion(+)

-- 
2.25.1

Message ID	20200623195418.586430537@linuxfoundation.org
State	New
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>, Mathieu Poirier <mathieu.poirier@linaro.org>, Mike Leach <mike.leach@linaro.org>, Suzuki K Poulose <suzuki.poulose@arm.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.7 233/477] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata Date: Tue, 23 Jun 2020 21:53:50 +0200 Message-Id: <20200623195418.586430537@linuxfoundation.org> In-Reply-To: <20200623195407.572062007@linuxfoundation.org> References: <20200623195407.572062007@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,002/477] power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select [5.7,003/477] clk: sunxi: Fix incorrect usage of round_down() [5.7,005/477] rtc: rc5t619: Fix an ERR_PTR vs NULL check [5.7,006/477] i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets [5.7,009/477] remoteproc: Fix IDR initialisation in rproc_alloc() [5.7,010/477] clk: qcom: msm8916: Fix the address location of pll->config_reg [5.7,012/477] ASoC: fsl_esai: Disable exception interrupt before scheduling tasklet [5.7,014/477] ARM: dts: renesas: Fix IOMMU device node names [5.7,016/477] ARM: integrator: Add some Kconfig selections [5.7,019/477] ASoC: codecs: wm97xx: fix ac97 dependency [5.7,020/477] arm64: dts: meson-gxbb-kii-pro: fix board compatible [5.7,022/477] scsi: qedi: Check for buffer overflow in qedi_set_path() [5.7,025/477] ALSA: isa/wavefront: prevent out of bounds write in ioctl [5.7,027/477] PCI: endpoint: functions/pci-epf-test: Fix DMA channel release [5.7,028/477] scsi: qla2xxx: Fix issue with adapters stopping state [5.7,032/477] rtc: mc13xxx: fix a double-unlock issue [5.7,035/477] f2fs: report delalloc reserve as non-free in statfs for project quota [5.7,037/477] remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use [5.7,038/477] clk: samsung: Mark top ISP and CAM clocks on Exynos542x as critical [5.7,039/477] staging: wfx: fix output of rx_stats on big endian hosts [5.7,040/477] usblp: poison URBs upon disconnect [5.7,041/477] usb: roles: Switch on role-switch uevent reporting [5.7,042/477] serial: 8250: Fix max baud limit in generic 8250 port [5.7,044/477] misc: fastrpc: Fix an incomplete memory release in fastrpc_rpmsg_probe() [5.7,045/477] misc: fastrpc: fix potential fastrpc_invoke_ctx leak [5.7,046/477] dm mpath: switch paths in dm_blk_ioctl() code path [5.7,048/477] arm64: dts: armada-3720-turris-mox: fix SFP binding [5.7,049/477] arm64: dts: juno: Fix GIC child nodes [5.7,052/477] pinctrl: ocelot: Fix GPIO interrupt decoding on Jaguar2 [5.7,054/477] ASoC: SOF: Do nothing when DSP PM callbacks are not set [5.7,057/477] ps3disk: use the default segment boundary [5.7,058/477] arm64: dts: fvp/juno: Fix node address fields [5.7,060/477] arm64: dts: qcom: sc7180: Correct the pdc interrupt ranges [5.7,063/477] scsi: hisi_sas: Do not reset phy timer to wait for stray phy up [5.7,064/477] powerpc/book3s64/radix/tlb: Determine hugepage flush correctly [5.7,066/477] m68k/PCI: Fix a memory leak in an error handling path [5.7,068/477] usb: cdns3: Fix runtime PM imbalance on error [5.7,071/477] powerpc/ptdump: Add _PAGE_COHERENT flag [5.7,072/477] mfd: wm8994: Fix driver operation if loaded as modules [5.7,075/477] scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event [5.7,076/477] scsi: vhost: Notify TCM about the maximum sg entries supported per command [5.7,077/477] clk: clk-flexgen: fix clock-critical handling [5.7,081/477] PCI: vmd: Filter resource type bits from shadow register [5.7,082/477] RDMA/core: Fix several reference count leaks. [5.7,084/477] ASoC: qcom: q6asm-dai: kCFI fix [5.7,085/477] powerpc/crashkernel: Take "mem=" option into account [5.7,086/477] pwm: img: Call pm_runtime_put() in pm_runtime_get_sync() failed case [5.7,088/477] clk: sprd: fix compile-testing [5.7,089/477] drm/nouveau: gr/gk20a: Use firmware version 0 [5.7,090/477] crypto: omap-sham - huge buffer access fixes [5.7,091/477] yam: fix possible memory leak in yam_init_driver [5.7,092/477] net: mdiobus: Disable preemption upon u64_stats update [5.7,094/477] NTB: ntb_pingpong: Choose doorbells based on port number [5.7,095/477] NTB: Fix the default port and peer numbers for legacy drivers [5.7,097/477] apparmor: fix introspection of of task mode for unconfined tasks [5.7,098/477] net: dsa: lantiq_gswip: fix and improve the unsupported interface error [5.7,105/477] scsi: sr: Fix sr_probe() missing deallocate of device minor [5.7,107/477] media: s5p-mfc: Properly handle dma_parms for the allocated devices [5.7,109/477] ibmvnic: Flush existing work items before device removal [5.7,112/477] x86/purgatory: Disable various profiling and sanitizing options [5.7,113/477] ARM: dts: bcm283x: Use firmware PM driver for V3D [5.7,114/477] arm64: dts: realtek: rtd129x: Fix GIC CPU masks for RTD1293 [5.7,116/477] staging: rtl8712: fix multiline derefernce warnings [5.7,118/477] arm64: dts: mt8173: fix unit name warnings [5.7,120/477] arm64: dts: qcom: msm8916: remove unit name for thermal trip points [5.7,121/477] ARM: dts: sun8i-h2-plus-bananapi-m2-zero: Fix led polarity [5.7,123/477] ALSA: usb-audio: RME Babyface Pro mixer patch [5.7,125/477] scsi: qedf: Fix crash when MFW calls for protocol stats while function is still pro... [5.7,127/477] pinctrl: rza1: Fix wrong array assignment of rza1l_swio_entries [5.7,129/477] fuse: BUG_ON correction in fuse_dev_splice_write() [5.7,130/477] arm64: dts: qcom: fix pm8150 gpio interrupts [5.7,131/477] firmware: qcom_scm: fix bogous abuse of dma-direct internals [5.7,132/477] arm64: dts: qcom: sm8250: Fix PDC compatible and reg [5.7,133/477] staging: gasket: Fix mapping refcnt leak when put attribute fails [5.7,134/477] staging: gasket: Fix mapping refcnt leak when register/store fails [5.7,136/477] ALSA: usb-audio: Fix racy list management in output queue [5.7,137/477] Input: mms114 - add extra compatible for mms345l [5.7,138/477] s390/qdio: consistently restore the IRQ handler [5.7,140/477] s390/qdio: put thinint indicator after early error [5.7,141/477] staging: wfx: fix overflow in frame counters [5.7,143/477] tty: hvc: Fix data abort due to race in hvc_open [5.7,144/477] slimbus: ngd: get drvdata from correct device [5.7,146/477] of: property: Fix create device links for all child-supplier dependencies [5.7,147/477] of: property: Do not link to disabled devices [5.7,150/477] clk: meson: meson8b: Fix the vclk_div{1, 2, 4, 6, 12}_en gate bits [5.7,151/477] gpio: pca953x: fix handling of automatic address incrementing [5.7,152/477] ASoC: component: suppress uninitialized-variable warning [5.7,153/477] thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR [5.7,154/477] ASoC: rt5682: fix I2C/Soundwire dependencies [5.7,155/477] arm64: dts: meson-g12b-ugoos-am6: fix board compatible [5.7,156/477] arm64: dts: meson: fix leds subnodes name [5.7,159/477] ASoC: max98373: reorder max98373_reset() in resume [5.7,161/477] ARM: dts: aspeed: ast2600: Set arch timer always-on [5.7,162/477] ARM: dts: aspeed: Change KCS nodes to v2 binding [5.7,163/477] HID: intel-ish-hid: avoid bogus uninitialized-variable warning [5.7,169/477] staging: wfx: avoid compiler warning on empty array [5.7,173/477] PCI: rcar: Fix incorrect programming of OB windows [5.7,174/477] PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges [5.7,175/477] scsi: qla2xxx: Fix warning after FC target reset [5.7,177/477] power: supply: lp8788: Fix an error handling path in lp8788_charger_probe() [5.7,178/477] power: supply: smb347-charger: IRQSTAT_D is volatile [5.7,181/477] remoteproc/mediatek: fix invalid use of sizeof in scp_ipi_init() [5.7,182/477] arm64: dts: msm8996: Fix CSI IRQ types [5.7,185/477] f2fs: Fix wrong stub helper update_sit_info [5.7,187/477] f2fs: compress: fix zstd data corruption [5.7,188/477] um: do not evaluate compilers library path when cleaning [5.7,190/477] SoC: rsnd: add interrupt support for SSI BUSIF buffer [5.7,192/477] ASoC: ti: omap-mcbsp: Fix an error handling path in asoc_mcbsp_probe() [5.7,193/477] pinctrl: rockchip: fix memleak in rockchip_dt_node_to_map [5.7,195/477] dlm: remove BUG() before panic() [5.7,196/477] phy: ti: j721e-wiz: Fix some error return code in wiz_probe() [5.7,198/477] arm64: dts: qcom: db820c: Fix invalid pm8994 supplies [5.7,199/477] arm64: dts: qcom: c630: Add WiFi node [5.7,200/477] clk: ti: composite: fix memory leak [5.7,201/477] PCI: Fix pci_register_host_bridge() device_register() error handling [5.7,202/477] powerpc/64: Dont initialise init_task->thread.regs [5.7,205/477] staging: wfx: fix value of scan timeout [5.7,208/477] HID: Add quirks for Trust Panora Graphic Tablet [5.7,209/477] PCI/PM: Assume ports without DLL Link Active train links in 100 ms [5.7,212/477] pinctrl: ocelot: Always register GPIO driver [5.7,213/477] ipmi: use vzalloc instead of kmalloc for user creation [5.7,216/477] powerpc/64s/exceptions: Machine check reconcile irq state [5.7,218/477] PCI: aardvark: Train link immediately after enabling training [5.7,220/477] PCI: aardvark: Issue PERST via GPIO [5.7,222/477] phy: cadence: sierra: Fix for USB3 U1/U2 state [5.7,224/477] iommu/arm-smmu-v3: Dont reserve implementation defined register space [5.7,226/477] usb/ohci-platform: Fix a warning when hibernating [5.7,227/477] drm/msm: Fix undefined "rd_full" link error [5.7,228/477] drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation [5.7,230/477] USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() [5.7,231/477] tty: n_gsm: Fix bogus i++ in gsm_data_kick [5.7,232/477] coresight: Fix support for sparsely populated ports [5.7,233/477] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata [5.7,234/477] fpga: dfl: afu: Corrected error handling levels [5.7,235/477] clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 [5.7,237/477] RDMA/hns: Fix cmdq parameter of querying pf timer resource [5.7,238/477] scsi: target: tcmu: Userspace must not complete queued commands [5.7,241/477] fuse: fix copy_file_range cache issues [5.7,242/477] fuse: copy_file_range should truncate cache [5.7,245/477] powerpc/powernv: add NULL check after kzalloc [5.7,248/477] dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone [5.7,250/477] xen/cpuhotplug: Fix initial CPU offlining for PV(H) guests [5.7,252/477] bus: mhi: core: Read transfer length from an event properly [5.7,253/477] PCI: dwc: pci-dra7xx: Use devm_platform_ioremap_resource_byname() [5.7,254/477] PCI: dwc: Fix inner MSI IRQ domain registration [5.7,255/477] PCI: amlogic: meson: Dont use FAST_LINK_MODE to set up link [5.7,259/477] watchdog: da9062: No need to ping manually before setting timeout [5.7,261/477] USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke [5.7,262/477] usb: gadget: lpc32xx_udc: dont dereference ep pointer before null check [5.7,266/477] scripts: headers_install: Exit with error on config leak [5.7,270/477] mfd: stmfx: Fix stmfx_irq_init error path [5.7,271/477] mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt [5.7,273/477] powerpc/32s: Dont warn when mapping RO data ROX. [5.7,274/477] powerpc/8xx: Drop CONFIG_8xx_COPYBACK option [5.7,278/477] scsi: ufs-qcom: Fix scheduling while atomic issue [5.7,280/477] scsi: iscsi: Fix deadlock on recovery path during GFP_IO reclaim [5.7,282/477] KVM: PPC: Book3S HV: Ignore kmemleak false positives [5.7,283/477] KVM: PPC: Book3S: Fix some RCU-list locks [5.7,286/477] clk: ast2600: Fix AHB clock divider for A1 [5.7,287/477] misc: xilinx-sdfec: improve get_user_pages_fast() error handling [5.7,289/477] ASoC: dapm: Move dai_link widgets to runtime to fix use after free [5.7,290/477] net: sunrpc: Fix off-by-one issues in rpc_ntop6 [5.7,293/477] ARM: davinci: fix build failure without I2C [5.7,294/477] input: i8042 - Remove special PowerPC handling [5.7,298/477] usb: dwc3: meson-g12a: fix error path when fetching the reset line fails [5.7,300/477] ASoC: SOF: Intel: hda: fix generic hda codec support [5.7,301/477] vfio/mdev: Fix reference count leak in add_mdev_supported_type [5.7,303/477] mailbox: imx: Fix return in imx_mu_scu_xlate() [5.7,304/477] mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe() [5.7,306/477] openrisc: Fix issue with argument clobbering for clone/fork [5.7,307/477] drm/nouveau/disp/gm200-: fix NV_PDISP_SOR_HDMI2_CTRL(n) selection [5.7,310/477] pwm: imx27: Fix rounding behavior [5.7,312/477] scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj [5.7,315/477] pinctrl: imxl: Fix an error handling path in imx1_pinctrl_core_probe() [5.7,318/477] pinctrl: freescale: imx: Use devm_of_iomap() to avoid a resource leak in case of er... [5.7,319/477] nfsd: safer handling of corrupted c_type [5.7,320/477] RDMA/cm: Spurious WARNING triggered in cm_destroy_id() [5.7,321/477] drm/amd/display: Revalidate bandwidth before commiting DC updates [5.7,322/477] ext4: handle ext4_mark_inode_dirty errors [5.7,324/477] crypto: omap-sham - add proper load balancing support for multicore [5.7,325/477] pwm: Add missing "CONFIG_" prefix [5.7,328/477] lib/zlib: remove outdated and incorrect pre-increment optimization [5.7,329/477] include/linux/bitops.h: avoid clang shift-count-overflow warnings [5.7,332/477] blktrace: fix endianness in get_pdu_int() [5.7,334/477] KVM: selftests: Fix build with "make ARCH=x86_64" [5.7,336/477] net: dp83867: Fix OF_MDIO config check [5.7,337/477] net: marvell: Fix OF_MDIO config check [5.7,338/477] net: mscc: Fix OF_MDIO config check [5.7,341/477] NTB: ntb_tool: reading the link file should not end in a NULL byte [5.7,343/477] NTB: perf: Dont require one more memory window than number of peers [5.7,344/477] NTB: perf: Fix support for hardware that doesnt have port numbers [5.7,346/477] NTB: ntb_test: Fix bug when counting remote files [5.7,348/477] mailbox: imx: Add context save/restore for suspend/resume [5.7,349/477] arm64: ftrace: Change CONFIG_FTRACE_WITH_REGS to CONFIG_DYNAMIC_FTRACE_WITH_REGS [5.7,351/477] selftests/net: in timestamping, strncpy needs to preserve null byte [5.7,354/477] ASoC: soc-pcm: dpcm: fix playback/capture checks [5.7,355/477] ASoC: core: only convert non DPCM link to DPCM link [5.7,359/477] bpf/sockmap: Fix kernel panic at __tcp_bpf_recvmsg [5.7,360/477] bpf, sockhash: Synchronize delete from bucket list on map free [5.7,361/477] tracing/probe: Fix bpf_task_fd_query() for kprobes and uprobes [5.7,362/477] drm/sun4i: hdmi ddc clk: Fix size of m divider [5.7,364/477] scsi: acornscsi: Fix an error handling path in acornscsi_probe() [5.7,366/477] x86/idt: Keep spurious entries unset in system_vectors [5.7,367/477] x86/mce/dev-mcelog: Fix -Wstringop-truncation warning about strncpy() [5.7,369/477] tools, bpftool: Fix memory leak in codegen error cases [5.7,372/477] nfs: set invalid blocks after NFSv4 writes [5.7,373/477] NFS: Fix direct WRITE throughput regression [5.7,376/477] net: ipa: program upper nibbles of sequencer type [5.7,377/477] bpf: sockmap: Dont attach programs to UDP sockets [5.7,379/477] libbpf: Support pre-initializing .bss global variables [5.7,382/477] usb/ehci-platform: Set PM runtime as active on resume [5.7,383/477] perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() [5.7,384/477] perf stat: Fix NULL pointer dereference [5.7,389/477] crypto: hisilicon - Cap block size at 2^31 [5.7,391/477] powerpc: Fix kernel crash in show_instructions() w/DEBUG_VIRTUAL [5.7,392/477] afs: Fix non-setting of mtime when writing into mmap [5.7,394/477] afs: Fix EOF corruption [5.7,396/477] afs: Set error flag rather than return error from file status decode [5.7,398/477] afs: Fix the mapping of the UAEOVERFLOW abort code [5.7,399/477] bnxt_en: Simplify bnxt_resume(). [5.7,401/477] bnxt_en: Fix AER reset logic on 57500 chips. [5.7,403/477] net: dsa: sja1105: fix PTP timestamping with large tc-taprio cycles [5.7,405/477] s390/numa: let NODES_SHIFT depend on NEED_MULTIPLE_NODES [5.7,407/477] mvpp2: remove module bugfix [5.7,409/477] mlxsw: spectrum: Adjust headroom buffers for 8x ports [5.7,411/477] arm64: hw_breakpoint: Dont invoke overflow handler on uaccess watchpoints [5.7,414/477] pinctrl: qcom: ipq6018 Add missing pins in qpic pin group [5.7,415/477] ext4: fix partial cluster initialization when splitting extent [5.7,417/477] ext4, jbd2: ensure panic by fix a race between jbd2 abort and ext4 error handlers [5.7,418/477] arm64: dts: realtek: rtd129x: Use reserved-memory for RPC regions [5.7,419/477] arm64: dts: realtek: rtd129x: Carve out boot ROM from memory [5.7,420/477] sh: Convert iounmap() macros to inline functions [5.7,421/477] drm/nouveau/kms: Fix regression by audio component transition [5.7,424/477] drm/amdgpu/display: use blanked rather than plane state for sync groups [5.7,425/477] drm/amdgpu: Replace invalid device ID with a valid device ID [5.7,427/477] selinux: fix a double free in cond_read_node()/cond_read_list() [5.7,430/477] io_uring: fix io_kiocb.flags modification race in IOPOLL mode [5.7,432/477] io_uring: add memory barrier to synchronize io_kiocbs result and iopoll_completed [5.7,435/477] io_uring: fix possible race condition against REQ_F_NEED_CLEANUP [5.7,436/477] ext4: avoid race conditions when remounting with options that change dax [5.7,437/477] drm/dp_mst: Increase ACT retry timeout to 3s [5.7,439/477] f2fs: split f2fs_d_compare() from f2fs_match_name() [5.7,441/477] s390: fix syscall_get_error for compat processes [5.7,443/477] drm/msm: Check for powered down HW in the devfreq callbacks [5.7,445/477] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser [5.7,447/477] drm/amdkfd: Use correct major in devcgroup check [5.7,450/477] drm/i915/tc: fix the reset of ln0 [5.7,451/477] drm/i915/gt: Incrementally check for rewinding [5.7,454/477] drm/i915/gt: Move snb GT workarounds from init_clock_gating to workarounds [5.7,455/477] drm/i915/gt: Move ilk GT workarounds from init_clock_gating to workarounds [5.7,457/477] drm/i915/gt: Move gen4 GT workarounds from init_clock_gating to workarounds [5.7,458/477] Revert "drm/amd/display: disable dcn20 abm feature for bring up" [5.7,462/477] tracing: Make ftrace packed events have align of 1 [5.7,464/477] proc/bootconfig: Fix to use correct quotes for value [5.7,468/477] sample-trace-array: Fix sleeping function called from invalid context [5.7,469/477] netfilter: nft_set_rbtree: Dont account for expired elements on insertion [5.7,471/477] kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex [5.7,472/477] kretprobe: Prevent triggering kretprobe from within kprobe_flush_task [5.7,475/477] net: octeon: mgmt: Repair filling of RX ring [5.7,476/477] net: core: device_rename: Use rwsem instead of a seqcount

[5.7,233/477] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata

Commit Message

Patch