diff mbox series

[5.11,060/601] mt76: fix potential DMA mapping leak

Message ID	20210512144829.789785491@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Felix Fietkau <nbd@nbd.name> Subject: [PATCH 5.11 060/601] mt76: fix potential DMA mapping leak Date: Wed, 12 May 2021 16:42:17 +0200 Message-Id: <20210512144829.789785491@linuxfoundation.org> In-Reply-To: <20210512144827.811958675@linuxfoundation.org> References: <20210512144827.811958675@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.11,002/601] bluetooth: eliminate the potential race condition when removing the HCI controller [5.11,003/601] net/nfc: fix use-after-free llcp_sock_bind/connect [5.11,004/601] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers [5.11,005/601] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" [5.11,006/601] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() [5.11,007/601] tty: moxa: fix TIOCSSERIAL jiffies conversions [5.11,008/601] tty: amiserial: fix TIOCSSERIAL permission check [5.11,009/601] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions [5.11,010/601] staging: greybus: uart: fix TIOCSSERIAL jiffies conversions [5.11,011/601] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check [5.11,012/601] staging: fwserial: fix TIOCSSERIAL jiffies conversions [5.11,013/601] tty: moxa: fix TIOCSSERIAL permission check [5.11,014/601] staging: fwserial: fix TIOCSSERIAL permission check [5.11,015/601] drm: bridge: fix LONTIUM use of mipi_dsi_() functions [5.11,016/601] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply [5.11,017/601] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply [5.11,018/601] usb: typec: tcpm: update power supply once partner accepts [5.11,019/601] usb: xhci-mtk: remove or operator for setting schedule parameters [5.11,020/601] usb: xhci-mtk: improve bandwidth scheduling with TT [5.11,021/601] ASoC: samsung: tm2_wm5110: check of of_parse return value [5.11,022/601] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function [5.11,023/601] ASoC: tlv320aic32x4: Register clocks before registering component [5.11,024/601] ASoC: tlv320aic32x4: Increase maximum register in regmap [5.11,025/601] MIPS: pci-mt7620: fix PLL lock check [5.11,026/601] MIPS: pci-rt2880: fix slot 0 configuration [5.11,027/601] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [5.11,028/601] PCI: Allow VPD access for QLogic ISP2722 [5.11,029/601] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID [5.11,030/601] PCI: xgene: Fix cfg resource mapping [5.11,031/601] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c [5.11,032/601] PM / devfreq: Unlock mutex and free devfreq struct in error path [5.11,033/601] soc/tegra: regulators: Fix locking up when voltage-spread is out of range [5.11,034/601] iio: inv_mpu6050: Fully validate gyro and accel scale writes [5.11,035/601] iio: sx9310: Fix write_.._debounce() [5.11,036/601] iio:accel:adis16201: Fix wrong axis assignment that prevents loading [5.11,037/601] iio:adc:ad7476: Fix remove handling [5.11,038/601] iio: sx9310: Fix access to variable DT array [5.11,039/601] sc16is7xx: Defer probe if device read fails [5.11,040/601] phy: cadence: Sierra: Fix PHY power_on sequence [5.11,041/601] misc: lis3lv02d: Fix false-positive WARN on various HP models [5.11,042/601] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() [5.11,043/601] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [5.11,044/601] misc: vmw_vmci: explicitly initialize vmci_datagram payload [5.11,045/601] selinux: add proper NULL termination to the secclass_map permissions [5.11,046/601] x86, sched: Treat Intel SNC topology as default, COD as exception [5.11,047/601] async_xor: increase src_offs when dropping destination page [5.11,048/601] md/bitmap: wait for external bitmap writes to complete during tear down [5.11,049/601] md-cluster: fix use-after-free issue when removing rdev [5.11,050/601] md: split mddev_find [5.11,051/601] md: factor out a mddev_find_locked helper from mddev_find [5.11,052/601] md: md_open returns -EBUSY when entering racing area [5.11,053/601] md: Fix missing unused status line of /proc/mdstat [5.11,054/601] MIPS: Reinstate platform `__div64_32 handler [5.11,055/601] MIPS: generic: Update node names to avoid unit addresses [5.11,056/601] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() [5.11,057/601] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [5.11,058/601] cfg80211: scan: drop entry from hidden_list on overflow [5.11,059/601] rtw88: Fix array overrun in rtw_get_tx_power_params() [5.11,060/601] mt76: fix potential DMA mapping leak [5.11,061/601] FDDI: defxx: Make MMIO the configuration default except for EISA [5.11,062/601] drm/qxl: use ttm bo priorities [5.11,063/601] drm/ingenic: Fix non-OSD mode [5.11,064/601] drm/panfrost: Clear MMU irqs before handling the fault [5.11,065/601] drm/panfrost: Dont try to map pages that are already mapped [5.11,066/601] drm/radeon: fix copy of uninitialized variable back to userspace [5.11,067/601] drm/dp_mst: Revise broadcast msg lct & lcr [5.11,068/601] drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast [5.11,069/601] drm: bridge: fix ANX7625 use of mipi_dsi_() functions [5.11,070/601] drm: bridge/panel: Cleanup connector on bridge detach [5.11,071/601] drm/amd/display: Reject non-zero src_y and src_x for video planes [5.11,072/601] drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 [5.11,073/601] drm/amdgpu: add new MC firmware for Polaris12 32bit ASIC [5.11,074/601] drm/amdgpu: Init GFX10_ADDR_CONFIG for VCN v3 in DPG mode. [5.11,075/601] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [5.11,076/601] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [5.11,077/601] ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries [5.11,078/601] ALSA: hda/realtek: Re-order ALC269 HP quirk table entries [5.11,079/601] ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries [5.11,080/601] ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries [5.11,081/601] ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries [5.11,082/601] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [5.11,083/601] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries [5.11,084/601] ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries [5.11,085/601] ALSA: hda/realtek: Re-order ALC662 quirk table entries [5.11,086/601] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [5.11,087/601] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable [5.11,088/601] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 [5.11,089/601] KVM: s390: VSIE: correctly handle MVPG when in VSIE [5.11,090/601] KVM: s390: split kvm_s390_logical_to_effective [5.11,091/601] KVM: s390: fix guarded storage control register handling [5.11,092/601] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal fa... [5.11,093/601] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO [5.11,094/601] KVM: s390: split kvm_s390_real_to_abs [5.11,095/601] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer [5.11,096/601] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit [5.11,097/601] KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests [5.11,098/601] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads [5.11,099/601] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT [5.11,100/601] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception [5.11,101/601] KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs [5.11,102/601] KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes [5.11,103/601] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created [5.11,104/601] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported [5.11,105/601] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch [5.11,106/601] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit [5.11,107/601] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit [5.11,108/601] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read [5.11,109/601] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU [5.11,110/601] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed [5.11,111/601] KVM: arm64: Fully zero the vcpu state on reset [5.11,112/601] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read [5.11,113/601] KVM: selftests: Sync data verify of dirty logging with guest sync [5.11,114/601] KVM: selftests: Always run vCPU thread with blocked SIG_IPI [5.11,115/601] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" [5.11,116/601] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" [5.11,117/601] mfd: stmpe: Revert "Constify static struct resource" [5.11,118/601] ovl: fix missing revert_creds() on error path [5.11,119/601] Revert "drm/qxl: do not run release if qxl failed to init" [5.11,120/601] usb: gadget: pch_udc: Revert d3cb25a12138 completely [5.11,121/601] Revert "tools/power turbostat: adjust for temperature offset" [5.11,122/601] firmware: xilinx: Fix dereferencing freed memory [5.11,123/601] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FI... [5.11,124/601] x86/vdso: Use proper modifier for lens format specifier in extract() [5.11,125/601] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER [5.11,126/601] crypto: keembay-ocs-aes - Fix error return code in kmb_ocs_aes_probe() [5.11,127/601] crypto: sun8i-ss - fix result memory leak on error path [5.11,128/601] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [5.11,129/601] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 [5.11,130/601] ARM: dts: exynos: correct fuel gauge interrupt trigger level on P4 Note family [5.11,131/601] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family [5.11,132/601] ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family [5.11,133/601] ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family [5.11,134/601] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family [5.11,135/601] ARM: dts: exynos: correct PMIC interrupt trigger level on P4 Note family [5.11,136/601] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [5.11,137/601] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [5.11,138/601] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family [5.11,139/601] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files [5.11,140/601] arm64: dts: renesas: Add mmc aliases into board dts files [5.11,141/601] bus: ti-sysc: Fix initializing module_pa for modules without sysc register [5.11,142/601] x86/platform/uv: Set section block size for hubless architectures [5.11,143/601] serial: stm32: fix code cleaning warnings and checks [5.11,144/601] serial: stm32: add "_usart" prefix in functions name [5.11,145/601] serial: stm32: fix probe and remove order for dma [5.11,146/601] serial: stm32: Use of_device_get_match_data() [5.11,147/601] serial: stm32: fix startup by enabling usart for reception [5.11,148/601] serial: stm32: fix incorrect characters on console [5.11,149/601] serial: stm32: fix TX and RX FIFO thresholds [5.11,150/601] serial: stm32: fix a deadlock condition with wakeup event [5.11,151/601] serial: stm32: fix wake-up flag handling [5.11,152/601] serial: stm32: fix a deadlock in set_termios [5.11,153/601] serial: liteuart: fix return value check in liteuart_probe() [5.11,154/601] serial: stm32: fix tx dma completion, release channel [5.11,155/601] serial: stm32: call stm32_transmit_chars locked [5.11,156/601] serial: stm32: fix FIFO flush in startup and set_termios [5.11,157/601] serial: stm32: add FIFO flush when port is closed [5.11,158/601] serial: stm32: fix tx_empty condition [5.11,159/601] usb: typec: tcpm: Handle vbus shutoff when in source mode [5.11,160/601] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS [5.11,161/601] usb: typec: tps6598x: Fix return value check in tps6598x_probe() [5.11,162/601] usb: typec: stusb160x: fix return value check in stusb160x_probe() [5.11,163/601] mfd: intel_pmt: Fix nuisance messages and handling of disabled capabilities [5.11,164/601] regmap: set debugfs_name to NULL after it is freed [5.11,165/601] spi: rockchip: avoid objtool warning [5.11,166/601] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() [5.11,167/601] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC [5.11,168/601] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() [5.11,169/601] mtd: rawnand: qcom: Return actual error code instead of -ENODEV [5.11,170/601] mtd: dont lock when recursively deleting partitions [5.11,171/601] mtd: maps: fix error return code of physmap_flash_remove() [5.11,172/601] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control [5.11,173/601] arm64: dts: ti: k3-j721e-main: Update the speed modes supported and their itap del... [5.11,174/601] iio: adis16480: fix pps mode sampling frequency math [5.11,175/601] arm64: dts: qcom: sc7180: trogdor: Fix trip point config of charger thermal zone [5.11,176/601] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity [5.11,177/601] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer [5.11,178/601] arm64: dts: qcom: sc7180: Avoid glitching SPI CS at bootup on trogdor [5.11,179/601] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges [5.11,180/601] arm64: dts: qcom: sm8150: fix number of pins in gpio-ranges [5.11,181/601] arm64: dts: qcom: sm8250: fix number of pins in gpio-ranges [5.11,182/601] arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x [5.11,183/601] crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map [5.11,184/601] spi: stm32: drop devres version of spi_register_master [5.11,185/601] regulator: bd9576: Fix return from bd957x_probe() [5.11,186/601] arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding [5.11,187/601] selftests/x86: Add a missing .note.GNU-stack section to thunks_32.S [5.11,188/601] spi: stm32: Fix use-after-free on unbind [5.11,189/601] Drivers: hv: vmbus: Drop error message when No request id available [5.11,190/601] x86/microcode: Check for offline CPUs before requesting new microcode [5.11,191/601] devtmpfs: fix placement of complete() call [5.11,192/601] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [5.11,193/601] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [5.11,194/601] usb: gadget: pch_udc: Check for DMA mapping error [5.11,195/601] usb: gadget: pch_udc: Initialize device pointer before use [5.11,196/601] usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) [5.11,197/601] crypto: ccp - fix command queuing to TEE ring buffer [5.11,198/601] crypto: qat - dont release uninitialized resources [5.11,199/601] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init [5.11,200/601] fotg210-udc: Fix DMA on EP0 for length > max packet size [5.11,201/601] fotg210-udc: Fix EP0 IN requests bigger than two packets [5.11,202/601] fotg210-udc: Remove a dubious condition leading to fotg210_done [5.11,203/601] fotg210-udc: Mask GRP2 interrupts we dont handle [5.11,204/601] fotg210-udc: Dont DMA more than the buffer can take [5.11,205/601] fotg210-udc: Complete OUT requests on short packets [5.11,206/601] usb: gadget: s3c: Fix incorrect resources releasing [5.11,207/601] usb: gadget: s3c: Fix the error handling path in s3c2410_udc_probe() [5.11,208/601] dt-bindings: serial: stm32: Use type: object instead of false for additionalProper... [5.11,209/601] mtd: require write permissions for locking and badblock ioctls [5.11,210/601] arm64: dts: renesas: r8a779a0: Fix PMU interrupt [5.11,211/601] arm64: dts: mt8183: Add gce client reg for display subcomponents [5.11,212/601] arm64: dts: mt8173: fix wrong power-domain phandle of pmic [5.11,213/601] bus: qcom: Put child node before return [5.11,214/601] soundwire: bus: Fix device found flag correctly [5.11,215/601] phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup [5.11,216/601] phy: ralink: phy-mt7621-pci: fix XTAL bitmask [5.11,217/601] phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally [5.11,218/601] phy: ralink: phy-mt7621-pci: fix return value check in mt7621_pci_phy_probe() [5.11,219/601] phy: ingenic: Fix a typo in ingenic_usb_phy_probe() [5.11,220/601] arm64: dts: mediatek: fix reset GPIO level on pumpkin [5.11,221/601] NFSv4.2: fix copy stateid copying for the async copy [5.11,222/601] crypto: poly1305 - fix poly1305_core_setkey() declaration [5.11,223/601] crypto: qat - fix error path in adf_isr_resource_alloc() [5.11,224/601] usb: gadget: aspeed: fix dma map failure [5.11,225/601] USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() [5.11,226/601] drivers: nvmem: Fix voltage settings for QTI qfprom-efuse [5.11,227/601] driver core: platform: Declare early_platform_cleanup() prototype [5.11,228/601] ARM: dts: qcom: msm8974-lge-nexus5: correct fuel gauge interrupt trigger level [5.11,229/601] ARM: dts: qcom: msm8974-samsung-klte: correct fuel gauge interrupt trigger level [5.11,230/601] memory: pl353: fix mask of ECC page_size config register [5.11,231/601] soundwire: stream: fix memory leak in stream config error path [5.11,232/601] m68k: mvme147,mvme16x: Dont wipe PCC timer config bits [5.11,233/601] firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool [5.11,234/601] firmware: qcom_scm: Reduce locking section for __get_convention() [5.11,235/601] firmware: qcom_scm: Workaround lack of "is available" call on SC7180 [5.11,236/601] iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol [5.11,237/601] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init [5.11,238/601] irqchip/gic-v3: Fix OF_BAD_ADDR error handling [5.11,239/601] staging: comedi: tests: ni_routes_test: Fix compilation error [5.11,240/601] staging: rtl8192u: Fix potential infinite loop [5.11,241/601] staging: fwserial: fix TIOCSSERIAL implementation [5.11,242/601] staging: fwserial: fix TIOCGSERIAL implementation [5.11,243/601] staging: greybus: uart: fix unprivileged TIOCCSERIAL [5.11,244/601] platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing mor... [5.11,245/601] soc: qcom: pdr: Fix error return code in pdr_register_listener [5.11,246/601] PM / devfreq: Use more accurate returned new_freq as resume_freq [5.11,247/601] clocksource/drivers/timer-ti-dm: Fix posted mode status check order [5.11,248/601] clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped [5.11,249/601] clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() [5.11,250/601] spi: Fix use-after-free with devm_spi_alloc_* [5.11,251/601] spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() [5.11,252/601] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz [5.11,253/601] soc: qcom: mdt_loader: Detect truncated read of segments [5.11,254/601] PM: runtime: Replace inline function pm_runtime_callbacks_present() [5.11,255/601] cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration [5.11,256/601] ACPI: CPPC: Replace cppc_attr with kobj_attribute [5.11,257/601] crypto: allwinner - add missing CRYPTO_ prefix [5.11,258/601] crypto: sun8i-ss - Fix memory leak of pad [5.11,259/601] crypto: sa2ul - Fix memory leak of rxd [5.11,260/601] crypto: qat - Fix a double free in adf_create_ring [5.11,261/601] cpufreq: armada-37xx: Fix setting TBG parent for load levels [5.11,262/601] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock [5.11,263/601] cpufreq: armada-37xx: Fix the AVS value for load L1 [5.11,264/601] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz [5.11,265/601] clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 [5.11,266/601] cpufreq: armada-37xx: Fix driver cleanup when registration failed [5.11,267/601] cpufreq: armada-37xx: Fix determining base CPU frequency [5.11,268/601] spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op... [5.11,269/601] spi: spi-zynqmp-gqspi: add mutex locking for exec_op [5.11,270/601] spi: spi-zynqmp-gqspi: transmit dummy circles by using the controllers internal fu... [5.11,271/601] spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op [5.11,272/601] spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() [5.11,273/601] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [5.11,274/601] USB: cdc-acm: fix unprivileged TIOCCSERIAL [5.11,275/601] USB: cdc-acm: fix TIOCGSERIAL implementation [5.11,276/601] tty: actually undefine superseded ASYNC flags [5.11,277/601] tty: fix return value for unsupported ioctls [5.11,278/601] tty: fix return value for unsupported termiox ioctls [5.11,279/601] serial: core: return early on unsupported ioctls [5.11,280/601] firmware: qcom-scm: Fix QCOM_SCM configuration [5.11,281/601] node: fix device cleanups in error handling code [5.11,282/601] crypto: chelsio - Read rxchannel-id from firmware [5.11,283/601] usbip: vudc: fix missing unlock on error in usbip_sockfd_store() [5.11,284/601] m68k: Add missing mmap_read_lock() to sys_cacheflush() [5.11,285/601] spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() [5.11,286/601] memory: renesas-rpc-if: fix possible NULL pointer dereference of resource [5.11,287/601] memory: samsung: exynos5422-dmc: handle clk_set_parent() failure [5.11,288/601] security: keys: trusted: fix TPM2 authorizations [5.11,289/601] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk... [5.11,290/601] ARM: dts: aspeed: Rainier: Fix humidity sensor bus address [5.11,291/601] Drivers: hv: vmbus: Use after free in __vmbus_open() [5.11,292/601] spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue [5.11,293/601] spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume [5.11,294/601] spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op [5.11,295/601] spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails [5.11,296/601] x86/platform/uv: Fix !KEXEC build failure [5.11,297/601] hwmon: (pmbus/pxe1610) dont bail out when not all pages are active [5.11,298/601] Drivers: hv: vmbus: Increase wait time for VMbus unload [5.11,299/601] PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check [5.11,300/601] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. [5.11,301/601] usb: dwc2: Fix hibernation between host and device modes. [5.11,302/601] ttyprintk: Add TTY hangup callback. [5.11,303/601] serial: omap: dont disable rs485 if rts gpio is missing [5.11,304/601] serial: omap: fix rs485 half-duplex filtering [5.11,305/601] xen-blkback: fix compatibility bug with single page rings [5.11,306/601] soc: aspeed: fix a ternary sign expansion bug [5.11,307/601] drm/tilcdc: send vblank event when disabling crtc [5.11,308/601] drm/stm: Fix bus_flags handling [5.11,309/601] drm/amd/display: Fix off by one in hdmi_14_process_transaction() [5.11,310/601] drm/mcde/panel: Inverse misunderstood flag [5.11,311/601] scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb() [5.11,312/601] sched/fair: Fix shift-out-of-bounds in load_balance() [5.11,313/601] printk: limit second loop of syslog_print_all [5.11,314/601] afs: Fix updating of i_mode due to 3rd party change [5.11,315/601] rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() [5.11,316/601] media: vivid: fix assignment of dev->fbuf_out_flags [5.11,317/601] media: saa7134: use sg_dma_len when building pgtable [5.11,318/601] media: saa7146: use sg_dma_len when building pgtable [5.11,319/601] media: omap4iss: return error code when omap4iss_get() failed [5.11,320/601] media: rkisp1: rsz: crash fix when setting src format [5.11,321/601] media: aspeed: fix clock handling logic [5.11,322/601] drm/probe-helper: Check epoch counter in output_poll_execute() [5.11,323/601] media: venus: core: Fix some resource leaks in the error path of venus_probe() [5.11,324/601] media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_stre... [5.11,325/601] media: m88ds3103: fix return value check in m88ds3103_probe() [5.11,326/601] media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 [5.11,327/601] media: [next] staging: media: atomisp: fix memory leak of object flash [5.11,328/601] media: atomisp: Fixed error handling path [5.11,329/601] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [5.11,330/601] media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() [5.11,331/601] drm/amdkfd: fix build error with AMD_IOMMU_V2=m [5.11,332/601] of: overlay: fix for_each_child.cocci warnings [5.11,333/601] x86/kprobes: Fix to check non boostable prefixes correctly [5.11,334/601] selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) [5.11,335/601] pata_arasan_cf: fix IRQ check [5.11,336/601] pata_ipx4xx_cf: fix IRQ check [5.11,337/601] sata_mv: add IRQ checks [5.11,338/601] ata: libahci_platform: fix IRQ check [5.11,339/601] seccomp: Fix CONFIG tests for Seccomp_filters [5.11,340/601] nvme-tcp: block BH in sk state_change sk callback [5.11,341/601] nvmet-tcp: fix incorrect locking in state_change sk callback [5.11,342/601] clk: imx: Fix reparenting of UARTs not associated with stdout [5.11,343/601] power: supply: bq25980: Move props from battery node [5.11,344/601] nvme: retrigger ANA log update if group descriptor isnt found [5.11,345/601] media: ccs: Fix sub-device function [5.11,346/601] media: ipu3-cio2: Fix pixel-rate derived link frequency [5.11,347/601] media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from im... [5.11,348/601] media: i2c: imx219: Balance runtime PM use-count [5.11,349/601] media: v4l2-ctrls.c: fix race condition in hdl->requests list [5.11,350/601] media: rkvdec: Do not require all controls to be present in every request [5.11,351/601] vfio/fsl-mc: Re-order vfio_fsl_mc_probe() [5.11,352/601] vfio/pci: Move VGA and VF initialization to functions [5.11,353/601] vfio/pci: Re-order vfio_pci_probe() [5.11,354/601] drm/msm: Fix debugfs deadlock [5.11,355/601] vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer [5.11,356/601] clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback [5.11,357/601] clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable [5.11,358/601] drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() [5.11,359/601] clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE [5.11,360/601] clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE [5.11,361/601] drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct [5.11,362/601] drm/amd/display: check fb of primary plane [5.11,363/601] drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() [5.11,364/601] clk: uniphier: Fix potential infinite loop [5.11,365/601] scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() [5.11,366/601] scsi: pm80xx: Fix potential infinite loop [5.11,367/601] scsi: ufs: ufshcd-pltfrm: Fix deferred probing [5.11,368/601] scsi: hisi_sas: Fix IRQ checks [5.11,369/601] scsi: jazz_esp: Add IRQ check [5.11,370/601] scsi: sun3x_esp: Add IRQ check [5.11,371/601] scsi: sni_53c710: Add IRQ check [5.11,372/601] scsi: ibmvfc: Fix invalid state machine BUG_ON() [5.11,373/601] mailbox: sprd: Introduce refcnt when clients requests/free channels [5.11,374/601] mfd: stm32-timers: Avoid clearing auto reload register [5.11,375/601] nvmet-tcp: fix a segmentation fault during io parsing error [5.11,376/601] nvme-pci: dont simple map sgl when sgls are disabled [5.11,377/601] media: meson-ge2d: fix rotation parameters [5.11,378/601] media: cedrus: Fix H265 status definitions [5.11,379/601] HSI: core: fix resource leaks in hsi_add_client_from_dt() [5.11,380/601] x86/events/amd/iommu: Fix sysfs type mismatch [5.11,381/601] perf/amd/uncore: Fix sysfs type mismatch [5.11,382/601] io_uring: fix overflows checks in provide buffers [5.11,383/601] block/rnbd-clt-sysfs: Remove copy buffer overlap in rnbd_clt_get_path_name [5.11,384/601] sched/debug: Fix cgroup_path[] serialization [5.11,385/601] kthread: Fix PF_KTHREAD vs to_kthread() race [5.11,386/601] ataflop: potential out of bounds in do_format() [5.11,387/601] ataflop: fix off by one in ataflop_probe() [5.11,388/601] drivers/block/null_blk/main: Fix a double free in null_init. [5.11,389/601] xsk: Respect devices headroom and tailroom on generic xmit path [5.11,390/601] HID: plantronics: Workaround for double volume key presses [5.11,391/601] perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed c... [5.11,392/601] ASoC: Intel: boards: sof-wm8804: add check for PLL setting [5.11,393/601] ASoC: Intel: Skylake: Compile when any configuration is selected [5.11,394/601] RDMA/mlx5: Fix mlx5 rates to IB rates map [5.11,395/601] wilc1000: write value to WILC_INTR2_ENABLE register [5.11,396/601] KVM: x86/mmu: Retry page faults that hit an invalid memslot [5.11,397/601] Bluetooth: avoid deadlock between hci_dev->lock and socket lock [5.11,398/601] net: lapbether: Prevent racing when checking whether the netif is running [5.11,399/601] libbpf: Add explicit padding to bpf_xdp_set_link_opts [5.11,400/601] bpftool: Fix maybe-uninitialized warnings [5.11,401/601] iommu: Check dev->iommu in iommu_dev_xxx functions [5.11,402/601] dma-iommu: use static-key to minimize the impact in the fast-path [5.11,403/601] iommu/dma: Resurrect the "forcedac" option [5.11,404/601] iommu/vt-d: Reject unsupported page request modes [5.11,405/601] selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed [5.11,406/601] libbpf: Add explicit padding to btf_dump_emit_type_decl_opts [5.11,407/601] powerpc/mm: Move the linear_mapping_mutex to the ifdef where it is used [5.11,408/601] powerpc/fadump: Mark fadump_calculate_reserve_size as __init [5.11,409/601] powerpc/prom: Mark identical_pvr_fixup as __init [5.11,410/601] MIPS: fix local_irq_{disable,enable} in asmmacro.h [5.11,411/601] ima: Fix the error code for restoring the PCR value [5.11,412/601] inet: use bigger hash table for IP ID generation [5.11,413/601] pinctrl: pinctrl-single: remove unused parameter [5.11,414/601] pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero [5.11,415/601] MIPS: loongson64: fix bug when PAGE_SIZE > 16KB [5.11,416/601] ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk [5.11,417/601] iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK [5.11,418/601] RDMA/mlx5: Fix drop packet rule in egress table [5.11,419/601] IB/isert: Fix a use after free in isert_connect_request [5.11,420/601] powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration [5.11,421/601] MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again [5.11,422/601] gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP [5.11,423/601] fs: dlm: fix missing unlock on error in accept_from_sock() [5.11,424/601] ASoC: q6afe-clocks: fix reprobing of the driver [5.11,425/601] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [5.11,426/601] net: phy: lan87xx: fix access to wrong register of LAN87xx [5.11,427/601] udp: never accept GSO_FRAGLIST packets [5.11,428/601] powerpc/pseries: Only register vio drivers if vio bus exists [5.11,429/601] net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() [5.11,430/601] bug: Remove redundant condition check in report_bug [5.11,431/601] RDMA/core: Fix corrupted SL on passive side [5.11,432/601] nfc: pn533: prevent potential memory corruption [5.11,433/601] net: hns3: Limiting the scope of vector_ring_chain variable [5.11,434/601] mips: bmips: fix syscon-reboot nodes [5.11,435/601] KVM: arm64: Fix error return code in init_hyp_mode() [5.11,436/601] iommu/vt-d: Dont set then clear private data in prq_event_thread() [5.11,437/601] iommu: Fix a boundary issue to avoid performance drop [5.11,438/601] iommu/vt-d: Report right snoop capability when using FL for IOVA [5.11,439/601] iommu/vt-d: Report the right page fault address [5.11,440/601] iommu/vt-d: Preset Access/Dirty bits for IOVA over FL [5.11,441/601] iommu/vt-d: Remove WO permissions on second-level paging entries [5.11,442/601] iommu/vt-d: Invalidate PASID cache when root/context entry changed [5.11,443/601] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [5.11,444/601] HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness [5.11,445/601] HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling [5.11,446/601] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() [5.11,447/601] HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE [5.11,448/601] KVM: arm64: Initialize VCPU mdcr_el2 before loading it [5.11,449/601] ASoC: simple-card: fix possible uninitialized single_cpu local variable [5.11,450/601] liquidio: Fix unintented sign extension of a left shift of a u16 [5.11,451/601] IB/hfi1: Use kzalloc() for mmu_rb_handler allocation [5.11,452/601] powerpc/64s: Fix pte update for kernel memory on radix [5.11,453/601] powerpc/pseries: Add key to flags in pSeries_lpar_hpte_updateboltedpp() [5.11,454/601] powerpc/64s: Use htab_convert_pte_flags() in hash__mark_rodata_ro() [5.11,455/601] powerpc/perf: Fix PMU constraint check for EBB events [5.11,456/601] powerpc: iommu: fix build when neither PCI or IBMVIO is set [5.11,457/601] mac80211: bail out if cipher schemes are invalid [5.11,458/601] perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric [5.11,459/601] RDMA/hns: Fix missing assignment of max_inline_data [5.11,460/601] xfs: fix return of uninitialized value in variable error [5.11,461/601] rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() [5.11,462/601] mt7601u: fix always true expression [5.11,463/601] mt76: mt7615: fix tx skb dma unmap [5.11,464/601] mt76: mt7915: fix tx skb dma unmap [5.11,465/601] mt76: mt7915: fix aggr len debugfs node [5.11,466/601] mt76: mt7615: fix mib stats counter reporting to mac80211 [5.11,467/601] mt76: mt7915: fix mib stats counter reporting to mac80211 [5.11,468/601] mt76: reduce q->lock hold time [5.11,469/601] mt76: check return value of mt76_txq_send_burst in mt76_txq_schedule_list [5.11,470/601] mt76: mt7915: fix rxrate reporting [5.11,471/601] mt76: mt7915: fix txrate reporting [5.11,472/601] mt76: mt7663: fix when beacon filter is being applied [5.11,473/601] mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation [5.11,474/601] mt76: mt7663s: fix the possible device hang in high traffic [5.11,475/601] mt76: mt7615: cleanup mcu tx queue in mt7615_dma_reset() [5.11,476/601] mt76: mt7915: bring up the WA event rx queue for band1 [5.11,477/601] mt76: mt7915: cleanup mcu tx queue in mt7915_dma_reset() [5.11,478/601] KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit [5.11,479/601] ovl: show "userxattr" in the mount data [5.11,480/601] ovl: invalidate readdir cache on changes to dir with origin [5.11,481/601] RDMA/qedr: Fix error return code in qedr_iw_connect() [5.11,482/601] IB/hfi1: Fix error return code in parse_platform_config() [5.11,483/601] RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() [5.11,484/601] cxgb4: Fix unintentional sign extension issues [5.11,485/601] net: thunderx: Fix unintentional sign extension issue [5.11,486/601] RDMA/srpt: Fix error return code in srpt_cm_req_recv() [5.11,487/601] RDMA/rtrs-clt: destroy sysfs after removing session from active list [5.11,488/601] i2c: cadence: fix reference leak when pm_runtime_get_sync fails [5.11,489/601] i2c: img-scb: fix reference leak when pm_runtime_get_sync fails [5.11,490/601] i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails [5.11,491/601] i2c: imx: fix reference leak when pm_runtime_get_sync fails [5.11,492/601] i2c: omap: fix reference leak when pm_runtime_get_sync fails [5.11,493/601] i2c: sprd: fix reference leak when pm_runtime_get_sync fails [5.11,494/601] i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails [5.11,495/601] i2c: xiic: fix reference leak when pm_runtime_get_sync fails [5.11,496/601] i2c: cadence: add IRQ check [5.11,497/601] i2c: emev2: add IRQ check [5.11,498/601] i2c: jz4780: add IRQ check [5.11,499/601] i2c: mlxbf: add IRQ check [5.11,500/601] i2c: rcar: make sure irq is not threaded on Gen2 and earlier [5.11,501/601] i2c: rcar: protect against supurious interrupts on V3U [5.11,502/601] i2c: rcar: add IRQ check [5.11,503/601] i2c: sh7760: add IRQ check [5.11,504/601] iwlwifi: rs-fw: dont support stbc for HE 160 [5.11,505/601] iwlwifi: dbg: disable ini debug in 9000 family and below [5.11,506/601] powerpc/xive: Drop check on irq_data in xive_core_debug_show() [5.11,507/601] powerpc/xive: Fix xmon command "dxi" [5.11,508/601] powerpc/syscall: Rename syscall_64.c into interrupt.c [5.11,509/601] powerpc/syscall: Change condition to check MSR_RI [5.11,510/601] ASoC: ak5558: correct reset polarity [5.11,511/601] net/mlx5: Fix bit-wise and with zero [5.11,512/601] net/packet: remove data races in fanout operations [5.11,513/601] drm/i915/gvt: Fix error code in intel_gvt_init_device() [5.11,514/601] iommu/amd: Put newline after closing bracket in warning [5.11,515/601] perf beauty: Fix fsconfig generator [5.11,516/601] drm/amdgpu: fix an error code in init_pmu_entry_by_type_and_add() [5.11,517/601] drm/amd/pm: fix error code in smu_set_power_limit() [5.11,518/601] MIPS: pci-legacy: stop using of_pci_range_to_resource [5.11,519/601] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [5.11,520/601] mptcp: fix format specifiers for unsigned int [5.11,521/601] powerpc/smp: Reintroduce cpu_core_mask [5.11,522/601] KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid [5.11,523/601] rtlwifi: 8821ae: upgrade PHY and RF parameters [5.11,524/601] wlcore: fix overlapping snprintf arguments in debugfs [5.11,525/601] i2c: sh7760: fix IRQ error path [5.11,526/601] i2c: mediatek: Fix wrong dma sync flag [5.11,527/601] mwl8k: Fix a double Free in mwl8k_probe_hw [5.11,528/601] netfilter: nft_payload: fix C-VLAN offload support [5.11,529/601] netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector [5.11,530/601] netfilter: nftables_offload: special ethertype handling for VLAN [5.11,531/601] vsock/vmci: log once the failed queue pair allocation [5.11,532/601] libbpf: Initialize the bpf_seq_printf parameters array field by field [5.11,533/601] net: ethernet: ixp4xx: Set the DMA masks explicitly [5.11,534/601] gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check [5.11,535/601] RDMA/cxgb4: add missing qpid increment [5.11,536/601] RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails [5.11,537/601] ALSA: usb: midi: dont return -ENOMEM when usb_urb_ep_type_check fails [5.11,538/601] sfc: ef10: fix TX queue lookup in TX event handling [5.11,539/601] vsock/virtio: free queued packets when closing socket [5.11,540/601] net: marvell: prestera: fix port event handling on init [5.11,541/601] net: davinci_emac: Fix incorrect masking of tx and rx error channel [5.11,542/601] mt76: mt7615: fix memleak when mt7615_unregister_device() [5.11,543/601] mt76: mt7915: fix memleak when mt7915_unregister_device() [5.11,544/601] powerpc/pseries/iommu: Fix window size for direct mapping with pmem [5.11,545/601] crypto: ccp: Detect and reject "invalid" addresses destined for PSP [5.11,546/601] net: dsa: mv88e6xxx: Fix off-by-one in VTU devlink region size [5.11,547/601] nfp: devlink: initialize the devlink port attribute "lanes" [5.11,548/601] net: stmmac: fix TSO and TBS feature enabling during driver open [5.11,549/601] net: renesas: ravb: Fix a stuck issue when a lot of frames are received [5.11,550/601] net: phy: intel-xway: enable integrated led functions [5.11,551/601] RDMA/rxe: Fix a bug in rxe_fill_ip_info() [5.11,552/601] RDMA/core: Add CM to restrack after successful attachment to a device [5.11,553/601] powerpc/64: Fix the definition of the fixmap area [5.11,554/601] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [5.11,555/601] ath10k: Fix a use after free in ath10k_htc_send_bundle [5.11,556/601] ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock [5.11,557/601] wlcore: Fix buffer overrun by snprintf due to incorrect buffer size [5.11,558/601] powerpc/perf: Fix the threshold event selection for memory events in power10 [5.11,559/601] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [5.11,560/601] net: phy: marvell: fix m88e1011_set_downshift [5.11,561/601] net: phy: marvell: fix m88e1111_set_downshift [5.11,562/601] net: enetc: fix link error again [5.11,563/601] bnxt_en: fix ternary sign extension bug in bnxt_show_temp() [5.11,564/601] ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.11,565/601] arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.11,566/601] net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb [5.11,567/601] selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static [5.11,568/601] selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test [5.11,569/601] bnxt_en: Fix RX consumer index logic in the error path. [5.11,570/601] KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM [5.11,571/601] KVM: SVM: Zero out the VMCB array used to track SEV ASID association [5.11,572/601] KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails [5.11,573/601] KVM: SVM: Disable SEV/SEV-ES if NPT is disabled [5.11,574/601] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send [5.11,575/601] selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro [5.11,576/601] selftests/bpf: Fix field existence CO-RE reloc tests [5.11,577/601] selftests/bpf: Fix core_reloc test runner [5.11,578/601] bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds [5.11,579/601] RDMA/siw: Fix a use after free in siw_alloc_mr [5.11,580/601] RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res [5.11,581/601] net: bridge: mcast: fix broken length + header check for MRDv6 Adv. [5.11,582/601] net: dsa: mv88e6xxx: Fix 6095/6097/6185 ports in non-SERDES CMODE [5.11,583/601] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [5.11,584/601] perf tools: Change fields type in perf_record_time_conv [5.11,585/601] perf jit: Let convert_timestamp() to be backwards-compatible [5.11,586/601] perf session: Add swap operation for event TIME_CONV [5.11,587/601] ia64: fix EFI_DEBUG build [5.11,588/601] kfifo: fix ternary sign extension bugs [5.11,589/601] mm/sl?b.c: remove ctor argument from kmem_cache_flags [5.11,590/601] mm, slub: enable slub_debug static key when creating cache with explicit debug flags [5.11,591/601] mm: memcontrol: slab: fix obtain a reference to a freeing memcg [5.11,592/601] mm/sparse: add the missing sparse_buffer_fini() in error branch [5.11,593/601] mm/memory-failure: unnecessary amount of unmapping [5.11,594/601] afs: Fix speculative status fetches [5.11,595/601] bpf: Fix alu32 const subreg bound tracking on bitwise operations [5.11,596/601] bpf, ringbuf: Deny reserve of buffers larger than ringbuf [5.11,597/601] bpf: Prevent writable memory-mapping of read-only ringbuf pages [5.11,598/601] net: Only allow init netns to set default tcp cong to a restricted algo [5.11,599/601] smp: Fix smp_call_function_single_async prototype [5.11,600/601] Revert "net/sctp: fix race condition in sctp_destroy_sock" [5.11,601/601] sctp: delay auto_asconf init until binding the first addr

Commit Message

Greg KH May 12, 2021, 2:42 p.m. UTC

From: Felix Fietkau <nbd@nbd.name>

commit b4403cee6400c5f679e9c4a82b91d61aa961eccf upstream.

With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap
could potentially inherit a non-zero value from stack garbage.
If this happens, it will cause DMA mappings for MCU command frames to not be
unmapped after completion

Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -309,7 +309,7 @@  static int
 mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
 			  struct sk_buff *skb, u32 tx_info)
 {
-	struct mt76_queue_buf buf;
+	struct mt76_queue_buf buf = {};
 	dma_addr_t addr;
 
 	if (q->queued + 1 >= q->ndesc - 1)