[5.10,046/530] md/bitmap: wait for external bitmap writes to complete during tear down

From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>

From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>

commit 404a8ef512587b2460107d3272c17a89aef75edf upstream.

NULL pointer dereference was observed in super_written() when it tries
to access the mddev structure.

[The below stack trace is from an older kernel, but the problem described
in this patch applies to the mainline kernel.]

[ 1194.474861] task: ffff8fdd20858000 task.stack: ffffb99d40790000
[ 1194.488000] RIP: 0010:super_written+0x29/0xe1
[ 1194.499688] RSP: 0018:ffff8ffb7fcc3c78 EFLAGS: 00010046
[ 1194.512477] RAX: 0000000000000000 RBX: ffff8ffb7bf4a000 RCX: ffff8ffb78991048
[ 1194.527325] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8ffb56b8a200
[ 1194.542576] RBP: ffff8ffb7fcc3c90 R08: 000000000000000b R09: 0000000000000000
[ 1194.558001] R10: ffff8ffb56b8a298 R11: 0000000000000000 R12: ffff8ffb56b8a200
[ 1194.573070] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 1194.588117] FS:  0000000000000000(0000) GS:ffff8ffb7fcc0000(0000) knlGS:0000000000000000
[ 1194.604264] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1194.617375] CR2: 00000000000002b8 CR3: 00000021e040a002 CR4: 00000000007606e0
[ 1194.632327] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1194.647865] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1194.663316] PKRU: 55555554
[ 1194.674090] Call Trace:
[ 1194.683735]  <IRQ>
[ 1194.692948]  bio_endio+0xae/0x135
[ 1194.703580]  blk_update_request+0xad/0x2fa
[ 1194.714990]  blk_update_bidi_request+0x20/0x72
[ 1194.726578]  __blk_end_bidi_request+0x2c/0x4d
[ 1194.738373]  __blk_end_request_all+0x31/0x49
[ 1194.749344]  blk_flush_complete_seq+0x377/0x383
[ 1194.761550]  flush_end_io+0x1dd/0x2a7
[ 1194.772910]  blk_finish_request+0x9f/0x13c
[ 1194.784544]  scsi_end_request+0x180/0x25c
[ 1194.796149]  scsi_io_completion+0xc8/0x610
[ 1194.807503]  scsi_finish_command+0xdc/0x125
[ 1194.818897]  scsi_softirq_done+0x81/0xde
[ 1194.830062]  blk_done_softirq+0xa4/0xcc
[ 1194.841008]  __do_softirq+0xd9/0x29f
[ 1194.851257]  irq_exit+0xe6/0xeb
[ 1194.861290]  do_IRQ+0x59/0xe3
[ 1194.871060]  common_interrupt+0x1c6/0x382
[ 1194.881988]  </IRQ>
[ 1194.890646] RIP: 0010:cpuidle_enter_state+0xdd/0x2a5
[ 1194.902532] RSP: 0018:ffffb99d40793e68 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff43
[ 1194.917317] RAX: ffff8ffb7fce27c0 RBX: ffff8ffb7fced800 RCX: 000000000000001f
[ 1194.932056] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000
[ 1194.946428] RBP: ffffb99d40793ea0 R08: 0000000000000004 R09: 0000000000002ed2
[ 1194.960508] R10: 0000000000002664 R11: 0000000000000018 R12: 0000000000000003
[ 1194.974454] R13: 000000000000000b R14: ffffffff925715a0 R15: 0000011610120d5a
[ 1194.988607]  ? cpuidle_enter_state+0xcc/0x2a5
[ 1194.999077]  cpuidle_enter+0x17/0x19
[ 1195.008395]  call_cpuidle+0x23/0x3a
[ 1195.017718]  do_idle+0x172/0x1d5
[ 1195.026358]  cpu_startup_entry+0x73/0x75
[ 1195.035769]  start_secondary+0x1b9/0x20b
[ 1195.044894]  secondary_startup_64+0xa5/0xa5
[ 1195.084921] RIP: super_written+0x29/0xe1 RSP: ffff8ffb7fcc3c78
[ 1195.096354] CR2: 00000000000002b8

bio in the above stack is a bitmap write whose completion is invoked after
the tear down sequence sets the mddev structure to NULL in rdev.

During tear down, there is an attempt to flush the bitmap writes, but for
external bitmaps, there is no explicit wait for all the bitmap writes to
complete. For instance, md_bitmap_flush() is called to flush the bitmap
writes, but the last call to md_bitmap_daemon_work() in md_bitmap_flush()
could generate new bitmap writes for which there is no explicit wait to
complete those writes. The call to md_bitmap_update_sb() will return
simply for external bitmaps and the follow-up call to md_update_sb() is
conditional and may not get called for external bitmaps. This results in a
kernel panic when the completion routine, super_written() is called which
tries to reference mddev in the rdev that has been set to
NULL(in unbind_rdev_from_array() by tear down sequence).

The solution is to call md_super_wait() for external bitmaps after the
last call to md_bitmap_daemon_work() in md_bitmap_flush() to ensure there
are no pending bitmap writes before proceeding with the tear down.

Cc: stable@vger.kernel.org
Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
Reviewed-by: Zhao Heming <heming.zhao@suse.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/md-bitmap.c |    2 ++
 1 file changed, 2 insertions(+)

Message ID	20210512144821.259781623@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>, Zhao Heming <heming.zhao@suse.com>, Song Liu <song@kernel.org> Subject: [PATCH 5.10 046/530] md/bitmap: wait for external bitmap writes to complete during tear down Date: Wed, 12 May 2021 16:42:36 +0200 Message-Id: <20210512144821.259781623@linuxfoundation.org> In-Reply-To: <20210512144819.664462530@linuxfoundation.org> References: <20210512144819.664462530@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/530] bluetooth: eliminate the potential race condition when removing the HCI controller [5.10,003/530] net/nfc: fix use-after-free llcp_sock_bind/connect [5.10,004/530] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers [5.10,005/530] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" [5.10,006/530] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() [5.10,007/530] tty: moxa: fix TIOCSSERIAL jiffies conversions [5.10,008/530] tty: amiserial: fix TIOCSSERIAL permission check [5.10,009/530] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions [5.10,010/530] staging: greybus: uart: fix TIOCSSERIAL jiffies conversions [5.10,011/530] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check [5.10,012/530] staging: fwserial: fix TIOCSSERIAL jiffies conversions [5.10,013/530] tty: moxa: fix TIOCSSERIAL permission check [5.10,014/530] staging: fwserial: fix TIOCSSERIAL permission check [5.10,015/530] drm: bridge: fix LONTIUM use of mipi_dsi_() functions [5.10,016/530] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply [5.10,017/530] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply [5.10,018/530] usb: typec: tcpm: update power supply once partner accepts [5.10,019/530] usb: xhci-mtk: remove or operator for setting schedule parameters [5.10,020/530] usb: xhci-mtk: improve bandwidth scheduling with TT [5.10,021/530] ASoC: samsung: tm2_wm5110: check of of_parse return value [5.10,022/530] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function [5.10,023/530] ASoC: tlv320aic32x4: Register clocks before registering component [5.10,024/530] ASoC: tlv320aic32x4: Increase maximum register in regmap [5.10,025/530] MIPS: pci-mt7620: fix PLL lock check [5.10,026/530] MIPS: pci-rt2880: fix slot 0 configuration [5.10,027/530] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [5.10,028/530] PCI: Allow VPD access for QLogic ISP2722 [5.10,029/530] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID [5.10,030/530] PCI: xgene: Fix cfg resource mapping [5.10,031/530] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c [5.10,032/530] PM / devfreq: Unlock mutex and free devfreq struct in error path [5.10,033/530] soc/tegra: regulators: Fix locking up when voltage-spread is out of range [5.10,034/530] iio: inv_mpu6050: Fully validate gyro and accel scale writes [5.10,035/530] iio:accel:adis16201: Fix wrong axis assignment that prevents loading [5.10,036/530] iio:adc:ad7476: Fix remove handling [5.10,037/530] sc16is7xx: Defer probe if device read fails [5.10,038/530] phy: cadence: Sierra: Fix PHY power_on sequence [5.10,039/530] misc: lis3lv02d: Fix false-positive WARN on various HP models [5.10,040/530] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() [5.10,041/530] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [5.10,042/530] misc: vmw_vmci: explicitly initialize vmci_datagram payload [5.10,043/530] selinux: add proper NULL termination to the secclass_map permissions [5.10,044/530] x86, sched: Treat Intel SNC topology as default, COD as exception [5.10,045/530] async_xor: increase src_offs when dropping destination page [5.10,046/530] md/bitmap: wait for external bitmap writes to complete during tear down [5.10,047/530] md-cluster: fix use-after-free issue when removing rdev [5.10,048/530] md: split mddev_find [5.10,049/530] md: factor out a mddev_find_locked helper from mddev_find [5.10,050/530] md: md_open returns -EBUSY when entering racing area [5.10,051/530] md: Fix missing unused status line of /proc/mdstat [5.10,052/530] MIPS: Reinstate platform `__div64_32 handler [5.10,053/530] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() [5.10,054/530] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [5.10,055/530] cfg80211: scan: drop entry from hidden_list on overflow [5.10,056/530] rtw88: Fix array overrun in rtw_get_tx_power_params() [5.10,057/530] mt76: fix potential DMA mapping leak [5.10,058/530] FDDI: defxx: Make MMIO the configuration default except for EISA [5.10,059/530] drm/i915/gvt: Fix virtual display setup for BXT/APL [5.10,060/530] drm/i915/gvt: Fix vfio_edid issue for BXT/APL [5.10,061/530] drm/qxl: use ttm bo priorities [5.10,062/530] drm/panfrost: Clear MMU irqs before handling the fault [5.10,063/530] drm/panfrost: Dont try to map pages that are already mapped [5.10,064/530] drm/radeon: fix copy of uninitialized variable back to userspace [5.10,065/530] drm/dp_mst: Revise broadcast msg lct & lcr [5.10,066/530] drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast [5.10,067/530] drm: bridge/panel: Cleanup connector on bridge detach [5.10,068/530] drm/amd/display: Reject non-zero src_y and src_x for video planes [5.10,069/530] drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 [5.10,070/530] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [5.10,071/530] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [5.10,072/530] ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries [5.10,073/530] ALSA: hda/realtek: Re-order ALC269 HP quirk table entries [5.10,074/530] ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries [5.10,075/530] ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries [5.10,076/530] ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries [5.10,077/530] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [5.10,078/530] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries [5.10,079/530] ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries [5.10,080/530] ALSA: hda/realtek: Re-order ALC662 quirk table entries [5.10,081/530] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [5.10,082/530] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable [5.10,083/530] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 [5.10,084/530] KVM: s390: VSIE: correctly handle MVPG when in VSIE [5.10,085/530] KVM: s390: split kvm_s390_logical_to_effective [5.10,086/530] KVM: s390: fix guarded storage control register handling [5.10,087/530] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal fa... [5.10,088/530] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO [5.10,089/530] KVM: s390: split kvm_s390_real_to_abs [5.10,090/530] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer [5.10,091/530] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit [5.10,092/530] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads [5.10,093/530] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT [5.10,094/530] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception [5.10,095/530] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created [5.10,096/530] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported [5.10,097/530] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch [5.10,098/530] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit [5.10,099/530] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit [5.10,100/530] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read [5.10,101/530] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU [5.10,102/530] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed [5.10,103/530] KVM: arm64: Fully zero the vcpu state on reset [5.10,104/530] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read [5.10,105/530] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" [5.10,106/530] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" [5.10,107/530] ovl: fix missing revert_creds() on error path [5.10,108/530] Revert "drm/qxl: do not run release if qxl failed to init" [5.10,109/530] usb: gadget: pch_udc: Revert d3cb25a12138 completely [5.10,110/530] Revert "tools/power turbostat: adjust for temperature offset" [5.10,111/530] firmware: xilinx: Fix dereferencing freed memory [5.10,112/530] firmware: xilinx: Add a blank line after function declaration [5.10,113/530] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FI... [5.10,114/530] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER [5.10,115/530] crypto: sun8i-ss - fix result memory leak on error path [5.10,116/530] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [5.10,117/530] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 [5.10,118/530] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family [5.10,119/530] ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family [5.10,120/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family [5.10,121/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family [5.10,122/530] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [5.10,123/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [5.10,124/530] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family [5.10,125/530] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files [5.10,126/530] arm64: dts: renesas: Add mmc aliases into board dts files [5.10,127/530] x86/platform/uv: Set section block size for hubless architectures [5.10,128/530] serial: stm32: fix code cleaning warnings and checks [5.10,129/530] serial: stm32: add "_usart" prefix in functions name [5.10,130/530] serial: stm32: fix probe and remove order for dma [5.10,131/530] serial: stm32: Use of_device_get_match_data() [5.10,132/530] serial: stm32: fix startup by enabling usart for reception [5.10,133/530] serial: stm32: fix incorrect characters on console [5.10,134/530] serial: stm32: fix TX and RX FIFO thresholds [5.10,135/530] serial: stm32: fix a deadlock condition with wakeup event [5.10,136/530] serial: stm32: fix wake-up flag handling [5.10,137/530] serial: stm32: fix a deadlock in set_termios [5.10,138/530] serial: stm32: fix tx dma completion, release channel [5.10,139/530] serial: stm32: call stm32_transmit_chars locked [5.10,140/530] serial: stm32: fix FIFO flush in startup and set_termios [5.10,141/530] serial: stm32: add FIFO flush when port is closed [5.10,142/530] serial: stm32: fix tx_empty condition [5.10,143/530] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS [5.10,144/530] usb: typec: tps6598x: Fix return value check in tps6598x_probe() [5.10,145/530] usb: typec: stusb160x: fix return value check in stusb160x_probe() [5.10,146/530] regmap: set debugfs_name to NULL after it is freed [5.10,147/530] spi: rockchip: avoid objtool warning [5.10,148/530] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() [5.10,149/530] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC [5.10,150/530] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() [5.10,151/530] mtd: rawnand: qcom: Return actual error code instead of -ENODEV [5.10,152/530] mtd: dont lock when recursively deleting partitions [5.10,153/530] mtd: maps: fix error return code of physmap_flash_remove() [5.10,154/530] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control [5.10,155/530] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity [5.10,156/530] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer [5.10,157/530] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges [5.10,158/530] arm64: dts: qcom: sm8150: fix number of pins in gpio-ranges [5.10,159/530] arm64: dts: qcom: sm8250: fix number of pins in gpio-ranges [5.10,160/530] arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x [5.10,161/530] crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map [5.10,162/530] spi: stm32: drop devres version of spi_register_master [5.10,163/530] regulator: bd9576: Fix return from bd957x_probe() [5.10,164/530] arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding [5.10,165/530] spi: stm32: Fix use-after-free on unbind [5.10,166/530] x86/microcode: Check for offline CPUs before requesting new microcode [5.10,167/530] devtmpfs: fix placement of complete() call [5.10,168/530] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [5.10,169/530] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [5.10,170/530] usb: gadget: pch_udc: Check for DMA mapping error [5.10,171/530] usb: gadget: pch_udc: Initialize device pointer before use [5.10,172/530] usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) [5.10,173/530] crypto: ccp - fix command queuing to TEE ring buffer [5.10,174/530] crypto: qat - dont release uninitialized resources [5.10,175/530] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init [5.10,176/530] fotg210-udc: Fix DMA on EP0 for length > max packet size [5.10,177/530] fotg210-udc: Fix EP0 IN requests bigger than two packets [5.10,178/530] fotg210-udc: Remove a dubious condition leading to fotg210_done [5.10,179/530] fotg210-udc: Mask GRP2 interrupts we dont handle [5.10,180/530] fotg210-udc: Dont DMA more than the buffer can take [5.10,181/530] fotg210-udc: Complete OUT requests on short packets [5.10,182/530] usb: gadget: s3c: Fix incorrect resources releasing [5.10,183/530] usb: gadget: s3c: Fix the error handling path in s3c2410_udc_probe() [5.10,184/530] dt-bindings: serial: stm32: Use type: object instead of false for additionalProper... [5.10,185/530] mtd: require write permissions for locking and badblock ioctls [5.10,186/530] arm64: dts: renesas: r8a779a0: Fix PMU interrupt [5.10,187/530] bus: qcom: Put child node before return [5.10,188/530] soundwire: bus: Fix device found flag correctly [5.10,189/530] phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup [5.10,190/530] phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally [5.10,191/530] arm64: dts: mediatek: fix reset GPIO level on pumpkin [5.10,192/530] NFSD: Fix sparse warning in nfs4proc.c [5.10,193/530] NFSv4.2: fix copy stateid copying for the async copy [5.10,194/530] crypto: poly1305 - fix poly1305_core_setkey() declaration [5.10,195/530] crypto: qat - fix error path in adf_isr_resource_alloc() [5.10,196/530] usb: gadget: aspeed: fix dma map failure [5.10,197/530] USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() [5.10,198/530] drivers: nvmem: Fix voltage settings for QTI qfprom-efuse [5.10,199/530] driver core: platform: Declare early_platform_cleanup() prototype [5.10,200/530] memory: pl353: fix mask of ECC page_size config register [5.10,201/530] soundwire: stream: fix memory leak in stream config error path [5.10,202/530] m68k: mvme147,mvme16x: Dont wipe PCC timer config bits [5.10,203/530] firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool [5.10,204/530] firmware: qcom_scm: Reduce locking section for __get_convention() [5.10,205/530] firmware: qcom_scm: Workaround lack of "is available" call on SC7180 [5.10,206/530] iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol [5.10,207/530] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init [5.10,208/530] irqchip/gic-v3: Fix OF_BAD_ADDR error handling [5.10,209/530] staging: comedi: tests: ni_routes_test: Fix compilation error [5.10,210/530] staging: rtl8192u: Fix potential infinite loop [5.10,211/530] staging: fwserial: fix TIOCSSERIAL implementation [5.10,212/530] staging: fwserial: fix TIOCGSERIAL implementation [5.10,213/530] staging: greybus: uart: fix unprivileged TIOCCSERIAL [5.10,214/530] soc: qcom: pdr: Fix error return code in pdr_register_listener [5.10,215/530] PM / devfreq: Use more accurate returned new_freq as resume_freq [5.10,216/530] clocksource/drivers/timer-ti-dm: Fix posted mode status check order [5.10,217/530] clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped [5.10,218/530] clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() [5.10,219/530] spi: Fix use-after-free with devm_spi_alloc_* [5.10,220/530] spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() [5.10,221/530] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz [5.10,222/530] soc: qcom: mdt_loader: Detect truncated read of segments [5.10,223/530] PM: runtime: Replace inline function pm_runtime_callbacks_present() [5.10,224/530] cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration [5.10,225/530] ACPI: CPPC: Replace cppc_attr with kobj_attribute [5.10,226/530] crypto: allwinner - add missing CRYPTO_ prefix [5.10,227/530] crypto: sun8i-ss - Fix memory leak of pad [5.10,228/530] crypto: sa2ul - Fix memory leak of rxd [5.10,229/530] crypto: qat - Fix a double free in adf_create_ring [5.10,230/530] cpufreq: armada-37xx: Fix setting TBG parent for load levels [5.10,231/530] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock [5.10,232/530] cpufreq: armada-37xx: Fix the AVS value for load L1 [5.10,233/530] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz [5.10,234/530] clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 [5.10,235/530] cpufreq: armada-37xx: Fix driver cleanup when registration failed [5.10,236/530] cpufreq: armada-37xx: Fix determining base CPU frequency [5.10,237/530] spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op... [5.10,238/530] spi: spi-zynqmp-gqspi: add mutex locking for exec_op [5.10,239/530] spi: spi-zynqmp-gqspi: transmit dummy circles by using the controllers internal fu... [5.10,240/530] spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op [5.10,241/530] spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() [5.10,242/530] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [5.10,243/530] USB: cdc-acm: fix unprivileged TIOCCSERIAL [5.10,244/530] USB: cdc-acm: fix TIOCGSERIAL implementation [5.10,245/530] tty: actually undefine superseded ASYNC flags [5.10,246/530] tty: fix return value for unsupported ioctls [5.10,247/530] tty: Remove dead termiox code [5.10,248/530] tty: fix return value for unsupported termiox ioctls [5.10,249/530] serial: core: return early on unsupported ioctls [5.10,250/530] firmware: qcom-scm: Fix QCOM_SCM configuration [5.10,251/530] node: fix device cleanups in error handling code [5.10,252/530] crypto: chelsio - Read rxchannel-id from firmware [5.10,253/530] usbip: vudc: fix missing unlock on error in usbip_sockfd_store() [5.10,254/530] m68k: Add missing mmap_read_lock() to sys_cacheflush() [5.10,255/530] spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() [5.10,256/530] memory: renesas-rpc-if: fix possible NULL pointer dereference of resource [5.10,257/530] memory: samsung: exynos5422-dmc: handle clk_set_parent() failure [5.10,258/530] security: keys: trusted: fix TPM2 authorizations [5.10,259/530] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk... [5.10,260/530] ARM: dts: aspeed: Rainier: Fix humidity sensor bus address [5.10,261/530] Drivers: hv: vmbus: Use after free in __vmbus_open() [5.10,262/530] spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue [5.10,263/530] spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume [5.10,264/530] spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op [5.10,265/530] spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails [5.10,266/530] x86/platform/uv: Fix !KEXEC build failure [5.10,267/530] hwmon: (pmbus/pxe1610) dont bail out when not all pages are active [5.10,268/530] Drivers: hv: vmbus: Increase wait time for VMbus unload [5.10,269/530] PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check [5.10,270/530] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. [5.10,271/530] usb: dwc2: Fix hibernation between host and device modes. [5.10,272/530] ttyprintk: Add TTY hangup callback. [5.10,273/530] serial: omap: dont disable rs485 if rts gpio is missing [5.10,274/530] serial: omap: fix rs485 half-duplex filtering [5.10,275/530] xen-blkback: fix compatibility bug with single page rings [5.10,276/530] soc: aspeed: fix a ternary sign expansion bug [5.10,277/530] drm/tilcdc: send vblank event when disabling crtc [5.10,278/530] drm/stm: Fix bus_flags handling [5.10,279/530] drm/amd/display: Fix off by one in hdmi_14_process_transaction() [5.10,280/530] drm/mcde/panel: Inverse misunderstood flag [5.10,281/530] sched/fair: Fix shift-out-of-bounds in load_balance() [5.10,282/530] afs: Fix updating of i_mode due to 3rd party change [5.10,283/530] rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() [5.10,284/530] media: vivid: fix assignment of dev->fbuf_out_flags [5.10,285/530] media: saa7134: use sg_dma_len when building pgtable [5.10,286/530] media: saa7146: use sg_dma_len when building pgtable [5.10,287/530] media: omap4iss: return error code when omap4iss_get() failed [5.10,288/530] media: rkisp1: rsz: crash fix when setting src format [5.10,289/530] media: aspeed: fix clock handling logic [5.10,290/530] drm/probe-helper: Check epoch counter in output_poll_execute() [5.10,291/530] media: venus: core: Fix some resource leaks in the error path of venus_probe() [5.10,292/530] media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_stre... [5.10,293/530] media: m88ds3103: fix return value check in m88ds3103_probe() [5.10,294/530] media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 [5.10,295/530] media: [next] staging: media: atomisp: fix memory leak of object flash [5.10,296/530] media: atomisp: Fixed error handling path [5.10,297/530] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [5.10,298/530] media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() [5.10,299/530] drm/amdkfd: fix build error with AMD_IOMMU_V2=m [5.10,300/530] of: overlay: fix for_each_child.cocci warnings [5.10,301/530] x86/kprobes: Fix to check non boostable prefixes correctly [5.10,302/530] selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) [5.10,303/530] pata_arasan_cf: fix IRQ check [5.10,304/530] pata_ipx4xx_cf: fix IRQ check [5.10,305/530] sata_mv: add IRQ checks [5.10,306/530] ata: libahci_platform: fix IRQ check [5.10,307/530] seccomp: Fix CONFIG tests for Seccomp_filters [5.10,308/530] nvme-tcp: block BH in sk state_change sk callback [5.10,309/530] nvmet-tcp: fix incorrect locking in state_change sk callback [5.10,310/530] clk: imx: Fix reparenting of UARTs not associated with stdout [5.10,311/530] power: supply: bq25980: Move props from battery node [5.10,312/530] nvme: retrigger ANA log update if group descriptor isnt found [5.10,313/530] media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from im... [5.10,314/530] media: i2c: imx219: Balance runtime PM use-count [5.10,315/530] media: v4l2-ctrls.c: fix race condition in hdl->requests list [5.10,316/530] vfio/fsl-mc: Re-order vfio_fsl_mc_probe() [5.10,317/530] vfio/pci: Move VGA and VF initialization to functions [5.10,318/530] vfio/pci: Re-order vfio_pci_probe() [5.10,319/530] vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer [5.10,320/530] clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback [5.10,321/530] clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable [5.10,322/530] drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() [5.10,323/530] clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE [5.10,324/530] clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE [5.10,325/530] drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct [5.10,326/530] drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() [5.10,327/530] clk: uniphier: Fix potential infinite loop [5.10,328/530] scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() [5.10,329/530] scsi: pm80xx: Fix potential infinite loop [5.10,330/530] scsi: ufs: ufshcd-pltfrm: Fix deferred probing [5.10,331/530] scsi: hisi_sas: Fix IRQ checks [5.10,332/530] scsi: jazz_esp: Add IRQ check [5.10,333/530] scsi: sun3x_esp: Add IRQ check [5.10,334/530] scsi: sni_53c710: Add IRQ check [5.10,335/530] scsi: ibmvfc: Fix invalid state machine BUG_ON() [5.10,336/530] mailbox: sprd: Introduce refcnt when clients requests/free channels [5.10,337/530] mfd: stm32-timers: Avoid clearing auto reload register [5.10,338/530] nvmet-tcp: fix a segmentation fault during io parsing error [5.10,339/530] nvme-pci: dont simple map sgl when sgls are disabled [5.10,340/530] media: cedrus: Fix H265 status definitions [5.10,341/530] HSI: core: fix resource leaks in hsi_add_client_from_dt() [5.10,342/530] x86/events/amd/iommu: Fix sysfs type mismatch [5.10,343/530] perf/amd/uncore: Fix sysfs type mismatch [5.10,344/530] io_uring: fix overflows checks in provide buffers [5.10,345/530] sched/debug: Fix cgroup_path[] serialization [5.10,346/530] drivers/block/null_blk/main: Fix a double free in null_init. [5.10,347/530] xsk: Respect devices headroom and tailroom on generic xmit path [5.10,348/530] HID: plantronics: Workaround for double volume key presses [5.10,349/530] perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed c... [5.10,350/530] ASoC: Intel: boards: sof-wm8804: add check for PLL setting [5.10,351/530] ASoC: Intel: Skylake: Compile when any configuration is selected [5.10,352/530] RDMA/mlx5: Fix mlx5 rates to IB rates map [5.10,353/530] wilc1000: write value to WILC_INTR2_ENABLE register [5.10,354/530] KVM: x86/mmu: Retry page faults that hit an invalid memslot [5.10,355/530] Bluetooth: avoid deadlock between hci_dev->lock and socket lock [5.10,356/530] net: lapbether: Prevent racing when checking whether the netif is running [5.10,357/530] libbpf: Add explicit padding to bpf_xdp_set_link_opts [5.10,358/530] bpftool: Fix maybe-uninitialized warnings [5.10,359/530] iommu: Check dev->iommu in iommu_dev_xxx functions [5.10,360/530] iommu/vt-d: Reject unsupported page request modes [5.10,361/530] selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed [5.10,362/530] libbpf: Add explicit padding to btf_dump_emit_type_decl_opts [5.10,363/530] powerpc/fadump: Mark fadump_calculate_reserve_size as __init [5.10,364/530] powerpc/prom: Mark identical_pvr_fixup as __init [5.10,365/530] MIPS: fix local_irq_{disable,enable} in asmmacro.h [5.10,366/530] ima: Fix the error code for restoring the PCR value [5.10,367/530] inet: use bigger hash table for IP ID generation [5.10,368/530] pinctrl: pinctrl-single: remove unused parameter [5.10,369/530] pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero [5.10,370/530] MIPS: loongson64: fix bug when PAGE_SIZE > 16KB [5.10,371/530] ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk [5.10,372/530] iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK [5.10,373/530] RDMA/mlx5: Fix drop packet rule in egress table [5.10,374/530] IB/isert: Fix a use after free in isert_connect_request [5.10,375/530] powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration [5.10,376/530] MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again [5.10,377/530] gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP [5.10,378/530] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [5.10,379/530] net: phy: lan87xx: fix access to wrong register of LAN87xx [5.10,380/530] udp: never accept GSO_FRAGLIST packets [5.10,381/530] powerpc/pseries: Only register vio drivers if vio bus exists [5.10,382/530] net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() [5.10,383/530] bug: Remove redundant condition check in report_bug [5.10,384/530] RDMA/core: Fix corrupted SL on passive side [5.10,385/530] nfc: pn533: prevent potential memory corruption [5.10,386/530] net: hns3: Limiting the scope of vector_ring_chain variable [5.10,387/530] mips: bmips: fix syscon-reboot nodes [5.10,388/530] iommu/vt-d: Dont set then clear private data in prq_event_thread() [5.10,389/530] iommu: Fix a boundary issue to avoid performance drop [5.10,390/530] iommu/vt-d: Report right snoop capability when using FL for IOVA [5.10,391/530] iommu/vt-d: Report the right page fault address [5.10,392/530] iommu/vt-d: Preset Access/Dirty bits for IOVA over FL [5.10,393/530] iommu/vt-d: Remove WO permissions on second-level paging entries [5.10,394/530] iommu/vt-d: Invalidate PASID cache when root/context entry changed [5.10,395/530] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [5.10,396/530] HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness [5.10,397/530] HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling [5.10,398/530] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() [5.10,399/530] HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE [5.10,400/530] KVM: arm64: Initialize VCPU mdcr_el2 before loading it [5.10,401/530] ASoC: simple-card: fix possible uninitialized single_cpu local variable [5.10,402/530] liquidio: Fix unintented sign extension of a left shift of a u16 [5.10,403/530] IB/hfi1: Use kzalloc() for mmu_rb_handler allocation [5.10,404/530] powerpc/64s: Fix pte update for kernel memory on radix [5.10,405/530] powerpc/perf: Fix PMU constraint check for EBB events [5.10,406/530] powerpc: iommu: fix build when neither PCI or IBMVIO is set [5.10,407/530] mac80211: bail out if cipher schemes are invalid [5.10,408/530] perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric [5.10,409/530] xfs: fix return of uninitialized value in variable error [5.10,410/530] rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() [5.10,411/530] mt7601u: fix always true expression [5.10,412/530] mt76: mt7615: fix tx skb dma unmap [5.10,413/530] mt76: mt7915: fix tx skb dma unmap [5.10,414/530] mt76: mt7915: fix aggr len debugfs node [5.10,415/530] mt76: mt7615: fix mib stats counter reporting to mac80211 [5.10,416/530] mt76: mt7915: fix mib stats counter reporting to mac80211 [5.10,417/530] mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation [5.10,418/530] mt76: mt7663s: fix the possible device hang in high traffic [5.10,419/530] KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit [5.10,420/530] ovl: invalidate readdir cache on changes to dir with origin [5.10,421/530] RDMA/qedr: Fix error return code in qedr_iw_connect() [5.10,422/530] IB/hfi1: Fix error return code in parse_platform_config() [5.10,423/530] RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() [5.10,424/530] cxgb4: Fix unintentional sign extension issues [5.10,425/530] net: thunderx: Fix unintentional sign extension issue [5.10,426/530] RDMA/srpt: Fix error return code in srpt_cm_req_recv() [5.10,427/530] RDMA/rtrs-clt: destroy sysfs after removing session from active list [5.10,428/530] i2c: cadence: fix reference leak when pm_runtime_get_sync fails [5.10,429/530] i2c: img-scb: fix reference leak when pm_runtime_get_sync fails [5.10,430/530] i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails [5.10,431/530] i2c: imx: fix reference leak when pm_runtime_get_sync fails [5.10,432/530] i2c: omap: fix reference leak when pm_runtime_get_sync fails [5.10,433/530] i2c: sprd: fix reference leak when pm_runtime_get_sync fails [5.10,434/530] i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails [5.10,435/530] i2c: xiic: fix reference leak when pm_runtime_get_sync fails [5.10,436/530] i2c: cadence: add IRQ check [5.10,437/530] i2c: emev2: add IRQ check [5.10,438/530] i2c: jz4780: add IRQ check [5.10,439/530] i2c: mlxbf: add IRQ check [5.10,440/530] i2c: rcar: make sure irq is not threaded on Gen2 and earlier [5.10,441/530] i2c: rcar: protect against supurious interrupts on V3U [5.10,442/530] i2c: rcar: add IRQ check [5.10,443/530] i2c: sh7760: add IRQ check [5.10,444/530] powerpc/xive: Drop check on irq_data in xive_core_debug_show() [5.10,445/530] powerpc/xive: Fix xmon command "dxi" [5.10,446/530] ASoC: ak5558: correct reset polarity [5.10,447/530] net/mlx5: Fix bit-wise and with zero [5.10,448/530] net/packet: make packet_fanout.arr size configurable up to 64K [5.10,449/530] net/packet: remove data races in fanout operations [5.10,450/530] drm/i915/gvt: Fix error code in intel_gvt_init_device() [5.10,451/530] iommu/amd: Put newline after closing bracket in warning [5.10,452/530] perf beauty: Fix fsconfig generator [5.10,453/530] drm/amd/pm: fix error code in smu_set_power_limit() [5.10,454/530] MIPS: pci-legacy: stop using of_pci_range_to_resource [5.10,455/530] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [5.10,456/530] powerpc/smp: Reintroduce cpu_core_mask [5.10,457/530] KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid [5.10,458/530] rtlwifi: 8821ae: upgrade PHY and RF parameters [5.10,459/530] wlcore: fix overlapping snprintf arguments in debugfs [5.10,460/530] i2c: sh7760: fix IRQ error path [5.10,461/530] i2c: mediatek: Fix wrong dma sync flag [5.10,462/530] mwl8k: Fix a double Free in mwl8k_probe_hw [5.10,463/530] netfilter: nft_payload: fix C-VLAN offload support [5.10,464/530] netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector [5.10,465/530] netfilter: nftables_offload: special ethertype handling for VLAN [5.10,466/530] vsock/vmci: log once the failed queue pair allocation [5.10,467/530] libbpf: Initialize the bpf_seq_printf parameters array field by field [5.10,468/530] net: ethernet: ixp4xx: Set the DMA masks explicitly [5.10,469/530] gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check [5.10,470/530] RDMA/cxgb4: add missing qpid increment [5.10,471/530] RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails [5.10,472/530] ALSA: usb: midi: dont return -ENOMEM when usb_urb_ep_type_check fails [5.10,473/530] sfc: ef10: fix TX queue lookup in TX event handling [5.10,474/530] vsock/virtio: free queued packets when closing socket [5.10,475/530] net: marvell: prestera: fix port event handling on init [5.10,476/530] net: davinci_emac: Fix incorrect masking of tx and rx error channel [5.10,477/530] mt76: mt7615: fix memleak when mt7615_unregister_device() [5.10,478/530] crypto: ccp: Detect and reject "invalid" addresses destined for PSP [5.10,479/530] nfp: devlink: initialize the devlink port attribute "lanes" [5.10,480/530] net: stmmac: fix TSO and TBS feature enabling during driver open [5.10,481/530] net: renesas: ravb: Fix a stuck issue when a lot of frames are received [5.10,482/530] net: phy: intel-xway: enable integrated led functions [5.10,483/530] RDMA/rxe: Fix a bug in rxe_fill_ip_info() [5.10,484/530] RDMA/core: Add CM to restrack after successful attachment to a device [5.10,485/530] powerpc/64: Fix the definition of the fixmap area [5.10,486/530] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [5.10,487/530] ath10k: Fix a use after free in ath10k_htc_send_bundle [5.10,488/530] ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock [5.10,489/530] wlcore: Fix buffer overrun by snprintf due to incorrect buffer size [5.10,490/530] powerpc/perf: Fix the threshold event selection for memory events in power10 [5.10,491/530] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [5.10,492/530] net: phy: marvell: fix m88e1011_set_downshift [5.10,493/530] net: phy: marvell: fix m88e1111_set_downshift [5.10,494/530] net: enetc: fix link error again [5.10,495/530] bnxt_en: fix ternary sign extension bug in bnxt_show_temp() [5.10,496/530] ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.10,497/530] arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.10,498/530] net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb [5.10,499/530] selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static [5.10,500/530] selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test [5.10,501/530] bnxt_en: Fix RX consumer index logic in the error path. [5.10,502/530] KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM [5.10,503/530] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send [5.10,504/530] selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro [5.10,505/530] selftests/bpf: Fix field existence CO-RE reloc tests [5.10,506/530] selftests/bpf: Fix core_reloc test runner [5.10,507/530] bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds [5.10,508/530] RDMA/siw: Fix a use after free in siw_alloc_mr [5.10,509/530] RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res [5.10,510/530] net: bridge: mcast: fix broken length + header check for MRDv6 Adv. [5.10,511/530] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [5.10,512/530] perf tools: Change fields type in perf_record_time_conv [5.10,513/530] perf jit: Let convert_timestamp() to be backwards-compatible [5.10,514/530] perf session: Add swap operation for event TIME_CONV [5.10,515/530] ia64: fix EFI_DEBUG build [5.10,516/530] kfifo: fix ternary sign extension bugs [5.10,517/530] mm/sl?b.c: remove ctor argument from kmem_cache_flags [5.10,518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags [5.10,519/530] mm: memcontrol: slab: fix obtain a reference to a freeing memcg [5.10,520/530] mm/sparse: add the missing sparse_buffer_fini() in error branch [5.10,521/530] mm/memory-failure: unnecessary amount of unmapping [5.10,522/530] afs: Fix speculative status fetches [5.10,523/530] bpf: Fix alu32 const subreg bound tracking on bitwise operations [5.10,524/530] bpf, ringbuf: Deny reserve of buffers larger than ringbuf [5.10,525/530] bpf: Prevent writable memory-mapping of read-only ringbuf pages [5.10,526/530] arm64: Remove arm64_dma32_phys_limit and its uses [5.10,527/530] net: Only allow init netns to set default tcp cong to a restricted algo [5.10,528/530] smp: Fix smp_call_function_single_async prototype [5.10,529/530] Revert "net/sctp: fix race condition in sctp_destroy_sock" [5.10,530/530] sctp: delay auto_asconf init until binding the first addr

[5.10,046/530] md/bitmap: wait for external bitmap writes to complete during tear down

Commit Message

Patch