[5.16,0312/1039] mt76: mt7921: fix possible NULL pointer dereference in mt7921_mac_write_txwi

From: Lorenzo Bianconi <lorenzo@kernel.org>

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        stable@vger.kernel.org, Lorenzo Bianconi <lorenzo@kernel.org>,
        Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.16 0312/1039] mt76: mt7921: fix possible NULL pointer
 dereference in mt7921_mac_write_txwi
Date: Mon, 24 Jan 2022 19:35:01 +0100
Message-Id: <20220124184135.792115428@linuxfoundation.org>
In-Reply-To: <20220124184125.121143506@linuxfoundation.org>
References: <20220124184125.121143506@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Message ID	20220124184135.792115428@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Lorenzo Bianconi <lorenzo@kernel.org>, Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.16 0312/1039] mt76: mt7921: fix possible NULL pointer dereference in mt7921_mac_write_txwi Date: Mon, 24 Jan 2022 19:35:01 +0100 Message-Id: <20220124184135.792115428@linuxfoundation.org> In-Reply-To: <20220124184125.121143506@linuxfoundation.org> References: <20220124184125.121143506@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.16,0002/1039] KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock [5.16,0003/1039] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 [5.16,0006/1039] HID: wacom: Ignore the confidence flag when a touch is removed [5.16,0008/1039] ALSA: core: Fix SSID quirk lookup for subvendor=0 [5.16,0010/1039] f2fs: fix to do sanity check on inode type during garbage collection [5.16,0011/1039] f2fs: fix to do sanity check in is_alive() [5.16,0012/1039] f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() [5.16,0013/1039] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file [5.16,0015/1039] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings [5.16,0016/1039] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 [5.16,0018/1039] mtd: rawnand: davinci: Dont calculate ECC when reading page [5.16,0019/1039] mtd: rawnand: davinci: Avoid duplicated page read [5.16,0020/1039] mtd: rawnand: davinci: Rewrite function description [5.16,0024/1039] RISC-V: Use common riscv_cpuid_to_hartid_mask() for both SMP=y and SMP=n [5.16,0025/1039] riscv: try to allocate crashkern region from 32bit addressible memory [5.16,0028/1039] riscv: mm: fix wrong phys_ram_base value for RV64 [5.16,0029/1039] x86/gpu: Reserve stolen memory for first integrated Intel GPU [5.16,0031/1039] crypto: x86/aesni - dont require alignment of data [5.16,0034/1039] rtc: cmos: take rtc_lock while reading from CMOS [5.16,0035/1039] net: phy: marvell: add Marvell specific PHY loopback [5.16,0036/1039] ksmbd: uninitialized variable in create_socket() [5.16,0037/1039] ksmbd: fix guest connection failure with nautilus [5.16,0038/1039] ksmbd: add support for smb2 max credit parameter [5.16,0041/1039] ksmbd: add reserved room in ipc request/response [5.16,0044/1039] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE [5.16,0045/1039] media: flexcop-usb: fix control-message timeouts [5.16,0046/1039] media: mceusb: fix control-message timeouts [5.16,0048/1039] media: cpia2: fix control-message timeouts [5.16,0050/1039] media: dib0700: fix undefined behavior in tuner shutdown [5.16,0051/1039] media: redrat3: fix control-message timeouts [5.16,0055/1039] can: softing_cs: softingcs_probe(): fix memleak on registration failure [5.16,0056/1039] mei: hbm: fix client dma reply status [5.16,0057/1039] iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs [5.16,0059/1039] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() [5.16,0061/1039] bus: mhi: core: Fix reading wake_capable channel configuration [5.16,0063/1039] cxl/pmem: Fix reference counting for delayed work [5.16,0065/1039] thermal/drivers/int340x: Fix RFIM mailbox write commands [5.16,0069/1039] gpu: host1x: Add back arm_iommu_detach_device() [5.16,0071/1039] io_uring: fix no lock protection for ctx->cq_extra [5.16,0073/1039] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() [5.16,0074/1039] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller [5.16,0075/1039] mm_zone: add function to check if managed dma zone exists [5.16,0081/1039] drm/rockchip: dsi: Reconfigure hardware on resume() [5.16,0082/1039] drm/ttm: Put BO in its memory managers lru list [5.16,0083/1039] Bluetooth: hci_vhci: Fix to set the force_wakeup value [5.16,0084/1039] Bluetooth: mgmt: Fix Experimental Feature Changed event [5.16,0086/1039] drm/bridge: display-connector: fix an uninitialized pointer in probe() [5.16,0088/1039] drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure [5.16,0091/1039] drm/rockchip: dsi: Disable PLL clock on bind error [5.16,0094/1039] clk: bcm-2835: Pick the closest clock rate [5.16,0096/1039] drm/vc4: hdmi: Set a default HSM rate [5.16,0097/1039] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm [5.16,0101/1039] drm/vc4: crtc: Make sure the HDMI controller is powered when disabling [5.16,0106/1039] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND [5.16,0108/1039] drm/vc4: hdmi: Enable the scrambler on reconnection [5.16,0112/1039] wcn36xx: Release DMA channel descriptor allocations [5.16,0114/1039] wcn36xx: populate band before determining rate on RX [5.16,0115/1039] wcn36xx: fix RX BD rate mapping for 5GHz legacy rates [5.16,0117/1039] bpftool: Fix memory leak in prog_dump() [5.16,0118/1039] mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() [5.16,0120/1039] media: ipu3-cio2: fix error code in cio2_bridge_connect_sensor() [5.16,0121/1039] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() [5.16,0127/1039] media: atomisp: add NULL check for asd obtained from atomisp_video_pipe [5.16,0129/1039] media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() [5.16,0132/1039] media: aspeed: Update signal status immediately to ensure sane hw state [5.16,0133/1039] arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name [5.16,0134/1039] arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ [5.16,0137/1039] fs: dlm: dont call kernel_getpeername() in error_report() [5.16,0143/1039] ath11k: reset RSN/WPA present state for open BSS [5.16,0146/1039] kernel/locking: Use a pointer in ww_mutex_trylock(). [5.16,0147/1039] fs: dlm: fix build with CONFIG_IPV6 disabled [5.16,0150/1039] mctp/test: Update refcount checking in route fragment tests [5.16,0153/1039] ath11k: allocate dst ring descriptors from cacheable memory [5.16,0154/1039] ath11k: add hw_param for wakeup_mhi [5.16,0156/1039] media: dmxdev: fix UAF when dvb_register_device() fails [5.16,0160/1039] crypto: qce - fix uaf on qce_ahash_register_one [5.16,0163/1039] arm64: dts: qcom: sc7280: Fix interrupt-map parent address cells [5.16,0165/1039] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure [5.16,0166/1039] soc: imx: gpcv2: keep i.MX8MM VPU-H1 bus clock active [5.16,0167/1039] cpufreq: qcom-hw: Fix probable nested interrupt handling [5.16,0168/1039] ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco [5.16,0170/1039] tools/resolve_btf_ids: Close ELF file on error [5.16,0172/1039] libbpf: Fix glob_syms memory leak in bpf_linker [5.16,0174/1039] crypto: qat - fix undetected PFVF timeout in ACK loop [5.16,0175/1039] ath11k: Use host CE parameters for CE interrupts configuration [5.16,0176/1039] arm64: dts: ti: k3-j721e: correct cache-sets info [5.16,0179/1039] pinctrl: apple: return an error if pinmux is missing in the DT [5.16,0180/1039] net: dsa: rtl8365mb: set RGMII RX delay in steps of 0.3 ns [5.16,0183/1039] bfq: Do not let waker requests skip proper accounting [5.16,0184/1039] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data [5.16,0186/1039] media: i2c: Re-order runtime pm initialisation [5.16,0187/1039] media: i2c: ov8865: Fix lockdep error [5.16,0188/1039] media: rcar-csi2: Correct the selection of hsfreqrange [5.16,0190/1039] media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() [5.16,0198/1039] net: stmmac: Add platform level debug register dump feature [5.16,0199/1039] net: lantiq: fix missing free_netdev() on error in ltq_etop_probe() [5.16,0202/1039] netfilter: bridge: add support for pppoe filtering [5.16,0206/1039] drm/vmwgfx: Remove the deprecated lower mem limit [5.16,0207/1039] drm/vmwgfx: Fail to initialize on broken configs [5.16,0210/1039] pinctrl: mediatek: uninitialized variable in mtk_pctrl_show_one_pin() [5.16,0213/1039] drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() [5.16,0215/1039] libbpf: Clean gen_loaders attach kind. [5.16,0218/1039] arm64: dts: ti: k3-am642: Fix the L2 cache sets [5.16,0221/1039] arm64: dts: ti: k3-j7200: Correct the d-cache-sets info [5.16,0223/1039] serial: amba-pl011: do not request memory region twice [5.16,0224/1039] mtd: core: provide unique name for nvmem device [5.16,0228/1039] Bluetooth: btmtksdio: fix resume failure [5.16,0229/1039] bpf: Fix the test_task_vma selftest to support output shorter than 1 kB [5.16,0233/1039] bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) [5.16,0239/1039] platform/x86: wmi: Replace read_takes_no_args with a flags field [5.16,0241/1039] samples/bpf: Clean up samples/bpf build failes [5.16,0243/1039] samples: bpf: Fix unknown warning group build warning on Clang [5.16,0244/1039] media: uvcvideo: Fix memory leak of object map on error exit path [5.16,0245/1039] media: uvcvideo: Avoid invalid memory access [5.16,0247/1039] media: dib8000: Fix a memleak in dib8000_init() [5.16,0250/1039] wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma [5.16,0258/1039] drm/amd/display: Fix bug in debugfs crc_win_update entry [5.16,0259/1039] drm/amd/display: Fix out of bounds access on DNC31 stream encoder regs [5.16,0260/1039] drm/msm/gpu: Dont allow zero fence_id [5.16,0261/1039] drm/msm/dp: displayPort driver need algorithm rational [5.16,0262/1039] rcu/exp: Mark current CPU as exp-QS in IPI loop second pass [5.16,0263/1039] wcn36xx: Fix max channels retrieval [5.16,0265/1039] mwifiex: Fix possible ABBA deadlock [5.16,0267/1039] x86/uaccess: Move variable into switch case statement [5.16,0268/1039] libbpf: Add "bool skipped" to struct bpf_map [5.16,0270/1039] selftests: harness: avoid false negatives if test has no ASSERTs [5.16,0272/1039] crypto: stm32/cryp - fix xts and race condition in crypto_engine requests [5.16,0275/1039] crypto: stm32/cryp - fix lrw chaining mode [5.16,0277/1039] crypto: stm32 - Revert broken pm_runtime_resume_and_get changes [5.16,0280/1039] ath11k: Fix deleting uninitialized kernel timer during fragment cache flush [5.16,0283/1039] ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors [5.16,0285/1039] media: dw2102: Fix use after free [5.16,0286/1039] media: msi001: fix possible null-ptr-deref in msi001_probe() [5.16,0288/1039] ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() [5.16,0291/1039] net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports [5.16,0292/1039] net: dsa: hellcreek: Add missing PTP via UDP rules [5.16,0298/1039] drm/tegra: gr2d: Explicitly control module reset [5.16,0302/1039] xfrm: state and policy should fail if XFRMA_IF_ID 0 [5.16,0303/1039] ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding [5.16,0308/1039] mt76: mt7921: drop offload_flags overwritten [5.16,0309/1039] mt76: mt7921: fix MT7921E reset failure [5.16,0311/1039] mt76: fix possible OOB issue in mt76_calculate_default_rate [5.16,0312/1039] mt76: mt7921: fix possible NULL pointer dereference in mt7921_mac_write_txwi [5.16,0314/1039] mt76: mt7921s: fix the device cannot sleep deeply in suspend [5.16,0316/1039] mt76: mt7921s: fix possible kernel crash due to invalid Rx count [5.16,0317/1039] mt76: connac: fix last_chan configuration in mt76_connac_mcu_rate_txpower_band [5.16,0318/1039] mt76: mt7921: fix possible resume failure [5.16,0319/1039] mt76: connac: introduce MCU_EXT macros [5.16,0322/1039] mt76: connac: introduce MCU_UNI_CMD macro [5.16,0325/1039] rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC [5.16,0326/1039] rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE [5.16,0329/1039] iwlwifi: mvm: test roc running status bits before removing the sta [5.16,0331/1039] iwlwifi: mvm: set protected flag only for NDP ranging [5.16,0333/1039] mmc: meson-mx-sdio: add IRQ check [5.16,0334/1039] block: fix error unwinding in device_add_disk [5.16,0335/1039] selinux: fix potential memleak in selinux_add_opt() [5.16,0340/1039] lib/logic_iomem: Fix operation on 32-bit [5.16,0343/1039] bpftool: Enable line buffering for stdout [5.16,0348/1039] backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion [5.16,0351/1039] ath11k: Fix unexpected return buffer manager error for QCA6390 [5.16,0353/1039] Bluetooth: hci_qca: Stop IBS timer during BT OFF [5.16,0355/1039] crypto: octeontx2 - prevent underflow in get_cores_bmap() [5.16,0357/1039] regulator: qcom-labibb: OCP interrupts are not a failure while disabled [5.16,0358/1039] hwmon: (mr75203) fix wrong power-up delay value [5.16,0359/1039] x86/mce/inject: Avoid out-of-bounds write when setting flags [5.16,0361/1039] bpf: Add missing map_get_next_key method to bloom filter map. [5.16,0362/1039] serial: 8250_bcm7271: Propagate error codes from brcmuart_probe() [5.16,0365/1039] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_re... [5.16,0367/1039] power: reset: mt6397: Check for null res pointer [5.16,0368/1039] net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path [5.16,0370/1039] net: dsa: fix incorrect function pointer check for MRP ring roles [5.16,0375/1039] bpf: Dont promote bogus looking registers after null check. [5.16,0377/1039] bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). [5.16,0378/1039] libbpf: Use probe_name for legacy kprobe [5.16,0380/1039] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone [5.16,0381/1039] net: fix SOF_TIMESTAMPING_BIND_PHC to work with multiple sockets [5.16,0382/1039] ppp: ensure minimum packet size in ppp_write() [5.16,0384/1039] staging: greybus: audio: Check null pointer [5.16,0385/1039] fsl/fman: Check for null pointer after calling devm_ioremap [5.16,0386/1039] Bluetooth: hci_bcm: Check for error irq [5.16,0387/1039] Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe [5.16,0389/1039] usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe [5.16,0391/1039] usb: dwc2: gadget: initialize max_speed from params [5.16,0395/1039] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc [5.16,0399/1039] drivers/firmware: Add missing platform_device_put() in sysfb_create_simplefb [5.16,0401/1039] serial: stm32: move tx dma terminate DMA to shutdown [5.16,0405/1039] net/mlx5e: Fix page DMA map/unmap attributes [5.16,0408/1039] net/mlx5e: Dont block routes with nexthop objects in SW [5.16,0409/1039] Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" [5.16,0411/1039] net/mlx5e: Fix matching on modified inner ip_ecn bits [5.16,0415/1039] lib/mpi: Add the return value check of kcalloc() [5.16,0416/1039] Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() [5.16,0417/1039] Bluetooth: hci_sock: fix endian bug in hci_sock_setsockopt() [5.16,0418/1039] mptcp: fix per socket endpoint accounting [5.16,0419/1039] mptcp: fix opt size when sending DSS + MP_FAIL [5.16,0420/1039] mptcp: fix a DSS option writing error [5.16,0423/1039] octeontx2-af: Increment ptp refcount before use [5.16,0424/1039] octeontx2-nicvf: Free VF PTP resources. [5.16,0425/1039] ax25: uninitialized variable in ax25_setsockopt() [5.16,0430/1039] can: mcp251xfd: add missing newline to printed strings [5.16,0432/1039] tpm_tis: Fix an error handling path in tpm_tis_core_init() [5.16,0433/1039] can: softing: softing_startstop(): fix set but not used variable warning [5.16,0436/1039] pcmcia: fix setting of kthread task states [5.16,0437/1039] netfilter: egress: avoid a lockdep splat [5.16,0438/1039] net: openvswitch: Fix ct_state nat flags for conns arriving from tc [5.16,0441/1039] net: mcs7830: handle usb read errors properly [5.16,0444/1039] ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible [5.16,0446/1039] ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls [5.16,0447/1039] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls [5.16,0448/1039] ALSA: hda: Fix potential deadlock at codec unbinding [5.16,0449/1039] RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pendin... [5.16,0450/1039] RDMA/hns: Validate the pkey index [5.16,0452/1039] clk: renesas: rzg2l: Check return value of pm_genpd_init() [5.16,0454/1039] clk: imx8mn: Fix imx8mn_clko1_sels [5.16,0455/1039] ASoC: cs42l42: Report initial jack state [5.16,0458/1039] ASoC: codecs: wcd938x: add SND_SOC_WCD938_SDW to codec list instead [5.16,0461/1039] dt-bindings: thermal: Fix definition of cooling-maps contribution property [5.16,0462/1039] powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflo... [5.16,0467/1039] ALSA: usb-audio: Drop superfluous 0 in Presonus Studio 1810cs ID [5.16,0468/1039] ASoC: amd: Fix dependency for SPI master [5.16,0469/1039] misc: at25: Make driver OF independent again [5.16,0470/1039] char/mwave: Adjust io port register size [5.16,0471/1039] binder: fix handling of error during copy [5.16,0472/1039] binder: avoid potential data leakage when copying txn [5.16,0474/1039] uio: uio_dmem_genirq: Catch the Exception [5.16,0481/1039] PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() [5.16,0482/1039] powerpc/powermac: Add additional missing lockdep_register_key() [5.16,0483/1039] iommu/arm-smmu-qcom: Fix TTBR0 read [5.16,0484/1039] RDMA/core: Let ib_find_gid() continue search even after empty entry [5.16,0489/1039] clk: stm32: Fix ltdcs clock turn off by clk_disable_unused() after system enter ... [5.16,0490/1039] mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support [5.16,0492/1039] dmaengine: pxa/mmp: stop referencing config->slave_id [5.16,0494/1039] iommu/amd: X2apic mode: re-enable after resume [5.16,0497/1039] iommu/amd: Remove useless irq affinity notifier [5.16,0498/1039] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on [5.16,0500/1039] ASoC: mediatek: mt8195: correct default value [5.16,0501/1039] counter: 104-quad-8: Fix persistent enabled events bug [5.16,0502/1039] of: fdt: Aggregate the processing of "linux,usable-memory-range" [5.16,0504/1039] scsi: block: pm: Always set request queue runtime active in blk_post_runtime_res... [5.16,0506/1039] ASoC: mediatek: Check for error clk pointer [5.16,0507/1039] powerpc/64s: Mask NIP before checking against SRR0 [5.16,0508/1039] powerpc/64s: Use EMIT_WARN_ENTRY for SRR debug warnings [5.16,0511/1039] ASoC: samsung: idma: Check of ioremap return value [5.16,0512/1039] misc: lattice-ecp3-config: Fix task hung when firmware load failed [5.16,0516/1039] mips: bcm63xx: add support for clk_set_parent() [5.16,0518/1039] ASoC: fsl_mqs: fix MODULE_ALIAS [5.16,0519/1039] ALSA: hda/cs8409: Increase delay during jack detection [5.16,0522/1039] MIPS: fix local_{add,sub}_return on MIPS64 [5.16,0523/1039] RDMA/cxgb4: Set queue pair state when being queried [5.16,0527/1039] ASoC: imx-card: improve the sound quality for low rate [5.16,0530/1039] of: base: Fix phandle argument length mismatch error message [5.16,0531/1039] of/fdt: Dont worry about non-memory region overlap for no-map [5.16,0532/1039] MIPS: compressed: Fix build with ZSTD compression [5.16,0535/1039] mailbox: pcc: Avoid using the uninitialized variable dev [5.16,0536/1039] mailbox: pcc: Handle all PCC subtypes correctly in pcc_mbox_irq [5.16,0538/1039] leds: lp55xx: initialise output direction from dts [5.16,0540/1039] Bluetooth: Fix debugfs entry leak in hci_register_dev() [5.16,0542/1039] drm/panel: Delete panel on mipi_dsi_attach() failure [5.16,0543/1039] Bluetooth: Fix removing adv when processing cmd complete [5.16,0545/1039] fs: dlm: filter user dlm messages for kernel locks [5.16,0547/1039] libbpf: Improve sanity checking during BTF fix up [5.16,0548/1039] libbpf: Validate that .BTF and .BTF.ext sections contain data [5.16,0551/1039] selftests/bpf: Destroy XDP link correctly [5.16,0553/1039] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply [5.16,0554/1039] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR [5.16,0556/1039] media: atomisp: fix try_fmt logic [5.16,0557/1039] media: atomisp: set per-devices default mode [5.16,0558/1039] media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure [5.16,0564/1039] media: atomisp: handle errors at sh_css_create_isp_params() [5.16,0566/1039] usb: dwc3: meson-g12a: fix shared reset control use [5.16,0567/1039] USB: ehci_brcm_hub_control: Improve port index sanitizing [5.16,0568/1039] usb: gadget: f_fs: Use stream_open() for endpoint files [5.16,0571/1039] HID: magicmouse: Report battery level over USB [5.16,0572/1039] HID: apple: Do not reset quirks when the Fn key is not found [5.16,0573/1039] media: b2c2: Add missing check in flexcop_pci_isr: [5.16,0574/1039] libbpf: Accommodate DWARF/compiler bug with duplicated structs [5.16,0577/1039] arm64: dts: qcom: sm[68]350: Use interrupts-extended with pdc interrupts [5.16,0578/1039] arm64: dts: qcom: sm8350: Shorten camera-thermal-bottom name [5.16,0580/1039] ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART [5.16,0582/1039] drm/amd/display: check top_pipe_to_program pointer [5.16,0586/1039] drm/amd/display: add else to avoid double destroy clk_mgr [5.16,0589/1039] mxser: dont throttle manually [5.16,0591/1039] serial: 8250_dw: Add StarFive JH7100 quirk [5.16,0592/1039] tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown() [5.16,0595/1039] crypto: jitter - consider 32 LSB for APT [5.16,0597/1039] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() [5.16,0598/1039] rsi: Fix use-after-free in rsi_rx_done_handler() [5.16,0599/1039] rsi: Fix out-of-bounds read in rsi_read_pkt() [5.16,0601/1039] media: venus: avoid calling core_clk_setrate() concurrently during concurrent vi... [5.16,0602/1039] regulator: da9121: Prevent current limit change when enabled [5.16,0603/1039] drm/vmwgfx: Release ttm memory if probe fails [5.16,0606/1039] ACPI: Change acpi_device_always_present() into acpi_device_override_status() [5.16,0607/1039] ACPI / x86: Allow specifying acpi_device_override_status() quirks by path [5.16,0609/1039] drm: Return error codes from struct drm_driver.gem_create_object [5.16,0612/1039] arm64: dts: ti: j721e-main: Fix dtbs_check in serdes_ln_ctrl node [5.16,0613/1039] usb: uhci: add aspeed ast2600 uhci support [5.16,0614/1039] floppy: Add max size check for user space request [5.16,0617/1039] media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. [5.16,0618/1039] media: rcar-vin: Update format alignment constraints [5.16,0620/1039] media: atomisp: fix "variable dereferenced before check asd" [5.16,0621/1039] media: m920x: dont use stack on USB reads [5.16,0622/1039] thunderbolt: Runtime PM activate both ends of the device link [5.16,0624/1039] iwlwifi: mvm: synchronize with FW after multicast commands [5.16,0626/1039] iwlwifi: acpi: fix wgds rev 3 size [5.16,0632/1039] ath10k: drop beacon and probe response which leak from other channel [5.16,0633/1039] net: phy: prefer 1000baseT over 1000baseKX [5.16,0634/1039] gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock [5.16,0637/1039] arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards [5.16,0638/1039] ath11k: Avoid false DEADLOCK warning reported by lockdep [5.16,0639/1039] ARM: dts: qcom: sdx55: fix IPA interconnect definitions [5.16,0640/1039] x86/mce: Allow instrumentation during task work queueing [5.16,0642/1039] x86/mce: Mark mce_panic() noinstr [5.16,0646/1039] kunit: Dont crash if no parameters are generated [5.16,0648/1039] drm/amdkfd: Fix error handling in svm_range_add [5.16,0650/1039] HID: quirks: Allow inverting the absolute X/Y values [5.16,0651/1039] HID: i2c-hid-of: Expose the touchscreen-inverted properties [5.16,0656/1039] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO [5.16,0658/1039] drm/amd/amdgpu: fix psp tmr bo pin count leak in SRIOV [5.16,0659/1039] drm/amd/amdgpu: fix gmc bo pin count leak in SRIOV [5.16,0660/1039] audit: ensure userspace is penalized the same as the kernel when under pressure [5.16,0662/1039] arm64: tegra: Adjust length of CCPLEX cluster MMIO region [5.16,0668/1039] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 [5.16,0670/1039] mt76: mt7915: fix SMPS operation fail [5.16,0671/1039] mt76: connac: fix a theoretical NULL pointer dereference in mt76_connac_get_phy_... [5.16,0672/1039] mt76: do not pass the received frame with decryption error [5.16,0674/1039] mt76: mt7921: fix network buffer leak by txs missing [5.16,0675/1039] ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep() [5.16,0676/1039] ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() [5.16,0678/1039] rtw88: 8822c: update rx settings to prevent potential hw deadlock [5.16,0679/1039] PM: AVS: qcom-cpr: Use div64_ul instead of do_div [5.16,0680/1039] iwlwifi: recognize missing PNVM data and then log filename [5.16,0682/1039] iwlwifi: remove module loading failure message [5.16,0683/1039] iwlwifi: mvm: Fix calculation of frame length [5.16,0687/1039] block: check minor range in device_add_disk() [5.16,0688/1039] um: registers: Rename function names to avoid conflicts and build problems [5.16,0690/1039] Bluetooth: btintel: Add missing quirks and msft ext for legacy bootloader [5.16,0693/1039] xfrm: rate limit SA mapping change message to user space [5.16,0694/1039] drm/etnaviv: consider completed fence seqno in hang check [5.16,0695/1039] jffs2: GC deadlock reading a page that is used in jffs2_write_begin() [5.16,0700/1039] ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 [5.16,0701/1039] mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling [5.16,0705/1039] amdgpu/pm: Make sysfs pm attributes as read-only for VFs [5.16,0708/1039] net/mlx5: DR, Fix error flow in creating matcher [5.16,0712/1039] mac80211: allow non-standard VHT MCS-10/11 [5.16,0714/1039] dm space map common: add bounds check to sm_ll_lookup_bitmap() [5.16,0718/1039] net: phy: marvell: configure RGMII delays for 88E1118 [5.16,0719/1039] net: gemini: allow any RGMII interface mode [5.16,0721/1039] serial: pl010: Drop CR register reset on set_termios [5.16,0724/1039] random: do not throw away excess input to crng_fast_load [5.16,0726/1039] net/mlx5e: Unblock setting vid 0 for VF in case PF isnt eswitch manager [5.16,0727/1039] parisc: Avoid calling faulthandler_disabled() twice [5.16,0732/1039] x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs [5.16,0733/1039] clk: samsung: exynos850: Register clocks early [5.16,0734/1039] powerpc/6xx: add missing of_node_put [5.16,0735/1039] powerpc/powernv: add missing of_node_put [5.16,0736/1039] powerpc/cell: add missing of_node_put [5.16,0737/1039] powerpc/btext: add missing of_node_put [5.16,0739/1039] ASoC: imx-hdmi: add put_device() after of_find_device_by_node() [5.16,0740/1039] i2c: i801: Dont silently correct invalid transfer size [5.16,0741/1039] powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING [5.16,0742/1039] i2c: mpc: Correct I2C reset procedure [5.16,0746/1039] KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST [5.16,0747/1039] w1: Misuse of get_user()/put_user() reported by sparse [5.16,0748/1039] nvmem: core: set size for sysfs bin file [5.16,0749/1039] dm: fix alloc_dax error handling in alloc_dev [5.16,0754/1039] scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV [5.16,0758/1039] powerpc/40x: Map 32Mbytes of memory at startup [5.16,0762/1039] ASoC: SOF: Intel: hda: add quirks for HDAudio DMA position information [5.16,0763/1039] udf: Fix error handling in udf_new_inode() [5.16,0766/1039] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters [5.16,0768/1039] ASoC: SOF: ipc: Add null pointer check for substream->runtime [5.16,0769/1039] selftests/powerpc: Add a test of sigreturning to the kernel [5.16,0771/1039] scsi: sr: Dont use GFP_DMA [5.16,0773/1039] ASoC: mediatek: mt8192-mt6359: fix device_node leak [5.16,0774/1039] phy: phy-mtk-tphy: add support efuse setting [5.16,0775/1039] ASoC: mediatek: mt8173: fix device_node leak [5.16,0777/1039] habanalabs: change wait for interrupt timeout to 64 bit [5.16,0778/1039] habanalabs: skip read fw errors if dynamic descriptor invalid [5.16,0779/1039] phy: mediatek: Fix missing check in mtk_mipi_tx_probe [5.16,0781/1039] signal: In get_signal test for signal_group_exit every time through the loop [5.16,0784/1039] PCI: rcar: Check if device is runtime suspended instead of __clk_is_enabled() [5.16,0785/1039] PCI: dwc: Do not remap invalid res [5.16,0786/1039] PCI: aardvark: Fix checking for MEM resource type [5.16,0787/1039] PCI: apple: Fix REFCLK1 enable/poll logic [5.16,0789/1039] KVM: s390: Ensure kvm_arch_no_poll() is read once when blocking vCPU [5.16,0792/1039] KVM: x86: Handle 32-bit wrap of EIP for EMULTYPE_SKIP with flat code seg [5.16,0802/1039] PCI: mvebu: Fix configuring secondary bus of PCIe Root Port via emulated bridge [5.16,0805/1039] PCI: mvebu: Fix support for PCI_EXP_DEVCTL on emulated bridge [5.16,0807/1039] PCI: mvebu: Fix support for DEVCAP2, DEVCTL2 and LNKCTL2 registers on emulated b... [5.16,0808/1039] KVM: RISC-V: Avoid spurious virtual interrupts after clearing hideleg CSR [5.16,0809/1039] NFSD: Fix verifier returned in stable WRITEs [5.16,0813/1039] drm/i915/pxp: Hold RPM wakelock during PXP unbind [5.16,0814/1039] drm/i915: dont call free_mmap_offset when purging [5.16,0816/1039] SUNRPC: Fix sockaddr handling in svcsock_accept_class trace points [5.16,0817/1039] drm/sun4i: dw-hdmi: Fix missing put_device() call in sun8i_hdmi_phy_get [5.16,0820/1039] ntb_hw_switchtec: Fix bug with more than 32 partitions [5.16,0821/1039] drm/amd/display: invalid parameter check in dmub_hpd_callback [5.16,0824/1039] PCI: mt7621: Add missing MODULE_LICENSE() [5.16,0825/1039] i3c: master: dw: check return of dw_i3c_master_get_free_pos() [5.16,0826/1039] dma-buf: cma_heap: Fix mutex locking section [5.16,0829/1039] mm: defer kmemleak object creation of module_alloc() [5.16,0830/1039] kasan: fix quarantine conflicting with init_on_free [5.16,0831/1039] selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting [5.16,0832/1039] mm/page_isolation: unset migratetype directly for non Buddy page [5.16,0835/1039] ifcvf/vDPA: fix misuse virtio-net device config size for blk dev [5.16,0836/1039] crypto: omap-aes - Fix broken pm_runtime_and_get() usage [5.16,0837/1039] crypto: stm32/crc32 - Fix kernel BUG triggered in probe() [5.16,0838/1039] crypto: caam - replace this_cpu_ptr with raw_cpu_ptr [5.16,0841/1039] tpm: fix NPE on probe for missing device [5.16,0843/1039] spi: uniphier: Fix a bug that doesnt point to private data correctly [5.16,0844/1039] xen/gntdev: fix unmap notification order [5.16,0847/1039] x86/mce: Check regs before accessing it [5.16,0850/1039] cputime, cpuacct: Include guest time in user time in cpuacct.stat [5.16,0852/1039] tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails [5.16,0853/1039] tracing/kprobes: nmissed not showed correctly for kretprobe [5.16,0854/1039] tracing: Have syscall trace events use trace_event_buffer_lock_reserve() [5.16,0856/1039] iwlwifi: mvm: Increase the scan timeout guard to 30 seconds [5.16,0858/1039] device property: Fix fwnode_graph_devcon_match() fwnode leak [5.16,0859/1039] drm/tegra: submit: Add missing pm_runtime_mark_last_busy() [5.16,0860/1039] drm/etnaviv: limit submit sizes [5.16,0861/1039] drm/amd/display: Fix the uninitialized variable in enable_stream_features() [5.16,0865/1039] powerpc/64s/radix: Fix huge vmap false positive [5.16,0866/1039] scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance [5.16,0870/1039] drm/amd/display: Revert W/A for hard hangs on DCN20/DCN21 [5.16,0871/1039] drm/i915/display/ehl: Update voltage swing table [5.16,0877/1039] PCI: pci-bridge-emul: Fix definitions of reserved bits [5.16,0879/1039] PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device [5.16,0880/1039] xfrm: fix policy lookup for ipv6 gre packets [5.16,0883/1039] btrfs: zoned: cache reported zone during mount [5.16,0886/1039] btrfs: zoned: unset dedicated block group on allocation failure [5.16,0888/1039] btrfs: respect the max size in the header when activating swap file [5.16,0890/1039] ext4: make sure quota gets properly shutdown on error [5.16,0892/1039] ext4: initialize err_blk before calling __ext4_get_inode_loc [5.16,0893/1039] ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE [5.16,0894/1039] ext4: set csum seed in tmp inode while migrating to extents [5.16,0895/1039] ext4: Fix BUG_ON in ext4_bread when write quota data [5.16,0897/1039] ext4: fast commit may miss tracking unwritten range during ftruncate [5.16,0898/1039] ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal [5.16,0900/1039] ext4: fix an use-after-free issue about data=journal writeback mode [5.16,0903/1039] drm/radeon: fix error handling in radeon_driver_open_kms [5.16,0905/1039] firmware: Update Kconfig help text for Google firmware [5.16,0906/1039] can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message [5.16,0908/1039] drm/vc4: hdmi: Make sure the device is powered with CEC [5.16,0914/1039] Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH [5.16,0920/1039] scsi: core: Show SCMD_LAST in text form [5.16,0921/1039] of: base: Improve argument length mismatch error [5.16,0922/1039] scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl() [5.16,0923/1039] dmaengine: uniphier-xdmac: Fix type of address variables [5.16,0924/1039] dmaengine: idxd: fix wq settings post wq disable [5.16,0927/1039] dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK [5.16,0929/1039] powerpc/cell: Fix clang -Wimplicit-fallthrough warning [5.16,0930/1039] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses [5.16,0931/1039] block: fix async_depth sysfs interface for mq-deadline [5.16,0932/1039] block: Fix fsync always failed if once failed [5.16,0934/1039] drm/vc4: Fix non-blocking commit getting stuck forever [5.16,0935/1039] drm/vc4: crtc: Copy assigned channel to the CRTC [5.16,0936/1039] libbpf: Remove deprecation attribute from struct bpf_prog_prep_result [5.16,0937/1039] arm64/bpf: Remove 128MB limit for BPF JIT programs [5.16,0940/1039] xdp: check prog type before updating BPF link [5.16,0942/1039] bpf: Mark PTR_TO_FUNC register initially with zero offset [5.16,0945/1039] ipv4: avoid quadratic behavior in netns dismantle [5.16,0946/1039] mlx5: Dont accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get() [5.16,0948/1039] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module [5.16,0949/1039] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries [5.16,0951/1039] riscv: dts: microchip: mpfs: Drop empty chosen node [5.16,0952/1039] drm/vmwgfx: Remove explicit transparent hugepages support [5.16,0954/1039] f2fs: fix remove page failed in invalidate compress pages [5.16,0958/1039] f2fs: fix to check available space of CP area correctly in update_ckpt_flags() [5.16,0959/1039] crypto: octeontx2 - uninitialized variable in kvf_limits_store() [5.16,0964/1039] gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe [5.16,0965/1039] gpio: idt3243x: Fix IRQ check in idt_gpio_probe [5.16,0966/1039] net/smc: Fix hung_task when removing SMC-R devices [5.16,0969/1039] net: axienet: reset core on initialization prior to MDIO access [5.16,0971/1039] net: axienet: limit minimum TX ring size [5.16,0974/1039] net: axienet: fix for TX busy handling [5.16,0977/1039] um: gitignore: Add kernel/capflags.c [5.16,0978/1039] HID: vivaldi: fix handling devices not using numbered reports [5.16,0981/1039] rtc: pxa: fix null pointer dereference [5.16,0982/1039] vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 [5.16,0984/1039] taskstats: Cleanup the use of task->exit_code [5.16,0986/1039] netns: add schedule point in ops_exit_list() [5.16,0988/1039] xfrm: Dont accidentally set RTO_ONLINK in decode_session4() [5.16,0989/1039] vdpa/mlx5: Fix config_attr_mask assignment [5.16,0991/1039] gre: Dont accidentally set RTO_ONLINK in gre_fill_metadata_dst() [5.16,0992/1039] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() [5.16,0996/1039] dmaengine: at_xdmac: Print debug message after realeasing the lock [5.16,0998/1039] dmaengine: at_xdmac: Fix lld view setting [5.16,1000/1039] perf cputopo: Fix CPU topology reading on s/390 [5.16,1001/1039] perf tools: Drop requirement for libstdc++.so for libopencsd check [5.16,1003/1039] perf test: Enable system wide for metricgroups test [5.16,1005/1039] perf metric: Fix metric_leader [5.16,1006/1039] devlink: Remove misleading internal_flags from health reporter dump [5.16,1008/1039] net: fix sock_timestamping_bind_phc() to release device [5.16,1009/1039] net: bonding: fix bond_xmit_broadcast return value error bug [5.16,1012/1039] net: mscc: ocelot: dont let phylink re-enable TX PAUSE on the NPI port [5.16,1013/1039] bcmgenet: add WOL IRQ check [5.16,1015/1039] net: wwan: Fix MRU mismatch issue which may lead to data connection lost [5.16,1017/1039] net: ocelot: Fix the call to switchdev_bridge_port_offload [5.16,1019/1039] net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account [5.16,1020/1039] net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices [5.16,1022/1039] dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property [5.16,1027/1039] scripts/dtc: dtx_diff: remove broken example from help text [5.16,1028/1039] lib82596: Fix IRQ check in sni_82596_probe [5.16,1030/1039] bonding: Fix extraction of ports from the packet headers [5.16,1033/1039] KVM: x86: Partially allow KVM_SET_CPUID{,2} after KVM_RUN [5.16,1034/1039] KVM: selftests: Rename get_cpuid_test to cpuid_test [5.16,1037/1039] ASoC: SOF: free widgets in sof_tear_down_pipelines() for static pipelines

[5.16,0312/1039] mt76: mt7921: fix possible NULL pointer dereference in mt7921_mac_write_txwi

Commit Message

Patch