[5.15,723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits

From: Ye Bin <yebin10@huawei.com>

From: Ye Bin <yebin10@huawei.com>

commit 298b5c521746d69c07beb2757292fb5ccc1b0f85 upstream.

We got issue as follows when run syzkaller test:
[ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user
[ 1901.130901] Aborting journal on device vda-8.
[ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal
[ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal
[ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal
[ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal
[ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted
[ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal
[ 1901.136915] ==================================================================
[ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal
[ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal
[ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968
[ 1901.138817]
[ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal
[ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1
[ 1901.146479] Hardware name: linux,dummy-virt (DT)
[ 1901.147317] Call trace:
[ 1901.147552]  dump_backtrace+0x0/0x2d8
[ 1901.147898]  show_stack+0x28/0x38
[ 1901.148215]  dump_stack+0xec/0x15c
[ 1901.148746]  kasan_report+0x108/0x338
[ 1901.149207]  __asan_load8+0x58/0xb0
[ 1901.149753]  __ext4_journal_ensure_credits+0x74/0x140 [ext4]
[ 1901.150579]  ext4_xattr_delete_inode+0xe4/0x700 [ext4]
[ 1901.151316]  ext4_evict_inode+0x524/0xba8 [ext4]
[ 1901.151985]  evict+0x1a4/0x378
[ 1901.152353]  iput+0x310/0x428
[ 1901.152733]  do_unlinkat+0x260/0x428
[ 1901.153056]  __arm64_sys_unlinkat+0x6c/0xc0
[ 1901.153455]  el0_svc_common+0xc8/0x320
[ 1901.153799]  el0_svc_handler+0xf8/0x160
[ 1901.154265]  el0_svc+0x10/0x218
[ 1901.154682] ==================================================================

This issue may happens like this:
	Process1                               Process2
ext4_evict_inode
  ext4_journal_start
   ext4_truncate
     ext4_ind_truncate
       ext4_free_branches
         ext4_ind_truncate_ensure_credits
	   ext4_journal_ensure_credits_fn
	     ext4_journal_restart
	       handle->h_transaction = NULL;
                                           mount -o remount,abort  /mnt
					   -> trigger JBD abort
               start_this_handle -> will return failed
  ext4_xattr_delete_inode
    ext4_journal_ensure_credits
      ext4_journal_ensure_credits_fn
        __ext4_journal_ensure_credits
	  jbd2_handle_buffer_credits
	    journal = handle->h_transaction->t_journal; ->null-ptr-deref

Now, indirect truncate process didn't handle error. To solve this issue
maybe simply add check handle is abort in '__ext4_journal_ensure_credits'
is enough, and i also think this is necessary.

Cc: stable@kernel.org
Signed-off-by: Ye Bin <yebin10@huawei.com>
Link: https://lore.kernel.org/r/20211224100341.3299128-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ext4_jbd2.c |    2 ++
 1 file changed, 2 insertions(+)

Message ID	20220124184125.948399488@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, stable@kernel.org, Ye Bin <yebin10@huawei.com>, Theodore Tso <tytso@mit.edu> Subject: [PATCH 5.15 723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits Date: Mon, 24 Jan 2022 19:44:00 +0100 Message-Id: <20220124184125.948399488@linuxfoundation.org> In-Reply-To: <20220124184100.867127425@linuxfoundation.org> References: <20220124184100.867127425@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,003/846] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 [5.15,004/846] HID: uhid: Fix worker destroying device without any protection [5.15,006/846] HID: wacom: Ignore the confidence flag when a touch is removed [5.15,008/846] ALSA: core: Fix SSID quirk lookup for subvendor=0 [5.15,011/846] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file [5.15,012/846] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() [5.15,013/846] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings [5.15,014/846] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 [5.15,016/846] mtd: rawnand: davinci: Dont calculate ECC when reading page [5.15,020/846] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function [5.15,024/846] riscv: Dont use va_pa_offset on kdump [5.15,025/846] riscv: use hart id instead of cpu id on machine_kexec [5.15,032/846] rtc: cmos: take rtc_lock while reading from CMOS [5.15,035/846] ksmbd: fix guest connection failure with nautilus [5.15,038/846] ksmbd: limits exceeding the maximum allowable outstanding requests [5.15,041/846] media: ov8865: Disable only enabled regulators on error path [5.15,042/846] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE [5.15,046/846] media: cpia2: fix control-message timeouts [5.15,047/846] media: s2255: fix control-message timeouts [5.15,052/846] media: cec-pin: fix interrupt en/disable handling [5.15,056/846] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 [5.15,057/846] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() [5.15,058/846] bus: mhi: pci_generic: Graceful shutdown on freeze [5.15,059/846] bus: mhi: core: Fix reading wake_capable channel configuration [5.15,067/846] virtio/virtio_mem: handle a possible NULL as a memcpy parameter [5.15,068/846] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() [5.15,069/846] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller [5.15,071/846] dma/pool: create dma atomic pool only if dma zone has managed pages [5.15,073/846] ath11k: add string type to search board data in board-2.bin for WCN6855 [5.15,075/846] drm/ttm: Put BO in its memory managers lru list [5.15,076/846] Bluetooth: L2CAP: Fix not initializing sk_peer_pid [5.15,077/846] drm/bridge: display-connector: fix an uninitialized pointer in probe() [5.15,078/846] drm: fix null-ptr-deref in drm_dev_init_release() [5.15,080/846] drm/panel: innolux-p079zca: Delete panel on attach() failure [5.15,081/846] drm/rockchip: dsi: Fix unbalanced clock on probe error [5.15,083/846] drm/rockchip: dsi: Disable PLL clock on bind error [5.15,084/846] drm/rockchip: dsi: Reconfigure hardware on resume() [5.15,086/846] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails [5.15,090/846] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm [5.15,091/846] drm/vc4: hdmi: Make sure the controller is powered in detect [5.15,092/846] drm/vc4: hdmi: Make sure the controller is powered up during bind [5.15,097/846] drm/vc4: hdmi: Enable the scrambler on reconnection [5.15,101/846] wcn36xx: Put DXE block into reset before freeing memory [5.15,107/846] media: videobuf2: Fix the size printk format [5.15,108/846] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() [5.15,109/846] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case [5.15,111/846] media: atomisp: do not use err var when checking port validity for ISP2400 [5.15,112/846] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() [5.15,113/846] media: atomisp: fix ifdefs in sh_css.c [5.15,115/846] media: atomisp: fix enum formats logic [5.15,117/846] media: aspeed: fix mode-detect always time out at 2nd run [5.15,118/846] media: em28xx: fix memory leak in em28xx_init_dev [5.15,119/846] media: aspeed: Update signal status immediately to ensure sane hw state [5.15,124/846] fs: dlm: dont call kernel_getpeername() in error_report() [5.15,126/846] Bluetooth: stop proccessing malicious adv data [5.15,129/846] ath11k: reset RSN/WPA present state for open BSS [5.15,130/846] spi: hisi-kunpeng: Fix the debugfs directory name incorrect [5.15,133/846] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() [5.15,134/846] drm/vboxvideo: fix a NULL vs IS_ERR() check [5.15,135/846] arm64: dts: renesas: cat875: Add rx/tx delays [5.15,139/846] crypto: qce - fix uaf on qce_ahash_register_one [5.15,140/846] crypto: qce - fix uaf on qce_skcipher_register_one [5.15,143/846] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure [5.15,147/846] libbpf: Fix glob_syms memory leak in bpf_linker [5.15,148/846] libbpf: Fix using invalidated memory in bpf_linker [5.15,151/846] crypto: qat - fix undetected PFVF timeout in ACK loop [5.15,152/846] ath11k: Use host CE parameters for CE interrupts configuration [5.15,153/846] arm64: dts: ti: k3-j721e: correct cache-sets info [5.15,154/846] tty: serial: atmel: Check return code of dmaengine_submit() [5.15,155/846] tty: serial: atmel: Call dma_async_issue_pending() [5.15,158/846] bfq: Do not let waker requests skip proper accounting [5.15,159/846] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data [5.15,160/846] media: i2c: imx274: fix s_frame_interval runtime resume not requested [5.15,162/846] media: i2c: ov8865: Fix lockdep error [5.15,164/846] media: imx-pxp: Initialize the spinlock prior to using it [5.15,166/846] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released [5.15,174/846] igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS [5.15,176/846] powerpc: Avoid discarding flags in system_call_exception() [5.15,181/846] ACPI: EC: Rework flushing of EC work while suspended to idle [5.15,184/846] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() [5.15,186/846] crypto: caam - save caam memory to support crypto engine retry mechanism. [5.15,191/846] tty: serial: uartlite: allow 64 bit address [5.15,193/846] mtd: core: provide unique name for nvmem device [5.15,194/846] floppy: Fix hang in watchdog when disk is ejected [5.15,199/846] sched/fair: Fix detection of per-CPU kthreads waking a task [5.15,203/846] bpf: Remove config check to enable bpf support for branch records [5.15,205/846] arm64: mte: DC {GVA,GZVA} shouldnt be used when DCZID_EL0.DZP == 1 [5.15,206/846] samples/bpf: Install libbpf headers when building [5.15,212/846] media: si2157: Fix "warm" tuner state detection [5.15,214/846] sched/rt: Try to restart rt period timer when rt runtime exceeded [5.15,218/846] Bluetooth: btusb: Handle download_firmware failure cases [5.15,226/846] mwifiex: Fix possible ABBA deadlock [5.15,231/846] crypto: stm32/cryp - fix CTR counter carry [5.15,232/846] crypto: stm32/cryp - fix xts and race condition in crypto_engine requests [5.15,233/846] crypto: stm32/cryp - check early input data [5.15,234/846] crypto: stm32/cryp - fix double pm exit [5.15,237/846] crypto: stm32 - Revert broken pm_runtime_resume_and_get changes [5.15,238/846] crypto: hisilicon/qm - fix incorrect return value of hisi_qm_resume() [5.15,239/846] ath11k: Fix deleting uninitialized kernel timer during fragment cache flush [5.15,242/846] perf/arm-cmn: Fix CPU hotplug unregistration [5.15,243/846] media: dw2102: Fix use after free [5.15,245/846] media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes [5.15,247/846] net: dsa: hellcreek: Fix insertion of static FDB entries [5.15,248/846] net: dsa: hellcreek: Add STP forwarding rule [5.15,249/846] net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports [5.15,250/846] net: dsa: hellcreek: Add missing PTP via UDP rules [5.15,251/846] arm64: dts: qcom: c630: Fix soundcard setup [5.15,253/846] drm/msm/dpu: fix safe status debugfs file [5.15,254/846] drm/bridge: ti-sn65dsi86: Set max register for regmap [5.15,255/846] gpu: host1x: select CONFIG_DMA_SHARED_BUFFER [5.15,257/846] drm/tegra: vic: Fix DMA API misuse [5.15,258/846] media: hantro: Fix probe func error path [5.15,259/846] xfrm: interface with if_id 0 should return error [5.15,260/846] xfrm: state and policy should fail if XFRMA_IF_ID 0 [5.15,261/846] ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding [5.15,264/846] arm64: dts: marvell: cn9130: enable CP0 GPIO controllers [5.15,265/846] ARM: dts: armada-38x: Add generic compatible to UART nodes [5.15,268/846] rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC [5.15,269/846] rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE [5.15,270/846] iwlwifi: mvm: fix 32-bit build in FTM [5.15,271/846] iwlwifi: mvm: test roc running status bits before removing the sta [5.15,275/846] mmc: meson-mx-sdio: add IRQ check [5.15,277/846] selinux: fix potential memleak in selinux_add_opt() [5.15,278/846] um: fix ndelay/udelay defines [5.15,279/846] um: rename set_signals() to um_set_signals() [5.15,282/846] lib/logic_iomem: Fix operation on 32-bit [5.15,284/846] Bluetooth: L2CAP: Fix using wrong mode [5.15,286/846] backlight: qcom-wled: Validate enabled string indices in DT [5.15,288/846] backlight: qcom-wled: Fix off-by-one maximum with default num_strings [5.15,292/846] software node: fix wrong node passed to find nargs_prop [5.15,293/846] Bluetooth: hci_qca: Stop IBS timer during BT OFF [5.15,296/846] regulator: qcom-labibb: OCP interrupts are not a failure while disabled [5.15,298/846] x86/mce/inject: Avoid out-of-bounds write when setting flags [5.15,299/846] io_uring: remove double poll on poll update [5.15,301/846] ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes [5.15,303/846] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() [5.15,308/846] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() [5.15,309/846] bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() [5.15,311/846] bpf: Dont promote bogus looking registers after null check. [5.15,312/846] bpf: Fix verifier support for validation of async callbacks [5.15,313/846] bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). [5.15,315/846] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone [5.15,318/846] rocker: fix a sleeping in atomic bug [5.15,320/846] fsl/fman: Check for null pointer after calling devm_ioremap [5.15,323/846] net/smc: Reset conn->lgr when link group registration fails [5.15,325/846] usb: dwc2: do not gate off the hardware if it does not support clock gating [5.15,326/846] usb: dwc2: gadget: initialize max_speed from params [5.15,328/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init [5.15,330/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init [5.15,331/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_b... [5.15,335/846] serial: stm32: move tx dma terminate DMA to shutdown [5.15,339/846] net/mlx5e: Dont block routes with nexthop objects in SW [5.15,341/846] Revert "net/mlx5e: Block offload of outer header csum for GRE tunnel" [5.15,344/846] net/mlx5e: Sync VXLAN udp ports during uplink representor profile change [5.15,349/846] mptcp: fix opt size when sending DSS + MP_FAIL [5.15,353/846] ax25: uninitialized variable in ax25_setsockopt() [5.15,354/846] netrom: fix api breakage in nr_setsockopt() [5.15,356/846] net: mscc: ocelot: fix incorrect balancing with down LAG ports [5.15,357/846] can: mcp251xfd: add missing newline to printed strings [5.15,360/846] can: softing: softing_startstop(): fix set but not used variable warning [5.15,363/846] pcmcia: fix setting of kthread task states [5.15,364/846] net/sched: flow_dissector: Fix matching on zone id for invalid conns [5.15,365/846] net: openvswitch: Fix matching zone id for invalid conns arriving from tc [5.15,366/846] net: openvswitch: Fix ct_state nat flags for conns arriving from tc [5.15,368/846] bnxt_en: Refactor coredump functions [5.15,369/846] bnxt_en: move coredump functions into dedicated file [5.15,372/846] ext4: avoid trim error on fs with small groups [5.15,373/846] ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible [5.15,376/846] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls [5.15,377/846] ALSA: hda: Fix potential deadlock at codec unbinding [5.15,378/846] RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending ... [5.15,380/846] scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() [5.15,381/846] clk: renesas: rzg2l: Check return value of pm_genpd_init() [5.15,383/846] clk: imx8mn: Fix imx8mn_clko1_sels [5.15,388/846] ALSA: hda: Make proper use of timecounter [5.15,398/846] binder: fix handling of error during copy [5.15,400/846] openrisc: Add clone3 ABI wrapper [5.15,401/846] uio: uio_dmem_genirq: Catch the Exception [5.15,402/846] iommu: Extend mutex lock scope in iommu_probe_device() [5.15,403/846] iommu/io-pgtable-arm: Fix table descriptor paddr formatting [5.15,406/846] RDMA/qedr: Fix reporting max_{send/recv}_wr attrs [5.15,409/846] iommu/arm-smmu-qcom: Fix TTBR0 read [5.15,410/846] RDMA/core: Let ib_find_gid() continue search even after empty entry [5.15,413/846] of: unittest: fix warning on PowerPC frame size warning [5.15,417/846] mips: fix Kconfig reference to PHYS_ADDR_T_64BIT [5.15,418/846] dmaengine: pxa/mmp: stop referencing config->slave_id [5.15,420/846] iommu/amd: X2apic mode: re-enable after resume [5.15,424/846] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on [5.15,425/846] iommu/iova: Fix race between FQ timeout and teardown [5.15,428/846] efi: apply memblock cap after memblock_add() [5.15,432/846] powerpc/64s: Mask NIP before checking against SRR0 [5.15,437/846] ASoC: mediatek: mt8195: correct pcmif BE dai control flow [5.15,439/846] mips: lantiq: add support for clk_set_parent() [5.15,440/846] mips: bcm63xx: add support for clk_set_parent() [5.15,442/846] ASoC: fsl_mqs: fix MODULE_ALIAS [5.15,448/846] ASoC: imx-card: Fix mclk calculation issue for akcodec [5.15,449/846] ASoC: imx-card: improve the sound quality for low rate [5.15,451/846] clk: bm1880: remove kfrees on static allocations [5.15,453/846] of/fdt: Dont worry about non-memory region overlap for no-map [5.15,455/846] MIPS: compressed: Fix build with ZSTD compression [5.15,459/846] Bluetooth: Fix debugfs entry leak in hci_register_dev() [5.15,461/846] drm/panel: Delete panel on mipi_dsi_attach() failure [5.15,462/846] Bluetooth: Fix removing adv when processing cmd complete [5.15,463/846] fs: dlm: filter user dlm messages for kernel locks [5.15,467/846] selftests/bpf: Destroy XDP link correctly [5.15,468/846] selftests/bpf: Fix bpf_object leak in skb_ctx selftest [5.15,470/846] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR [5.15,475/846] media: atomisp: check before deference asd variable [5.15,476/846] ARM: shmobile: rcar-gen2: Add missing of_node_put() [5.15,477/846] batman-adv: allow netlink usage in unprivileged containers [5.15,479/846] ath11k: Fix crash caused by uninitialized TX ring [5.15,482/846] usb: gadget: f_fs: Use stream_open() for endpoint files [5.15,483/846] psi: Fix PSI_MEM_FULL state when tasks are in memstall and doing reclaim [5.15,484/846] drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L [5.15,487/846] media: b2c2: Add missing check in flexcop_pci_isr: [5.15,488/846] libbpf: Accommodate DWARF/compiler bug with duplicated structs [5.15,489/846] ethernet: renesas: Use div64_ul instead of do_div [5.15,492/846] soc: imx: gpcv2: Synchronously suspend MIX domains [5.15,494/846] drm/amd/display: check top_pipe_to_program pointer [5.15,495/846] drm/amdgpu/display: set vblank_disable_immediate for DC [5.15,497/846] mlxsw: pci: Add shutdown method in PCI driver [5.15,498/846] drm/amd/display: add else to avoid double destroy clk_mgr [5.15,499/846] drm/bridge: megachips: Ensure both bridges are probed before registration [5.15,500/846] mxser: keep only !tty test in ISR [5.15,503/846] HSI: core: Fix return freed object in hsi_new_client [5.15,504/846] crypto: jitter - consider 32 LSB for APT [5.15,510/846] regulator: da9121: Prevent current limit change when enabled [5.15,516/846] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win [5.15,518/846] arm64: dts: ti: j721e-main: Fix dtbs_check in serdes_ln_ctrl node [5.15,520/846] floppy: Add max size check for user space request [5.15,521/846] x86/mm: Flush global TLB when switching to trampoline page-table [5.15,525/846] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() [5.15,527/846] media: m920x: dont use stack on USB reads [5.15,528/846] thunderbolt: Runtime PM activate both ends of the device link [5.15,529/846] arm64: dts: renesas: Fix thermal bindings [5.15,530/846] iwlwifi: mvm: synchronize with FW after multicast commands [5.15,531/846] iwlwifi: mvm: avoid clearing a just saved session protection id [5.15,532/846] rcutorture: Avoid soft lockup during cpu stall [5.15,534/846] ath10k: Fix tx hanging [5.15,535/846] net-sysfs: update the queue counts in the unregistration path [5.15,536/846] net: phy: prefer 1000baseT over 1000baseKX [5.15,538/846] gpio: aspeed-sgpio: Convert aspeed_sgpio.lock to raw_spinlock [5.15,540/846] ath11k: Avoid false DEADLOCK warning reported by lockdep [5.15,545/846] x86/mce: Mark mce_read_aux() noinstr [5.15,549/846] drm/amdkfd: Fix error handling in svm_range_add [5.15,551/846] HID: i2c-hid-of: Expose the touchscreen-inverted properties [5.15,555/846] mmc: tmio: reinit card irqs in reset routine [5.15,556/846] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO [5.15,559/846] audit: ensure userspace is penalized the same as the kernel when under pressure [5.15,561/846] arm64: tegra: Adjust length of CCPLEX cluster MMIO region [5.15,563/846] crypto: hisilicon/hpre - fix memory leak in hpre_curve25519_src_init() [5.15,565/846] cpufreq: Fix initialization of min and max frequency QoS requests [5.15,567/846] mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy() [5.15,571/846] ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() [5.15,572/846] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream [5.15,574/846] PM: AVS: qcom-cpr: Use div64_ul instead of do_div [5.15,575/846] iwlwifi: fix leaks/bad data after failed firmware load [5.15,577/846] iwlwifi: mvm: Fix calculation of frame length [5.15,578/846] iwlwifi: mvm: fix AUX ROC removal [5.15,579/846] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ [5.15,581/846] block: check minor range in device_add_disk() [5.15,583/846] ath11k: Fix napi related hang [5.15,586/846] xfrm: rate limit SA mapping change message to user space [5.15,588/846] jffs2: GC deadlock reading a page that is used in jffs2_write_begin() [5.15,590/846] ACPICA: Utilities: Avoid deleting the same object twice in a row [5.15,593/846] ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 [5.15,594/846] mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling [5.15,595/846] drm/amdgpu: Dont inherit GEM object VMAs in child process [5.15,597/846] amdgpu/pm: Make sysfs pm attributes as read-only for VFs [5.15,598/846] ACPI: battery: Add the ThinkPad "Not Charging" quirk [5.15,599/846] ACPI: CPPC: Check present CPUs for determining _CPC is valid [5.15,602/846] net: mdio: Demote probed message to debug print [5.15,603/846] mac80211: allow non-standard VHT MCS-10/11 [5.15,605/846] dm space map common: add bounds check to sm_ll_lookup_bitmap() [5.15,607/846] mlxsw: pci: Avoid flow control for EMAD packets [5.15,610/846] regulator: qcom_smd: Align probe function with rpmh-regulator [5.15,612/846] serial: pl011: Drop CR register reset on set_termios [5.15,613/846] serial: core: Keep mctrl register state and cached copy in sync [5.15,615/846] net/mlx5: Update log_max_qp value to FW max capability [5.15,618/846] scripts: sphinx-pre-install: Fix ctex support on Debian [5.15,619/846] can: flexcan: allow to change quirks at runtime [5.15,620/846] can: flexcan: rename RX modes [5.15,621/846] can: flexcan: add more quirks to describe RX path capabilities [5.15,622/846] x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs [5.15,625/846] powerpc/cell: add missing of_node_put [5.15,628/846] ASoC: imx-hdmi: add put_device() after of_find_device_by_node() [5.15,629/846] i2c: i801: Dont silently correct invalid transfer size [5.15,631/846] i2c: mpc: Correct I2C reset procedure [5.15,632/846] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB [5.15,635/846] KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST [5.15,636/846] w1: Misuse of get_user()/put_user() reported by sparse [5.15,638/846] dm: fix alloc_dax error handling in alloc_dev [5.15,639/846] interconnect: qcom: rpm: Prevent integer overflow in rate [5.15,640/846] scsi: ufs: Fix a kernel crash during shutdown [5.15,641/846] scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV [5.15,642/846] scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup [5.15,644/846] MIPS: Loongson64: Use three arguments for slti [5.15,649/846] udf: Fix error handling in udf_new_inode() [5.15,652/846] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters [5.15,654/846] MIPS: Octeon: Fix build errors using clang [5.15,655/846] scsi: sr: Dont use GFP_DMA [5.15,657/846] ASoC: mediatek: mt8192-mt6359: fix device_node leak [5.15,659/846] ASoC: mediatek: mt8173: fix device_node leak [5.15,661/846] habanalabs: skip read fw errors if dynamic descriptor invalid [5.15,662/846] phy: mediatek: Fix missing check in mtk_mipi_tx_probe [5.15,663/846] mailbox: change mailbox-mpfs compatible string [5.15,664/846] seg6: export get_srh() for ICMP handling [5.15,667/846] rpmsg: core: Clean up resources on announce_create failure. [5.15,668/846] ifcvf/vDPA: fix misuse virtio-net device config size for blk dev [5.15,671/846] crypto: caam - replace this_cpu_ptr with raw_cpu_ptr [5.15,673/846] tpm: fix potential NULL pointer access in tpm_del_char_device [5.15,675/846] mfd: tps65910: Set PWR_OFF bit during driver probe [5.15,676/846] spi: uniphier: Fix a bug that doesnt point to private data correctly [5.15,678/846] md: Move alloc/free acct bioset in to personality [5.15,681/846] serial: Fix incorrect rs485 polarity on uart open [5.15,683/846] sched/cpuacct: Fix user/system in shown cpuacct.usage* [5.15,686/846] remoteproc: imx_rproc: Fix a resource leak in the remove function [5.15,689/846] device property: Fix fwnode_graph_devcon_match() fwnode leak [5.15,690/846] drm/tegra: submit: Add missing pm_runtime_mark_last_busy() [5.15,691/846] drm/etnaviv: limit submit sizes [5.15,694/846] drm/bridge: analogix_dp: Make PSR-exit block less [5.15,696/846] powerpc/64s/radix: Fix huge vmap false positive [5.15,697/846] scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance [5.15,699/846] drm/i915/display/ehl: Update voltage swing table [5.15,701/846] PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors [5.15,702/846] PCI: pciehp: Fix infinite loop in IRQ handler upon power fault [5.15,703/846] PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only [5.15,704/846] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space [5.15,709/846] xfrm: fix dflt policy check when there is no policy configured [5.15,713/846] ext4: make sure to reset inode lockdep class when quota enabling fails [5.15,714/846] ext4: make sure quota gets properly shutdown on error [5.15,716/846] ext4: initialize err_blk before calling __ext4_get_inode_loc [5.15,717/846] ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE [5.15,718/846] ext4: set csum seed in tmp inode while migrating to extents [5.15,719/846] ext4: Fix BUG_ON in ext4_bread when write quota data [5.15,720/846] ext4: use ext4_ext_remove_space() for fast commit replay delete range [5.15,721/846] ext4: fast commit may miss tracking unwritten range during ftruncate [5.15,722/846] ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal [5.15,723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits [5.15,725/846] ext4: dont use the orphan list when migrating an inode [5.15,726/846] tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails [5.15,727/846] ath11k: qmi: avoid error messages when dma allocation fails [5.15,733/846] media: rcar-csi2: Optimize the selection PHTW register [5.15,734/846] drm/vc4: hdmi: Make sure the device is powered with CEC [5.15,736/846] Documentation: coresight: Fix documentation issue [5.15,738/846] Documentation: ACPI: Fix data node reference documentation [5.15,739/846] Documentation, arch: Remove leftovers from raw device [5.15,740/846] Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH [5.15,741/846] Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization [5.15,742/846] Documentation: fix firewire.rst ABI file path error [5.15,743/846] Bluetooth: btusb: Return error code when getting patch status failed [5.15,746/846] scsi: core: Show SCMD_LAST in text form [5.15,747/846] scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl() [5.15,749/846] dmaengine: uniphier-xdmac: Fix type of address variables [5.15,750/846] dmaengine: idxd: fix wq settings post wq disable [5.15,755/846] powerpc/cell: Fix clang -Wimplicit-fallthrough warning [5.15,756/846] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses [5.15,757/846] block: fix async_depth sysfs interface for mq-deadline [5.15,758/846] block: Fix fsync always failed if once failed [5.15,759/846] drm/vc4: crtc: Drop feed_txp from state [5.15,762/846] arm64/bpf: Remove 128MB limit for BPF JIT programs [5.15,765/846] xdp: check prog type before updating BPF link [5.15,770/846] ipv4: avoid quadratic behavior in netns dismantle [5.15,771/846] mlx5: Dont accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get() [5.15,774/846] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries [5.15,775/846] riscv: dts: microchip: mpfs: Drop empty chosen node [5.15,777/846] drm/vmwgfx: Remove unused compile options [5.15,778/846] f2fs: fix remove page failed in invalidate compress pages [5.15,779/846] f2fs: fix to avoid panic in is_alive() if metadata is inconsistent [5.15,780/846] f2fs: compress: fix potential deadlock of compress file [5.15,782/846] f2fs: fix to check available space of CP area correctly in update_ckpt_flags() [5.15,788/846] gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe [5.15,791/846] net: axienet: increase reset timeout [5.15,792/846] net: axienet: Wait for PhyRstCmplt after core reset [5.15,793/846] net: axienet: reset core on initialization prior to MDIO access [5.15,794/846] net: axienet: add missing memory barriers [5.15,797/846] net: axienet: fix number of TX ring slots for available check [5.15,799/846] net: axienet: increase default TX ring size to 128 [5.15,800/846] bitops: protect find_first_{,zero}_bit properly [5.15,801/846] um: gitignore: Add kernel/capflags.c [5.15,802/846] HID: vivaldi: fix handling devices not using numbered reports [5.15,809/846] iwlwifi: fix Bz NMI behaviour [5.15,810/846] xfrm: Dont accidentally set RTO_ONLINK in decode_session4() [5.15,811/846] vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps() [5.15,813/846] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() [5.15,814/846] perf script: Fix hex dump character output [5.15,816/846] dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending [5.15,817/846] dmaengine: at_xdmac: Print debug message after realeasing the lock [5.15,819/846] dmaengine: at_xdmac: Fix lld view setting [5.15,820/846] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition [5.15,821/846] perf tools: Drop requirement for libstdc++.so for libopencsd check [5.15,825/846] net: fix sock_timestamping_bind_phc() to release device [5.15,826/846] net: bonding: fix bond_xmit_broadcast return value error bug [5.15,829/846] net: mscc: ocelot: dont let phylink re-enable TX PAUSE on the NPI port [5.15,831/846] net: wwan: Fix MRU mismatch issue which may lead to data connection lost [5.15,832/846] net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() [5.15,835/846] net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account [5.15,838/846] dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property [5.15,839/846] dt-bindings: display: meson-vpu: Add missing amlogic,canvas property [5.15,841/846] sch_api: Dont skip qdisc attach on ingress [5.15,842/846] scripts/dtc: dtx_diff: remove broken example from help text

[5.15,723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits

Commit Message

Patch