[5.15,479/846] ath11k: Fix crash caused by uninitialized TX ring

From: Baochen Qiang <bqiang@codeaurora.org>

From: Baochen Qiang <bqiang@codeaurora.org>

[ Upstream commit 273703ebdb01b6c5f1aaf4b98fb57b177609055c ]

Commit 31582373a4a8 ("ath11k: Change number of TCL rings to one for
QCA6390") avoids initializing the other entries of dp->tx_ring cause
the corresponding TX rings on QCA6390/WCN6855 are not used, but leaves
those ring masks in ath11k_hw_ring_mask_qca6390.tx unchanged. Normally
this is OK because we will only get interrupts from the first TX ring
on these chips and thus only the first entry of dp->tx_ring is involved.

In case of one MSI vector, all DP rings share the same IRQ. For each
interrupt, all rings have to be checked, which means the other entries
of dp->tx_ring are involved. However since they are not initialized,
system crashes.

Fix this issue by simply removing those ring masks.

crash stack:
[  102.907438] BUG: kernel NULL pointer dereference, address: 0000000000000028
[  102.907447] #PF: supervisor read access in kernel mode
[  102.907451] #PF: error_code(0x0000) - not-present page
[  102.907453] PGD 1081f0067 P4D 1081f0067 PUD 1081f1067 PMD 0
[  102.907460] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[  102.907465] CPU: 0 PID: 3511 Comm: apt-check Kdump: loaded Tainted: G            E     5.15.0-rc4-wt-ath+ #20
[  102.907470] Hardware name: AMD Celadon-RN/Celadon-RN, BIOS RCD1005E 10/08/2020
[  102.907472] RIP: 0010:ath11k_dp_tx_completion_handler+0x201/0x830 [ath11k]
[  102.907497] Code: 3c 24 4e 8d ac 37 10 04 00 00 4a 8d bc 37 68 04 00 00 48 89 3c 24 48 63 c8 89 83 84 18 00 00 48 c1 e1 05 48 03 8b 78 18 00 00 <8b> 51 08 89 d6 83 e6 07 89 74 24 24 83 fe 03 74 04 85 f6 75 63 41
[  102.907501] RSP: 0000:ffff9b7340003e08 EFLAGS: 00010202
[  102.907505] RAX: 0000000000000001 RBX: ffff8e21530c0100 RCX: 0000000000000020
[  102.907508] RDX: 0000000000000000 RSI: 00000000fffffe00 RDI: ffff8e21530c1938
[  102.907511] RBP: ffff8e21530c0000 R08: 0000000000000001 R09: 0000000000000000
[  102.907513] R10: ffff8e2145534c10 R11: 0000000000000001 R12: ffff8e21530c2938
[  102.907515] R13: ffff8e21530c18e0 R14: 0000000000000100 R15: ffff8e21530c2978
[  102.907518] FS:  00007f5d4297e740(0000) GS:ffff8e243d600000(0000) knlGS:0000000000000000
[  102.907521] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  102.907524] CR2: 0000000000000028 CR3: 00000001034ea000 CR4: 0000000000350ef0
[  102.907527] Call Trace:
[  102.907531]  <IRQ>
[  102.907537]  ath11k_dp_service_srng+0x5c/0x2f0 [ath11k]
[  102.907556]  ath11k_pci_ext_grp_napi_poll+0x21/0x70 [ath11k_pci]
[  102.907562]  __napi_poll+0x2c/0x160
[  102.907570]  net_rx_action+0x251/0x310
[  102.907576]  __do_softirq+0x107/0x2fc
[  102.907585]  irq_exit_rcu+0x74/0x90
[  102.907593]  common_interrupt+0x83/0xa0
[  102.907600]  </IRQ>
[  102.907601]  asm_common_interrupt+0x1e/0x40

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1

Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211026011605.58615-1-quic_bqiang@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/hw.c | 2 --
 1 file changed, 2 deletions(-)

Message ID	20220124184117.544956395@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Baochen Qiang <bqiang@codeaurora.org>, Kalle Valo <kvalo@codeaurora.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.15 479/846] ath11k: Fix crash caused by uninitialized TX ring Date: Mon, 24 Jan 2022 19:39:56 +0100 Message-Id: <20220124184117.544956395@linuxfoundation.org> In-Reply-To: <20220124184100.867127425@linuxfoundation.org> References: <20220124184100.867127425@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,003/846] HID: Ignore battery for Elan touchscreen on HP Envy X360 15t-dr100 [5.15,004/846] HID: uhid: Fix worker destroying device without any protection [5.15,006/846] HID: wacom: Ignore the confidence flag when a touch is removed [5.15,008/846] ALSA: core: Fix SSID quirk lookup for subvendor=0 [5.15,011/846] f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file [5.15,012/846] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() [5.15,013/846] mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings [5.15,014/846] mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 [5.15,016/846] mtd: rawnand: davinci: Dont calculate ECC when reading page [5.15,020/846] mtd: rawnand: ingenic: JZ4740 needs oob_first read page function [5.15,024/846] riscv: Dont use va_pa_offset on kdump [5.15,025/846] riscv: use hart id instead of cpu id on machine_kexec [5.15,032/846] rtc: cmos: take rtc_lock while reading from CMOS [5.15,035/846] ksmbd: fix guest connection failure with nautilus [5.15,038/846] ksmbd: limits exceeding the maximum allowable outstanding requests [5.15,041/846] media: ov8865: Disable only enabled regulators on error path [5.15,042/846] media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE [5.15,046/846] media: cpia2: fix control-message timeouts [5.15,047/846] media: s2255: fix control-message timeouts [5.15,052/846] media: cec-pin: fix interrupt en/disable handling [5.15,056/846] iio: trigger: Fix a scheduling whilst atomic issue seen on tsc2046 [5.15,057/846] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() [5.15,058/846] bus: mhi: pci_generic: Graceful shutdown on freeze [5.15,059/846] bus: mhi: core: Fix reading wake_capable channel configuration [5.15,067/846] virtio/virtio_mem: handle a possible NULL as a memcpy parameter [5.15,068/846] dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() [5.15,069/846] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller [5.15,071/846] dma/pool: create dma atomic pool only if dma zone has managed pages [5.15,073/846] ath11k: add string type to search board data in board-2.bin for WCN6855 [5.15,075/846] drm/ttm: Put BO in its memory managers lru list [5.15,076/846] Bluetooth: L2CAP: Fix not initializing sk_peer_pid [5.15,077/846] drm/bridge: display-connector: fix an uninitialized pointer in probe() [5.15,078/846] drm: fix null-ptr-deref in drm_dev_init_release() [5.15,080/846] drm/panel: innolux-p079zca: Delete panel on attach() failure [5.15,081/846] drm/rockchip: dsi: Fix unbalanced clock on probe error [5.15,083/846] drm/rockchip: dsi: Disable PLL clock on bind error [5.15,084/846] drm/rockchip: dsi: Reconfigure hardware on resume() [5.15,086/846] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails [5.15,090/846] drm/vc4: hdmi: Move the HSM clock enable to runtime_pm [5.15,091/846] drm/vc4: hdmi: Make sure the controller is powered in detect [5.15,092/846] drm/vc4: hdmi: Make sure the controller is powered up during bind [5.15,097/846] drm/vc4: hdmi: Enable the scrambler on reconnection [5.15,101/846] wcn36xx: Put DXE block into reset before freeing memory [5.15,107/846] media: videobuf2: Fix the size printk format [5.15,108/846] media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() [5.15,109/846] media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case [5.15,111/846] media: atomisp: do not use err var when checking port validity for ISP2400 [5.15,112/846] media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() [5.15,113/846] media: atomisp: fix ifdefs in sh_css.c [5.15,115/846] media: atomisp: fix enum formats logic [5.15,117/846] media: aspeed: fix mode-detect always time out at 2nd run [5.15,118/846] media: em28xx: fix memory leak in em28xx_init_dev [5.15,119/846] media: aspeed: Update signal status immediately to ensure sane hw state [5.15,124/846] fs: dlm: dont call kernel_getpeername() in error_report() [5.15,126/846] Bluetooth: stop proccessing malicious adv data [5.15,129/846] ath11k: reset RSN/WPA present state for open BSS [5.15,130/846] spi: hisi-kunpeng: Fix the debugfs directory name incorrect [5.15,133/846] drm/dp: Dont read back backlight mode in drm_edp_backlight_enable() [5.15,134/846] drm/vboxvideo: fix a NULL vs IS_ERR() check [5.15,135/846] arm64: dts: renesas: cat875: Add rx/tx delays [5.15,139/846] crypto: qce - fix uaf on qce_ahash_register_one [5.15,140/846] crypto: qce - fix uaf on qce_skcipher_register_one [5.15,143/846] cpufreq: qcom-cpufreq-hw: Update offline CPUs per-cpu thermal pressure [5.15,147/846] libbpf: Fix glob_syms memory leak in bpf_linker [5.15,148/846] libbpf: Fix using invalidated memory in bpf_linker [5.15,151/846] crypto: qat - fix undetected PFVF timeout in ACK loop [5.15,152/846] ath11k: Use host CE parameters for CE interrupts configuration [5.15,153/846] arm64: dts: ti: k3-j721e: correct cache-sets info [5.15,154/846] tty: serial: atmel: Check return code of dmaengine_submit() [5.15,155/846] tty: serial: atmel: Call dma_async_issue_pending() [5.15,158/846] bfq: Do not let waker requests skip proper accounting [5.15,159/846] libbpf: Silence uninitialized warning/error in btf_dump_dump_type_data [5.15,160/846] media: i2c: imx274: fix s_frame_interval runtime resume not requested [5.15,162/846] media: i2c: ov8865: Fix lockdep error [5.15,164/846] media: imx-pxp: Initialize the spinlock prior to using it [5.15,166/846] media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released [5.15,174/846] igc: AF_XDP zero-copy metadata adjust breaks SKBs on XDP_PASS [5.15,176/846] powerpc: Avoid discarding flags in system_call_exception() [5.15,181/846] ACPI: EC: Rework flushing of EC work while suspended to idle [5.15,184/846] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() [5.15,186/846] crypto: caam - save caam memory to support crypto engine retry mechanism. [5.15,191/846] tty: serial: uartlite: allow 64 bit address [5.15,193/846] mtd: core: provide unique name for nvmem device [5.15,194/846] floppy: Fix hang in watchdog when disk is ejected [5.15,199/846] sched/fair: Fix detection of per-CPU kthreads waking a task [5.15,203/846] bpf: Remove config check to enable bpf support for branch records [5.15,205/846] arm64: mte: DC {GVA,GZVA} shouldnt be used when DCZID_EL0.DZP == 1 [5.15,206/846] samples/bpf: Install libbpf headers when building [5.15,212/846] media: si2157: Fix "warm" tuner state detection [5.15,214/846] sched/rt: Try to restart rt period timer when rt runtime exceeded [5.15,218/846] Bluetooth: btusb: Handle download_firmware failure cases [5.15,226/846] mwifiex: Fix possible ABBA deadlock [5.15,231/846] crypto: stm32/cryp - fix CTR counter carry [5.15,232/846] crypto: stm32/cryp - fix xts and race condition in crypto_engine requests [5.15,233/846] crypto: stm32/cryp - check early input data [5.15,234/846] crypto: stm32/cryp - fix double pm exit [5.15,237/846] crypto: stm32 - Revert broken pm_runtime_resume_and_get changes [5.15,238/846] crypto: hisilicon/qm - fix incorrect return value of hisi_qm_resume() [5.15,239/846] ath11k: Fix deleting uninitialized kernel timer during fragment cache flush [5.15,242/846] perf/arm-cmn: Fix CPU hotplug unregistration [5.15,243/846] media: dw2102: Fix use after free [5.15,245/846] media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes [5.15,247/846] net: dsa: hellcreek: Fix insertion of static FDB entries [5.15,248/846] net: dsa: hellcreek: Add STP forwarding rule [5.15,249/846] net: dsa: hellcreek: Allow PTP P2P measurements on blocked ports [5.15,250/846] net: dsa: hellcreek: Add missing PTP via UDP rules [5.15,251/846] arm64: dts: qcom: c630: Fix soundcard setup [5.15,253/846] drm/msm/dpu: fix safe status debugfs file [5.15,254/846] drm/bridge: ti-sn65dsi86: Set max register for regmap [5.15,255/846] gpu: host1x: select CONFIG_DMA_SHARED_BUFFER [5.15,257/846] drm/tegra: vic: Fix DMA API misuse [5.15,258/846] media: hantro: Fix probe func error path [5.15,259/846] xfrm: interface with if_id 0 should return error [5.15,260/846] xfrm: state and policy should fail if XFRMA_IF_ID 0 [5.15,261/846] ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding [5.15,264/846] arm64: dts: marvell: cn9130: enable CP0 GPIO controllers [5.15,265/846] ARM: dts: armada-38x: Add generic compatible to UART nodes [5.15,268/846] rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC [5.15,269/846] rtw88: Disable PCIe ASPM while doing NAPI poll on 8821CE [5.15,270/846] iwlwifi: mvm: fix 32-bit build in FTM [5.15,271/846] iwlwifi: mvm: test roc running status bits before removing the sta [5.15,275/846] mmc: meson-mx-sdio: add IRQ check [5.15,277/846] selinux: fix potential memleak in selinux_add_opt() [5.15,278/846] um: fix ndelay/udelay defines [5.15,279/846] um: rename set_signals() to um_set_signals() [5.15,282/846] lib/logic_iomem: Fix operation on 32-bit [5.15,284/846] Bluetooth: L2CAP: Fix using wrong mode [5.15,286/846] backlight: qcom-wled: Validate enabled string indices in DT [5.15,288/846] backlight: qcom-wled: Fix off-by-one maximum with default num_strings [5.15,292/846] software node: fix wrong node passed to find nargs_prop [5.15,293/846] Bluetooth: hci_qca: Stop IBS timer during BT OFF [5.15,296/846] regulator: qcom-labibb: OCP interrupts are not a failure while disabled [5.15,298/846] x86/mce/inject: Avoid out-of-bounds write when setting flags [5.15,299/846] io_uring: remove double poll on poll update [5.15,301/846] ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes [5.15,303/846] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() [5.15,308/846] netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() [5.15,309/846] bpf, sockmap: Fix return codes from tcp_bpf_recvmsg_parser() [5.15,311/846] bpf: Dont promote bogus looking registers after null check. [5.15,312/846] bpf: Fix verifier support for validation of async callbacks [5.15,313/846] bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). [5.15,315/846] netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone [5.15,318/846] rocker: fix a sleeping in atomic bug [5.15,320/846] fsl/fman: Check for null pointer after calling devm_ioremap [5.15,323/846] net/smc: Reset conn->lgr when link group registration fails [5.15,325/846] usb: dwc2: do not gate off the hardware if it does not support clock gating [5.15,326/846] usb: dwc2: gadget: initialize max_speed from params [5.15,328/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init [5.15,330/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init [5.15,331/846] HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_b... [5.15,335/846] serial: stm32: move tx dma terminate DMA to shutdown [5.15,339/846] net/mlx5e: Dont block routes with nexthop objects in SW [5.15,341/846] Revert "net/mlx5e: Block offload of outer header csum for GRE tunnel" [5.15,344/846] net/mlx5e: Sync VXLAN udp ports during uplink representor profile change [5.15,349/846] mptcp: fix opt size when sending DSS + MP_FAIL [5.15,353/846] ax25: uninitialized variable in ax25_setsockopt() [5.15,354/846] netrom: fix api breakage in nr_setsockopt() [5.15,356/846] net: mscc: ocelot: fix incorrect balancing with down LAG ports [5.15,357/846] can: mcp251xfd: add missing newline to printed strings [5.15,360/846] can: softing: softing_startstop(): fix set but not used variable warning [5.15,363/846] pcmcia: fix setting of kthread task states [5.15,364/846] net/sched: flow_dissector: Fix matching on zone id for invalid conns [5.15,365/846] net: openvswitch: Fix matching zone id for invalid conns arriving from tc [5.15,366/846] net: openvswitch: Fix ct_state nat flags for conns arriving from tc [5.15,368/846] bnxt_en: Refactor coredump functions [5.15,369/846] bnxt_en: move coredump functions into dedicated file [5.15,372/846] ext4: avoid trim error on fs with small groups [5.15,373/846] ASoC: Intel: sof_sdw: fix jack detection on HP Spectre x360 convertible [5.15,376/846] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls [5.15,377/846] ALSA: hda: Fix potential deadlock at codec unbinding [5.15,378/846] RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending ... [5.15,380/846] scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() [5.15,381/846] clk: renesas: rzg2l: Check return value of pm_genpd_init() [5.15,383/846] clk: imx8mn: Fix imx8mn_clko1_sels [5.15,388/846] ALSA: hda: Make proper use of timecounter [5.15,398/846] binder: fix handling of error during copy [5.15,400/846] openrisc: Add clone3 ABI wrapper [5.15,401/846] uio: uio_dmem_genirq: Catch the Exception [5.15,402/846] iommu: Extend mutex lock scope in iommu_probe_device() [5.15,403/846] iommu/io-pgtable-arm: Fix table descriptor paddr formatting [5.15,406/846] RDMA/qedr: Fix reporting max_{send/recv}_wr attrs [5.15,409/846] iommu/arm-smmu-qcom: Fix TTBR0 read [5.15,410/846] RDMA/core: Let ib_find_gid() continue search even after empty entry [5.15,413/846] of: unittest: fix warning on PowerPC frame size warning [5.15,417/846] mips: fix Kconfig reference to PHYS_ADDR_T_64BIT [5.15,418/846] dmaengine: pxa/mmp: stop referencing config->slave_id [5.15,420/846] iommu/amd: X2apic mode: re-enable after resume [5.15,424/846] ASoC: Intel: catpt: Test dmaengine_submit() result before moving on [5.15,425/846] iommu/iova: Fix race between FQ timeout and teardown [5.15,428/846] efi: apply memblock cap after memblock_add() [5.15,432/846] powerpc/64s: Mask NIP before checking against SRR0 [5.15,437/846] ASoC: mediatek: mt8195: correct pcmif BE dai control flow [5.15,439/846] mips: lantiq: add support for clk_set_parent() [5.15,440/846] mips: bcm63xx: add support for clk_set_parent() [5.15,442/846] ASoC: fsl_mqs: fix MODULE_ALIAS [5.15,448/846] ASoC: imx-card: Fix mclk calculation issue for akcodec [5.15,449/846] ASoC: imx-card: improve the sound quality for low rate [5.15,451/846] clk: bm1880: remove kfrees on static allocations [5.15,453/846] of/fdt: Dont worry about non-memory region overlap for no-map [5.15,455/846] MIPS: compressed: Fix build with ZSTD compression [5.15,459/846] Bluetooth: Fix debugfs entry leak in hci_register_dev() [5.15,461/846] drm/panel: Delete panel on mipi_dsi_attach() failure [5.15,462/846] Bluetooth: Fix removing adv when processing cmd complete [5.15,463/846] fs: dlm: filter user dlm messages for kernel locks [5.15,467/846] selftests/bpf: Destroy XDP link correctly [5.15,468/846] selftests/bpf: Fix bpf_object leak in skb_ctx selftest [5.15,470/846] drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR [5.15,475/846] media: atomisp: check before deference asd variable [5.15,476/846] ARM: shmobile: rcar-gen2: Add missing of_node_put() [5.15,477/846] batman-adv: allow netlink usage in unprivileged containers [5.15,479/846] ath11k: Fix crash caused by uninitialized TX ring [5.15,482/846] usb: gadget: f_fs: Use stream_open() for endpoint files [5.15,483/846] psi: Fix PSI_MEM_FULL state when tasks are in memstall and doing reclaim [5.15,484/846] drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L [5.15,487/846] media: b2c2: Add missing check in flexcop_pci_isr: [5.15,488/846] libbpf: Accommodate DWARF/compiler bug with duplicated structs [5.15,489/846] ethernet: renesas: Use div64_ul instead of do_div [5.15,492/846] soc: imx: gpcv2: Synchronously suspend MIX domains [5.15,494/846] drm/amd/display: check top_pipe_to_program pointer [5.15,495/846] drm/amdgpu/display: set vblank_disable_immediate for DC [5.15,497/846] mlxsw: pci: Add shutdown method in PCI driver [5.15,498/846] drm/amd/display: add else to avoid double destroy clk_mgr [5.15,499/846] drm/bridge: megachips: Ensure both bridges are probed before registration [5.15,500/846] mxser: keep only !tty test in ISR [5.15,503/846] HSI: core: Fix return freed object in hsi_new_client [5.15,504/846] crypto: jitter - consider 32 LSB for APT [5.15,510/846] regulator: da9121: Prevent current limit change when enabled [5.15,516/846] ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win [5.15,518/846] arm64: dts: ti: j721e-main: Fix dtbs_check in serdes_ln_ctrl node [5.15,520/846] floppy: Add max size check for user space request [5.15,521/846] x86/mm: Flush global TLB when switching to trampoline page-table [5.15,525/846] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() [5.15,527/846] media: m920x: dont use stack on USB reads [5.15,528/846] thunderbolt: Runtime PM activate both ends of the device link [5.15,529/846] arm64: dts: renesas: Fix thermal bindings [5.15,530/846] iwlwifi: mvm: synchronize with FW after multicast commands [5.15,531/846] iwlwifi: mvm: avoid clearing a just saved session protection id [5.15,532/846] rcutorture: Avoid soft lockup during cpu stall [5.15,534/846] ath10k: Fix tx hanging [5.15,535/846] net-sysfs: update the queue counts in the unregistration path [5.15,536/846] net: phy: prefer 1000baseT over 1000baseKX [5.15,538/846] gpio: aspeed-sgpio: Convert aspeed_sgpio.lock to raw_spinlock [5.15,540/846] ath11k: Avoid false DEADLOCK warning reported by lockdep [5.15,545/846] x86/mce: Mark mce_read_aux() noinstr [5.15,549/846] drm/amdkfd: Fix error handling in svm_range_add [5.15,551/846] HID: i2c-hid-of: Expose the touchscreen-inverted properties [5.15,555/846] mmc: tmio: reinit card irqs in reset routine [5.15,556/846] mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO [5.15,559/846] audit: ensure userspace is penalized the same as the kernel when under pressure [5.15,561/846] arm64: tegra: Adjust length of CCPLEX cluster MMIO region [5.15,563/846] crypto: hisilicon/hpre - fix memory leak in hpre_curve25519_src_init() [5.15,565/846] cpufreq: Fix initialization of min and max frequency QoS requests [5.15,567/846] mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy() [5.15,571/846] ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() [5.15,572/846] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream [5.15,574/846] PM: AVS: qcom-cpr: Use div64_ul instead of do_div [5.15,575/846] iwlwifi: fix leaks/bad data after failed firmware load [5.15,577/846] iwlwifi: mvm: Fix calculation of frame length [5.15,578/846] iwlwifi: mvm: fix AUX ROC removal [5.15,579/846] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ [5.15,581/846] block: check minor range in device_add_disk() [5.15,583/846] ath11k: Fix napi related hang [5.15,586/846] xfrm: rate limit SA mapping change message to user space [5.15,588/846] jffs2: GC deadlock reading a page that is used in jffs2_write_begin() [5.15,590/846] ACPICA: Utilities: Avoid deleting the same object twice in a row [5.15,593/846] ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 [5.15,594/846] mmc: mtk-sd: Use readl_poll_timeout instead of open-coded polling [5.15,595/846] drm/amdgpu: Dont inherit GEM object VMAs in child process [5.15,597/846] amdgpu/pm: Make sysfs pm attributes as read-only for VFs [5.15,598/846] ACPI: battery: Add the ThinkPad "Not Charging" quirk [5.15,599/846] ACPI: CPPC: Check present CPUs for determining _CPC is valid [5.15,602/846] net: mdio: Demote probed message to debug print [5.15,603/846] mac80211: allow non-standard VHT MCS-10/11 [5.15,605/846] dm space map common: add bounds check to sm_ll_lookup_bitmap() [5.15,607/846] mlxsw: pci: Avoid flow control for EMAD packets [5.15,610/846] regulator: qcom_smd: Align probe function with rpmh-regulator [5.15,612/846] serial: pl011: Drop CR register reset on set_termios [5.15,613/846] serial: core: Keep mctrl register state and cached copy in sync [5.15,615/846] net/mlx5: Update log_max_qp value to FW max capability [5.15,618/846] scripts: sphinx-pre-install: Fix ctex support on Debian [5.15,619/846] can: flexcan: allow to change quirks at runtime [5.15,620/846] can: flexcan: rename RX modes [5.15,621/846] can: flexcan: add more quirks to describe RX path capabilities [5.15,622/846] x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs [5.15,625/846] powerpc/cell: add missing of_node_put [5.15,628/846] ASoC: imx-hdmi: add put_device() after of_find_device_by_node() [5.15,629/846] i2c: i801: Dont silently correct invalid transfer size [5.15,631/846] i2c: mpc: Correct I2C reset procedure [5.15,632/846] clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB [5.15,635/846] KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST [5.15,636/846] w1: Misuse of get_user()/put_user() reported by sparse [5.15,638/846] dm: fix alloc_dax error handling in alloc_dev [5.15,639/846] interconnect: qcom: rpm: Prevent integer overflow in rate [5.15,640/846] scsi: ufs: Fix a kernel crash during shutdown [5.15,641/846] scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV [5.15,642/846] scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup [5.15,644/846] MIPS: Loongson64: Use three arguments for slti [5.15,649/846] udf: Fix error handling in udf_new_inode() [5.15,652/846] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters [5.15,654/846] MIPS: Octeon: Fix build errors using clang [5.15,655/846] scsi: sr: Dont use GFP_DMA [5.15,657/846] ASoC: mediatek: mt8192-mt6359: fix device_node leak [5.15,659/846] ASoC: mediatek: mt8173: fix device_node leak [5.15,661/846] habanalabs: skip read fw errors if dynamic descriptor invalid [5.15,662/846] phy: mediatek: Fix missing check in mtk_mipi_tx_probe [5.15,663/846] mailbox: change mailbox-mpfs compatible string [5.15,664/846] seg6: export get_srh() for ICMP handling [5.15,667/846] rpmsg: core: Clean up resources on announce_create failure. [5.15,668/846] ifcvf/vDPA: fix misuse virtio-net device config size for blk dev [5.15,671/846] crypto: caam - replace this_cpu_ptr with raw_cpu_ptr [5.15,673/846] tpm: fix potential NULL pointer access in tpm_del_char_device [5.15,675/846] mfd: tps65910: Set PWR_OFF bit during driver probe [5.15,676/846] spi: uniphier: Fix a bug that doesnt point to private data correctly [5.15,678/846] md: Move alloc/free acct bioset in to personality [5.15,681/846] serial: Fix incorrect rs485 polarity on uart open [5.15,683/846] sched/cpuacct: Fix user/system in shown cpuacct.usage* [5.15,686/846] remoteproc: imx_rproc: Fix a resource leak in the remove function [5.15,689/846] device property: Fix fwnode_graph_devcon_match() fwnode leak [5.15,690/846] drm/tegra: submit: Add missing pm_runtime_mark_last_busy() [5.15,691/846] drm/etnaviv: limit submit sizes [5.15,694/846] drm/bridge: analogix_dp: Make PSR-exit block less [5.15,696/846] powerpc/64s/radix: Fix huge vmap false positive [5.15,697/846] scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance [5.15,699/846] drm/i915/display/ehl: Update voltage swing table [5.15,701/846] PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors [5.15,702/846] PCI: pciehp: Fix infinite loop in IRQ handler upon power fault [5.15,703/846] PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only [5.15,704/846] PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space [5.15,709/846] xfrm: fix dflt policy check when there is no policy configured [5.15,713/846] ext4: make sure to reset inode lockdep class when quota enabling fails [5.15,714/846] ext4: make sure quota gets properly shutdown on error [5.15,716/846] ext4: initialize err_blk before calling __ext4_get_inode_loc [5.15,717/846] ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE [5.15,718/846] ext4: set csum seed in tmp inode while migrating to extents [5.15,719/846] ext4: Fix BUG_ON in ext4_bread when write quota data [5.15,720/846] ext4: use ext4_ext_remove_space() for fast commit replay delete range [5.15,721/846] ext4: fast commit may miss tracking unwritten range during ftruncate [5.15,722/846] ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal [5.15,723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits [5.15,725/846] ext4: dont use the orphan list when migrating an inode [5.15,726/846] tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails [5.15,727/846] ath11k: qmi: avoid error messages when dma allocation fails [5.15,733/846] media: rcar-csi2: Optimize the selection PHTW register [5.15,734/846] drm/vc4: hdmi: Make sure the device is powered with CEC [5.15,736/846] Documentation: coresight: Fix documentation issue [5.15,738/846] Documentation: ACPI: Fix data node reference documentation [5.15,739/846] Documentation, arch: Remove leftovers from raw device [5.15,740/846] Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH [5.15,741/846] Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization [5.15,742/846] Documentation: fix firewire.rst ABI file path error [5.15,743/846] Bluetooth: btusb: Return error code when getting patch status failed [5.15,746/846] scsi: core: Show SCMD_LAST in text form [5.15,747/846] scsi: ufs: ufs-mediatek: Fix error checking in ufs_mtk_init_va09_pwr_ctrl() [5.15,749/846] dmaengine: uniphier-xdmac: Fix type of address variables [5.15,750/846] dmaengine: idxd: fix wq settings post wq disable [5.15,755/846] powerpc/cell: Fix clang -Wimplicit-fallthrough warning [5.15,756/846] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses [5.15,757/846] block: fix async_depth sysfs interface for mq-deadline [5.15,758/846] block: Fix fsync always failed if once failed [5.15,759/846] drm/vc4: crtc: Drop feed_txp from state [5.15,762/846] arm64/bpf: Remove 128MB limit for BPF JIT programs [5.15,765/846] xdp: check prog type before updating BPF link [5.15,770/846] ipv4: avoid quadratic behavior in netns dismantle [5.15,771/846] mlx5: Dont accidentally set RTO_ONLINK before mlx5e_route_lookup_ipv4_get() [5.15,774/846] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries [5.15,775/846] riscv: dts: microchip: mpfs: Drop empty chosen node [5.15,777/846] drm/vmwgfx: Remove unused compile options [5.15,778/846] f2fs: fix remove page failed in invalidate compress pages [5.15,779/846] f2fs: fix to avoid panic in is_alive() if metadata is inconsistent [5.15,780/846] f2fs: compress: fix potential deadlock of compress file [5.15,782/846] f2fs: fix to check available space of CP area correctly in update_ckpt_flags() [5.15,788/846] gpio: mpc8xxx: Fix IRQ check in mpc8xxx_probe [5.15,791/846] net: axienet: increase reset timeout [5.15,792/846] net: axienet: Wait for PhyRstCmplt after core reset [5.15,793/846] net: axienet: reset core on initialization prior to MDIO access [5.15,794/846] net: axienet: add missing memory barriers [5.15,797/846] net: axienet: fix number of TX ring slots for available check [5.15,799/846] net: axienet: increase default TX ring size to 128 [5.15,800/846] bitops: protect find_first_{,zero}_bit properly [5.15,801/846] um: gitignore: Add kernel/capflags.c [5.15,802/846] HID: vivaldi: fix handling devices not using numbered reports [5.15,809/846] iwlwifi: fix Bz NMI behaviour [5.15,810/846] xfrm: Dont accidentally set RTO_ONLINK in decode_session4() [5.15,811/846] vdpa/mlx5: Restore cur_num_vqs in case of failure in change_num_qps() [5.15,813/846] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() [5.15,814/846] perf script: Fix hex dump character output [5.15,816/846] dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending [5.15,817/846] dmaengine: at_xdmac: Print debug message after realeasing the lock [5.15,819/846] dmaengine: at_xdmac: Fix lld view setting [5.15,820/846] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition [5.15,821/846] perf tools: Drop requirement for libstdc++.so for libopencsd check [5.15,825/846] net: fix sock_timestamping_bind_phc() to release device [5.15,826/846] net: bonding: fix bond_xmit_broadcast return value error bug [5.15,829/846] net: mscc: ocelot: dont let phylink re-enable TX PAUSE on the NPI port [5.15,831/846] net: wwan: Fix MRU mismatch issue which may lead to data connection lost [5.15,832/846] net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() [5.15,835/846] net: cpsw: avoid alignment faults by taking NET_IP_ALIGN into account [5.15,838/846] dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property [5.15,839/846] dt-bindings: display: meson-vpu: Add missing amlogic,canvas property [5.15,841/846] sch_api: Dont skip qdisc attach on ingress [5.15,842/846] scripts/dtc: dtx_diff: remove broken example from help text

[5.15,479/846] ath11k: Fix crash caused by uninitialized TX ring

Commit Message

Patch