[5.4,267/388] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata

From: Suzuki K Poulose <suzuki.poulose@arm.com>

From: Suzuki K Poulose <suzuki.poulose@arm.com>

[ Upstream commit 3f4943d422c5febbb3c764670011a00eb2a86238 ]

etm probe could be deferred due to the dependency in the trace
path chain and may be retried. We need to clear the per-cpu
etmdrvdata entry for the etm in case of a failure to avoid
use-after-free cases as reported below:

KASAN use-after-free bug in etm4_cpu_pm_notify():

[    8.574566] coresight etm0: CPU0: ETM v4.2 initialized
[    8.581920] BUG: KASAN: use-after-free in etm4_cpu_pm_notify+0x580/0x2024
[    8.581925] Read of size 8 at addr ffffff813304f8c8 by task swapper/3/0
[    8.581927]
[    8.581934] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S      W         5.4.28 #314
[    8.587775] coresight etm1: CPU1: ETM v4.2 initialized
[    8.594195] Call trace:
[    8.594205]  dump_backtrace+0x0/0x188
[    8.594209]  show_stack+0x20/0x2c
[    8.594216]  dump_stack+0xdc/0x144
[    8.594227]  print_address_description+0x3c/0x494
[    8.594232]  __kasan_report+0x144/0x168
[    8.601598] coresight etm2: CPU2: ETM v4.2 initialized
[    8.602563]  kasan_report+0x10/0x18
[    8.602568]  check_memory_region+0x1a4/0x1b4
[    8.602572]  __kasan_check_read+0x18/0x24
[    8.602577]  etm4_cpu_pm_notify+0x580/0x2024
[    8.665945]  notifier_call_chain+0x5c/0x90
[    8.670166]  __atomic_notifier_call_chain+0x90/0xf8
[    8.675182]  cpu_pm_notify+0x40/0x6c
[    8.678858]  cpu_pm_enter+0x38/0x80
[    8.682451]  psci_enter_idle_state+0x34/0x70
[    8.686844]  cpuidle_enter_state+0xb8/0x20c
[    8.691143]  cpuidle_enter+0x38/0x4c
[    8.694820]  call_cpuidle+0x3c/0x68
[    8.698408]  do_idle+0x1a0/0x280
[    8.701729]  cpu_startup_entry+0x24/0x28
[    8.705768]  secondary_start_kernel+0x15c/0x170
[    8.710423]
[    8.711972] Allocated by task 242:
[    8.715473]  __kasan_kmalloc+0xf0/0x1ac
[    8.719426]  kasan_slab_alloc+0x14/0x1c
[    8.723375]  __kmalloc_track_caller+0x23c/0x388
[    8.728040]  devm_kmalloc+0x38/0x94
[    8.731632]  etm4_probe+0x48/0x3c8
[    8.735140]  amba_probe+0xbc/0x158
[    8.738645]  really_probe+0x144/0x408
[    8.742412]  driver_probe_device+0x70/0x140
[    8.746716]  __device_attach_driver+0x9c/0x110
[    8.751287]  bus_for_each_drv+0x90/0xd8
[    8.755236]  __device_attach+0xb4/0x164
[    8.759188]  device_initial_probe+0x20/0x2c
[    8.763490]  bus_probe_device+0x34/0x94
[    8.767436]  device_add+0x34c/0x3e0
[    8.771029]  amba_device_try_add+0x68/0x440
[    8.775332]  amba_deferred_retry_func+0x48/0xc8
[    8.779997]  process_one_work+0x344/0x648
[    8.784127]  worker_thread+0x2ac/0x47c
[    8.787987]  kthread+0x128/0x138
[    8.791313]  ret_from_fork+0x10/0x18
[    8.794993]
[    8.796532] Freed by task 242:
[    8.799684]  __kasan_slab_free+0x15c/0x22c
[    8.803897]  kasan_slab_free+0x10/0x1c
[    8.807761]  kfree+0x25c/0x4bc
[    8.810913]  release_nodes+0x240/0x2b0
[    8.814767]  devres_release_all+0x3c/0x54
[    8.818887]  really_probe+0x178/0x408
[    8.822661]  driver_probe_device+0x70/0x140
[    8.826963]  __device_attach_driver+0x9c/0x110
[    8.831539]  bus_for_each_drv+0x90/0xd8
[    8.835487]  __device_attach+0xb4/0x164
[    8.839431]  device_initial_probe+0x20/0x2c
[    8.843732]  bus_probe_device+0x34/0x94
[    8.847678]  device_add+0x34c/0x3e0
[    8.851274]  amba_device_try_add+0x68/0x440
[    8.855576]  amba_deferred_retry_func+0x48/0xc8
[    8.860240]  process_one_work+0x344/0x648
[    8.864366]  worker_thread+0x2ac/0x47c
[    8.868228]  kthread+0x128/0x138
[    8.871557]  ret_from_fork+0x10/0x18
[    8.875231]
[    8.876782] The buggy address belongs to the object at ffffff813304f800
[    8.876782]  which belongs to the cache kmalloc-1k of size 1024
[    8.889632] The buggy address is located 200 bytes inside of
[    8.889632]  1024-byte region [ffffff813304f800, ffffff813304fc00)
[    8.901761] The buggy address belongs to the page:
[    8.906695] page:ffffffff04ac1200 refcount:1 mapcount:0 mapping:ffffff8146c03800 index:0x0 compound_mapcount: 0
[    8.917047] flags: 0x4000000000010200(slab|head)
[    8.921799] raw: 4000000000010200 dead000000000100 dead000000000122 ffffff8146c03800
[    8.929753] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[    8.937703] page dumped because: kasan: bad access detected
[    8.943433]
[    8.944974] Memory state around the buggy address:
[    8.949903]  ffffff813304f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[    8.957320]  ffffff813304f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.964742] >ffffff813304f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.972157]                                               ^
[    8.977886]  ffffff813304f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.985298]  ffffff813304f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[    8.992713] ==================================================================

Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states")
Reported-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Mike Leach <mike.leach@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20200518180242.7916-22-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwtracing/coresight/coresight-etm4x.c | 1 +
 1 file changed, 1 insertion(+)

Message ID	20200929110023.384494556@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=j5F6=DG=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>, Mathieu Poirier <mathieu.poirier@linaro.org>, Mike Leach <mike.leach@linaro.org>, Suzuki K Poulose <suzuki.poulose@arm.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 267/388] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata Date: Tue, 29 Sep 2020 12:59:58 +0200 Message-Id: <20200929110023.384494556@linuxfoundation.org> In-Reply-To: <20200929110010.467764689@linuxfoundation.org> References: <20200929110010.467764689@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/388] scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs [5.4,003/388] scsi: mpt3sas: Free diag buffer without any status check [5.4,004/388] selinux: allow labeling before policy is loaded [5.4,005/388] media: mc-device.c: fix memleak in media_device_register_entity [5.4,006/388] drm/amd/display: Do not double-buffer DTO adjustments [5.4,007/388] drm/amdkfd: Fix race in gfx10 context restore handler [5.4,008/388] dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling) [5.4,009/388] scsi: qla2xxx: Add error handling for PLOGI ELS passthrough [5.4,010/388] ath10k: fix array out-of-bounds access [5.4,011/388] ath10k: fix memory leak for tpc_stats_final [5.4,012/388] PCI/IOV: Serialize sysfs sriov_numvfs reads vs writes [5.4,013/388] mm: fix double page fault on arm64 if PTE_AF is cleared [5.4,014/388] scsi: aacraid: fix illegal IO beyond last LBA [5.4,015/388] m68k: q40: Fix info-leak in rtc_ioctl [5.4,016/388] xfs: fix inode fork extent count overflow [5.4,017/388] gma/gma500: fix a memory disclosure bug due to uninitialized bytes [5.4,018/388] ASoC: kirkwood: fix IRQ error handling [5.4,019/388] soundwire: intel/cadence: fix startup sequence [5.4,020/388] media: smiapp: Fix error handling at NVM reading [5.4,021/388] drm/amd/display: Free gamma after calculating legacy transfer function [5.4,022/388] xfs: properly serialise fallocate against AIO+DIO [5.4,023/388] leds: mlxreg: Fix possible buffer overflow [5.4,024/388] dm table: do not allow request-based DM to stack on partitions [5.4,025/388] PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out [5.4,026/388] scsi: fnic: fix use after free [5.4,027/388] scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce [5.4,028/388] powerpc/64s: Always disable branch profiling for prom_init.o [5.4,029/388] net: silence data-races on sk_backlog.tail [5.4,030/388] dax: Fix alloc_dax_region() compile warning [5.4,031/388] iomap: Fix overflow in iomap_page_mkwrite [5.4,032/388] f2fs: avoid kernel panic on corruption test [5.4,033/388] clk/ti/adpll: allocate room for terminating null [5.4,034/388] drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table [5.4,035/388] ice: Fix to change Rx/Tx ring descriptor size via ethtool with DCBx [5.4,036/388] mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup() [5.4,037/388] mfd: mfd-core: Protect against NULL call-back function pointer [5.4,038/388] drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table [5.4,039/388] tpm_crb: fix fTPM on AMD Zen+ CPUs [5.4,040/388] tracing: Verify if trace array exists before destroying it. [5.4,041/388] tracing: Adding NULL checks for trace_array descriptor pointer [5.4,042/388] bcache: fix a lost wake-up problem caused by mca_cannibalize_lock [5.4,043/388] dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails [5.4,044/388] x86/kdump: Always reserve the low 1M when the crashkernel option is specified [5.4,045/388] RDMA/qedr: Fix potential use after free [5.4,046/388] RDMA/i40iw: Fix potential use after free [5.4,047/388] PCI: Avoid double hpmemsize MMIO window assignment [5.4,048/388] fix dget_parent() fastpath race [5.4,049/388] xfs: fix attr leaf header freemap.size underflow [5.4,050/388] RDMA/iw_cgxb4: Fix an error handling path in c4iw_connect() [5.4,051/388] ubi: Fix producing anchor PEBs [5.4,052/388] mmc: core: Fix size overflow for mmc partitions [5.4,053/388] gfs2: clean up iopen glock mess in gfs2_create_inode [5.4,054/388] scsi: pm80xx: Cleanup command when a reset times out [5.4,055/388] mt76: do not use devm API for led classdev [5.4,056/388] mt76: add missing locking around ampdu action [5.4,057/388] debugfs: Fix !DEBUG_FS debugfs_create_automount [5.4,058/388] SUNRPC: Capture completion of all RPC tasks [5.4,059/388] CIFS: Use common error handling code in smb2_ioctl_query_info() [5.4,060/388] CIFS: Properly process SMB3 lease breaks [5.4,061/388] f2fs: stop GC when the victim becomes fully valid [5.4,062/388] ASoC: max98090: remove msleep in PLL unlocked workaround [5.4,063/388] xtensa: fix system_call interaction with ptrace [5.4,064/388] s390: avoid misusing CALL_ON_STACK for task stack setup [5.4,065/388] xfs: fix realtime file data space leak [5.4,066/388] drm/amdgpu: fix calltrace during kmd unload(v3) [5.4,067/388] arm64: insn: consistently handle exit text [5.4,068/388] selftests/bpf: De-flake test_tcpbpf [5.4,069/388] kernel/notifier.c: intercept duplicate registrations to avoid infinite loops [5.4,070/388] kernel/sys.c: avoid copying possible padding bytes in copy_to_user [5.4,071/388] KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() [5.4,072/388] module: Remove accidental change of module_enable_x() [5.4,073/388] xfs: fix log reservation overflows when allocating large rt extents [5.4,074/388] ALSA: hda: enable regmap internal locking [5.4,075/388] tipc: fix link overflow issue at socket shutdown [5.4,076/388] vcc_seq_next should increase position index [5.4,077/388] neigh_stat_seq_next() should increase position index [5.4,078/388] rt_cpu_seq_next should increase position index [5.4,079/388] ipv6_route_seq_next should increase position index [5.4,080/388] drm/mcde: Handle pending vblank while disabling display [5.4,081/388] seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier [5.4,082/388] drm/scheduler: Avoid accessing freed bad job. [5.4,083/388] media: ti-vpe: cal: Restrict DMA to avoid memory corruption [5.4,084/388] opp: Replace list_kref with a local counter [5.4,085/388] scsi: qla2xxx: Fix stuck session in GNL [5.4,086/388] scsi: lpfc: Fix incomplete NVME discovery when target [5.4,087/388] sctp: move trace_sctp_probe_path into sctp_outq_sack [5.4,088/388] ACPI: EC: Reference count query handlers under lock [5.4,089/388] scsi: ufs: Make ufshcd_add_command_trace() easier to read [5.4,090/388] scsi: ufs: Fix a race condition in the tracing code [5.4,091/388] drm/amd/display: Initialize DSC PPS variables to 0 [5.4,092/388] i2c: tegra: Prevent interrupt triggering after transfer timeout [5.4,093/388] btrfs: tree-checker: Check leaf chunk item size [5.4,094/388] dmaengine: zynqmp_dma: fix burst length configuration [5.4,095/388] s390/cpum_sf: Use kzalloc and minor changes [5.4,096/388] nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create() [5.4,097/388] powerpc/eeh: Only dump stack once if an MMIO loop is detected [5.4,098/388] Bluetooth: btrtl: Use kvmalloc for FW allocations [5.4,099/388] tracing: Set kernel_stacks caller size properly [5.4,100/388] ARM: 8948/1: Prevent OOB access in stacktrace [5.4,101/388] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter [5.4,102/388] ceph: ensure we have a new cap before continuing in fill_inode [5.4,103/388] selftests/ftrace: fix glob selftest [5.4,104/388] tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility [5.4,105/388] Bluetooth: Fix refcount use-after-free issue [5.4,106/388] mm/swapfile.c: swap_next should increase position index [5.4,107/388] mm: pagewalk: fix termination condition in walk_pte_range() [5.4,108/388] Bluetooth: prefetch channel before killing sock [5.4,109/388] KVM: fix overflow of zero page refcount with ksm running [5.4,110/388] ALSA: hda: Clear RIRB status before reading WP [5.4,111/388] skbuff: fix a data race in skb_queue_len() [5.4,112/388] nfsd: Fix a perf warning [5.4,113/388] drm/amd/display: fix workaround for incorrect double buffer register for DLG ADL an... [5.4,114/388] audit: CONFIG_CHANGE dont log internal bookkeeping as an event [5.4,115/388] selinux: sel_avc_get_stat_idx should increase position index [5.4,116/388] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available [5.4,117/388] scsi: lpfc: Fix release of hwq to clear the eq relationship [5.4,118/388] scsi: lpfc: Fix coverity errors in fmdi attribute handling [5.4,119/388] drm/omap: fix possible object reference leak [5.4,120/388] locking/lockdep: Decrement IRQ context counters when removing lock chain [5.4,121/388] clk: stratix10: use do_div() for 64-bit calculation [5.4,122/388] crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test [5.4,123/388] mt76: clear skb pointers from rx aggregation reorder buffer during cleanup [5.4,124/388] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw [5.4,125/388] ALSA: usb-audio: Dont create a mixer element with bogus volume range [5.4,126/388] perf test: Fix test trace+probe_vfs_getname.sh on s390 [5.4,127/388] RDMA/rxe: Fix configuration of atomic queue pair attributes [5.4,128/388] KVM: x86: fix incorrect comparison in trace event [5.4,129/388] KVM: nVMX: Hold KVMs srcu lock when syncing vmcs12->shadow [5.4,130/388] dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all [5.4,131/388] media: staging/imx: Missing assignment in imx_media_capture_device_register() [5.4,132/388] x86/pkeys: Add check for pkey "overflow" [5.4,133/388] bpf: Remove recursion prevention from rcu free callback [5.4,134/388] dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all [5.4,135/388] dmaengine: tegra-apb: Prevent race conditions on channels freeing [5.4,136/388] soundwire: bus: disable pm_runtime in sdw_slave_delete [5.4,137/388] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic [5.4,138/388] drm/omap: dss: Cleanup DSS ports on initialisation failure [5.4,139/388] iavf: use tc_cls_can_offload_and_chain0() instead of chain check [5.4,140/388] firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp [5.4,141/388] random: fix data races at timer_rand_state [5.4,142/388] bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal [5.4,143/388] ASoC: SOF: ipc: check ipc return value before data copy [5.4,144/388] media: go7007: Fix URB type for interrupt handling [5.4,145/388] Bluetooth: guard against controllers sending zerod events [5.4,146/388] timekeeping: Prevent 32bit truncation in scale64_check_overflow() [5.4,147/388] powerpc/book3s64: Fix error handling in mm_iommu_do_alloc() [5.4,148/388] drm/amd/display: fix image corruption with ODM 2:1 DSC 2 slice [5.4,149/388] ext4: fix a data race at inode->i_disksize [5.4,150/388] perf jevents: Fix leak of mapfile memory [5.4,151/388] mm: avoid data corruption on CoW fault into PFN-mapped VMA [5.4,152/388] drm/amdgpu: increase atombios cmd timeout [5.4,153/388] ARM: OMAP2+: Handle errors for cpu_pm [5.4,154/388] drm/amd/display: Stop if retimer is not available [5.4,155/388] clk: imx: Fix division by zero warning on pfdv2 [5.4,156/388] cpu-topology: Fix the potential data corruption [5.4,157/388] s390/irq: replace setup_irq() by request_irq() [5.4,158/388] perf cs-etm: Swap packets for instruction samples [5.4,159/388] perf cs-etm: Correct synthesizing instruction samples [5.4,160/388] ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read [5.4,161/388] scsi: aacraid: Disabling TM path and only processing IOP reset [5.4,162/388] Bluetooth: L2CAP: handle l2cap config request during open state [5.4,163/388] media: tda10071: fix unsigned sign extension overflow [5.4,164/388] tty: sifive: Finish transmission before changing the clock [5.4,165/388] xfs: dont ever return a stale pointer from __xfs_dir3_free_read [5.4,166/388] xfs: mark dir corrupt when lookup-by-hash fails [5.4,167/388] ext4: mark block bitmap corrupted when found instead of BUGON [5.4,168/388] tpm: ibmvtpm: Wait for buffer to be set before proceeding [5.4,169/388] rtc: sa1100: fix possible race condition [5.4,170/388] rtc: ds1374: fix possible race condition [5.4,171/388] nfsd: Dont add locks to closed or closing open stateids [5.4,172/388] RDMA/cm: Remove a race freeing timewait_info [5.4,173/388] intel_th: Disallow multi mode on devices where its broken [5.4,174/388] KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the vali... [5.4,175/388] drm/msm: fix leaks if initialization fails [5.4,176/388] drm/msm/a5xx: Always set an OPP supported hardware value [5.4,177/388] tracing: Use address-of operator on section symbols [5.4,178/388] thermal: rcar_thermal: Handle probe error gracefully [5.4,179/388] KVM: LAPIC: Mark hrtimer for period or oneshot mode to expire in hard interrupt con... [5.4,180/388] perf parse-events: Fix 3 use after frees found with clang ASAN [5.4,181/388] btrfs: do not init a reloc root if we arent relocating [5.4,182/388] btrfs: free the reloc_control in a consistent way [5.4,183/388] r8169: improve RTL8168b FIFO overflow workaround [5.4,184/388] serial: 8250_port: Dont service RX FIFO if throttled [5.4,185/388] serial: 8250_omap: Fix sleeping function called from invalid context during probe [5.4,186/388] serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout [5.4,187/388] perf cpumap: Fix snprintf overflow check [5.4,188/388] net: axienet: Convert DMA error handler to a work queue [5.4,189/388] net: axienet: Propagate failure of DMA descriptor setup [5.4,190/388] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn [5.4,191/388] tools: gpio-hammer: Avoid potential overflow in main [5.4,192/388] exec: Add exec_update_mutex to replace cred_guard_mutex [5.4,193/388] exec: Fix a deadlock in strace [5.4,194/388] selftests/ptrace: add test cases for dead-locks [5.4,195/388] kernel/kcmp.c: Use new infrastructure to fix deadlocks in execve [5.4,196/388] proc: Use new infrastructure to fix deadlocks in execve [5.4,197/388] proc: io_accounting: Use new infrastructure to fix deadlocks in execve [5.4,198/388] perf: Use new infrastructure to fix deadlocks in execve [5.4,199/388] nvme-multipath: do not reset on unknown status [5.4,200/388] nvme: Fix ctrl use-after-free during sysfs deletion [5.4,201/388] nvme: Fix controller creation races with teardown flow [5.4,202/388] brcmfmac: Fix double freeing in the fmac usb data path [5.4,203/388] xfs: prohibit fs freezing when using empty transactions [5.4,204/388] RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices [5.4,205/388] IB/iser: Always check sig MR before putting it to the free pool [5.4,206/388] scsi: hpsa: correct race condition in offload enabled [5.4,207/388] SUNRPC: Fix a potential buffer overflow in svc_print_xprts() [5.4,208/388] svcrdma: Fix leak of transport addresses [5.4,209/388] netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup() [5.4,210/388] PCI: Use ioremap(), not phys_to_virt() for platform ROM [5.4,211/388] ubifs: ubifs_jnl_write_inode: Fix a memory leak bug [5.4,212/388] ubifs: ubifs_add_orphan: Fix a memory leak bug [5.4,213/388] ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len [5.4,214/388] ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint ... [5.4,215/388] PCI: pciehp: Fix MSI interrupt race [5.4,216/388] NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests() [5.4,217/388] drm/amdgpu/vcn2.0: stall DPG when WPTR/RPTR reset [5.4,218/388] powerpc/perf: Implement a global lock to avoid races between trace, core and thread... [5.4,219/388] mm/kmemleak.c: use address-of operator on section symbols [5.4,220/388] mm/filemap.c: clear page error before actual read [5.4,221/388] mm/swapfile: fix data races in try_to_unuse() [5.4,222/388] mm/vmscan.c: fix data races using kswapd_classzone_idx [5.4,223/388] SUNRPC: Dont start a timer on an already queued rpc task [5.4,224/388] nvmet-rdma: fix double free of rdma queue [5.4,225/388] workqueue: Remove the warning in wq_worker_sleeping() [5.4,226/388] drm/amdgpu/sriov add amdgpu_amdkfd_pre_reset in gpu reset [5.4,227/388] mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area [5.4,228/388] ALSA: hda: Skip controller resume if not needed [5.4,229/388] scsi: qedi: Fix termination timeouts in session logout [5.4,230/388] serial: uartps: Wait for tx_empty in console setup [5.4,231/388] btrfs: fix setting last_trans for reloc roots [5.4,232/388] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race [5.4,233/388] perf stat: Force error in fallback on :k events [5.4,234/388] bdev: Reduce time holding bd_mutex in sync in blkdev_close() [5.4,235/388] drivers: char: tlclk.c: Avoid data race between init and interrupt handler [5.4,236/388] KVM: arm64: vgic-v3: Retire all pending LPIs on vcpu destroy [5.4,237/388] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi() [5.4,238/388] net: openvswitch: use u64 for meter bucket [5.4,239/388] scsi: aacraid: Fix error handling paths in aac_probe_one() [5.4,240/388] staging:r8188eu: avoid skb_clone for amsdu to msdu conversion [5.4,241/388] sparc64: vcc: Fix error return code in vcc_probe() [5.4,242/388] arm64: cpufeature: Relax checks for AArch32 support at EL[0-2] [5.4,243/388] sched/fair: Eliminate bandwidth race between throttling and distribution [5.4,244/388] dpaa2-eth: fix error return code in setup_dpni() [5.4,245/388] dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion [5.4,246/388] devlink: Fix reporters recovery condition [5.4,247/388] atm: fix a memory leak of vcc->user_back [5.4,248/388] media: venus: vdec: Init registered list unconditionally [5.4,249/388] perf mem2node: Avoid double free related to realloc [5.4,250/388] mm/slub: fix incorrect interpretation of s->offset [5.4,251/388] i2c: tegra: Restore pinmux on system resume [5.4,252/388] power: supply: max17040: Correct voltage reading [5.4,253/388] phy: samsung: s5pv210-usb2: Add delay after reset [5.4,254/388] Bluetooth: Handle Inquiry Cancel error after Inquiry Complete [5.4,255/388] USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() [5.4,256/388] KVM: x86: handle wrap around 32-bit address space [5.4,257/388] tipc: fix memory leak in service subscripting [5.4,258/388] tty: serial: samsung: Correct clock selection logic [5.4,259/388] ALSA: hda: Fix potential race in unsol event handler [5.4,260/388] drm/exynos: dsi: Remove bridge node reference in error handling path in probe function [5.4,261/388] ipmi:bt-bmc: Fix error handling and status check [5.4,262/388] powerpc/traps: Make unrecoverable NMIs die instead of panic [5.4,263/388] svcrdma: Fix backchannel return code [5.4,264/388] fuse: dont check refcount after stealing page [5.4,265/388] fuse: update attr_version counter on fuse_notify_inval_inode() [5.4,266/388] USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int [5.4,267/388] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata [5.4,268/388] arm64: acpi: Make apei_claim_sea() synchronise with APEIs irq work [5.4,269/388] scsi: cxlflash: Fix error return code in cxlflash_probe() [5.4,270/388] arm64/cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register [5.4,271/388] drm/amdkfd: fix restore worker race condition [5.4,272/388] e1000: Do not perform reset in reset_task if we are already down [5.4,273/388] drm/nouveau/debugfs: fix runtime pm imbalance on error [5.4,274/388] drm/nouveau: fix runtime pm imbalance on error [5.4,275/388] drm/nouveau/dispnv50: fix runtime pm imbalance on error [5.4,276/388] printk: handle blank console arguments passed in. [5.4,277/388] usb: dwc3: Increase timeout for CmdAct cleared by device controller [5.4,278/388] btrfs: dont force read-only after error in drop snapshot [5.4,279/388] btrfs: fix double __endio_write_update_ordered in direct I/O [5.4,280/388] gpio: rcar: Fix runtime PM imbalance on error [5.4,281/388] vfio/pci: fix memory leaks of eventfd ctx [5.4,282/388] KVM: PPC: Book3S HV: Close race with page faults around memslot flushes [5.4,283/388] perf evsel: Fix 2 memory leaks [5.4,284/388] perf trace: Fix the selection for architectures to generate the errno name tables [5.4,285/388] perf stat: Fix duration_time value for higher intervals [5.4,286/388] perf util: Fix memory leak of prefix_if_not_in [5.4,287/388] perf metricgroup: Free metric_events on error [5.4,288/388] perf kcore_copy: Fix module map when there are no modules loaded [5.4,289/388] PCI: tegra194: Fix runtime PM imbalance on error [5.4,290/388] ASoC: img-i2s-out: Fix runtime PM imbalance on error [5.4,291/388] wlcore: fix runtime pm imbalance in wl1271_tx_work [5.4,292/388] wlcore: fix runtime pm imbalance in wlcore_regdomain_config [5.4,293/388] mtd: rawnand: gpmi: Fix runtime PM imbalance on error [5.4,294/388] mtd: rawnand: omap_elm: Fix runtime PM imbalance on error [5.4,295/388] PCI: tegra: Fix runtime PM imbalance on error [5.4,296/388] ceph: fix potential race in ceph_check_caps [5.4,297/388] mm/swap_state: fix a data race in swapin_nr_pages [5.4,298/388] mm: memcontrol: fix stat-corrupting race in charge moving [5.4,299/388] rapidio: avoid data race between file operation callbacks and mport_cdev_add(). [5.4,300/388] mtd: parser: cmdline: Support MTD names containing one or more colons [5.4,301/388] x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline [5.4,302/388] NFS: nfs_xdr_status should record the procedure name [5.4,303/388] vfio/pci: Clear error and request eventfd ctx after releasing [5.4,304/388] cifs: Fix double add page to memcg when cifs_readpages [5.4,305/388] nvme: fix possible deadlock when I/O is blocked [5.4,306/388] mac80211: skip mpath lookup also for control port tx [5.4,307/388] scsi: libfc: Handling of extra kref [5.4,308/388] scsi: libfc: Skip additional kref updating work event [5.4,309/388] selftests/x86/syscall_nt: Clear weird flags after each test [5.4,310/388] vfio/pci: fix racy on error and request eventfd ctx [5.4,311/388] btrfs: qgroup: fix data leak caused by race between writeback and truncate [5.4,312/388] perf tests: Fix test 68 zstd compression for s390 [5.4,313/388] scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure [5.4,314/388] ubi: fastmap: Free unused fastmap anchor peb during detach [5.4,315/388] mt76: fix LED link time failure [5.4,316/388] opp: Increase parsed_static_opps in _of_add_opp_table_v1() [5.4,317/388] perf parse-events: Use strcmp() to compare the PMU name [5.4,318/388] ALSA: hda: Always use jackpoll helper for jack update after resume [5.4,319/388] ALSA: hda: Workaround for spurious wakeups on some Intel platforms [5.4,320/388] net: openvswitch: use div_u64() for 64-by-32 divisions [5.4,321/388] nvme: explicitly update mpath disk capacity on revalidation [5.4,322/388] device_cgroup: Fix RCU list debugging warning [5.4,323/388] ASoC: pcm3168a: ignore 0 Hz settings [5.4,324/388] ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 [5.4,325/388] ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions [5.4,326/388] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 [5.4,327/388] RISC-V: Take text_mutex in ftrace_init_nop() [5.4,328/388] i2c: aspeed: Mask IRQ status to relevant bits [5.4,329/388] s390/init: add missing __init annotations [5.4,330/388] lockdep: fix order in trace_hardirqs_off_caller() [5.4,331/388] EDAC/ghes: Check whether the driver is on the safe list correctly [5.4,332/388] drm/amdkfd: fix a memory leak issue [5.4,333/388] drm/amd/display: update nv1x stutter latencies [5.4,334/388] drm/amdgpu/dc: Require primary plane to be enabled whenever the CRTC is [5.4,335/388] i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices() [5.4,336/388] objtool: Fix noreturn detection for ignored functions [5.4,337/388] ieee802154: fix one possible memleak in ca8210_dev_com_init [5.4,338/388] ieee802154/adf7242: check status of adf7242_read_reg [5.4,339/388] clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() [5.4,340/388] mwifiex: Increase AES key storage size to 256 bits [5.4,341/388] batman-adv: bla: fix type misuse for backbone_gw hash indexing [5.4,342/388] atm: eni: fix the missed pci_disable_device() for eni_init_one() [5.4,343/388] batman-adv: mcast/TT: fix wrongly dropped or rerouted packets [5.4,344/388] netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled [5.4,345/388] mac802154: tx: fix use-after-free [5.4,346/388] bpf: Fix clobbering of r2 in bpf_gen_ld_abs [5.4,347/388] drm/vc4/vc4_hdmi: fill ASoC card owner [5.4,348/388] net: qed: Disable aRFS for NPAR and 100G [5.4,349/388] net: qede: Disable aRFS for NPAR and 100G [5.4,350/388] net: qed: RDMA personality shouldnt fail VF load [5.4,351/388] drm/sun4i: sun8i-csc: Secondary CSC register correction [5.4,352/388] batman-adv: Add missing include for in_interrupt() [5.4,353/388] nvme-tcp: fix kconfig dependency warning when !CRYPTO [5.4,354/388] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN [5.4,355/388] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh [5.4,356/388] batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh [5.4,357/388] bpf: Fix a rcu warning for bpffs map pretty-print [5.4,358/388] lib80211: fix unmet direct dependendices config warning when !CRYPTO [5.4,359/388] ALSA: asihpi: fix iounmap in error handler [5.4,360/388] regmap: fix page selection for noinc reads [5.4,361/388] regmap: fix page selection for noinc writes [5.4,362/388] MIPS: Add the missing CPU_1074K into __get_cpu_type() [5.4,363/388] regulator: axp20x: fix LDO2/4 description [5.4,364/388] KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE [5.4,365/388] KVM: SVM: Add a dedicated INVD intercept routine [5.4,366/388] mm: validate pmd after splitting [5.4,367/388] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback [5.4,368/388] x86/ioapic: Unbreak check_timer() [5.4,369/388] scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported [5.4,370/388] ALSA: usb-audio: Add delay quirk for H570e USB headsets [5.4,371/388] ALSA: hda/realtek - Couldnt detect Mic if booting with headset plugged [5.4,372/388] ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 [5.4,373/388] lib/string.c: implement stpcpy [5.4,374/388] tracing: fix double free [5.4,375/388] s390/dasd: Fix zero write for FBA devices [5.4,376/388] kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() [5.4,377/388] kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot [5.4,378/388] btrfs: fix overflow when copying corrupt csums for a message [5.4,379/388] dmabuf: fix NULL pointer dereference in dma_buf_release() [5.4,380/388] mm, THP, swap: fix allocating cluster for swapfile by mistake [5.4,381/388] mm/gup: fix gup_fast with dynamic page table folding [5.4,382/388] s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl [5.4,383/388] KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch [5.4,384/388] dm: fix bio splitting and its bio completion order for regular IO [5.4,385/388] kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE [5.4,386/388] ata: define AC_ERR_OK [5.4,387/388] ata: make qc_prep return ata_completion_errors [5.4,388/388] ata: sata_mv, avoid trigerrable BUG_ON

[5.4,267/388] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata

Commit Message

Patch