[5.15,185/913] drm/i915/gem: add missing boundary check in vm_access

From: Mastan Katragadda <mastanx.katragadda@intel.com>

From: Mastan Katragadda <mastanx.katragadda@intel.com>

commit 3886a86e7e6cc6ce2ce93c440fecd8f42aed0ce7 upstream.

A missing bounds check in vm_access() can lead to an out-of-bounds read
or write in the adjacent memory area, since the len attribute is not
validated before the memcpy later in the function, potentially hitting:

[  183.637831] BUG: unable to handle page fault for address: ffffc90000c86000
[  183.637934] #PF: supervisor read access in kernel mode
[  183.637997] #PF: error_code(0x0000) - not-present page
[  183.638059] PGD 100000067 P4D 100000067 PUD 100258067 PMD 106341067 PTE 0
[  183.638144] Oops: 0000 [#2] PREEMPT SMP NOPTI
[  183.638201] CPU: 3 PID: 1790 Comm: poc Tainted: G      D           5.17.0-rc6-ci-drm-11296+ #1
[  183.638298] Hardware name: Intel Corporation CoffeeLake Client Platform/CoffeeLake H DDR4 RVP, BIOS CNLSFWR1.R00.X208.B00.1905301319 05/30/2019
[  183.638430] RIP: 0010:memcpy_erms+0x6/0x10
[  183.640213] RSP: 0018:ffffc90001763d48 EFLAGS: 00010246
[  183.641117] RAX: ffff888109c14000 RBX: ffff888111bece40 RCX: 0000000000000ffc
[  183.642029] RDX: 0000000000001000 RSI: ffffc90000c86000 RDI: ffff888109c14004
[  183.642946] RBP: 0000000000000ffc R08: 800000000000016b R09: 0000000000000000
[  183.643848] R10: ffffc90000c85000 R11: 0000000000000048 R12: 0000000000001000
[  183.644742] R13: ffff888111bed190 R14: ffff888109c14000 R15: 0000000000001000
[  183.645653] FS:  00007fe5ef807540(0000) GS:ffff88845b380000(0000) knlGS:0000000000000000
[  183.646570] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  183.647481] CR2: ffffc90000c86000 CR3: 000000010ff02006 CR4: 00000000003706e0
[  183.648384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  183.649271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  183.650142] Call Trace:
[  183.650988]  <TASK>
[  183.651793]  vm_access+0x1f0/0x2a0 [i915]
[  183.652726]  __access_remote_vm+0x224/0x380
[  183.653561]  mem_rw.isra.0+0xf9/0x190
[  183.654402]  vfs_read+0x9d/0x1b0
[  183.655238]  ksys_read+0x63/0xe0
[  183.656065]  do_syscall_64+0x38/0xc0
[  183.656882]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  183.657663] RIP: 0033:0x7fe5ef725142
[  183.659351] RSP: 002b:00007ffe1e81c7e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  183.660227] RAX: ffffffffffffffda RBX: 0000557055dfb780 RCX: 00007fe5ef725142
[  183.661104] RDX: 0000000000001000 RSI: 00007ffe1e81d880 RDI: 0000000000000005
[  183.661972] RBP: 00007ffe1e81e890 R08: 0000000000000030 R09: 0000000000000046
[  183.662832] R10: 0000557055dfc2e0 R11: 0000000000000246 R12: 0000557055dfb1c0
[  183.663691] R13: 00007ffe1e81e980 R14: 0000000000000000 R15: 0000000000000000

Changes since v1:
     - Updated if condition with range_overflows_t [Chris Wilson]

Fixes: 9f909e215fea ("drm/i915: Implement vm_ops->access for gdb access into mmaps")
Signed-off-by: Mastan Katragadda <mastanx.katragadda@intel.com>
Suggested-by: Adam Zabrocki <adamza@microsoft.com>
Reported-by: Jackson Cody <cody.jackson@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jon Bloomfield <jon.bloomfield@intel.com>
Cc: Sudeep Dutt <sudeep.dutt@intel.com>
Cc: <stable@vger.kernel.org> # v5.8+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
[mauld: tidy up the commit message and add Cc: stable]
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220303060428.1668844-1-mastanx.katragadda@intel.com
(cherry picked from commit 661412e301e2ca86799aa4f400d1cf0bd38c57c6)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/i915/gem/i915_gem_mman.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20220405070345.401007855@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Mastan Katragadda <mastanx.katragadda@intel.com>, Adam Zabrocki <adamza@microsoft.com>, Jackson Cody <cody.jackson@intel.com>, Chris Wilson <chris@chris-wilson.co.uk>, Jon Bloomfield <jon.bloomfield@intel.com>, Sudeep Dutt <sudeep.dutt@intel.com>, Matthew Auld <matthew.auld@intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Subject: [PATCH 5.15 185/913] drm/i915/gem: add missing boundary check in vm_access Date: Tue, 5 Apr 2022 09:20:47 +0200 Message-Id: <20220405070345.401007855@linuxfoundation.org> In-Reply-To: <20220405070339.801210740@linuxfoundation.org> References: <20220405070339.801210740@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,003/913] dt-bindings: usb: hcd: correct usb-device path [5.15,004/913] USB: serial: pl2303: fix GS type detection [5.15,007/913] hv: utils: add PTP_1588_CLOCK to Kconfig to fix build [5.15,011/913] ARM: mstar: Select HAVE_ARM_ARCH_TIMER [5.15,012/913] virtio_console: break out of buf poll on remove [5.15,014/913] tools/virtio: fix virtio_test execution [5.15,015/913] ethernet: sun: Free the coherent when failing in probing [5.15,019/913] Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" [5.15,020/913] spi: Fix erroneous sgs value with min_t() [5.15,023/913] net: dsa: microchip: add spi_device_id tables [5.15,024/913] selftests: vm: fix clang build error multiple output files [5.15,028/913] iommu/iova: Improve 32-bit free space estimate [5.15,029/913] virtio-blk: Use blk_validate_block_size() to validate block size [5.15,030/913] tpm: fix reference counting for struct tpm_chip [5.15,033/913] xhci: fix garbage USBSTS being logged in some cases [5.15,034/913] xhci: fix runtime PM imbalance in USB2 resume [5.15,035/913] xhci: make xhci_handshake timeout for xhci_reset() adjustable [5.15,037/913] mei: me: disable driver on the ign firmware [5.15,040/913] bus: mhi: pci_generic: Add mru_default for Quectel EM1xx series [5.15,044/913] coresight: syscfg: Fix memleak on registration failure in cscfg_create_device [5.15,045/913] iio: afe: rescale: use s64 for temporary scale calculations [5.15,048/913] iio: inkern: make a best effort on offset calculation [5.15,052/913] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE [5.15,053/913] cifs: fix handlecache and multiuser [5.15,054/913] cifs: we do not need a spinlock around the tree access during umount [5.15,055/913] KEYS: fix length validation in keyctl_pkey_params_get_2() [5.15,060/913] firmware: stratix10-svc: add missing callback parameter on RSU [5.15,061/913] firmware: sysfb: fix platform-device leak in error path [5.15,063/913] SUNRPC: avoid race between mod_timer() and del_timer_sync() [5.15,065/913] NFSD: prevent underflow in nfssvc_decode_writeargs() [5.15,067/913] f2fs: fix to unlock page correctly in error path of is_alive() [5.15,068/913] f2fs: quota: fix loop condition at f2fs_quota_sync() [5.15,069/913] f2fs: fix to do sanity check on .cp_pack_total_block_count [5.15,070/913] remoteproc: Fix count check in rproc_coredump_write() [5.15,076/913] mtd: rawnand: protect access to rawnand devices while in suspend [5.15,077/913] can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path [5.15,079/913] can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path [5.15,080/913] jffs2: fix use-after-free in jffs2_clear_xattr_subsystem [5.15,086/913] mempolicy: mbind_range() set_policy() after vma_merge() [5.15,088/913] scsi: ufs: Fix runtime PM messages never-ending cycle [5.15,089/913] scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters [5.15,090/913] scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands [5.15,092/913] qed: validate and restrict untrusted VFs vlan promisc mode [5.15,094/913] riscv: Fix fill_callchain return value [5.15,096/913] Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" [5.15,097/913] cifs: prevent bad output lengths in smb2_ioctl_query_info() [5.15,098/913] cifs: fix NULL ptr dereference in smb2_ioctl_query_info() [5.15,099/913] ALSA: cs4236: fix an incorrect NULL check on list iterator [5.15,101/913] ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock [5.15,102/913] ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 [5.15,105/913] ocfs2: fix crash when mount with quota enabled [5.15,106/913] drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD panels [5.15,109/913] Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" [5.15,110/913] mm,hwpoison: unmap poisoned page before invalidation [5.15,112/913] dm stats: fix too short end duration_ns when using precise_timestamps [5.15,114/913] dm: interlock pending dm_io and dm_wait_for_bios_completion [5.15,117/913] tracing: Have trace event string test handle zero length strings [5.15,120/913] PCI: fu740: Force 2.5GT/s for initial device probe [5.15,124/913] arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs [5.15,126/913] arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs [5.15,127/913] arm64: dts: ti: k3-am64: Fix gic-v3 compatible regs [5.15,128/913] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM [5.15,129/913] Revert "ACPI: Pass the same capabilities to the _OSC regardless of the query flag" [5.15,134/913] ext4: make mb_optimize_scan performance mount option work with extents [5.15,137/913] landlock: Use square brackets around "landlock-ruleset" [5.15,138/913] mailbox: tegra-hsp: Flush whole channel [5.15,139/913] block: limit request dispatch loop duration [5.15,144/913] video: fbdev: atari: Atari 2 bpp (STe) palette bugfix [5.15,145/913] rfkill: make new event layout opt-in [5.15,149/913] ARM: dts: exynos: add missing HDMI supplies on SMDK5250 [5.15,153/913] pstore: Dont use semaphores in always-atomic-context code [5.15,154/913] thermal: int340x: Increase bitmap size [5.15,155/913] lib/raid6/test: fix multiple definition linking error [5.15,156/913] exec: Force single empty string when argv is empty [5.15,158/913] crypto: rsa-pkcs1pad - correctly get hash from source scatterlist [5.15,159/913] crypto: rsa-pkcs1pad - restore signature length check [5.15,160/913] crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() [5.15,164/913] media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC [5.15,165/913] media: venus: hfi_cmds: List HDR10 property as unsupported for v1 and v3 [5.15,166/913] media: venus: venc: Fix h264 8x8 transform control [5.15,170/913] btrfs: extend locking to all space_info members accesses [5.15,171/913] btrfs: verify the tranisd of the to-be-written dirty extent buffer [5.15,172/913] xtensa: define update_mmu_tlb function [5.15,173/913] xtensa: fix stop_machine_cpuslocked call in patch_text [5.15,174/913] xtensa: fix xtensa_wsr always writing 0 [5.15,175/913] drm/syncobj: flatten dma_fence_chains on transfer [5.15,176/913] drm/nouveau/backlight: Fix LVDS backlight detection on some laptops [5.15,177/913] drm/nouveau/backlight: Just set all backlight types as RAW [5.15,180/913] brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path [5.15,181/913] brcmfmac: pcie: Declare missing firmware files in pcie.c [5.15,183/913] brcmfmac: pcie: Fix crashes due to early IRQs [5.15,184/913] drm/i915/opregion: check port number bounds for SWSCI display power state [5.15,185/913] drm/i915/gem: add missing boundary check in vm_access [5.15,189/913] regulator: qcom_smd: fix for_each_child.cocci warnings [5.15,190/913] selinux: access superblock_security_struct in LSM blob way [5.15,194/913] hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER [5.15,195/913] crypto: sun8i-ss - really disable hash on A80 [5.15,197/913] crypto: mxs-dcp - Fix scatterlist processing [5.15,198/913] selinux: Fix selinux_sb_mnt_opts_compat() [5.15,199/913] thermal: int340x: Check for NULL after calling kmemdup() [5.15,202/913] spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe [5.15,208/913] crypto: rockchip - ECB does not need IV [5.15,211/913] crypto: ccree - dont attempt 0 len DMA mappings [5.15,213/913] spi: pxa2xx-pci: Balance reference count for PCI DMA device [5.15,214/913] hwmon: (pmbus) Add mutex to regulator ops [5.15,217/913] nvme: fix the check for duplicate unique identifiers [5.15,222/913] hwrng: atmel - disable trng on failure path [5.15,223/913] crypto: sun8i-ss - call finalize with bh disabled [5.15,225/913] crypto: amlogic - call finalize with bh disabled [5.15,226/913] crypto: gemini - call finalize with bh disabled [5.15,229/913] clocksource/drivers/exynos_mct: Refactor resources allocation [5.15,234/913] KEYS: trusted: Fix trusted key backends when building as module [5.15,235/913] KEYS: trusted: Avoid calling null function trusted_key_exit [5.15,236/913] ACPI: APEI: fix return value of __setup handlers [5.15,237/913] crypto: ccp - ccp_dmaengine_unregister release dma channels [5.15,238/913] crypto: ccree - Fix use after free in cc_cipher_exit() [5.15,241/913] clocksource: acpi_pm: fix return value of __setup handler [5.15,242/913] io_uring: dont check unrelated req->open.how in accept request [5.15,244/913] watch_queue: Fix NULL dereference in error cleanup [5.15,246/913] f2fs: fix to enable ATGC correctly via gc_idle sysfs interface [5.15,248/913] sched/core: Export pelt_thermal_tp [5.15,249/913] sched/uclamp: Fix iowait boost escaping uclamp restriction [5.15,250/913] rseq: Remove broken uapi field layout on 32-bit little endian [5.15,252/913] perf/x86/intel/pt: Fix address filter config for 32-bit kernel [5.15,255/913] nfsd: more robust allocation failure handling in nfsd_file_cache_init [5.15,256/913] sched/cpuacct: Fix charge percpu cpuusage [5.15,258/913] f2fs: fix to avoid potential deadlock [5.15,260/913] f2fs: fix compressed file start atomic write may cause data corruption [5.15,261/913] selftests, x86: fix how check_cc.sh is being invoked [5.15,263/913] kunit: make kunit_test_timeout compatible with comment [5.15,264/913] pinctrl: samsung: Remove EINT handler for Exynos850 ALIVE and CMGP gpios [5.15,266/913] media: camss: csid-170: fix non-10bit formats [5.15,268/913] media: camss: csid-170: set the right HALT_CMD when disabled [5.15,271/913] media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls [5.15,272/913] media: mtk-vcodec: potential dereference of null pointer [5.15,274/913] media: imx: imx8mq-mipi_csi2: fix system resume [5.15,275/913] media: bttv: fix WARNING regression on tunerless devices [5.15,276/913] media: atmel: atmel-sama7g5-isc: fix ispck leftover [5.15,277/913] ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively [5.15,280/913] ASoC: simple-card-utils: Set sysclk on all components [5.15,282/913] media: meson: vdec: potential dereference of null pointer [5.15,285/913] media: v4l: Avoid unaligned access warnings when printing 4cc modifiers [5.15,286/913] media: ov5648: Dont pack controls struct [5.15,287/913] media: aspeed: Correct value for h-total-pixels [5.15,289/913] video: fbdev: controlfb: Fix COMPILE_TEST build [5.15,290/913] video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() [5.15,291/913] video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() [5.15,292/913] video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() [5.15,295/913] ARM: dts: qcom: ipq4019: fix sleep clock [5.15,297/913] soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem [5.15,298/913] soc: qcom: aoss: remove spurious IRQF_ONESHOT flags [5.15,301/913] arm64: dts: broadcom: bcm4908: use proper TWD binding [5.15,302/913] arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc [5.15,306/913] ARM: dts: sun8i: v3s: Move the csi1 block to follow address order [5.15,307/913] ARM: ftrace: ensure that ADR takes the Thumb bit into account [5.15,308/913] vsprintf: Fix potential unaligned access [5.15,314/913] media: usb: go7007: s2250-board: fix leak in probe() [5.15,316/913] media: cedrus: h264: Fix neighbour info buffer size [5.15,319/913] ASoC: codecs: va-macro: fix accessing array out of bounds for enum type [5.15,320/913] ASoC: codecs: wc938x: fix accessing array out of bounds for enum type [5.15,321/913] ASoC: codecs: wcd938x: fix kcontrol max values [5.15,323/913] ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put [5.15,328/913] vsprintf: Fix %pK with kptr_restrict == 0 [5.15,330/913] ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() [5.15,331/913] soc: mediatek: pm-domains: Add wakeup capacity support in power domain [5.15,333/913] ASoC: ti: davinci-i2s: Add check for clk_enable() [5.15,335/913] arm64: dts: ns2: Fix spi-cpol and spi-cpha property [5.15,336/913] arm64: dts: broadcom: Fix sata nodename [5.15,338/913] ASoC: mxs-saif: Handle errors for clk_enable [5.15,340/913] ASoC: dwc-i2s: Handle errors for clk_enable [5.15,342/913] memory: emif: Add check for setup_interrupts [5.15,344/913] ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction [5.15,345/913] arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly [5.15,347/913] media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED [5.15,349/913] ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe [5.15,352/913] video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of [5.15,353/913] media: saa7134: fix incorrect use to determine if list is empty [5.15,357/913] ASoC: SOF: Add missing of_node_put() in imx8m_probe [5.15,361/913] ASoC: dmaengine: do not use a NULL prepare_slave_config() callback [5.15,362/913] ASoC: mxs: Fix error handling in mxs_sgtl5000_probe [5.15,364/913] ASoC: imx-es8328: Fix error return code in imx_es8328_probe() [5.15,366/913] ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digi... [5.15,367/913] mmc: davinci_mmc: Handle error for clk_enable [5.15,371/913] ASoC: amd: Fix reference to PCM buffer address [5.15,372/913] ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS [5.15,373/913] ARM: configs: multi_v5_defconfig: re-enable DRM_PANEL and FB_xxx [5.15,374/913] drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops [5.15,378/913] drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev [5.15,379/913] drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe [5.15,383/913] drm/v3d/v3d_drv: Check for error num after setting mask [5.15,384/913] drm/panfrost: Check for error num after setting mask [5.15,386/913] bpftool: Only set obj->skeleton on complete success [5.15,388/913] bpf: Fix UAF due to race between btf_try_get_module and load_module [5.15,389/913] drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode_d... [5.15,391/913] Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products [5.15,393/913] mtd: onenand: Check for error irq [5.15,396/913] drm/edid: Split deep color modes between RGB and YUV444 [5.15,398/913] ionic: start watchdog after all is setup [5.15,399/913] ionic: Dont send reset commands if FW isnt running [5.15,402/913] drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function [5.15,403/913] net: phy: at803x: move page selection fix to config_init [5.15,404/913] selftests/bpf: Normalize XDP section names in selftests [5.15,406/913] ath9k_htc: fix uninit value bugs [5.15,411/913] i40e: respect metadata on XSK Rx to skb [5.15,412/913] igc: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.15,413/913] ixgbe: pass bi->xdp to ixgbe_construct_skb_zc() directly [5.15,415/913] ixgbe: respect metadata on XSK Rx to skb [5.15,416/913] power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe [5.15,418/913] powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch [5.15,421/913] mt76: connac: fix sta_rec_wtbl tag len [5.15,422/913] mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode [5.15,423/913] mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv [5.15,426/913] mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update [5.15,428/913] ptp: unregister virtual clocks when unregistering physical clock. [5.15,431/913] mac80211: limit bandwidth in HE capabilities [5.15,434/913] net: asix: add proper error handling of usb read errors [5.15,435/913] i2c: bcm2835: Use platform_get_irq() to get the interrupt [5.15,436/913] i2c: bcm2835: Fix the error handling in bcm2835_i2c_probe() [5.15,437/913] mtd: mchp23k256: Add SPI ID table [5.15,438/913] mtd: mchp48l640: Add SPI ID table [5.15,446/913] cxl/regs: Fix size of CXL Capability Header Register [5.15,448/913] libbpf: Fix compilation warning due to mismatched printf format [5.15,449/913] drm/bridge: dw-hdmi: use safe format when first in bridge chain [5.15,451/913] power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init [5.15,454/913] drm/bridge: anx7625: Fix overflow issue on reading EDID [5.15,459/913] IB/cma: Allow XRC INI QPs to set their local ACK timeout [5.15,460/913] dax: make sure inodes are flushed before destroy cache [5.15,461/913] selftests: mptcp: add csum mib check for mptcp_connect [5.15,462/913] iwlwifi: mvm: Dont call iwl_mvm_sta_from_mac80211() with NULL sta [5.15,463/913] iwlwifi: mvm: dont iterate unadded vifs when handling FW SMPS req [5.15,465/913] iwlwifi: yoyo: remove DBGI_SRAM address reset writing [5.15,466/913] iwlwifi: Fix -EIO error code that is never returned [5.15,467/913] iwlwifi: mvm: Fix an error code in iwl_mvm_up() [5.15,468/913] mtd: rawnand: pl353: Set the nand chip node as the flash node [5.15,472/913] drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent [5.15,473/913] drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode [5.15,476/913] dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS [5.15,479/913] scsi: fnic: Fix a tracing statement [5.15,481/913] scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() [5.15,483/913] scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() [5.15,486/913] scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() [5.15,488/913] scsi: pm8001: Fix NCQ NON DATA command completion handling [5.15,489/913] scsi: pm8001: Fix abort all task initialization [5.15,490/913] RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR [5.15,491/913] drm/amd/display: Remove vupdate_int_entry definition [5.15,493/913] power: supply: sbs-charger: Dont cancel work that is not initialized [5.15,496/913] power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return [5.15,499/913] bpf, arm64: Call build_prologue() first in first JIT pass [5.15,500/913] bpf, arm64: Feed byte-offset into bpf line info [5.15,502/913] RDMA/irdma: Fix netdev notifications for vlans [5.15,509/913] KVM: x86: Fix emulation in writing cr8 [5.15,510/913] KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() [5.15,513/913] power: supply: wm8350-power: Handle error for wm8350_register_irq [5.15,514/913] power: supply: wm8350-power: Add missing free in free_charger_irq [5.15,516/913] RDMA/core: Fix ib_qp_usecnt_dec() called when error [5.15,517/913] PCI: Reduce warnings on possible RW1C corruption [5.15,518/913] net: axienet: fix RX ring refill allocation failure handling [5.15,521/913] MIPS: Sanitise Cavium switch cases in TLB handler synthesizers [5.15,523/913] powerpc/64s: Dont use DSISR for SLB faults [5.15,524/913] mfd: mc13xxx: Add check for mc13xxx_irq_request [5.15,525/913] libbpf: Unmap rings when umem deleted [5.15,527/913] platform/x86: huawei-wmi: check the return value of device_create_file() [5.15,528/913] scsi: mpt3sas: Fix incorrect 4GB boundary check [5.15,530/913] vxcan: enable local echo for sent CAN frames [5.15,532/913] mips: cdmm: Fix refcount leak in mips_cdmm_phys_base [5.15,536/913] power: ab8500_chargalg: Use CLOCK_MONOTONIC [5.15,538/913] Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error" [5.15,540/913] bpf, sockmap: Fix memleak in sk_psock_queue_msg [5.15,542/913] bpf, sockmap: Fix more uncharged while msg has more_data [5.15,543/913] bpf, sockmap: Fix double uncharge the mem of sk_msg [5.15,547/913] netfilter: flowtable: Fix QinQ and pppoe support for inet table [5.15,549/913] can: isotp: sanitize CAN ID checks in isotp_bind() [5.15,550/913] can: isotp: return -EADDRNOTAVAIL when reading from unbound socket [5.15,551/913] can: isotp: support MSG_TRUNC flag when reading from socket [5.15,553/913] ibmvnic: fix race between xmit and reset [5.15,555/913] selftests/bpf: Fix error reporting from sock_fields programs [5.15,558/913] Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt [5.15,559/913] ipv4: Fix route lookups when handling ICMP redirects and PMTU updates [5.15,561/913] i2c: meson: Fix wrong speed use from probe [5.15,564/913] powerpc/pseries: Fix use after free in remove_phb_dynamic() [5.15,565/913] selftests/bpf/test_lirc_mode2.sh: Exit with proper code [5.15,568/913] tcp: ensure PMTU updates are processed during fastopen [5.15,571/913] tipc: fix the timer expires after interval 100ms [5.15,572/913] mfd: asic3: Add missing iounmap() on error asic3_mfd_probe [5.15,573/913] ice: fix scheduling while atomic on aux critical err interrupt [5.15,574/913] ice: dont allow to run ice_send_event_to_aux() in atomic ctx [5.15,575/913] drivers: ethernet: cpsw: fix panic when interrupt coaleceing is set via ethtool [5.15,577/913] staging: r8188eu: convert DBG_88E_LEVEL call in hal/rtl8188e_hal_init.c [5.15,580/913] fsi: scom: Fix error handling [5.15,581/913] fsi: scom: Remove retries in indirect scoms [5.15,582/913] pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() [5.15,585/913] misc: alcor_pci: Fix an error handling path [5.15,586/913] cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse [5.15,588/913] clk: qcom: ipq8074: fix PCI-E clock oops [5.15,592/913] iio: mma8452: Fix probe failing when an i2c_device_id is used [5.15,595/913] pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel [5.15,597/913] clk: qcom: ipq8074: Use floor ops for SDCC1 clock [5.15,600/913] serial: 8250_mid: Balance reference count for PCI DMA device [5.15,601/913] serial: 8250_lpss: Balance reference count for PCI DMA device [5.15,602/913] NFS: Use of mapping_set_error() results in spurious errors [5.15,606/913] NFS: Return valid errors from nfs2/3_decode_dirent() [5.15,607/913] staging: r8188eu: fix endless loop in recv_func [5.15,608/913] dma-debug: fix return value of __setup handlers [5.15,610/913] clk: imx: off by one in imx_lpcg_parse_clks_from_dt() [5.15,611/913] clk: at91: sama7g5: fix parents of PDMCs GCLK [5.15,614/913] dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma [5.15,615/913] remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region [5.15,616/913] remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region [5.15,619/913] clk: actions: Terminate clk_div_table with sentinel element [5.15,621/913] clk: hisilicon: Terminate clk_div_table with sentinel element [5.15,622/913] clk: clps711x: Terminate clk_div_table with sentinel element [5.15,623/913] clk: Fix clk_hw_get_clk() when dev is NULL [5.15,625/913] mailbox: imx: fix crash in resume on i.mx8ulp [5.15,630/913] staging: mt7621-dts: fix GB-PC2 devicetree [5.15,632/913] pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback [5.15,634/913] pinctrl: mediatek: paris: Fix pingroup pin config state readback [5.15,636/913] pinctrl: microchip sgpio: use reset driver [5.15,637/913] pinctrl: microchip-sgpio: lock RMW access [5.15,640/913] tty: hvc: fix return value of __setup handler [5.15,641/913] kgdboc: fix return value of __setup handler [5.15,642/913] serial: 8250: fix XOFF/XON sending when DMA is used [5.15,644/913] virt: acrn: fix a memory leak in acrn_dev_ioctl() [5.15,645/913] kgdbts: fix return value of __setup handler [5.15,646/913] firmware: google: Properly state IOMEM dependency [5.15,650/913] SUNRPC dont resend a task on an offlined transport [5.15,653/913] perf stat: Fix forked applications enablement of counters [5.15,654/913] clk: qcom: gcc-msm8994: Fix gpll4 width [5.15,655/913] vsock/virtio: initialize vdev->priv before using VQs [5.15,658/913] clk: Initialize orphan req_rate [5.15,660/913] net: enetc: report software timestamping via SO_TIMESTAMPING [5.15,661/913] net: hns3: fix bug when PF set the duplicate MAC address for VFs [5.15,662/913] net: hns3: fix port base vlan add fail when concurrent with reset [5.15,665/913] net: hns3: refine the process when PF set VF VLAN [5.15,666/913] net: phy: broadcom: Fix brcm_fet_config_init() [5.15,670/913] net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL [5.15,671/913] qlcnic: dcb: default to returning -EOPNOTSUPP [5.15,674/913] octeontx2-af: initialize action variable [5.15,676/913] net/sched: act_ct: fix ref leak when switching zones [5.15,678/913] net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator [5.15,679/913] fs: fd tables have to be multiples of BITS_PER_LONG [5.15,681/913] fs: fix fd table size alignment properly [5.15,685/913] gcc-plugins/stackleak: Exactly match strings instead of prefixes [5.15,687/913] rcu: Mark writes to the rcu_segcblist structures ->flags field [5.15,688/913] block/bfq_wf2q: correct weight to ioprio [5.15,693/913] arm64: module: remove (NOLOAD) from linker script [5.15,694/913] selinux: allow FIOCLEX and FIONCLEX with policy capability [5.15,697/913] irqchip/qcom-pdc: Fix broken locking [5.15,704/913] ACPI/APEI: Limit printable size of BERT table data [5.15,705/913] PM: core: keep irq flags in device_pm_check_callbacks() [5.15,707/913] nvme-tcp: lockdep: annotate in-kernel sockets [5.15,708/913] spi: tegra20: Use of_device_get_match_data() [5.15,711/913] ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb [5.15,712/913] ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit [5.15,713/913] sched/tracing: Dont re-read p->state when emitting sched_switch event [5.15,716/913] f2fs: fix to do sanity check on curseg->alloc_type [5.15,717/913] NFSD: Fix nfsd_breaker_owns_lease() return values [5.15,718/913] f2fs: dont get FREEZE lock in f2fs_evict_inode in frozen fs [5.15,720/913] btrfs: make search_csum_tree return 0 if we get -EFBIG [5.15,723/913] Adjust cifssb maximum read size [5.15,724/913] ntfs: add sanity check on allocation size [5.15,727/913] media: staging: media: zoran: fix various V4L2 compliance errors [5.15,728/913] media: atmel: atmel-isc-base: report frame sizes as full supported range [5.15,729/913] media: ir_toy: free before error exiting [5.15,731/913] ASoC: SOF: Intel: match sdw version on link_slaves_found [5.15,735/913] media: iommu/mediatek: Return ENODEV if the device is NULL [5.15,736/913] media: iommu/mediatek: Add device_link between the consumer and the larb devices [5.15,738/913] video: fbdev: w100fb: Reset global state [5.15,743/913] ASoC: madera: Add dependencies on MFD [5.15,744/913] media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on... [5.15,747/913] ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk [5.15,749/913] video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() [5.15,751/913] video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit [5.15,754/913] media: imx-jpeg: fix a bug of accessing array out of bounds [5.15,755/913] media: cx88-mpeg: clear interrupt status register before streaming video [5.15,756/913] uaccess: fix type mismatch warnings from access_ok() [5.15,757/913] lib/test_lockup: fix kernel pointer check for separate address spaces [5.15,758/913] ARM: tegra: tamonten: Fix I2C3 pad setting [5.15,760/913] ASoC: amd: vg: fix for pm resume callback sequence [5.15,761/913] video: fbdev: sm712fb: Fix crash in smtcfb_write() [5.15,765/913] ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13" [5.15,767/913] mmc: host: Return an error when ->enable_sdio_irq() ops is missing [5.15,769/913] ALSA: hda/realtek: Add alc256-samsung-headphone fixup [5.15,771/913] KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root() [5.15,776/913] KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB flush h... [5.15,778/913] powerpc/kasan: Fix early region not updated correctly [5.15,779/913] powerpc/lib/sstep: Fix sthcx instruction [5.15,781/913] powerpc: Add set_memory_{p/np}() and remove set_memory_attr() [5.15,782/913] powerpc: Fix build errors with newer binutils [5.15,783/913] drm/dp: Fix off-by-one in register cache size [5.15,787/913] scsi: qla2xxx: Refactor asynchronous command initialization [5.15,788/913] scsi: qla2xxx: Implement ref count for SRB [5.15,790/913] scsi: qla2xxx: Fix warning message due to adisc being flushed [5.15,791/913] scsi: qla2xxx: Fix scheduling while atomic [5.15,792/913] scsi: qla2xxx: Fix premature hw access after PCI error [5.15,795/913] scsi: qla2xxx: Fix device reconnect in loop topology [5.15,796/913] scsi: qla2xxx: edif: Fix clang warning [5.15,797/913] scsi: qla2xxx: Fix T10 PI tag escape and IP guard options for 28XX adapters [5.15,800/913] scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() [5.15,801/913] scsi: qla2xxx: Fix disk failure to rediscover [5.15,804/913] scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests [5.15,805/913] scsi: qla2xxx: Fix N2N inconsistent PLOGI [5.15,806/913] scsi: qla2xxx: Fix stuck session of PRLI reject [5.15,808/913] scsi: qla2xxx: Use correct feature type field during RFF_ID processing [5.15,809/913] platform: chrome: Split trace include file [5.15,810/913] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq [5.15,818/913] ubifs: Add missing iput if do_tmpfile() failed in rename whiteout [5.15,820/913] ubifs: Fix ui->dirty race between do_tmpfile() and writeback work [5.15,821/913] ubifs: Rectify space amount budget for mkdir/tmpfile operations [5.15,822/913] ubifs: setflags: Make dirtied_ino_d 8 bytes aligned [5.15,823/913] ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() [5.15,824/913] ubifs: Fix to add refcount once page is set private [5.15,825/913] ubifs: rename_whiteout: correct old_dir size computing [5.15,827/913] nvme: fix the read-only state for zoned namespaces with unsupposed features [5.15,831/913] XArray: Fix xas_create_range() when multi-order entry present [5.15,832/913] can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path [5.15,835/913] XArray: Update the LRU list in xas_split() [5.15,837/913] rtc: check if __rtc_read_time was successful [5.15,840/913] net: hns3: fix the concurrency between functions reading debugfs [5.15,842/913] rxrpc: fix some null-ptr-deref bugs in server_key.c [5.15,845/913] crypto: arm/aes-neonbs-cbc - Select generic cbc and aes [5.15,846/913] watch_queue: Free the page array when watch_queue is dismantled [5.15,848/913] watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function [5.15,850/913] pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() [5.15,851/913] pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() [5.15,853/913] ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl [5.15,854/913] ARM: iop32x: offset IRQ numbers by 1 [5.15,857/913] riscv module: remove (NOLOAD) [5.15,860/913] spi: Fix Tegra QSPI example [5.15,862/913] can: isotp: restore accidentally removed MSG_PEEK feature [5.15,863/913] proc: bootconfig: Add null pointer check [5.15,864/913] drm/connector: Fix typo in documentation [5.15,866/913] staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet [5.15,871/913] net: add skb_set_end_offset() helper [5.15,872/913] net: preserve skb_end_offset() in skb_unclone_keeptruesize() [5.15,877/913] af_unix: Support POLLPRI for OOB. [5.15,878/913] bpf: Adjust BPF stack helper functions to accommodate skip > 0 [5.15,879/913] bpf: Fix comment for helper bpf_current_task_under_cgroup() [5.15,880/913] mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM [5.15,881/913] dt-bindings: mtd: nand-controller: Fix the reg property description [5.15,884/913] dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167 [5.15,886/913] ubi: fastmap: Return error code if memory allocation fails in add_aeb() [5.15,891/913] media: ov6650: Fix crop rectangle affected by set format [5.15,892/913] spi: mediatek: support tick_delay without enhance_timing [5.15,894/913] ARM: dts: spear13xx: Update SPI dma properties [5.15,899/913] openvswitch: Fixed nd target mask field in the flow dump. [5.15,900/913] torture: Make torture.sh help message match reality [5.15,905/913] iommu/dma: Skip extra sync during unmap w/swiotlb [5.15,907/913] iommu/dma: Check CONFIG_SWIOTLB more broadly [5.15,908/913] swiotlb: Support aligned swiotlb buffers [5.15,912/913] coredump/elf: Pass coredump_params into fill_note_info [5.15,913/913] coredump: Use the vma snapshot in fill_files_note

[5.15,185/913] drm/i915/gem: add missing boundary check in vm_access

Commit Message

Patch