[5.17,0668/1126] RDMA/rxe: Fix ref error in rxe_av.c

Message ID	20220405070427.234421231@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Bob Pearson <rpearsonhpe@gmail.com>, Jason Gunthorpe <jgg@nvidia.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.17 0668/1126] RDMA/rxe: Fix ref error in rxe_av.c Date: Tue, 5 Apr 2022 09:23:35 +0200 Message-Id: <20220405070427.234421231@linuxfoundation.org> In-Reply-To: <20220405070407.513532867@linuxfoundation.org> References: <20220405070407.513532867@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,0002/1126] USB: serial: pl2303: add IBM device IDs [5.17,0005/1126] USB: serial: simple: add Nokia phone driver [5.17,0008/1126] drm/amdgpu: move PX checking into amdgpu_device_ip_early_init [5.17,0009/1126] drm/amdgpu: only check for _PR3 on dGPUs [5.17,0010/1126] iommu/iova: Improve 32-bit free space estimate [5.17,0012/1126] block: ensure plug merging checks the correct queue at least once [5.17,0013/1126] usb: typec: tipd: Forward plug orientation to typec subsystem [5.17,0015/1126] xhci: fix garbage USBSTS being logged in some cases [5.17,0016/1126] xhci: fix runtime PM imbalance in USB2 resume [5.17,0018/1126] xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() [5.17,0020/1126] mei: me: add Alder Lake N device id. [5.17,0023/1126] bus: mhi: Fix pm_state conversion to string [5.17,0024/1126] bus: mhi: Fix MHI DMA structure endianness [5.17,0026/1126] coresight: Fix TRCCONFIGR.QE sysfs interface [5.17,0028/1126] dt-bindings: iio: adc: zynqmp_ams: Add clock entry [5.17,0029/1126] iio: adc: xilinx-ams: Fix single channel switching sequence [5.17,0030/1126] iio: accel: mma8452: use the correct logic to get mma8452_data [5.17,0033/1126] iio: afe: rescale: use s64 for temporary scale calculations [5.17,0034/1126] iio: adc: xilinx-ams: Fixed missing PS channels [5.17,0037/1126] iio: inkern: apply consumer scale when no channel scale is available [5.17,0040/1126] clk: rockchip: re-add rational best approximation algorithm to the fractional di... [5.17,0042/1126] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE [5.17,0045/1126] cifs: we do not need a spinlock around the tree access during umount [5.17,0046/1126] KEYS: fix length validation in keyctl_pkey_params_get_2() [5.17,0048/1126] KEYS: asymmetric: properly validate hash_algo and encoding [5.17,0051/1126] firmware: stratix10-svc: add missing callback parameter on RSU [5.17,0053/1126] HID: intel-ish-hid: Use dma_alloc_coherent for firmware update [5.17,0055/1126] SUNRPC: Do not dereference non-socket transports in sysfs [5.17,0058/1126] NFSD: prevent integer overflow on 32 bit systems [5.17,0059/1126] f2fs: fix to unlock page correctly in error path of is_alive() [5.17,0060/1126] f2fs: quota: fix loop condition at f2fs_quota_sync() [5.17,0062/1126] remoteproc: Fix count check in rproc_coredump_write() [5.17,0064/1126] pinctrl: ingenic: Fix regmap on X series SoCs [5.17,0065/1126] pinctrl: samsung: drop pin banks references on error paths [5.17,0066/1126] net: bnxt_ptp: fix compilation error [5.17,0067/1126] spi: mxic: Fix the transmit path [5.17,0070/1126] can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path [5.17,0075/1126] jffs2: fix memory leak in jffs2_scan_medium [5.17,0077/1126] mm: dont skip swap entry even if zap_details specified [5.17,0080/1126] mempolicy: mbind_range() set_policy() after vma_merge() [5.17,0081/1126] scsi: core: sd: Add silence_suspend flag to suppress some PM messages [5.17,0082/1126] scsi: ufs: Fix runtime PM messages never-ending cycle [5.17,0083/1126] scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters [5.17,0085/1126] qed: display VF trust config [5.17,0086/1126] qed: validate and restrict untrusted VFs vlan promisc mode [5.17,0087/1126] riscv: dts: canaan: Fix SPI3 bus width [5.17,0090/1126] RISC-V: Declare per cpu boot data as static [5.17,0093/1126] cifs: fix incorrect use of list iterator after the loop [5.17,0097/1126] ALSA: hda: Avoid unsol event during RPM suspending [5.17,0100/1126] rtc: mc146818-lib: fix locking in mc146818_set_time [5.17,0103/1126] ocfs2: fix crash when mount with quota enabled [5.17,0104/1126] drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD panels [5.17,0107/1126] Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" [5.17,0110/1126] mm/kmemleak: reset tag when compare object pointer [5.17,0113/1126] dm: interlock pending dm_io and dm_wait_for_bios_completion [5.17,0116/1126] tracing: Have trace event string test handle zero length strings [5.17,0118/1126] can: isotp: sanitize CAN ID checks in isotp_bind() [5.17,0121/1126] arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones [5.17,0122/1126] arm64: dts: qcom: sm8250: Fix MSI IRQ for PCIe1 and PCIe2 [5.17,0124/1126] arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs [5.17,0125/1126] arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs [5.17,0128/1126] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM [5.17,0129/1126] mmc: core: use sysfs_emit() instead of sprintf() [5.17,0132/1126] coredump: Also dump first pages of non-executable ELF libraries [5.17,0133/1126] ext4: fix ext4_fc_stats trace point [5.17,0134/1126] ext4: fix fs corruption when tring to remove a non-empty directory with IO error [5.17,0136/1126] ext4: make mb_optimize_scan performance mount option work with extents [5.17,0137/1126] samples/landlock: Fix path_list memory leak [5.17,0138/1126] landlock: Use square brackets around "landlock-ruleset" [5.17,0140/1126] btrfs: zoned: put block group after final usage [5.17,0142/1126] block: limit request dispatch loop duration [5.17,0145/1126] fbdev: Hot-unplug firmware fb devices on forced removal [5.17,0147/1126] video: fbdev: atari: Atari 2 bpp (STe) palette bugfix [5.17,0148/1126] rfkill: make new event layout opt-in [5.17,0152/1126] ARM: dts: exynos: add missing HDMI supplies on SMDK5250 [5.17,0155/1126] carl9170: fix missing bit-wise or operator for tx_params [5.17,0156/1126] pstore: Dont use semaphores in always-atomic-context code [5.17,0159/1126] exec: Force single empty string when argv is empty [5.17,0160/1126] crypto: rsa-pkcs1pad - only allow with rsa [5.17,0161/1126] crypto: rsa-pkcs1pad - correctly get hash from source scatterlist [5.17,0164/1126] bcache: fixup multiple threads crash [5.17,0165/1126] PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() [5.17,0166/1126] DEC: Limit PMAX memory probing to R3k systems [5.17,0167/1126] media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC [5.17,0168/1126] media: omap3isp: Use struct_group() for memcpy() region [5.17,0171/1126] media: venus: venc: Fix h264 8x8 transform control [5.17,0173/1126] media: davinci: vpif: fix unbalanced runtime PM enable [5.17,0174/1126] media: davinci: vpif: fix use-after-free on driver unbind [5.17,0177/1126] btrfs: extend locking to all space_info members accesses [5.17,0179/1126] xtensa: define update_mmu_tlb function [5.17,0180/1126] xtensa: fix stop_machine_cpuslocked call in patch_text [5.17,0183/1126] drm/syncobj: flatten dma_fence_chains on transfer [5.17,0184/1126] drm/nouveau/backlight: Fix LVDS backlight detection on some laptops [5.17,0186/1126] drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB [5.17,0191/1126] brcmfmac: pcie: Fix crashes due to early IRQs [5.17,0192/1126] drm/i915/opregion: check port number bounds for SWSCI display power state [5.17,0195/1126] PCI: pciehp: Clear cmd_busy bit in polling mode [5.17,0196/1126] PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" [5.17,0198/1126] regulator: qcom_smd: fix for_each_child.cocci warnings [5.17,0199/1126] selinux: access superblock_security_struct in LSM blob way [5.17,0202/1126] crypto: qat - fix a signedness bug in get_service_enabled() [5.17,0206/1126] crypto: qat - fix access to PFVF interrupt registers for GEN4 [5.17,0208/1126] crypto: octeontx2 - select CONFIG_NET_DEVLINK [5.17,0209/1126] crypto: mxs-dcp - Fix scatterlist processing [5.17,0211/1126] thermal: int340x: Check for NULL after calling kmemdup() [5.17,0212/1126] crypto: octeontx2 - remove CONFIG_DM_CRYPT check [5.17,0214/1126] spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe [5.17,0217/1126] selftests/sgx: Do not attempt enclave build without valid enclave [5.17,0218/1126] selftests/sgx: Ensure enclave data available during debug print [5.17,0220/1126] arm64/mm: avoid fixmap race condition when create pud mapping [5.17,0221/1126] security: add sctp_assoc_established hook [5.17,0223/1126] blk-cgroup: set blkg iostat after percpu stat aggregation [5.17,0224/1126] selftests/x86: Add validity check and allow field splitting [5.17,0227/1126] block: update io_ticks when io hang [5.17,0228/1126] audit: log AUDIT_TIME_* records only from rules [5.17,0229/1126] EVM: fix the evm= __setup handler return value [5.17,0231/1126] crypto: hisilicon/sec - fix the aead software fallback for engine [5.17,0232/1126] spi: pxa2xx-pci: Balance reference count for PCI DMA device [5.17,0237/1126] block: dont delete queue kobject before its children [5.17,0239/1126] PM: suspend: fix return value of __setup handler [5.17,0240/1126] spi: spi-zynqmp-gqspi: Handle error for dma_set_mask [5.17,0242/1126] crypto: sun8i-ss - call finalize with bh disabled [5.17,0244/1126] crypto: amlogic - call finalize with bh disabled [5.17,0246/1126] crypto: vmx - add missing dependencies [5.17,0247/1126] clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix [5.17,0250/1126] clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_in... [5.17,0252/1126] perf/arm-cmn: Hide XP PUB events for CMN-600 [5.17,0254/1126] KEYS: trusted: Fix trusted key backends when building as module [5.17,0255/1126] KEYS: trusted: Avoid calling null function trusted_key_exit [5.17,0257/1126] crypto: ccp - ccp_dmaengine_unregister release dma channels [5.17,0259/1126] crypto: qat - fix initialization of pfvf cap_msg structures [5.17,0261/1126] hwrng: nomadik - Change clk_disable to clk_disable_unprepare [5.17,0265/1126] io_uring: terminate manual loop iterator loop correctly for non-vecs [5.17,0267/1126] watch_queue: Actually free the watch [5.17,0270/1126] sched/core: Export pelt_thermal_tp [5.17,0274/1126] perf/core: Fix address filter parser for multiple filters [5.17,0276/1126] sched/fair: Improve consistency of allowed NUMA balance calculations [5.17,0277/1126] f2fs: fix missing free nid in f2fs_handle_failed_inode [5.17,0278/1126] ext4: fix remount with abort option [5.17,0282/1126] f2fs: fix to avoid potential deadlock [5.17,0285/1126] fs: erofs: add sanity check for kobject in erofs_unregister_sysfs [5.17,0288/1126] selftests, x86: fix how check_cc.sh is being invoked [5.17,0289/1126] drivers/base/memory: add memory block to memory group after registration succeeded [5.17,0290/1126] kunit: make kunit_test_timeout compatible with comment [5.17,0293/1126] media: camss: csid-170: fix non-10bit formats [5.17,0295/1126] media: camss: csid-170: set the right HALT_CMD when disabled [5.17,0300/1126] media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation [5.17,0301/1126] media: imx: imx8mq-mipi_csi2: fix system resume [5.17,0302/1126] media: bttv: fix WARNING regression on tunerless devices [5.17,0304/1126] ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively [5.17,0306/1126] ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting [5.17,0309/1126] media: coda: Fix missing put_device() call in coda_get_vdoa_data [5.17,0312/1126] media: ov6650: Fix set format try processing path [5.17,0315/1126] media: ov2740: identify module after subdev initialisation [5.17,0318/1126] video: fbdev: controlfb: Fix COMPILE_TEST build [5.17,0319/1126] video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() [5.17,0321/1126] video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() [5.17,0322/1126] ARM: dts: Fix OpenBMC flash layout label addresses [5.17,0323/1126] ASoC: max98927: add missing header file [5.17,0324/1126] arm64: dts: qcom: sc7280: Fix gmu unit address [5.17,0325/1126] firmware: qcom: scm: Remove reassignment to desc following initializer [5.17,0327/1126] soc: qcom: rpmpd: Check for null return of devm_kcalloc [5.17,0328/1126] soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem [5.17,0329/1126] soc: qcom: aoss: Fix missing put_device call in qmp_get [5.17,0332/1126] arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema [5.17,0333/1126] arm64: dts: qcom: msm8916-j5: Fix typo [5.17,0334/1126] arm64: dts: broadcom: bcm4908: use proper TWD binding [5.17,0335/1126] arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc [5.17,0337/1126] arm64: dts: qcom: sm8450: Update cpuidle states parameters [5.17,0339/1126] arm64: dts: qcom: ipq6018: fix usb reference period [5.17,0341/1126] soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe [5.17,0343/1126] ARM: dts: sun8i: v3s: Move the csi1 block to follow address order [5.17,0344/1126] ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 [5.17,0345/1126] ARM: ftrace: ensure that ADR takes the Thumb bit into account [5.17,0346/1126] vsprintf: Fix potential unaligned access [5.17,0347/1126] ARM: dts: qcom: sdx55: Fix the address used for PCIe EP local addr space [5.17,0348/1126] ARM: dts: imx: Add missing LVDS decoder on M53Menlo [5.17,0352/1126] media: em28xx: initialize refcount before kref_get [5.17,0356/1126] media: cedrus: h264: Fix neighbour info buffer size [5.17,0358/1126] ASoC: codecs: rx-macro: fix accessing compander for aux [5.17,0359/1126] ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type [5.17,0360/1126] ASoC: codecs: va-macro: fix accessing array out of bounds for enum type [5.17,0364/1126] ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put [5.17,0365/1126] media: v4l2-core: Initialize h264 scaling matrix [5.17,0366/1126] media: hantro: sunxi: Fix VP9 steps [5.17,0368/1126] selftests: vm: remove dependecy from internal kernel macros [5.17,0370/1126] vsprintf: Fix %pK with kptr_restrict == 0 [5.17,0373/1126] ASoC: acp: check the return value of devm_kzalloc() in acp_legacy_dai_links_crea... [5.17,0374/1126] soc: mediatek: pm-domains: Add wakeup capacity support in power domain [5.17,0375/1126] mmc: sdhci_am654: Fix the driver data of AM64 SoC [5.17,0376/1126] ASoC: ti: davinci-i2s: Add check for clk_enable() [5.17,0378/1126] arm64: dts: ns2: Fix spi-cpol and spi-cpha property [5.17,0385/1126] media: i2c: Fix pixel array positions in ov8865 [5.17,0386/1126] memory: emif: Add check for setup_interrupts [5.17,0387/1126] memory: emif: check the pointer temp in get_device_details() [5.17,0389/1126] arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly [5.17,0396/1126] ASoC: wm8350: Handle error for wm8350_register_irq [5.17,0397/1126] ASoC: fsi: Add check for clk_enable [5.17,0398/1126] video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of [5.17,0400/1126] ivtv: fix incorrect device_caps for ivtvfb [5.17,0402/1126] ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe [5.17,0404/1126] ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe [5.17,0405/1126] ASoC: rk817: Fix missing clk_disable_unprepare() in rk817_platform_probe [5.17,0406/1126] ASoC: dmaengine: do not use a NULL prepare_slave_config() callback [5.17,0408/1126] ASoC: fsl_spdif: Disable TX clock when stop [5.17,0410/1126] ASoC: SOF: Intel: enable DMI L1 for playback streams [5.17,0411/1126] ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_di... [5.17,0413/1126] rtla/osnoise: Fix osnoise hist stop tracing message [5.17,0416/1126] ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe [5.17,0417/1126] ASoC: mediatek: mt8195: Fix error handling in mt8195_mt6359_rt1019_rt5682_dev_probe [5.17,0420/1126] ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS [5.17,0422/1126] drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe() [5.17,0423/1126] drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops [5.17,0425/1126] drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev [5.17,0431/1126] drm/v3d/v3d_drv: Check for error num after setting mask [5.17,0434/1126] drm/panfrost: Check for error num after setting mask [5.17,0436/1126] libbpf: Fix possible NULL pointer dereference when destroying skeleton [5.17,0437/1126] bpftool: Only set obj->skeleton on complete success [5.17,0439/1126] udmabuf: validate ubuf->pagecount [5.17,0441/1126] drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode... [5.17,0442/1126] drm/locking: fix drm_modeset_acquire_ctx kernel-doc [5.17,0444/1126] Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products [5.17,0446/1126] Bluetooth: mt7921s: fix firmware coredump retrieve [5.17,0453/1126] selftests, xsk: Fix rx_full stats test [5.17,0454/1126] drm/edid: Dont clear formats if using deep color [5.17,0455/1126] drm/edid: Split deep color modes between RGB and YUV444 [5.17,0457/1126] ionic: start watchdog after all is setup [5.17,0460/1126] ionic: Correctly print AQ errors if completions arent received [5.17,0461/1126] net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave [5.17,0463/1126] Bluetooth: hci_event: Fix HCI_EV_VENDOR max_len [5.17,0464/1126] drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() [5.17,0465/1126] drm/amd/display: Call dc_stream_release for remove link enc assignment [5.17,0466/1126] drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_commo... [5.17,0468/1126] net: phy: at803x: move page selection fix to config_init [5.17,0473/1126] KVM: PPC: Fix vmx/vsx mixup in mmio emulation [5.17,0474/1126] selftests/net: timestamping: Fix bind_phc check [5.17,0476/1126] rtw88: fix idle mode flow for hw scan [5.17,0477/1126] rtw88: fix memory overrun and memory leak during hw_scan [5.17,0479/1126] i40e: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0481/1126] ice: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0485/1126] ixgbe: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0487/1126] power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe [5.17,0490/1126] KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init [5.17,0492/1126] mt76: connac: fix sta_rec_wtbl tag len [5.17,0494/1126] mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv [5.17,0495/1126] mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error [5.17,0497/1126] mt76: mt7921: do not always disable fw runtime-pm [5.17,0498/1126] mt76: mt7921: fix a leftover race in runtime-pm [5.17,0499/1126] mt76: mt7615: fix a leftover race in runtime-pm [5.17,0500/1126] mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb() [5.17,0501/1126] mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb() [5.17,0503/1126] mt76: mt7921e: fix possible probe failure after reboot [5.17,0504/1126] mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update [5.17,0505/1126] mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update [5.17,0512/1126] bpf: Fix a btf decl_tag bug when tagging a function [5.17,0516/1126] net: asix: add proper error handling of usb read errors [5.17,0519/1126] mtd: mchp48l640: Add SPI ID table [5.17,0520/1126] selftests/bpf: Extract syscall wrapper [5.17,0522/1126] igc: avoid kernel warning when changing RX ring parameters [5.17,0523/1126] igb: refactor XDP registration [5.17,0527/1126] RDMA/rxe: Check the last packet by RXE_END_MASK [5.17,0529/1126] libbpf: Fix riscv register names [5.17,0530/1126] cxl/core: Fix cxl_probe_component_regs() error message [5.17,0532/1126] cxl/regs: Fix size of CXL Capability Header Register [5.17,0533/1126] Netvsc: Call hv_unmap_memory() in the netvsc_device_remove() [5.17,0535/1126] libbpf: Fix compilation warning due to mismatched printf format [5.17,0536/1126] rtw88: fix use after free in rtw_hw_scan_update_probe_req() [5.17,0539/1126] libbpf: Fix libbpf.map inheritance chain for LIBBPF_0.7.0 [5.17,0540/1126] libbpf: Use dynamically allocated buffer when receiving netlink messages [5.17,0543/1126] iommu/ipmmu-vmsa: Check for error num after setting mask [5.17,0545/1126] ath11k: fix uninitialized rate_idx in ath11k_dp_tx_update_txcompl() [5.17,0546/1126] i2c: pasemi: Drop I2C classes from platform driver variant [5.17,0549/1126] drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug [5.17,0553/1126] cxl/core/port: Rename bus.c to port.c [5.17,0554/1126] cxl/port: Hold port reference until decoder release [5.17,0555/1126] dax: make sure inodes are flushed before destroy cache [5.17,0557/1126] iwlwifi: mvm: Dont call iwl_mvm_sta_from_mac80211() with NULL sta [5.17,0559/1126] iwlwifi: mvm: align locking in D3 test debugfs [5.17,0560/1126] iwlwifi: yoyo: remove DBGI_SRAM address reset writing [5.17,0565/1126] mtd: rawnand: pl353: Set the nand chip node as the flash node [5.17,0567/1126] drm/msm/dp: populate connector of struct dp_panel [5.17,0568/1126] drm/msm/dp: stop link training after link training 2 failed [5.17,0569/1126] drm/msm/dp: always add fail-safe mode into connector mode list [5.17,0570/1126] drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent [5.17,0571/1126] drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode [5.17,0572/1126] drm/msm/dpu: add DSPP blocks teardown [5.17,0575/1126] drm/msm/dp: fix panel bridge attachment [5.17,0578/1126] mips: Enable KCSAN [5.17,0580/1126] vfio/pci: fix memory leak during D3hot to D0 transition [5.17,0581/1126] vfio/pci: wake-up devices around reset functions [5.17,0583/1126] scsi: pm8001: Fix command initialization in pm80XX_send_read_log() [5.17,0584/1126] scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() [5.17,0588/1126] scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() [5.17,0589/1126] scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() [5.17,0593/1126] mt76: do not always copy ethhdr in reverse_frag0_hdr_trans [5.17,0594/1126] mt76: fix endianness errors in reverse_frag0_hdr_trans [5.17,0596/1126] net: dsa: realtek-smi: fix kdoc warnings [5.17,0598/1126] RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR [5.17,0599/1126] drm/amd/display: Remove vupdate_int_entry definition [5.17,0602/1126] mt76: mt7915: enlarge wcid size to 544 [5.17,0606/1126] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe [5.17,0609/1126] drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt [5.17,0610/1126] bpf, arm64: Call build_prologue() first in first JIT pass [5.17,0612/1126] xsk: Fix race at socket teardown [5.17,0614/1126] RDMA/irdma: Fix Passthrough mode in VM [5.17,0615/1126] RDMA/irdma: Remove incorrect masking of PD [5.17,0616/1126] libbpf: Fix BPF_MAP_TYPE_PERF_EVENT_ARRAY auto-pinning [5.17,0619/1126] libbpf: Skip forward declaration when counting duplicated type names [5.17,0621/1126] powerpc/Makefile: Dont pass -mcpu=powerpc64 when building 32-bit [5.17,0624/1126] KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors [5.17,0626/1126] KVM: arm64: Enable Cortex-A510 erratum 2077057 by default [5.17,0627/1126] i2c: xiic: Make bus names unique [5.17,0629/1126] Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() [5.17,0630/1126] Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device_connected() [5.17,0632/1126] power: supply: wm8350-power: Add missing free in free_charger_irq [5.17,0634/1126] RDMA/core: Fix ib_qp_usecnt_dec() called when error [5.17,0636/1126] net: axienet: fix RX ring refill allocation failure handling [5.17,0638/1126] mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n [5.17,0642/1126] mfd: mc13xxx: Add check for mc13xxx_irq_request [5.17,0643/1126] libbpf: Unmap rings when umem deleted [5.17,0645/1126] platform/x86: huawei-wmi: check the return value of device_create_file() [5.17,0646/1126] scsi: mpt3sas: Fix incorrect 4GB boundary check [5.17,0648/1126] xtensa: add missing XCHAL_HAVE_WINDOWED check [5.17,0651/1126] ath10k: Fix error handling in ath10k_setup_msa_resources [5.17,0653/1126] MIPS: RB532: fix return value of __setup handler [5.17,0654/1126] MIPS: pgalloc: fix memory leak caused by pgd_free() [5.17,0655/1126] mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init [5.17,0658/1126] Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error" [5.17,0663/1126] bpf, sockmap: Fix double uncharge the mem of sk_msg [5.17,0664/1126] samples/bpf, xdpsock: Fix race when running for fix duration of time [5.17,0665/1126] USB: storage: ums-realtek: fix error code in rts51x_read_mem() [5.17,0668/1126] RDMA/rxe: Fix ref error in rxe_av.c [5.17,0669/1126] powerpc/xive: fix return value of __setup handler [5.17,0670/1126] powerpc/time: Fix KVM host re-arming a timer beyond decrementer range [5.17,0674/1126] mt76: mt7921: fix mt7921_queues_acq implementation [5.17,0677/1126] bareudp: use ipv6_mod_enabled to check if IPv6 enabled [5.17,0678/1126] PCI: imx6: Invoke the PHY exit function after PHY power off [5.17,0680/1126] ibmvnic: fix race between xmit and reset [5.17,0682/1126] selftests/bpf: Fix error reporting from sock_fields programs [5.17,0684/1126] Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed [5.17,0685/1126] Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt [5.17,0687/1126] ipv4: Fix route lookups when handling ICMP redirects and PMTU updates [5.17,0692/1126] i2c: mux: demux-pinctrl: do not deactivate a master that is not active [5.17,0693/1126] powerpc/pseries: Fix use after free in remove_phb_dynamic() [5.17,0696/1126] drm/i915: Fix renamed struct field [5.17,0698/1126] bpftool: Fix print error when show bpf map [5.17,0699/1126] PCI: Avoid broken MSI on SB600 USB devices [5.17,0705/1126] tipc: fix the timer expires after interval 100ms [5.17,0706/1126] mfd: asic3: Add missing iounmap() on error asic3_mfd_probe [5.17,0707/1126] ice: fix scheduling while atomic on aux critical err interrupt [5.17,0710/1126] kernel/resource: fix kfree() of bootmem memory again [5.17,0711/1126] clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 [5.17,0714/1126] fsi: scom: Fix error handling [5.17,0715/1126] fsi: scom: Remove retries in indirect scoms [5.17,0717/1126] pps: clients: gpio: Propagate return value from pps_gpio_probe [5.17,0721/1126] soundwire: intel: fix wrong register name in intel_shim_wake [5.17,0724/1126] iio: mma8452: Fix probe failing when an i2c_device_id is used [5.17,0725/1126] staging: qlge: add unregister_netdev in qlge_probe [5.17,0727/1126] staging:iio:adc:ad7280a: Fix handing of device address bit reversing. [5.17,0729/1126] pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel [5.17,0730/1126] pinctrl: renesas: checker: Fix miscalculation of number of states [5.17,0733/1126] phy: phy-brcm-usb: fixup BCM4908 support [5.17,0735/1126] serial: 8250_lpss: Balance reference count for PCI DMA device [5.17,0736/1126] NFS: Use of mapping_set_error() results in spurious errors [5.17,0739/1126] habanalabs: Add check for pci_enable_device [5.17,0741/1126] staging: r8188eu: fix endless loop in recv_func [5.17,0742/1126] dma-debug: fix return value of __setup handlers [5.17,0744/1126] clk: imx: off by one in imx_lpcg_parse_clks_from_dt() [5.17,0746/1126] clk: qcom: clk-rcg2: Update logic to calculate D value for RCG [5.17,0747/1126] clk: qcom: clk-rcg2: Update the frac table for pixel clock [5.17,0748/1126] clk: starfive: jh7100: Dont round divisor up twice [5.17,0749/1126] clk: starfive: jh7100: Handle audio_div clock properly [5.17,0751/1126] remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region [5.17,0752/1126] remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region [5.17,0754/1126] nvdimm/region: Fix default alignment for small regions [5.17,0755/1126] clk: actions: Terminate clk_div_table with sentinel element [5.17,0756/1126] clk: loongson1: Terminate clk_div_table with sentinel element [5.17,0757/1126] clk: hisilicon: Terminate clk_div_table with sentinel element [5.17,0758/1126] clk: clps711x: Terminate clk_div_table with sentinel element [5.17,0761/1126] mailbox: imx: fix crash in resume on i.mx8ulp [5.17,0762/1126] NFS: remove unneeded check in decode_devicenotify_args() [5.17,0763/1126] staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree [5.17,0764/1126] staging: mt7621-dts: fix formatting [5.17,0766/1126] staging: mt7621-dts: fix GB-PC2 devicetree [5.17,0767/1126] pinctrl: ocelot: fix confops resource index [5.17,0768/1126] pinctrl: ocelot: fix duplicate debugfs entry [5.17,0769/1126] pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init [5.17,0770/1126] pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback [5.17,0773/1126] pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs [5.17,0781/1126] serial: 8250: fix XOFF/XON sending when DMA is used [5.17,0782/1126] virt: acrn: obtain pa from VMA with PFNMAP flag [5.17,0785/1126] firmware: google: Properly state IOMEM dependency [5.17,0787/1126] perf test arm64: Test unwinding using fame-pointer (fp) mode [5.17,0791/1126] SUNRPC: Dont call connect() more than once on a TCP socket [5.17,0792/1126] perf parse-events: Move slots only with topdown [5.17,0793/1126] netfilter: egress: Report interface as outgoing [5.17,0794/1126] netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options [5.17,0797/1126] kdb: Fix the putarea helper function [5.17,0798/1126] perf stat: Fix forked applications enablement of counters [5.17,0800/1126] clk: qcom: gcc-msm8994: Fix gpll4 width [5.17,0801/1126] vsock/virtio: initialize vdev->priv before using VQs [5.17,0803/1126] vsock/virtio: enable VQs early on probe [5.17,0804/1126] clk: Initialize orphan req_rate [5.17,0805/1126] xen: fix is_xen_pmu() [5.17,0807/1126] net: hns3: fix bug when PF set the duplicate MAC address for VFs [5.17,0808/1126] net: hns3: fix port base vlan add fail when concurrent with reset [5.17,0811/1126] net: phy: broadcom: Fix brcm_fet_config_init() [5.17,0813/1126] NFS: Dont loop forever in nfs_do_recoalesce() [5.17,0816/1126] net: hns3: add max order judgement for tx spare buffer [5.17,0818/1126] net: hns3: add netdev reset check for hns3_set_tunable() [5.17,0820/1126] net: hns3: fix phy can not link up when autoneg off and reset [5.17,0821/1126] net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL [5.17,0824/1126] net: sparx5: switchdev: fix possible NULL pointer dereference [5.17,0826/1126] selftests: tls: skip cmsg_to_pipe tests with TLS=n [5.17,0830/1126] fs: fd tables have to be multiples of BITS_PER_LONG [5.17,0831/1126] lib/test: use after free in register_test_dev_kmod() [5.17,0832/1126] fs: fix fd table size alignment properly [5.17,0840/1126] rcu: Mark writes to the rcu_segcblist structures ->flags field [5.17,0841/1126] block: throttle split bio in case of iops limit [5.17,0842/1126] memstick/mspro_block: fix handling of read-only devices [5.17,0844/1126] crypto: xts - Add softdep on ecb [5.17,0853/1126] irqchip/qcom-pdc: Fix broken locking [5.17,0855/1126] fs/binfmt_elf: Fix AT_PHDR for unusual ELF files [5.17,0856/1126] hwrng: cavium - fix NULL but dereferenced coccicheck error [5.17,0857/1126] bfq: fix use-after-free in bfq_dispatch_request [5.17,0858/1126] ACPICA: Avoid walking the ACPI Namespace if it is not there [5.17,0860/1126] ACPI / x86: Add skip i2c clients quirk for Lenovo Yoga Tablet 1050F/L [5.17,0864/1126] PM: core: keep irq flags in device_pm_check_callbacks() [5.17,0865/1126] parisc: Fix non-access data TLB cache flush faults [5.17,0866/1126] parisc: Fix handling off probe non-access faults [5.17,0867/1126] nvme-tcp: lockdep: annotate in-kernel sockets [5.17,0868/1126] spi: tegra20: Use of_device_get_match_data() [5.17,0870/1126] atomics: Fix atomic64_{read_acquire,set_release} fallbacks [5.17,0874/1126] sched/tracing: Dont re-read p->state when emitting sched_switch event [5.17,0876/1126] ext4: dont BUG if someone dirty pages without asking ext4 first [5.17,0877/1126] f2fs: fix to do sanity check on curseg->alloc_type [5.17,0879/1126] f2fs: dont get FREEZE lock in f2fs_evict_inode in frozen fs [5.17,0880/1126] btrfs: harden identification of a stale device [5.17,0885/1126] f2fs: use spin_lock to avoid hang [5.17,0887/1126] Adjust cifssb maximum read size [5.17,0888/1126] ntfs: add sanity check on allocation size [5.17,0892/1126] media: atmel: atmel-isc-base: report frame sizes as full supported range [5.17,0893/1126] media: ir_toy: free before error exiting [5.17,0894/1126] ASoC: sh: rz-ssi: Make the data structures available before registering the hand... [5.17,0896/1126] ASoC: SOF: Intel: match sdw version on link_slaves_found [5.17,0897/1126] media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers [5.17,0898/1126] ASoC: SOF: Intel: hda: Remove link assignment limitation [5.17,0905/1126] video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit [5.17,0906/1126] ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 [5.17,0908/1126] ASoC: madera: Add dependencies on MFD [5.17,0909/1126] media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off ... [5.17,0912/1126] ALSA: hda: Fix driver index handling at re-binding [5.17,0913/1126] ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk [5.17,0915/1126] video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() [5.17,0916/1126] video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() [5.17,0921/1126] media: imx-jpeg: fix a bug of accessing array out of bounds [5.17,0922/1126] media: cx88-mpeg: clear interrupt status register before streaming video [5.17,0923/1126] ASoC: rt5682s: Fix the wrong jack type detected [5.17,0924/1126] ARM: tegra: transformer: Drop reg-shift for Tegra HS UART [5.17,0925/1126] uaccess: fix type mismatch warnings from access_ok() [5.17,0926/1126] lib/test_lockup: fix kernel pointer check for separate address spaces [5.17,0929/1126] ASoC: amd: vg: fix for pm resume callback sequence [5.17,0930/1126] ASoC: amd: vangogh: fix uninitialized symbol warning in machine driver [5.17,0931/1126] video: fbdev: sm712fb: Fix crash in smtcfb_write() [5.17,0932/1126] media: i2c: ov5648: Fix lockdep error [5.17,0936/1126] ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13" [5.17,0937/1126] ASoC: SOF: Intel: hda: retrieve DMIC number for I2S boards [5.17,0939/1126] ALSA: intel-dsp-config: add more ACPI HIDs for ES83x6 devices [5.17,0940/1126] ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices [5.17,0945/1126] tracing: Have TRACE_DEFINE_ENUM affect trace event types as well [5.17,0946/1126] mmc: host: Return an error when ->enable_sdio_irq() ops is missing [5.17,0948/1126] media: atomisp: fix bad usage at error handling logic [5.17,0950/1126] KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255 [5.17,0951/1126] KVM: x86: Reinitialize context if host userspace toggles EFER.LME [5.17,0953/1126] KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root() [5.17,0956/1126] KVM: x86: hyper-v: Drop redundant ex parameter from kvm_hv_send_ipi() [5.17,0958/1126] KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB flush... [5.17,0959/1126] KVM: x86: hyper-v: HVCALL_SEND_IPI_EX is an XMM fast hypercall [5.17,0960/1126] powerpc/kasan: Fix early region not updated correctly [5.17,0962/1126] powerpc/lib/sstep: Fix sthcx instruction [5.17,0971/1126] scsi: qla2xxx: Implement ref count for SRB [5.17,0972/1126] scsi: qla2xxx: Fix stuck session in gpdb [5.17,0973/1126] scsi: qla2xxx: Fix warning message due to adisc being flushed [5.17,0974/1126] scsi: qla2xxx: Fix scheduling while atomic [5.17,0975/1126] scsi: qla2xxx: Fix premature hw access after PCI error [5.17,0977/1126] scsi: qla2xxx: Fix warning for missing error code [5.17,0978/1126] scsi: qla2xxx: Fix device reconnect in loop topology [5.17,0984/1126] scsi: qla2xxx: Fix disk failure to rediscover [5.17,0985/1126] scsi: qla2xxx: Fix incorrect reporting of task management failure [5.17,0989/1126] scsi: qla2xxx: Fix crash during module load unload test [5.17,0990/1126] scsi: qla2xxx: Fix N2N inconsistent PLOGI [5.17,0991/1126] scsi: qla2xxx: Fix stuck session of PRLI reject [5.17,0992/1126] scsi: qla2xxx: Reduce false trigger to login [5.17,0993/1126] scsi: qla2xxx: Use correct feature type field during RFF_ID processing [5.17,0994/1126] platform: chrome: Split trace include file [5.17,0995/1126] MIPS: crypto: Fix CRC32 code [5.17,0996/1126] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq [5.17,0997/1126] KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic... [5.17,1000/1126] KVM: Prevent module exit until all VMs are freed [5.17,1001/1126] KVM: x86: fix sending PV IPI [5.17,1006/1126] ubifs: Add missing iput if do_tmpfile() failed in rename whiteout [5.17,1007/1126] ubifs: Rename whiteout atomically [5.17,1008/1126] ubifs: Fix ui->dirty race between do_tmpfile() and writeback work [5.17,1009/1126] ubifs: Rectify space amount budget for mkdir/tmpfile operations [5.17,1012/1126] ubifs: Fix to add refcount once page is set private [5.17,1013/1126] ubifs: rename_whiteout: correct old_dir size computing [5.17,1016/1126] wireguard: queueing: use CFI-safe ptr_ring cleanup function [5.17,1018/1126] wireguard: socket: ignore v6 endpoints when ipv6 is disabled [5.17,1019/1126] XArray: Fix xas_create_range() when multi-order entry present [5.17,1022/1126] can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value [5.17,1024/1126] XArray: Update the LRU list in xas_split() [5.17,1026/1126] rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram [5.17,1027/1126] rtc: check if __rtc_read_time was successful [5.17,1028/1126] loop: fix ioctl calls using compat_loop_info [5.17,1029/1126] gfs2: gfs2_setattr_size error path fix [5.17,1030/1126] gfs2: Fix gfs2_file_buffered_write endless loop workaround [5.17,1031/1126] gfs2: Make sure FITRIM minlen is rounded up to fs block size [5.17,1034/1126] rxrpc: fix some null-ptr-deref bugs in server_key.c [5.17,1035/1126] rxrpc: Fix call timer start racing with call destruction [5.17,1038/1126] crypto: arm/aes-neonbs-cbc - Select generic cbc and aes [5.17,1041/1126] watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function [5.17,1042/1126] net: sparx5: uses, depends on BRIDGE or !BRIDGE [5.17,1045/1126] ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B [5.17,1047/1126] ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl [5.17,1049/1126] block: Fix the maximum minor value is blk_alloc_ext_minor() [5.17,1051/1126] Revert "virtio-pci: harden INTX interrupts" [5.17,1052/1126] Revert "virtio_pci: harden MSI-X interrupts" [5.17,1056/1126] io_uring: fix memory leak of uid in files registration [5.17,1058/1126] ACPI: CPPC: Avoid out of bounds access when parsing _CPC data [5.17,1060/1126] spi: Fix Tegra QSPI example [5.17,1061/1126] platform/chrome: cros_ec_typec: Check for EC device [5.17,1063/1126] can: isotp: restore accidentally removed MSG_PEEK feature [5.17,1064/1126] proc: bootconfig: Add null pointer check [5.17,1065/1126] x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation [5.17,1068/1126] scsi: qla2xxx: Add qla2x00_async_done() for async routines [5.17,1070/1126] docs: fix make htmldocs warning in SCTP.rst [5.17,1073/1126] KVM: x86: SVM: fix avic spec based definitions again [5.17,1074/1126] ax25: fix UAF bug in ax25_send_control() [5.17,1078/1126] net: add skb_set_end_offset() helper [5.17,1081/1126] mm/memcontrol: return 1 from cgroup.memory __setup() handler [5.17,1084/1126] libbpf: Define BTF_KIND_* constants in btf.h to avoid compilation errors [5.17,1085/1126] bpf: Adjust BPF stack helper functions to accommodate skip > 0 [5.17,1087/1126] nbd: fix possible overflow on first_minor in nbd_dev_add() [5.17,1092/1126] media: dt-binding: media: hynix,hi846: use $defs/port-base port description [5.17,1095/1126] dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167 [5.17,1097/1126] dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks [5.17,1098/1126] dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example [5.17,1099/1126] ubi: fastmap: Return error code if memory allocation fails in add_aeb() [5.17,1101/1126] ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV [5.17,1103/1126] perf vendor events: Update metrics for SkyLake Server [5.17,1104/1126] media: ov6650: Add try support to selection API operations [5.17,1105/1126] media: ov6650: Fix crop rectangle affected by set format [5.17,1106/1126] pinctrl: canonical rsel resistance selection property [5.17,1108/1126] ARM: dts: spear1340: Update serial node properties [5.17,1109/1126] ARM: dts: spear13xx: Update SPI dma properties [5.17,1113/1126] docs: sysctl/kernel: add missing bit to panic_print [5.17,1114/1126] xsk: Do not write NULL in SW ring at allocation failure [5.17,1118/1126] torture: Make torture.sh help message match reality [5.17,1119/1126] n64cart: convert bi_disk to bi_bdev->bd_disk fix build [5.17,1121/1126] mmc: rtsx: Let MMC core handle runtime PM [5.17,1123/1126] coredump: Snapshot the vmas in do_coredump [5.17,1124/1126] coredump: Remove the WARN_ON in dump_vma_snapshot

Message ID

20220405070427.234421231@linuxfoundation.org

State

New

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        stable@vger.kernel.org, Bob Pearson <rpearsonhpe@gmail.com>,
        Jason Gunthorpe <jgg@nvidia.com>,
        Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.17 0668/1126] RDMA/rxe: Fix ref error in rxe_av.c
Date: Tue,  5 Apr 2022 09:23:35 +0200
Message-Id: <20220405070427.234421231@linuxfoundation.org>
In-Reply-To: <20220405070407.513532867@linuxfoundation.org>
References: <20220405070407.513532867@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman April 5, 2022, 7:23 a.m. UTC

From: Bob Pearson <rpearsonhpe@gmail.com>

[ Upstream commit 63221acb0c63141cc7650f8eefb148337061e6db ]

The commit referenced below can take a reference to the AH which is never
dropped. This only happens in the UD request path. This patch optionally
passes that AH back to the caller so that it can hold the reference while
the AV is being accessed and then drop it. Code to do this is added to
rxe_req.c. The AV is also passed to rxe_prepare in rxe_net.c as an
optimization.

Fixes: e2fe06c90806 ("RDMA/rxe: Lookup kernel AH from ah index in UD WQEs")
Link: https://lore.kernel.org/r/20220304000808.225811-2-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_av.c   | 19 +++++++++-
 drivers/infiniband/sw/rxe/rxe_loc.h  |  5 ++-
 drivers/infiniband/sw/rxe/rxe_net.c  | 17 +++++----
 drivers/infiniband/sw/rxe/rxe_req.c  | 55 +++++++++++++++++-----------
 drivers/infiniband/sw/rxe/rxe_resp.c |  2 +-
 5 files changed, 63 insertions(+), 35 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_av.c b/drivers/infiniband/sw/rxe/rxe_av.c
index 38c7b6fb39d7..360a567159fe 100644
--- a/drivers/infiniband/sw/rxe/rxe_av.c
+++ b/drivers/infiniband/sw/rxe/rxe_av.c
@@ -99,11 +99,14 @@  void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr)
 	av->network_type = type;
 }
 
-struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt)
+struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp)
 {
 	struct rxe_ah *ah;
 	u32 ah_num;
 
+	if (ahp)
+		*ahp = NULL;
+
 	if (!pkt || !pkt->qp)
 		return NULL;
 
@@ -117,10 +120,22 @@  struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt)
 	if (ah_num) {
 		/* only new user provider or kernel client */
 		ah = rxe_pool_get_index(&pkt->rxe->ah_pool, ah_num);
-		if (!ah || ah->ah_num != ah_num || rxe_ah_pd(ah) != pkt->qp->pd) {
+		if (!ah) {
 			pr_warn("Unable to find AH matching ah_num\n");
 			return NULL;
 		}
+
+		if (rxe_ah_pd(ah) != pkt->qp->pd) {
+			pr_warn("PDs don't match for AH and QP\n");
+			rxe_drop_ref(ah);
+			return NULL;
+		}
+
+		if (ahp)
+			*ahp = ah;
+		else
+			rxe_drop_ref(ah);
+
 		return &ah->av;
 	}
 
diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
index b1e174afb1d4..b92bb7a15290 100644
--- a/drivers/infiniband/sw/rxe/rxe_loc.h
+++ b/drivers/infiniband/sw/rxe/rxe_loc.h
@@ -19,7 +19,7 @@  void rxe_av_to_attr(struct rxe_av *av, struct rdma_ah_attr *attr);
 
 void rxe_av_fill_ip_info(struct rxe_av *av, struct rdma_ah_attr *attr);
 
-struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt);
+struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp);
 
 /* rxe_cq.c */
 int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
@@ -102,7 +102,8 @@  void rxe_mw_cleanup(struct rxe_pool_elem *arg);
 /* rxe_net.c */
 struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
 				int paylen, struct rxe_pkt_info *pkt);
-int rxe_prepare(struct rxe_pkt_info *pkt, struct sk_buff *skb);
+int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
+		struct sk_buff *skb);
 int rxe_xmit_packet(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
 		    struct sk_buff *skb);
 const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num);
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index be72bdbfb4ba..580cfd742dd2 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -289,13 +289,13 @@  static void prepare_ipv6_hdr(struct dst_entry *dst, struct sk_buff *skb,
 	ip6h->payload_len = htons(skb->len - sizeof(*ip6h));
 }
 
-static int prepare4(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+static int prepare4(struct rxe_av *av, struct rxe_pkt_info *pkt,
+		    struct sk_buff *skb)
 {
 	struct rxe_qp *qp = pkt->qp;
 	struct dst_entry *dst;
 	bool xnet = false;
 	__be16 df = htons(IP_DF);
-	struct rxe_av *av = rxe_get_av(pkt);
 	struct in_addr *saddr = &av->sgid_addr._sockaddr_in.sin_addr;
 	struct in_addr *daddr = &av->dgid_addr._sockaddr_in.sin_addr;
 
@@ -315,11 +315,11 @@  static int prepare4(struct rxe_pkt_info *pkt, struct sk_buff *skb)
 	return 0;
 }
 
-static int prepare6(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+static int prepare6(struct rxe_av *av, struct rxe_pkt_info *pkt,
+		    struct sk_buff *skb)
 {
 	struct rxe_qp *qp = pkt->qp;
 	struct dst_entry *dst;
-	struct rxe_av *av = rxe_get_av(pkt);
 	struct in6_addr *saddr = &av->sgid_addr._sockaddr_in6.sin6_addr;
 	struct in6_addr *daddr = &av->dgid_addr._sockaddr_in6.sin6_addr;
 
@@ -340,16 +340,17 @@  static int prepare6(struct rxe_pkt_info *pkt, struct sk_buff *skb)
 	return 0;
 }
 
-int rxe_prepare(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
+		struct sk_buff *skb)
 {
 	int err = 0;
 
 	if (skb->protocol == htons(ETH_P_IP))
-		err = prepare4(pkt, skb);
+		err = prepare4(av, pkt, skb);
 	else if (skb->protocol == htons(ETH_P_IPV6))
-		err = prepare6(pkt, skb);
+		err = prepare6(av, pkt, skb);
 
-	if (ether_addr_equal(skb->dev->dev_addr, rxe_get_av(pkt)->dmac))
+	if (ether_addr_equal(skb->dev->dev_addr, av->dmac))
 		pkt->mask |= RXE_LOOPBACK_MASK;
 
 	return err;
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index b28036a7a3b8..204e31bbd61f 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -358,6 +358,7 @@  static inline int get_mtu(struct rxe_qp *qp)
 }
 
 static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+				       struct rxe_av *av,
 				       struct rxe_send_wqe *wqe,
 				       int opcode, u32 payload,
 				       struct rxe_pkt_info *pkt)
@@ -365,7 +366,6 @@  static struct sk_buff *init_req_packet(struct rxe_qp *qp,
 	struct rxe_dev		*rxe = to_rdev(qp->ibqp.device);
 	struct sk_buff		*skb;
 	struct rxe_send_wr	*ibwr = &wqe->wr;
-	struct rxe_av		*av;
 	int			pad = (-payload) & 0x3;
 	int			paylen;
 	int			solicited;
@@ -374,21 +374,9 @@  static struct sk_buff *init_req_packet(struct rxe_qp *qp,
 
 	/* length from start of bth to end of icrc */
 	paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE;
-
-	/* pkt->hdr, port_num and mask are initialized in ifc layer */
-	pkt->rxe	= rxe;
-	pkt->opcode	= opcode;
-	pkt->qp		= qp;
-	pkt->psn	= qp->req.psn;
-	pkt->mask	= rxe_opcode[opcode].mask;
-	pkt->paylen	= paylen;
-	pkt->wqe	= wqe;
+	pkt->paylen = paylen;
 
 	/* init skb */
-	av = rxe_get_av(pkt);
-	if (!av)
-		return NULL;
-
 	skb = rxe_init_packet(rxe, av, paylen, pkt);
 	if (unlikely(!skb))
 		return NULL;
@@ -447,13 +435,13 @@  static struct sk_buff *init_req_packet(struct rxe_qp *qp,
 	return skb;
 }
 
-static int finish_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
-		       struct rxe_pkt_info *pkt, struct sk_buff *skb,
-		       u32 paylen)
+static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,
+			 struct rxe_send_wqe *wqe, struct rxe_pkt_info *pkt,
+			 struct sk_buff *skb, u32 paylen)
 {
 	int err;
 
-	err = rxe_prepare(pkt, skb);
+	err = rxe_prepare(av, pkt, skb);
 	if (err)
 		return err;
 
@@ -608,6 +596,7 @@  static int rxe_do_local_ops(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
 int rxe_requester(void *arg)
 {
 	struct rxe_qp *qp = (struct rxe_qp *)arg;
+	struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
 	struct rxe_pkt_info pkt;
 	struct sk_buff *skb;
 	struct rxe_send_wqe *wqe;
@@ -619,6 +608,8 @@  int rxe_requester(void *arg)
 	struct rxe_send_wqe rollback_wqe;
 	u32 rollback_psn;
 	struct rxe_queue *q = qp->sq.queue;
+	struct rxe_ah *ah;
+	struct rxe_av *av;
 
 	rxe_add_ref(qp);
 
@@ -705,14 +696,28 @@  int rxe_requester(void *arg)
 		payload = mtu;
 	}
 
-	skb = init_req_packet(qp, wqe, opcode, payload, &pkt);
+	pkt.rxe = rxe;
+	pkt.opcode = opcode;
+	pkt.qp = qp;
+	pkt.psn = qp->req.psn;
+	pkt.mask = rxe_opcode[opcode].mask;
+	pkt.wqe = wqe;
+
+	av = rxe_get_av(&pkt, &ah);
+	if (unlikely(!av)) {
+		pr_err("qp#%d Failed no address vector\n", qp_num(qp));
+		wqe->status = IB_WC_LOC_QP_OP_ERR;
+		goto err_drop_ah;
+	}
+
+	skb = init_req_packet(qp, av, wqe, opcode, payload, &pkt);
 	if (unlikely(!skb)) {
 		pr_err("qp#%d Failed allocating skb\n", qp_num(qp));
 		wqe->status = IB_WC_LOC_QP_OP_ERR;
-		goto err;
+		goto err_drop_ah;
 	}
 
-	ret = finish_packet(qp, wqe, &pkt, skb, payload);
+	ret = finish_packet(qp, av, wqe, &pkt, skb, payload);
 	if (unlikely(ret)) {
 		pr_debug("qp#%d Error during finish packet\n", qp_num(qp));
 		if (ret == -EFAULT)
@@ -720,9 +725,12 @@  int rxe_requester(void *arg)
 		else
 			wqe->status = IB_WC_LOC_QP_OP_ERR;
 		kfree_skb(skb);
-		goto err;
+		goto err_drop_ah;
 	}
 
+	if (ah)
+		rxe_drop_ref(ah);
+
 	/*
 	 * To prevent a race on wqe access between requester and completer,
 	 * wqe members state and psn need to be set before calling
@@ -751,6 +759,9 @@  int rxe_requester(void *arg)
 
 	goto next_wqe;
 
+err_drop_ah:
+	if (ah)
+		rxe_drop_ref(ah);
 err:
 	wqe->state = wqe_state_error;
 	__rxe_do_task(&qp->comp.task);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 380934e38923..192cb9a096a1 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -632,7 +632,7 @@  static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp,
 	if (ack->mask & RXE_ATMACK_MASK)
 		atmack_set_orig(ack, qp->resp.atomic_orig);
 
-	err = rxe_prepare(ack, skb);
+	err = rxe_prepare(&qp->pri_av, ack, skb);
 	if (err) {
 		kfree_skb(skb);
 		return NULL;

[5.17,0668/1126] RDMA/rxe: Fix ref error in rxe_av.c

Commit Message

Patch