diff mbox series

[5.17,1074/1126] ax25: fix UAF bug in ax25_send_control()

Message ID	20220405070438.980584552@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Duoming Zhou <duoming@zju.edu.cn>, Paolo Abeni <pabeni@redhat.com> Subject: [PATCH 5.17 1074/1126] ax25: fix UAF bug in ax25_send_control() Date: Tue, 5 Apr 2022 09:30:21 +0200 Message-Id: <20220405070438.980584552@linuxfoundation.org> In-Reply-To: <20220405070407.513532867@linuxfoundation.org> References: <20220405070407.513532867@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,0002/1126] USB: serial: pl2303: add IBM device IDs [5.17,0005/1126] USB: serial: simple: add Nokia phone driver [5.17,0008/1126] drm/amdgpu: move PX checking into amdgpu_device_ip_early_init [5.17,0009/1126] drm/amdgpu: only check for _PR3 on dGPUs [5.17,0010/1126] iommu/iova: Improve 32-bit free space estimate [5.17,0012/1126] block: ensure plug merging checks the correct queue at least once [5.17,0013/1126] usb: typec: tipd: Forward plug orientation to typec subsystem [5.17,0015/1126] xhci: fix garbage USBSTS being logged in some cases [5.17,0016/1126] xhci: fix runtime PM imbalance in USB2 resume [5.17,0018/1126] xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() [5.17,0020/1126] mei: me: add Alder Lake N device id. [5.17,0023/1126] bus: mhi: Fix pm_state conversion to string [5.17,0024/1126] bus: mhi: Fix MHI DMA structure endianness [5.17,0026/1126] coresight: Fix TRCCONFIGR.QE sysfs interface [5.17,0028/1126] dt-bindings: iio: adc: zynqmp_ams: Add clock entry [5.17,0029/1126] iio: adc: xilinx-ams: Fix single channel switching sequence [5.17,0030/1126] iio: accel: mma8452: use the correct logic to get mma8452_data [5.17,0033/1126] iio: afe: rescale: use s64 for temporary scale calculations [5.17,0034/1126] iio: adc: xilinx-ams: Fixed missing PS channels [5.17,0037/1126] iio: inkern: apply consumer scale when no channel scale is available [5.17,0040/1126] clk: rockchip: re-add rational best approximation algorithm to the fractional di... [5.17,0042/1126] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE [5.17,0045/1126] cifs: we do not need a spinlock around the tree access during umount [5.17,0046/1126] KEYS: fix length validation in keyctl_pkey_params_get_2() [5.17,0048/1126] KEYS: asymmetric: properly validate hash_algo and encoding [5.17,0051/1126] firmware: stratix10-svc: add missing callback parameter on RSU [5.17,0053/1126] HID: intel-ish-hid: Use dma_alloc_coherent for firmware update [5.17,0055/1126] SUNRPC: Do not dereference non-socket transports in sysfs [5.17,0058/1126] NFSD: prevent integer overflow on 32 bit systems [5.17,0059/1126] f2fs: fix to unlock page correctly in error path of is_alive() [5.17,0060/1126] f2fs: quota: fix loop condition at f2fs_quota_sync() [5.17,0062/1126] remoteproc: Fix count check in rproc_coredump_write() [5.17,0064/1126] pinctrl: ingenic: Fix regmap on X series SoCs [5.17,0065/1126] pinctrl: samsung: drop pin banks references on error paths [5.17,0066/1126] net: bnxt_ptp: fix compilation error [5.17,0067/1126] spi: mxic: Fix the transmit path [5.17,0070/1126] can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path [5.17,0075/1126] jffs2: fix memory leak in jffs2_scan_medium [5.17,0077/1126] mm: dont skip swap entry even if zap_details specified [5.17,0080/1126] mempolicy: mbind_range() set_policy() after vma_merge() [5.17,0081/1126] scsi: core: sd: Add silence_suspend flag to suppress some PM messages [5.17,0082/1126] scsi: ufs: Fix runtime PM messages never-ending cycle [5.17,0083/1126] scsi: scsi_transport_fc: Fix FPIN Link Integrity statistics counters [5.17,0085/1126] qed: display VF trust config [5.17,0086/1126] qed: validate and restrict untrusted VFs vlan promisc mode [5.17,0087/1126] riscv: dts: canaan: Fix SPI3 bus width [5.17,0090/1126] RISC-V: Declare per cpu boot data as static [5.17,0093/1126] cifs: fix incorrect use of list iterator after the loop [5.17,0097/1126] ALSA: hda: Avoid unsol event during RPM suspending [5.17,0100/1126] rtc: mc146818-lib: fix locking in mc146818_set_time [5.17,0103/1126] ocfs2: fix crash when mount with quota enabled [5.17,0104/1126] drm/simpledrm: Add "panel orientation" property on non-upright mounted LCD panels [5.17,0107/1126] Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" [5.17,0110/1126] mm/kmemleak: reset tag when compare object pointer [5.17,0113/1126] dm: interlock pending dm_io and dm_wait_for_bios_completion [5.17,0116/1126] tracing: Have trace event string test handle zero length strings [5.17,0118/1126] can: isotp: sanitize CAN ID checks in isotp_bind() [5.17,0121/1126] arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones [5.17,0122/1126] arm64: dts: qcom: sm8250: Fix MSI IRQ for PCIe1 and PCIe2 [5.17,0124/1126] arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs [5.17,0125/1126] arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs [5.17,0128/1126] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM [5.17,0129/1126] mmc: core: use sysfs_emit() instead of sprintf() [5.17,0132/1126] coredump: Also dump first pages of non-executable ELF libraries [5.17,0133/1126] ext4: fix ext4_fc_stats trace point [5.17,0134/1126] ext4: fix fs corruption when tring to remove a non-empty directory with IO error [5.17,0136/1126] ext4: make mb_optimize_scan performance mount option work with extents [5.17,0137/1126] samples/landlock: Fix path_list memory leak [5.17,0138/1126] landlock: Use square brackets around "landlock-ruleset" [5.17,0140/1126] btrfs: zoned: put block group after final usage [5.17,0142/1126] block: limit request dispatch loop duration [5.17,0145/1126] fbdev: Hot-unplug firmware fb devices on forced removal [5.17,0147/1126] video: fbdev: atari: Atari 2 bpp (STe) palette bugfix [5.17,0148/1126] rfkill: make new event layout opt-in [5.17,0152/1126] ARM: dts: exynos: add missing HDMI supplies on SMDK5250 [5.17,0155/1126] carl9170: fix missing bit-wise or operator for tx_params [5.17,0156/1126] pstore: Dont use semaphores in always-atomic-context code [5.17,0159/1126] exec: Force single empty string when argv is empty [5.17,0160/1126] crypto: rsa-pkcs1pad - only allow with rsa [5.17,0161/1126] crypto: rsa-pkcs1pad - correctly get hash from source scatterlist [5.17,0164/1126] bcache: fixup multiple threads crash [5.17,0165/1126] PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() [5.17,0166/1126] DEC: Limit PMAX memory probing to R3k systems [5.17,0167/1126] media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC [5.17,0168/1126] media: omap3isp: Use struct_group() for memcpy() region [5.17,0171/1126] media: venus: venc: Fix h264 8x8 transform control [5.17,0173/1126] media: davinci: vpif: fix unbalanced runtime PM enable [5.17,0174/1126] media: davinci: vpif: fix use-after-free on driver unbind [5.17,0177/1126] btrfs: extend locking to all space_info members accesses [5.17,0179/1126] xtensa: define update_mmu_tlb function [5.17,0180/1126] xtensa: fix stop_machine_cpuslocked call in patch_text [5.17,0183/1126] drm/syncobj: flatten dma_fence_chains on transfer [5.17,0184/1126] drm/nouveau/backlight: Fix LVDS backlight detection on some laptops [5.17,0186/1126] drm/fb-helper: Mark screen buffers in system memory with FBINFO_VIRTFB [5.17,0191/1126] brcmfmac: pcie: Fix crashes due to early IRQs [5.17,0192/1126] drm/i915/opregion: check port number bounds for SWSCI display power state [5.17,0195/1126] PCI: pciehp: Clear cmd_busy bit in polling mode [5.17,0196/1126] PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" [5.17,0198/1126] regulator: qcom_smd: fix for_each_child.cocci warnings [5.17,0199/1126] selinux: access superblock_security_struct in LSM blob way [5.17,0202/1126] crypto: qat - fix a signedness bug in get_service_enabled() [5.17,0206/1126] crypto: qat - fix access to PFVF interrupt registers for GEN4 [5.17,0208/1126] crypto: octeontx2 - select CONFIG_NET_DEVLINK [5.17,0209/1126] crypto: mxs-dcp - Fix scatterlist processing [5.17,0211/1126] thermal: int340x: Check for NULL after calling kmemdup() [5.17,0212/1126] crypto: octeontx2 - remove CONFIG_DM_CRYPT check [5.17,0214/1126] spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe [5.17,0217/1126] selftests/sgx: Do not attempt enclave build without valid enclave [5.17,0218/1126] selftests/sgx: Ensure enclave data available during debug print [5.17,0220/1126] arm64/mm: avoid fixmap race condition when create pud mapping [5.17,0221/1126] security: add sctp_assoc_established hook [5.17,0223/1126] blk-cgroup: set blkg iostat after percpu stat aggregation [5.17,0224/1126] selftests/x86: Add validity check and allow field splitting [5.17,0227/1126] block: update io_ticks when io hang [5.17,0228/1126] audit: log AUDIT_TIME_* records only from rules [5.17,0229/1126] EVM: fix the evm= __setup handler return value [5.17,0231/1126] crypto: hisilicon/sec - fix the aead software fallback for engine [5.17,0232/1126] spi: pxa2xx-pci: Balance reference count for PCI DMA device [5.17,0237/1126] block: dont delete queue kobject before its children [5.17,0239/1126] PM: suspend: fix return value of __setup handler [5.17,0240/1126] spi: spi-zynqmp-gqspi: Handle error for dma_set_mask [5.17,0242/1126] crypto: sun8i-ss - call finalize with bh disabled [5.17,0244/1126] crypto: amlogic - call finalize with bh disabled [5.17,0246/1126] crypto: vmx - add missing dependencies [5.17,0247/1126] clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix [5.17,0250/1126] clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_in... [5.17,0252/1126] perf/arm-cmn: Hide XP PUB events for CMN-600 [5.17,0254/1126] KEYS: trusted: Fix trusted key backends when building as module [5.17,0255/1126] KEYS: trusted: Avoid calling null function trusted_key_exit [5.17,0257/1126] crypto: ccp - ccp_dmaengine_unregister release dma channels [5.17,0259/1126] crypto: qat - fix initialization of pfvf cap_msg structures [5.17,0261/1126] hwrng: nomadik - Change clk_disable to clk_disable_unprepare [5.17,0265/1126] io_uring: terminate manual loop iterator loop correctly for non-vecs [5.17,0267/1126] watch_queue: Actually free the watch [5.17,0270/1126] sched/core: Export pelt_thermal_tp [5.17,0274/1126] perf/core: Fix address filter parser for multiple filters [5.17,0276/1126] sched/fair: Improve consistency of allowed NUMA balance calculations [5.17,0277/1126] f2fs: fix missing free nid in f2fs_handle_failed_inode [5.17,0278/1126] ext4: fix remount with abort option [5.17,0282/1126] f2fs: fix to avoid potential deadlock [5.17,0285/1126] fs: erofs: add sanity check for kobject in erofs_unregister_sysfs [5.17,0288/1126] selftests, x86: fix how check_cc.sh is being invoked [5.17,0289/1126] drivers/base/memory: add memory block to memory group after registration succeeded [5.17,0290/1126] kunit: make kunit_test_timeout compatible with comment [5.17,0293/1126] media: camss: csid-170: fix non-10bit formats [5.17,0295/1126] media: camss: csid-170: set the right HALT_CMD when disabled [5.17,0300/1126] media: imx: imx8mq-mipi-csi2: remove wrong irq config write operation [5.17,0301/1126] media: imx: imx8mq-mipi_csi2: fix system resume [5.17,0302/1126] media: bttv: fix WARNING regression on tunerless devices [5.17,0304/1126] ASoC: sh: rz-ssi: Drop calling rz_ssi_pio_recv() recursively [5.17,0306/1126] ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting [5.17,0309/1126] media: coda: Fix missing put_device() call in coda_get_vdoa_data [5.17,0312/1126] media: ov6650: Fix set format try processing path [5.17,0315/1126] media: ov2740: identify module after subdev initialisation [5.17,0318/1126] video: fbdev: controlfb: Fix COMPILE_TEST build [5.17,0319/1126] video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() [5.17,0321/1126] video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() [5.17,0322/1126] ARM: dts: Fix OpenBMC flash layout label addresses [5.17,0323/1126] ASoC: max98927: add missing header file [5.17,0324/1126] arm64: dts: qcom: sc7280: Fix gmu unit address [5.17,0325/1126] firmware: qcom: scm: Remove reassignment to desc following initializer [5.17,0327/1126] soc: qcom: rpmpd: Check for null return of devm_kcalloc [5.17,0328/1126] soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem [5.17,0329/1126] soc: qcom: aoss: Fix missing put_device call in qmp_get [5.17,0332/1126] arm64: dts: qcom: sm8250: fix PCIe bindings to follow schema [5.17,0333/1126] arm64: dts: qcom: msm8916-j5: Fix typo [5.17,0334/1126] arm64: dts: broadcom: bcm4908: use proper TWD binding [5.17,0335/1126] arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc [5.17,0337/1126] arm64: dts: qcom: sm8450: Update cpuidle states parameters [5.17,0339/1126] arm64: dts: qcom: ipq6018: fix usb reference period [5.17,0341/1126] soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe [5.17,0343/1126] ARM: dts: sun8i: v3s: Move the csi1 block to follow address order [5.17,0344/1126] ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 [5.17,0345/1126] ARM: ftrace: ensure that ADR takes the Thumb bit into account [5.17,0346/1126] vsprintf: Fix potential unaligned access [5.17,0347/1126] ARM: dts: qcom: sdx55: Fix the address used for PCIe EP local addr space [5.17,0348/1126] ARM: dts: imx: Add missing LVDS decoder on M53Menlo [5.17,0352/1126] media: em28xx: initialize refcount before kref_get [5.17,0356/1126] media: cedrus: h264: Fix neighbour info buffer size [5.17,0358/1126] ASoC: codecs: rx-macro: fix accessing compander for aux [5.17,0359/1126] ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type [5.17,0360/1126] ASoC: codecs: va-macro: fix accessing array out of bounds for enum type [5.17,0364/1126] ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put [5.17,0365/1126] media: v4l2-core: Initialize h264 scaling matrix [5.17,0366/1126] media: hantro: sunxi: Fix VP9 steps [5.17,0368/1126] selftests: vm: remove dependecy from internal kernel macros [5.17,0370/1126] vsprintf: Fix %pK with kptr_restrict == 0 [5.17,0373/1126] ASoC: acp: check the return value of devm_kzalloc() in acp_legacy_dai_links_crea... [5.17,0374/1126] soc: mediatek: pm-domains: Add wakeup capacity support in power domain [5.17,0375/1126] mmc: sdhci_am654: Fix the driver data of AM64 SoC [5.17,0376/1126] ASoC: ti: davinci-i2s: Add check for clk_enable() [5.17,0378/1126] arm64: dts: ns2: Fix spi-cpol and spi-cpha property [5.17,0385/1126] media: i2c: Fix pixel array positions in ov8865 [5.17,0386/1126] memory: emif: Add check for setup_interrupts [5.17,0387/1126] memory: emif: check the pointer temp in get_device_details() [5.17,0389/1126] arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly [5.17,0396/1126] ASoC: wm8350: Handle error for wm8350_register_irq [5.17,0397/1126] ASoC: fsi: Add check for clk_enable [5.17,0398/1126] video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of [5.17,0400/1126] ivtv: fix incorrect device_caps for ivtvfb [5.17,0402/1126] ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe [5.17,0404/1126] ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe [5.17,0405/1126] ASoC: rk817: Fix missing clk_disable_unprepare() in rk817_platform_probe [5.17,0406/1126] ASoC: dmaengine: do not use a NULL prepare_slave_config() callback [5.17,0408/1126] ASoC: fsl_spdif: Disable TX clock when stop [5.17,0410/1126] ASoC: SOF: Intel: enable DMI L1 for playback streams [5.17,0411/1126] ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_di... [5.17,0413/1126] rtla/osnoise: Fix osnoise hist stop tracing message [5.17,0416/1126] ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe [5.17,0417/1126] ASoC: mediatek: mt8195: Fix error handling in mt8195_mt6359_rt1019_rt5682_dev_probe [5.17,0420/1126] ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS [5.17,0422/1126] drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe() [5.17,0423/1126] drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops [5.17,0425/1126] drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev [5.17,0431/1126] drm/v3d/v3d_drv: Check for error num after setting mask [5.17,0434/1126] drm/panfrost: Check for error num after setting mask [5.17,0436/1126] libbpf: Fix possible NULL pointer dereference when destroying skeleton [5.17,0437/1126] bpftool: Only set obj->skeleton on complete success [5.17,0439/1126] udmabuf: validate ubuf->pagecount [5.17,0441/1126] drm/selftests/test-drm_dp_mst_helper: Fix memory leak in sideband_msg_req_encode... [5.17,0442/1126] drm/locking: fix drm_modeset_acquire_ctx kernel-doc [5.17,0444/1126] Bluetooth: btintel: Fix WBS setting for Intel legacy ROM products [5.17,0446/1126] Bluetooth: mt7921s: fix firmware coredump retrieve [5.17,0453/1126] selftests, xsk: Fix rx_full stats test [5.17,0454/1126] drm/edid: Dont clear formats if using deep color [5.17,0455/1126] drm/edid: Split deep color modes between RGB and YUV444 [5.17,0457/1126] ionic: start watchdog after all is setup [5.17,0460/1126] ionic: Correctly print AQ errors if completions arent received [5.17,0461/1126] net: dsa: Move VLAN filtering syncing out of dsa_switch_bridge_leave [5.17,0463/1126] Bluetooth: hci_event: Fix HCI_EV_VENDOR max_len [5.17,0464/1126] drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() [5.17,0465/1126] drm/amd/display: Call dc_stream_release for remove link enc assignment [5.17,0466/1126] drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_commo... [5.17,0468/1126] net: phy: at803x: move page selection fix to config_init [5.17,0473/1126] KVM: PPC: Fix vmx/vsx mixup in mmio emulation [5.17,0474/1126] selftests/net: timestamping: Fix bind_phc check [5.17,0476/1126] rtw88: fix idle mode flow for hw scan [5.17,0477/1126] rtw88: fix memory overrun and memory leak during hw_scan [5.17,0479/1126] i40e: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0481/1126] ice: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0485/1126] ixgbe: dont reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb [5.17,0487/1126] power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe [5.17,0490/1126] KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init [5.17,0492/1126] mt76: connac: fix sta_rec_wtbl tag len [5.17,0494/1126] mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv [5.17,0495/1126] mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error [5.17,0497/1126] mt76: mt7921: do not always disable fw runtime-pm [5.17,0498/1126] mt76: mt7921: fix a leftover race in runtime-pm [5.17,0499/1126] mt76: mt7615: fix a leftover race in runtime-pm [5.17,0500/1126] mt76: mt7915: fix ht mcs in mt7915_mac_add_txs_skb() [5.17,0501/1126] mt76: mt7921: fix ht mcs in mt7921_mac_add_txs_skb() [5.17,0503/1126] mt76: mt7921e: fix possible probe failure after reboot [5.17,0504/1126] mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update [5.17,0505/1126] mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update [5.17,0512/1126] bpf: Fix a btf decl_tag bug when tagging a function [5.17,0516/1126] net: asix: add proper error handling of usb read errors [5.17,0519/1126] mtd: mchp48l640: Add SPI ID table [5.17,0520/1126] selftests/bpf: Extract syscall wrapper [5.17,0522/1126] igc: avoid kernel warning when changing RX ring parameters [5.17,0523/1126] igb: refactor XDP registration [5.17,0527/1126] RDMA/rxe: Check the last packet by RXE_END_MASK [5.17,0529/1126] libbpf: Fix riscv register names [5.17,0530/1126] cxl/core: Fix cxl_probe_component_regs() error message [5.17,0532/1126] cxl/regs: Fix size of CXL Capability Header Register [5.17,0533/1126] Netvsc: Call hv_unmap_memory() in the netvsc_device_remove() [5.17,0535/1126] libbpf: Fix compilation warning due to mismatched printf format [5.17,0536/1126] rtw88: fix use after free in rtw_hw_scan_update_probe_req() [5.17,0539/1126] libbpf: Fix libbpf.map inheritance chain for LIBBPF_0.7.0 [5.17,0540/1126] libbpf: Use dynamically allocated buffer when receiving netlink messages [5.17,0543/1126] iommu/ipmmu-vmsa: Check for error num after setting mask [5.17,0545/1126] ath11k: fix uninitialized rate_idx in ath11k_dp_tx_update_txcompl() [5.17,0546/1126] i2c: pasemi: Drop I2C classes from platform driver variant [5.17,0549/1126] drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug [5.17,0553/1126] cxl/core/port: Rename bus.c to port.c [5.17,0554/1126] cxl/port: Hold port reference until decoder release [5.17,0555/1126] dax: make sure inodes are flushed before destroy cache [5.17,0557/1126] iwlwifi: mvm: Dont call iwl_mvm_sta_from_mac80211() with NULL sta [5.17,0559/1126] iwlwifi: mvm: align locking in D3 test debugfs [5.17,0560/1126] iwlwifi: yoyo: remove DBGI_SRAM address reset writing [5.17,0565/1126] mtd: rawnand: pl353: Set the nand chip node as the flash node [5.17,0567/1126] drm/msm/dp: populate connector of struct dp_panel [5.17,0568/1126] drm/msm/dp: stop link training after link training 2 failed [5.17,0569/1126] drm/msm/dp: always add fail-safe mode into connector mode list [5.17,0570/1126] drm/msm/dsi: Use "ref" fw clock instead of global name for VCO parent [5.17,0571/1126] drm/msm/dsi/phy: fix 7nm v4.0 settings for C-PHY mode [5.17,0572/1126] drm/msm/dpu: add DSPP blocks teardown [5.17,0575/1126] drm/msm/dp: fix panel bridge attachment [5.17,0578/1126] mips: Enable KCSAN [5.17,0580/1126] vfio/pci: fix memory leak during D3hot to D0 transition [5.17,0581/1126] vfio/pci: wake-up devices around reset functions [5.17,0583/1126] scsi: pm8001: Fix command initialization in pm80XX_send_read_log() [5.17,0584/1126] scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() [5.17,0588/1126] scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() [5.17,0589/1126] scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() [5.17,0593/1126] mt76: do not always copy ethhdr in reverse_frag0_hdr_trans [5.17,0594/1126] mt76: fix endianness errors in reverse_frag0_hdr_trans [5.17,0596/1126] net: dsa: realtek-smi: fix kdoc warnings [5.17,0598/1126] RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR [5.17,0599/1126] drm/amd/display: Remove vupdate_int_entry definition [5.17,0602/1126] mt76: mt7915: enlarge wcid size to 544 [5.17,0606/1126] drm/tegra: Fix reference leak in tegra_dsi_ganged_probe [5.17,0609/1126] drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt [5.17,0610/1126] bpf, arm64: Call build_prologue() first in first JIT pass [5.17,0612/1126] xsk: Fix race at socket teardown [5.17,0614/1126] RDMA/irdma: Fix Passthrough mode in VM [5.17,0615/1126] RDMA/irdma: Remove incorrect masking of PD [5.17,0616/1126] libbpf: Fix BPF_MAP_TYPE_PERF_EVENT_ARRAY auto-pinning [5.17,0619/1126] libbpf: Skip forward declaration when counting duplicated type names [5.17,0621/1126] powerpc/Makefile: Dont pass -mcpu=powerpc64 when building 32-bit [5.17,0624/1126] KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors [5.17,0626/1126] KVM: arm64: Enable Cortex-A510 erratum 2077057 by default [5.17,0627/1126] i2c: xiic: Make bus names unique [5.17,0629/1126] Bluetooth: hci_sync: fix undefined return of hci_disconnect_all_sync() [5.17,0630/1126] Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device_connected() [5.17,0632/1126] power: supply: wm8350-power: Add missing free in free_charger_irq [5.17,0634/1126] RDMA/core: Fix ib_qp_usecnt_dec() called when error [5.17,0636/1126] net: axienet: fix RX ring refill allocation failure handling [5.17,0638/1126] mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n [5.17,0642/1126] mfd: mc13xxx: Add check for mc13xxx_irq_request [5.17,0643/1126] libbpf: Unmap rings when umem deleted [5.17,0645/1126] platform/x86: huawei-wmi: check the return value of device_create_file() [5.17,0646/1126] scsi: mpt3sas: Fix incorrect 4GB boundary check [5.17,0648/1126] xtensa: add missing XCHAL_HAVE_WINDOWED check [5.17,0651/1126] ath10k: Fix error handling in ath10k_setup_msa_resources [5.17,0653/1126] MIPS: RB532: fix return value of __setup handler [5.17,0654/1126] MIPS: pgalloc: fix memory leak caused by pgd_free() [5.17,0655/1126] mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init [5.17,0658/1126] Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error" [5.17,0663/1126] bpf, sockmap: Fix double uncharge the mem of sk_msg [5.17,0664/1126] samples/bpf, xdpsock: Fix race when running for fix duration of time [5.17,0665/1126] USB: storage: ums-realtek: fix error code in rts51x_read_mem() [5.17,0668/1126] RDMA/rxe: Fix ref error in rxe_av.c [5.17,0669/1126] powerpc/xive: fix return value of __setup handler [5.17,0670/1126] powerpc/time: Fix KVM host re-arming a timer beyond decrementer range [5.17,0674/1126] mt76: mt7921: fix mt7921_queues_acq implementation [5.17,0677/1126] bareudp: use ipv6_mod_enabled to check if IPv6 enabled [5.17,0678/1126] PCI: imx6: Invoke the PHY exit function after PHY power off [5.17,0680/1126] ibmvnic: fix race between xmit and reset [5.17,0682/1126] selftests/bpf: Fix error reporting from sock_fields programs [5.17,0684/1126] Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed [5.17,0685/1126] Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt [5.17,0687/1126] ipv4: Fix route lookups when handling ICMP redirects and PMTU updates [5.17,0692/1126] i2c: mux: demux-pinctrl: do not deactivate a master that is not active [5.17,0693/1126] powerpc/pseries: Fix use after free in remove_phb_dynamic() [5.17,0696/1126] drm/i915: Fix renamed struct field [5.17,0698/1126] bpftool: Fix print error when show bpf map [5.17,0699/1126] PCI: Avoid broken MSI on SB600 USB devices [5.17,0705/1126] tipc: fix the timer expires after interval 100ms [5.17,0706/1126] mfd: asic3: Add missing iounmap() on error asic3_mfd_probe [5.17,0707/1126] ice: fix scheduling while atomic on aux critical err interrupt [5.17,0710/1126] kernel/resource: fix kfree() of bootmem memory again [5.17,0711/1126] clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 [5.17,0714/1126] fsi: scom: Fix error handling [5.17,0715/1126] fsi: scom: Remove retries in indirect scoms [5.17,0717/1126] pps: clients: gpio: Propagate return value from pps_gpio_probe [5.17,0721/1126] soundwire: intel: fix wrong register name in intel_shim_wake [5.17,0724/1126] iio: mma8452: Fix probe failing when an i2c_device_id is used [5.17,0725/1126] staging: qlge: add unregister_netdev in qlge_probe [5.17,0727/1126] staging:iio:adc:ad7280a: Fix handing of device address bit reversing. [5.17,0729/1126] pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel [5.17,0730/1126] pinctrl: renesas: checker: Fix miscalculation of number of states [5.17,0733/1126] phy: phy-brcm-usb: fixup BCM4908 support [5.17,0735/1126] serial: 8250_lpss: Balance reference count for PCI DMA device [5.17,0736/1126] NFS: Use of mapping_set_error() results in spurious errors [5.17,0739/1126] habanalabs: Add check for pci_enable_device [5.17,0741/1126] staging: r8188eu: fix endless loop in recv_func [5.17,0742/1126] dma-debug: fix return value of __setup handlers [5.17,0744/1126] clk: imx: off by one in imx_lpcg_parse_clks_from_dt() [5.17,0746/1126] clk: qcom: clk-rcg2: Update logic to calculate D value for RCG [5.17,0747/1126] clk: qcom: clk-rcg2: Update the frac table for pixel clock [5.17,0748/1126] clk: starfive: jh7100: Dont round divisor up twice [5.17,0749/1126] clk: starfive: jh7100: Handle audio_div clock properly [5.17,0751/1126] remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region [5.17,0752/1126] remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region [5.17,0754/1126] nvdimm/region: Fix default alignment for small regions [5.17,0755/1126] clk: actions: Terminate clk_div_table with sentinel element [5.17,0756/1126] clk: loongson1: Terminate clk_div_table with sentinel element [5.17,0757/1126] clk: hisilicon: Terminate clk_div_table with sentinel element [5.17,0758/1126] clk: clps711x: Terminate clk_div_table with sentinel element [5.17,0761/1126] mailbox: imx: fix crash in resume on i.mx8ulp [5.17,0762/1126] NFS: remove unneeded check in decode_devicenotify_args() [5.17,0763/1126] staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree [5.17,0764/1126] staging: mt7621-dts: fix formatting [5.17,0766/1126] staging: mt7621-dts: fix GB-PC2 devicetree [5.17,0767/1126] pinctrl: ocelot: fix confops resource index [5.17,0768/1126] pinctrl: ocelot: fix duplicate debugfs entry [5.17,0769/1126] pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init [5.17,0770/1126] pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback [5.17,0773/1126] pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs [5.17,0781/1126] serial: 8250: fix XOFF/XON sending when DMA is used [5.17,0782/1126] virt: acrn: obtain pa from VMA with PFNMAP flag [5.17,0785/1126] firmware: google: Properly state IOMEM dependency [5.17,0787/1126] perf test arm64: Test unwinding using fame-pointer (fp) mode [5.17,0791/1126] SUNRPC: Dont call connect() more than once on a TCP socket [5.17,0792/1126] perf parse-events: Move slots only with topdown [5.17,0793/1126] netfilter: egress: Report interface as outgoing [5.17,0794/1126] netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options [5.17,0797/1126] kdb: Fix the putarea helper function [5.17,0798/1126] perf stat: Fix forked applications enablement of counters [5.17,0800/1126] clk: qcom: gcc-msm8994: Fix gpll4 width [5.17,0801/1126] vsock/virtio: initialize vdev->priv before using VQs [5.17,0803/1126] vsock/virtio: enable VQs early on probe [5.17,0804/1126] clk: Initialize orphan req_rate [5.17,0805/1126] xen: fix is_xen_pmu() [5.17,0807/1126] net: hns3: fix bug when PF set the duplicate MAC address for VFs [5.17,0808/1126] net: hns3: fix port base vlan add fail when concurrent with reset [5.17,0811/1126] net: phy: broadcom: Fix brcm_fet_config_init() [5.17,0813/1126] NFS: Dont loop forever in nfs_do_recoalesce() [5.17,0816/1126] net: hns3: add max order judgement for tx spare buffer [5.17,0818/1126] net: hns3: add netdev reset check for hns3_set_tunable() [5.17,0820/1126] net: hns3: fix phy can not link up when autoneg off and reset [5.17,0821/1126] net: sparx5: depends on PTP_1588_CLOCK_OPTIONAL [5.17,0824/1126] net: sparx5: switchdev: fix possible NULL pointer dereference [5.17,0826/1126] selftests: tls: skip cmsg_to_pipe tests with TLS=n [5.17,0830/1126] fs: fd tables have to be multiples of BITS_PER_LONG [5.17,0831/1126] lib/test: use after free in register_test_dev_kmod() [5.17,0832/1126] fs: fix fd table size alignment properly [5.17,0840/1126] rcu: Mark writes to the rcu_segcblist structures ->flags field [5.17,0841/1126] block: throttle split bio in case of iops limit [5.17,0842/1126] memstick/mspro_block: fix handling of read-only devices [5.17,0844/1126] crypto: xts - Add softdep on ecb [5.17,0853/1126] irqchip/qcom-pdc: Fix broken locking [5.17,0855/1126] fs/binfmt_elf: Fix AT_PHDR for unusual ELF files [5.17,0856/1126] hwrng: cavium - fix NULL but dereferenced coccicheck error [5.17,0857/1126] bfq: fix use-after-free in bfq_dispatch_request [5.17,0858/1126] ACPICA: Avoid walking the ACPI Namespace if it is not there [5.17,0860/1126] ACPI / x86: Add skip i2c clients quirk for Lenovo Yoga Tablet 1050F/L [5.17,0864/1126] PM: core: keep irq flags in device_pm_check_callbacks() [5.17,0865/1126] parisc: Fix non-access data TLB cache flush faults [5.17,0866/1126] parisc: Fix handling off probe non-access faults [5.17,0867/1126] nvme-tcp: lockdep: annotate in-kernel sockets [5.17,0868/1126] spi: tegra20: Use of_device_get_match_data() [5.17,0870/1126] atomics: Fix atomic64_{read_acquire,set_release} fallbacks [5.17,0874/1126] sched/tracing: Dont re-read p->state when emitting sched_switch event [5.17,0876/1126] ext4: dont BUG if someone dirty pages without asking ext4 first [5.17,0877/1126] f2fs: fix to do sanity check on curseg->alloc_type [5.17,0879/1126] f2fs: dont get FREEZE lock in f2fs_evict_inode in frozen fs [5.17,0880/1126] btrfs: harden identification of a stale device [5.17,0885/1126] f2fs: use spin_lock to avoid hang [5.17,0887/1126] Adjust cifssb maximum read size [5.17,0888/1126] ntfs: add sanity check on allocation size [5.17,0892/1126] media: atmel: atmel-isc-base: report frame sizes as full supported range [5.17,0893/1126] media: ir_toy: free before error exiting [5.17,0894/1126] ASoC: sh: rz-ssi: Make the data structures available before registering the hand... [5.17,0896/1126] ASoC: SOF: Intel: match sdw version on link_slaves_found [5.17,0897/1126] media: imx-jpeg: Prevent decoding NV12M jpegs into single-planar buffers [5.17,0898/1126] ASoC: SOF: Intel: hda: Remove link assignment limitation [5.17,0905/1126] video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit [5.17,0906/1126] ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 [5.17,0908/1126] ASoC: madera: Add dependencies on MFD [5.17,0909/1126] media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off ... [5.17,0912/1126] ALSA: hda: Fix driver index handling at re-binding [5.17,0913/1126] ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk [5.17,0915/1126] video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() [5.17,0916/1126] video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() [5.17,0921/1126] media: imx-jpeg: fix a bug of accessing array out of bounds [5.17,0922/1126] media: cx88-mpeg: clear interrupt status register before streaming video [5.17,0923/1126] ASoC: rt5682s: Fix the wrong jack type detected [5.17,0924/1126] ARM: tegra: transformer: Drop reg-shift for Tegra HS UART [5.17,0925/1126] uaccess: fix type mismatch warnings from access_ok() [5.17,0926/1126] lib/test_lockup: fix kernel pointer check for separate address spaces [5.17,0929/1126] ASoC: amd: vg: fix for pm resume callback sequence [5.17,0930/1126] ASoC: amd: vangogh: fix uninitialized symbol warning in machine driver [5.17,0931/1126] video: fbdev: sm712fb: Fix crash in smtcfb_write() [5.17,0932/1126] media: i2c: ov5648: Fix lockdep error [5.17,0936/1126] ASoC: Intel: sof_sdw: fix quirks for 2022 HP Spectre x360 13" [5.17,0937/1126] ASoC: SOF: Intel: hda: retrieve DMIC number for I2S boards [5.17,0939/1126] ALSA: intel-dsp-config: add more ACPI HIDs for ES83x6 devices [5.17,0940/1126] ASoC: Intel: soc-acpi: add more ACPI HIDs for ES83x6 devices [5.17,0945/1126] tracing: Have TRACE_DEFINE_ENUM affect trace event types as well [5.17,0946/1126] mmc: host: Return an error when ->enable_sdio_irq() ops is missing [5.17,0948/1126] media: atomisp: fix bad usage at error handling logic [5.17,0950/1126] KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255 [5.17,0951/1126] KVM: x86: Reinitialize context if host userspace toggles EFER.LME [5.17,0953/1126] KVM: x86/mmu: Move "invalid" check out of kvm_tdp_mmu_get_root() [5.17,0956/1126] KVM: x86: hyper-v: Drop redundant ex parameter from kvm_hv_send_ipi() [5.17,0958/1126] KVM: x86: hyper-v: Fix the maximum number of sparse banks for XMM fast TLB flush... [5.17,0959/1126] KVM: x86: hyper-v: HVCALL_SEND_IPI_EX is an XMM fast hypercall [5.17,0960/1126] powerpc/kasan: Fix early region not updated correctly [5.17,0962/1126] powerpc/lib/sstep: Fix sthcx instruction [5.17,0971/1126] scsi: qla2xxx: Implement ref count for SRB [5.17,0972/1126] scsi: qla2xxx: Fix stuck session in gpdb [5.17,0973/1126] scsi: qla2xxx: Fix warning message due to adisc being flushed [5.17,0974/1126] scsi: qla2xxx: Fix scheduling while atomic [5.17,0975/1126] scsi: qla2xxx: Fix premature hw access after PCI error [5.17,0977/1126] scsi: qla2xxx: Fix warning for missing error code [5.17,0978/1126] scsi: qla2xxx: Fix device reconnect in loop topology [5.17,0984/1126] scsi: qla2xxx: Fix disk failure to rediscover [5.17,0985/1126] scsi: qla2xxx: Fix incorrect reporting of task management failure [5.17,0989/1126] scsi: qla2xxx: Fix crash during module load unload test [5.17,0990/1126] scsi: qla2xxx: Fix N2N inconsistent PLOGI [5.17,0991/1126] scsi: qla2xxx: Fix stuck session of PRLI reject [5.17,0992/1126] scsi: qla2xxx: Reduce false trigger to login [5.17,0993/1126] scsi: qla2xxx: Use correct feature type field during RFF_ID processing [5.17,0994/1126] platform: chrome: Split trace include file [5.17,0995/1126] MIPS: crypto: Fix CRC32 code [5.17,0996/1126] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq [5.17,0997/1126] KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic... [5.17,1000/1126] KVM: Prevent module exit until all VMs are freed [5.17,1001/1126] KVM: x86: fix sending PV IPI [5.17,1006/1126] ubifs: Add missing iput if do_tmpfile() failed in rename whiteout [5.17,1007/1126] ubifs: Rename whiteout atomically [5.17,1008/1126] ubifs: Fix ui->dirty race between do_tmpfile() and writeback work [5.17,1009/1126] ubifs: Rectify space amount budget for mkdir/tmpfile operations [5.17,1012/1126] ubifs: Fix to add refcount once page is set private [5.17,1013/1126] ubifs: rename_whiteout: correct old_dir size computing [5.17,1016/1126] wireguard: queueing: use CFI-safe ptr_ring cleanup function [5.17,1018/1126] wireguard: socket: ignore v6 endpoints when ipv6 is disabled [5.17,1019/1126] XArray: Fix xas_create_range() when multi-order entry present [5.17,1022/1126] can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value [5.17,1024/1126] XArray: Update the LRU list in xas_split() [5.17,1026/1126] rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram [5.17,1027/1126] rtc: check if __rtc_read_time was successful [5.17,1028/1126] loop: fix ioctl calls using compat_loop_info [5.17,1029/1126] gfs2: gfs2_setattr_size error path fix [5.17,1030/1126] gfs2: Fix gfs2_file_buffered_write endless loop workaround [5.17,1031/1126] gfs2: Make sure FITRIM minlen is rounded up to fs block size [5.17,1034/1126] rxrpc: fix some null-ptr-deref bugs in server_key.c [5.17,1035/1126] rxrpc: Fix call timer start racing with call destruction [5.17,1038/1126] crypto: arm/aes-neonbs-cbc - Select generic cbc and aes [5.17,1041/1126] watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function [5.17,1042/1126] net: sparx5: uses, depends on BRIDGE or !BRIDGE [5.17,1045/1126] ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B [5.17,1047/1126] ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl [5.17,1049/1126] block: Fix the maximum minor value is blk_alloc_ext_minor() [5.17,1051/1126] Revert "virtio-pci: harden INTX interrupts" [5.17,1052/1126] Revert "virtio_pci: harden MSI-X interrupts" [5.17,1056/1126] io_uring: fix memory leak of uid in files registration [5.17,1058/1126] ACPI: CPPC: Avoid out of bounds access when parsing _CPC data [5.17,1060/1126] spi: Fix Tegra QSPI example [5.17,1061/1126] platform/chrome: cros_ec_typec: Check for EC device [5.17,1063/1126] can: isotp: restore accidentally removed MSG_PEEK feature [5.17,1064/1126] proc: bootconfig: Add null pointer check [5.17,1065/1126] x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation [5.17,1068/1126] scsi: qla2xxx: Add qla2x00_async_done() for async routines [5.17,1070/1126] docs: fix make htmldocs warning in SCTP.rst [5.17,1073/1126] KVM: x86: SVM: fix avic spec based definitions again [5.17,1074/1126] ax25: fix UAF bug in ax25_send_control() [5.17,1078/1126] net: add skb_set_end_offset() helper [5.17,1081/1126] mm/memcontrol: return 1 from cgroup.memory __setup() handler [5.17,1084/1126] libbpf: Define BTF_KIND_* constants in btf.h to avoid compilation errors [5.17,1085/1126] bpf: Adjust BPF stack helper functions to accommodate skip > 0 [5.17,1087/1126] nbd: fix possible overflow on first_minor in nbd_dev_add() [5.17,1092/1126] media: dt-binding: media: hynix,hi846: use $defs/port-base port description [5.17,1095/1126] dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167 [5.17,1097/1126] dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks [5.17,1098/1126] dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example [5.17,1099/1126] ubi: fastmap: Return error code if memory allocation fails in add_aeb() [5.17,1101/1126] ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV [5.17,1103/1126] perf vendor events: Update metrics for SkyLake Server [5.17,1104/1126] media: ov6650: Add try support to selection API operations [5.17,1105/1126] media: ov6650: Fix crop rectangle affected by set format [5.17,1106/1126] pinctrl: canonical rsel resistance selection property [5.17,1108/1126] ARM: dts: spear1340: Update serial node properties [5.17,1109/1126] ARM: dts: spear13xx: Update SPI dma properties [5.17,1113/1126] docs: sysctl/kernel: add missing bit to panic_print [5.17,1114/1126] xsk: Do not write NULL in SW ring at allocation failure [5.17,1118/1126] torture: Make torture.sh help message match reality [5.17,1119/1126] n64cart: convert bi_disk to bi_bdev->bd_disk fix build [5.17,1121/1126] mmc: rtsx: Let MMC core handle runtime PM [5.17,1123/1126] coredump: Snapshot the vmas in do_coredump [5.17,1124/1126] coredump: Remove the WARN_ON in dump_vma_snapshot

Commit Message

Greg Kroah-Hartman April 5, 2022, 7:30 a.m. UTC

From: Duoming Zhou <duoming@zju.edu.cn>

commit 5352a761308397a0e6250fdc629bb3f615b94747 upstream.

There are UAF bugs in ax25_send_control(), when we call ax25_release()
to deallocate ax25_dev. The possible race condition is shown below:

      (Thread 1)              |     (Thread 2)
ax25_dev_device_up() //(1)    |
                              | ax25_kill_by_device()
ax25_bind()          //(2)    |
ax25_connect()                | ...
 ax25->state = AX25_STATE_1   |
 ...                          | ax25_dev_device_down() //(3)

      (Thread 3)
ax25_release()                |
 ax25_dev_put()  //(4) FREE   |
 case AX25_STATE_1:           |
  ax25_send_control()         |
   alloc_skb()       //USE    |

The refcount of ax25_dev increases in position (1) and (2), and
decreases in position (3) and (4). The ax25_dev will be freed
before dereference sites in ax25_send_control().

The following is part of the report:

[  102.297448] BUG: KASAN: use-after-free in ax25_send_control+0x33/0x210
[  102.297448] Read of size 8 at addr ffff888009e6e408 by task ax25_close/602
[  102.297448] Call Trace:
[  102.303751]  ax25_send_control+0x33/0x210
[  102.303751]  ax25_release+0x356/0x450
[  102.305431]  __sock_release+0x6d/0x120
[  102.305431]  sock_close+0xf/0x20
[  102.305431]  __fput+0x11f/0x420
[  102.305431]  task_work_run+0x86/0xd0
[  102.307130]  get_signal+0x1075/0x1220
[  102.308253]  arch_do_signal_or_restart+0x1df/0xc00
[  102.308253]  exit_to_user_mode_prepare+0x150/0x1e0
[  102.308253]  syscall_exit_to_user_mode+0x19/0x50
[  102.308253]  do_syscall_64+0x48/0x90
[  102.308253]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  102.308253] RIP: 0033:0x405ae7

This patch defers the free operation of ax25_dev and net_device after
all corresponding dereference sites in ax25_release() to avoid UAF.

Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ax25/af_ax25.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff mbox series

Patch

--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -991,10 +991,6 @@  static int ax25_release(struct socket *s
 	sock_orphan(sk);
 	ax25 = sk_to_ax25(sk);
 	ax25_dev = ax25->ax25_dev;
-	if (ax25_dev) {
-		dev_put_track(ax25_dev->dev, &ax25_dev->dev_tracker);
-		ax25_dev_put(ax25_dev);
-	}
 
 	if (sk->sk_type == SOCK_SEQPACKET) {
 		switch (ax25->state) {
@@ -1056,6 +1052,10 @@  static int ax25_release(struct socket *s
 		sk->sk_state_change(sk);
 		ax25_destroy_socket(ax25);
 	}
+	if (ax25_dev) {
+		dev_put_track(ax25_dev->dev, &ax25_dev->dev_tracker);
+		ax25_dev_put(ax25_dev);
+	}
 
 	sock->sk   = NULL;
 	release_sock(sk);