diff mbox series

[5.9,078/757] KVM: SVM: Initialize prev_ga_tag before use

Message ID	20201027135454.208027972@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=OPSA=EC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>, Paolo Bonzini <pbonzini@redhat.com> Subject: [PATCH 5.9 078/757] KVM: SVM: Initialize prev_ga_tag before use Date: Tue, 27 Oct 2020 14:45:28 +0100 Message-Id: <20201027135454.208027972@linuxfoundation.org> In-Reply-To: <20201027135450.497324313@linuxfoundation.org> References: <20201027135450.497324313@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.9,002/757] ibmveth: Identify ingress large send packets. [5.9,003/757] cxgb4: handle 4-tuple PEDIT to NAT mode translation [5.9,004/757] ipv4: Restore flowi4_oif update before call to xfrm_lookup_route [5.9,005/757] mlx4: handle non-napi callers to napi_poll [5.9,006/757] mptcp: fix fallback for MP_JOIN subflows [5.9,007/757] mptcp: subflows garbage collection [5.9,008/757] net: dsa: microchip: fix race condition [5.9,009/757] net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() [5.9,010/757] net: fec: Fix PHY init after phy_reset_after_clk_enable() [5.9,011/757] net: fix pos incrementment in ipv6_route_seq_next [5.9,012/757] net: ipa: skip suspend/resume activities if not set up [5.9,013/757] net: mptcp: make DACK4/DACK8 usage consistent among all subflows [5.9,014/757] net: sched: Fix suspicious RCU usage while accessing tcf_tunnel_info [5.9,015/757] net/smc: fix use-after-free of delayed events [5.9,016/757] net/smc: fix valid DMBE buffer sizes [5.9,017/757] net/tls: sendfile fails with ktls offload [5.9,018/757] tipc: fix NULL pointer dereference in tipc_named_rcv [5.9,019/757] tipc: fix the skb_unshare() in tipc_buf_append() [5.9,020/757] socket: fix option SO_TIMESTAMPING_NEW [5.9,021/757] socket: dont clear SOCK_TSTAMP_NEW when SO_TIMESTAMPNS is disabled [5.9,022/757] can: m_can_platform: dont call m_can_class_suspend in runtime suspend [5.9,023/757] can: j1935: j1939_tp_tx_dat_new(): fix missing initialization of skbcnt [5.9,024/757] net: j1939: j1939_session_fresh_new(): fix missing initialization of skbcnt [5.9,025/757] binder: fix UAF when releasing todo list [5.9,026/757] ALSA: bebob: potential info leak in hwdep_read() [5.9,027/757] ALSA: hda: fix jack detection with Realtek codecs when in D3 [5.9,028/757] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close [5.9,029/757] tipc: re-configure queue limit for broadcast link [5.9,030/757] tipc: fix incorrect setting window for bcast link [5.9,031/757] chelsio/chtls: fix socket lock [5.9,032/757] chelsio/chtls: correct netdevice for vlan interface [5.9,033/757] chelsio/chtls: fix panic when server is on ipv6 [5.9,034/757] chelsio/chtls: Fix panic when listen on multiadapter [5.9,035/757] chelsio/chtls: correct function return and return type [5.9,036/757] chelsio/chtls: fix writing freed memory [5.9,037/757] ibmvnic: save changed mac address to adapter->mac_addr [5.9,038/757] icmp: randomize the global rate limiter [5.9,039/757] mptcp: initialize mptcp_options_receiveds ahmac [5.9,040/757] net: ftgmac100: Fix Aspeed ast2600 TX hang issue [5.9,041/757] net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device [5.9,042/757] net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup [5.9,043/757] net: Properly typecast int values to set sk_max_pacing_rate [5.9,044/757] net/sched: act_ct: Fix adding udp port mangle operation [5.9,045/757] net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels [5.9,046/757] netsec: ignore phy-mode device property on ACPI systems [5.9,047/757] nexthop: Fix performance regression in nexthop deletion [5.9,048/757] nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() [5.9,049/757] r8169: fix operation under forced interrupt threading [5.9,050/757] selftests: forwarding: Add missing rp_filter configuration [5.9,051/757] selftests: rtnetlink: load fou module for kci_test_encap_fou() test [5.9,052/757] tcp: fix to update snd_wl1 in bulk receiver fast path [5.9,053/757] net: ethernet: mtk-star-emac: select REGMAP_MMIO [5.9,054/757] net/sched: act_gate: Unlock ->tcfa_lock in tc_setup_flow_action() [5.9,055/757] ixgbe: fix probing of multi-port devices with one MDIO [5.9,056/757] mptcp: MPTCP_KUNIT_TESTS should depend on MPTCP instead of selecting it [5.9,057/757] net: openvswitch: fix to make sure flow_lookup() is not preempted [5.9,058/757] sfc: move initialisation of efx->filter_sem to efx_init_struct() [5.9,059/757] ALSA: hda - Dont register a cb func if it is registered already [5.9,060/757] ALSA: hda - Fix the return value if cb func is already registered [5.9,061/757] ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk [5.9,062/757] ALSA: hda/realtek - The front Mic on a HP machine doesnt work [5.9,063/757] ALSA: hda/realtek - set mic to auto detect on a HP AIO machine [5.9,064/757] ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 [5.9,065/757] ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 [5.9,066/757] cifs: remove bogus debug code [5.9,067/757] cifs: Return the error from crypt_message when enc/dec key not found. [5.9,068/757] SMB3: Resolve data corruption of TCP server info fields [5.9,069/757] SMB3.1.1: Fix ids returned in POSIX query dir [5.9,070/757] smb3: do not try to cache root directory if dir leases not supported [5.9,071/757] smb3: fix stat when special device file and mounted with modefromsid [5.9,072/757] arm64: Make use of ARCH_WORKAROUND_1 even when KVM is not enabled [5.9,073/757] KVM: nVMX: Morph notification vector IRQ on nested VM-Enter to pending PI [5.9,074/757] KVM: nVMX: Reset the segment cache when stuffing guest segs [5.9,075/757] KVM: nVMX: Reload vmcs01 if getting vmcs12s pages fails [5.9,076/757] KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages [5.9,077/757] KVM: x86: Intercept LA57 to inject #GP fault when its reserved [5.9,078/757] KVM: SVM: Initialize prev_ga_tag before use [5.9,079/757] ima: Dont ignore errors from crypto_shash_update() [5.9,080/757] crypto: caam - add xts check for block length equal to zero [5.9,081/757] crypto: algif_aead - Do not set MAY_BACKLOG on the async path [5.9,082/757] crypto: caam/qi - add fallback for XTS with more than 8B IV [5.9,083/757] crypto: caam/qi - add support for more XTS key lengths [5.9,084/757] crypto: caam/jr - add fallback for XTS with more than 8B IV [5.9,085/757] crypto: caam/jr - add support for more XTS key lengths [5.9,086/757] crypto: caam/qi2 - add fallback for XTS with more than 8B IV [5.9,087/757] crypto: caam/qi2 - add support for more XTS key lengths [5.9,088/757] RAS/CEC: Fix cec_init() prototype [5.9,089/757] sched/fair: Fix wrong negative conversion in find_energy_efficient_cpu() [5.9,090/757] microblaze: fix kbuild redundant file warning [5.9,091/757] EDAC/i5100: Fix error handling order in i5100_init_one() [5.9,092/757] EDAC/aspeed: Fix handling of platform_get_irq() error [5.9,093/757] EDAC/ti: Fix handling of platform_get_irq() error [5.9,094/757] perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS [5.9,095/757] x86/fpu: Allow multiple bits in clearcpuid= parameter [5.9,096/757] irqchip/ti-sci-inta: Fix unsigned comparison to zero [5.9,097/757] irqchip/ti-sci-intr: Fix unsigned comparison to zero [5.9,098/757] arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions [5.9,099/757] seqlock: Unbreak lockdep [5.9,100/757] drivers/perf: xgene_pmu: Fix uninitialized resource struct [5.9,101/757] drivers/perf: thunderx2_pmu: Fix memory resource error handling [5.9,102/757] sched/fair: Fix wrong cpu selecting from isolated domain [5.9,103/757] sched/fair: Use dst group while checking imbalance for NUMA balancer [5.9,104/757] arm64: perf: Add missing ISB in armv8pmu_enable_counter() [5.9,105/757] perf/x86/intel/uncore: Update Ice Lake uncore units [5.9,106/757] perf/x86/intel/uncore: Reduce the number of CBOX counters [5.9,107/757] perf/x86/intel/uncore: Fix for iio mapping on Skylake Server [5.9,108/757] perf/x86/intel/uncore: Fix the scale of the IMC free-running events [5.9,109/757] x86/nmi: Fix nmi_handle() duration miscalculation [5.9,110/757] x86/events/amd/iommu: Fix sizeof mismatch [5.9,111/757] pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags [5.9,112/757] pinctrl: qcom: Use return value from irq_set_wake() call [5.9,113/757] perf/x86: Fix n_pair for cancelled txn [5.9,114/757] lockdep: Fix usage_traceoverflow [5.9,115/757] lockdep: Fix lockdep recursion [5.9,116/757] lockdep: Revert "lockdep: Use raw_cpu_() for per-cpu variables" [5.9,117/757] perf/core: Fix race in the perf_mmap_close() function [5.9,118/757] regulator: set of_node for qcom vbus regulator [5.9,119/757] crypto: algif_skcipher - EBUSY on aio should be an error [5.9,120/757] crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() [5.9,121/757] crypto: ixp4xx - Fix the size used in a dma_free_coherent() call [5.9,122/757] crypto: picoxcell - Fix potential race condition bug [5.9,123/757] media: vivid: Fix global-out-of-bounds read in precalculate_color() [5.9,124/757] media: tuner-simple: fix regression in simple_set_radio_freq [5.9,125/757] crypto: ccree - fix runtime PM imbalance on error [5.9,126/757] media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" [5.9,127/757] media: hantro: h264: Get the correct fallback reference buffer [5.9,128/757] media: hantro: postproc: Fix motion vector space allocation [5.9,129/757] media: ov5640: Correct Bit Div register in clock tree diagram [5.9,130/757] media: i2c: fix error check on max9286_read call [5.9,131/757] media: m5mols: Check function pointer in m5mols_sensor_power [5.9,132/757] fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32 [5.9,133/757] media: uvcvideo: Set media controller entity functions [5.9,134/757] media: uvcvideo: Silence shift-out-of-bounds warning [5.9,135/757] media: staging/intel-ipu3: css: Correctly reset some memory [5.9,136/757] media: omap3isp: Fix memleak in isp_probe [5.9,137/757] media: i2c: ov5640: Remain in power down for DVP mode unless streaming [5.9,138/757] media: i2c: ov5640: Separate out mipi configuration from s_power [5.9,139/757] media: i2c: ov5640: Enable data pins on poweron for DVP mode [5.9,140/757] media: rcar_drif: Fix fwnode reference leak when parsing DT [5.9,141/757] media: rcar_drif: Allocate v4l2_async_subdev dynamically [5.9,142/757] media: rcar-csi2: Allocate v4l2_async_subdev dynamically [5.9,143/757] media: i2c: max9286: Allocate v4l2_async_subdev dynamically [5.9,144/757] crypto: sa2ul - fix compiler warning produced by clang [5.9,145/757] spi: fsi: Handle 9 to 15 byte transfers lengths [5.9,146/757] spi: fsi: Fix use of the bneq+ sequencer instruction [5.9,147/757] spi: fsi: Implement restricted size for certain controllers [5.9,148/757] spi: dw-pci: free previously allocated IRQs if desc->setup() fails [5.9,149/757] crypto: sa2ul - Select CRYPTO_AUTHENC [5.9,150/757] crypto: omap-sham - fix digcnt register handling with export/import [5.9,151/757] crypto: sa2ul - Fix pm_runtime_get_sync() error checking [5.9,152/757] selftests/seccomp: Use __NR_mknodat instead of __NR_mknod [5.9,153/757] selftests/seccomp: Refactor arch register macros to avoid xtensa special case [5.9,154/757] selftests/seccomp: powerpc: Fix seccomp return value testing [5.9,155/757] regmap: debugfs: Fix more error path regressions [5.9,156/757] hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} [5.9,157/757] hwmon: (w83627ehf) Fix a resource leak in probe [5.9,158/757] cypto: mediatek - fix leaks in mtk_desc_ring_alloc [5.9,159/757] crypto: stm32/crc32 - Avoid lock if hardware is already used [5.9,160/757] crypto: sun8i-ce - handle endianness of t_common_ctl [5.9,161/757] media: mx2_emmaprp: Fix memleak in emmaprp_probe [5.9,162/757] media: mtk-mdp: Fix Null pointer dereference when calling list_add [5.9,163/757] media: tc358743: initialize variable [5.9,164/757] media: tc358743: cleanup tc358743_cec_isr [5.9,165/757] nvme: fix error handling in nvme_ns_report_zones [5.9,166/757] media: rcar-vin: Fix a reference count leak. [5.9,167/757] media: rockchip/rga: Fix a reference count leak. [5.9,168/757] media: platform: fcp: Fix a reference count leak. [5.9,169/757] media: camss: Fix a reference count leak. [5.9,170/757] media: s5p-mfc: Fix a reference count leak [5.9,171/757] media: stm32-dcmi: Fix a reference count leak [5.9,172/757] media: ti-vpe: Fix a missing check and reference count leak [5.9,173/757] regulator: resolve supply after creating regulator [5.9,174/757] pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB [5.9,175/757] spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() [5.9,176/757] spi: spi-s3c64xx: Check return values [5.9,177/757] hwmon: (bt1-pvt) Test sensor power supply on probe [5.9,178/757] hwmon: (bt1-pvt) Cache current update timeout [5.9,179/757] hwmon: (bt1-pvt) Wait for the completion with timeout [5.9,180/757] spi: imx: Fix freeing of DMA channels if spi_bitbang_start() fails [5.9,181/757] btrfs: add owner and fs_info to alloc_state io_tree [5.9,182/757] blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue [5.9,183/757] ath10k: provide survey info as accumulated data [5.9,184/757] drm/vkms: fix xrgb on compute crc [5.9,185/757] Bluetooth: hci_uart: Cancel init work before unregistering [5.9,186/757] drm/amd/display: Fix wrong return value in dm_update_plane_state() [5.9,187/757] drm/vgem: add missing platform_device_unregister() in vgem_init() [5.9,188/757] drm/vkms: add missing platform_device_unregister() in vkms_init() [5.9,189/757] drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel [5.9,190/757] ath6kl: prevent potential array overflow in ath6kl_add_new_sta() [5.9,191/757] ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() [5.9,192/757] ath10k: Fix the size used in a dma_free_coherent() call in an error handling path [5.9,193/757] wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 [5.9,194/757] ASoC: qcom: lpass-platform: fix memory leak [5.9,195/757] ASoC: qcom: lpass-cpu: fix concurrency issue [5.9,196/757] ath11k: Fix possible memleak in ath11k_qmi_init_service [5.9,197/757] brcmfmac: check ndev pointer [5.9,198/757] mwifiex: Do not use GFP_KERNEL in atomic context [5.9,199/757] drm/malidp: Use struct drm_gem_object_funcs.get_sg_table internally [5.9,200/757] staging: rtl8192u: Do not use GFP_KERNEL in atomic context [5.9,201/757] drm/amd/display: fix potential integer overflow when shifting 32 bit variable bl_pwm [5.9,202/757] selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user() [5.9,203/757] drm/gma500: fix error check [5.9,204/757] scsi: qla4xxx: Fix an error handling path in qla4xxx_get_host_stats() [5.9,205/757] scsi: qla2xxx: Fix the size used in a dma_free_coherent() call [5.9,206/757] scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() [5.9,207/757] scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() [5.9,208/757] scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() [5.9,209/757] libbpf: Fix unintentional success return code in bpf_object__load [5.9,210/757] wilc1000: Fix memleak in wilc_sdio_probe [5.9,211/757] wilc1000: Fix memleak in wilc_bus_probe [5.9,212/757] rtw88: dont treat NULL pointer as an array [5.9,213/757] selftests/livepatch: Do not check order when using "comm" for dmesg checking [5.9,214/757] backlight: sky81452-backlight: Fix refcount imbalance on error [5.9,215/757] staging: wfx: fix frame reordering [5.9,216/757] staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent() [5.9,217/757] VMCI: check return value of get_user_pages_fast() for errors [5.9,218/757] mm/error_inject: Fix allow_error_inject function signatures. [5.9,219/757] drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel [5.9,220/757] samples/bpf: Fix to xdpsock to avoid recycling frames [5.9,221/757] ima: Pre-parse the list of keyrings in a KEY_CHECK rule [5.9,222/757] ima: Fail rule parsing when asymmetric key measurement isnt supportable [5.9,223/757] drm/crc-debugfs: Fix memleak in crc_control_write [5.9,224/757] Bluetooth: Clear suspend tasks on unregister [5.9,225/757] selftests: vm: add fragment CONFIG_GUP_BENCHMARK [5.9,226/757] scsi: ufs: Make ufshcd_print_trs() consider UFSHCD_QUIRK_PRDT_BYTE_GRAN [5.9,227/757] binder: Remove bogus warning on failed same-process transaction [5.9,228/757] drm/amdgpu: fix max_entries calculation v4 [5.9,229/757] soundwire: stream: fix NULL/IS_ERR confusion [5.9,230/757] soundwire: intel: fix NULL/ERR_PTR confusion [5.9,231/757] tty: serial: earlycon dependency [5.9,232/757] tty: hvcs: Dont NULL tty->driver_data until hvcs_cleanup() [5.9,233/757] pty: do tty_flip_buffer_push without port->lock in pty_write [5.9,234/757] pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() [5.9,235/757] pwm: lpss: Add range limit check for the base_unit register value [5.9,236/757] drivers/virt/fsl_hypervisor: Fix error handling path [5.9,237/757] sfc: dont double-down() filters in ef100_reset() [5.9,238/757] ath11k: fix a double free and a memory leak [5.9,239/757] video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error [5.9,240/757] video: fbdev: sis: fix null ptr dereference [5.9,241/757] video: fbdev: radeon: Fix memleak in radeonfb_pci_register [5.9,242/757] ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe() [5.9,243/757] scsi: ufs: ufs-mediatek: Eliminate error message for unbound mphy [5.9,244/757] scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk [5.9,245/757] HID: roccat: add bounds checking in kone_sysfs_write_settings() [5.9,246/757] ath11k: fix uninitialized return in ath11k_spectral_process_data() [5.9,247/757] drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check() [5.9,248/757] drm/panfrost: Ensure GPU quirks are always initialised [5.9,249/757] iomap: Clear page error before beginning a write [5.9,250/757] iomap: Mark read blocks uptodate in write_begin [5.9,251/757] selftests/lkdtm: Use "comm" instead of "diff" for dmesg [5.9,252/757] Bluetooth: Fix memory leak in read_adv_mon_features() [5.9,253/757] Bluetooth: Re-order clearing suspend tasks [5.9,254/757] pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser [5.9,255/757] pinctrl: mcp23s08: Fix mcp23x17 precious range [5.9,256/757] pinctrl: devicetree: Keep deferring even on timeout [5.9,257/757] drm/msm/adreno: fix probe without iommu [5.9,258/757] s390/bpf: Fix multiple tail calls [5.9,259/757] net/mlx5: Fix uninitialized variable warning [5.9,260/757] net/mlx5: Dont call timecounter cyc2time directly from 1PPS flow [5.9,261/757] scsi: mpt3sas: Fix sync irqs [5.9,262/757] net: stmmac: Fix incorrect location to set real_num_rx\|tx_queues [5.9,263/757] net: stmmac: use netif_tx_start\|stop_all_queues() function [5.9,264/757] xfs: force the log after remapping a synchronous-writes file [5.9,265/757] cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE [5.9,266/757] drm: mxsfb: check framebuffer pitch [5.9,267/757] cpufreq: qcom: Dont add frequencies without an OPP [5.9,268/757] ima: Fix NULL pointer dereference in ima_file_hash [5.9,269/757] ASoC: topology: disable size checks for bytes_ext controls if needed [5.9,270/757] ASoC: tlv320adcx140: Fix digital gain range [5.9,271/757] coresight: etm4x: Fix etm4_count race by moving cpuhp callbacks to init [5.9,272/757] coresight: fix offset by one error in counting ports [5.9,273/757] coresight: cti: disclaim device only when its claimed [5.9,274/757] coresight: cti: remove pm_runtime_get_sync() from CPU hotplug [5.9,275/757] coresight: etm4x: Ensure default perf settings filter user/kernel [5.9,276/757] coresight: etm4x: Fix issues within reset interface of sysfs [5.9,277/757] coresight: cti: Write regsiters directly in cti_enable_hw() [5.9,278/757] coresight: etm4x: Handle unreachable sink in perf mode [5.9,279/757] coresight: etm4x: Fix issues on trcseqevr access [5.9,280/757] nvmem: core: fix missing of_node_put() in of_nvmem_device_get() [5.9,281/757] selftests: mptcp: interpret \n as a new line [5.9,282/757] dmaengine: ti: k3-udma-glue: fix channel enable functions [5.9,283/757] selftests/bpf: Fix endianness issue in sk_assign [5.9,284/757] selftests/bpf: Fix endianness issue in test_sockopt_sk [5.9,285/757] Bluetooth: Fix auto-creation of hci_conn at Conn Complete event [5.9,286/757] xhci: dont create endpoint debugfs entry before ring buffer is set. [5.9,287/757] drm/msm: Fix the a650 hw_apriv check [5.9,288/757] net: dsa: rtl8366: Check validity of passed VLANs [5.9,289/757] net: dsa: rtl8366: Refactor VLAN/PVID init [5.9,290/757] net: dsa: rtl8366: Skip PVID setting if not requested [5.9,291/757] net: wilc1000: clean up resource in error path of init mon interface [5.9,292/757] ASoC: tas2770: Fix calling reset in probe [5.9,293/757] ASoC: tas2770: Add missing bias level power states [5.9,294/757] ASoC: tas2770: Fix required DT properties in the code [5.9,295/757] ASoC: tas2770: Fix error handling with update_bits [5.9,296/757] ASoC: tlv320aic32x4: Fix bdiv clock rate derivation [5.9,297/757] net: dsa: rtl8366rb: Support all 4096 VLANs [5.9,298/757] ASoC: SOF: control: add size checks for ext_bytes control .put() [5.9,299/757] ASoC: tas2770: Fix unbalanced calls to pm_runtime [5.9,300/757] spi: omap2-mcspi: Improve performance waiting for CHSTAT [5.9,301/757] ath11k: Add checked value for ath11k_ahb_remove [5.9,302/757] ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() [5.9,303/757] drm: rcar-du: Put reference to VSP device [5.9,304/757] phy: rockchip-dphy-rx0: Include linux/delay.h [5.9,305/757] dmaengine: dmatest: Check list for emptiness before access its last entry [5.9,306/757] ASoC: cros_ec_codec: fix kconfig dependency warning for SND_SOC_CROS_EC_CODEC [5.9,307/757] misc: mic: scif: Fix error handling path [5.9,308/757] ALSA: seq: oss: Avoid mutex lock for a long-time ioctl [5.9,309/757] net/mlx5e: IPsec: Use kvfree() for memory allocated with kvzalloc() [5.9,310/757] usb: dwc2: Fix parameter type in function pointer prototype [5.9,311/757] usb: dwc3: core: Properly default unspecified speed [5.9,312/757] usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails [5.9,313/757] rtw88: Fix probe error handling race with firmware loading [5.9,314/757] rtw88: Fix potential probe error handling race with wow firmware loading [5.9,315/757] mt76: mt7615: hold mt76 lock queueing wd in mt7615_queue_key_update [5.9,316/757] mt76: mt7615: release mutex in mt7615_reset_test_set [5.9,317/757] mt76: mt7663s: fix resume failure [5.9,318/757] mt76: mt7615: fix possible memory leak in mt7615_tm_set_tx_power [5.9,319/757] mt76: mt7615: fix a possible NULL pointer dereference in mt7615_pm_wake_work [5.9,320/757] mt76: fix a possible NULL pointer dereference in mt76_testmode_dump [5.9,321/757] mt76: mt7663u: fix dma header initialization [5.9,322/757] mt76: mt7615: move drv_own/fw_own in mt7615_mcu_ops [5.9,323/757] mt76: mt7622: fix fw hang on mt7622 [5.9,324/757] mt76: mt7915: fix possible memory leak in mt7915_mcu_add_beacon [5.9,325/757] quota: clear padding in v2r1_mem2diskdqb() [5.9,326/757] slimbus: core: check get_addr before removing laddr ida [5.9,327/757] slimbus: core: do not enter to clock pause mode in core [5.9,328/757] slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback [5.9,329/757] drm/vc4: crtc: Rework a bit the CRTC state code [5.9,330/757] ASoC: fsl_sai: Instantiate snd_soc_dai_driver [5.9,331/757] HID: hid-input: fix stylus battery reporting [5.9,332/757] tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n [5.9,333/757] tty: serial: imx: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n [5.9,334/757] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() [5.9,335/757] hv: clocksource: Add notrace attribute to read_hv_sched_clock_() functions [5.9,336/757] nl80211: fix OBSS PD min and max offset validation [5.9,337/757] iomap: Use kzalloc to allocate iomap_page [5.9,338/757] coresight: etm: perf: Fix warning caused by etm_setup_aux failure [5.9,339/757] coresight: cti: Fix remove sysfs link error [5.9,340/757] coresight: cti: Fix bug clearing sysfs links on callback [5.9,341/757] coresight: etm4x: Fix save and restore of TRCVMIDCCTLR1 register [5.9,342/757] ibmvnic: set up 200GBPS speed [5.9,343/757] bpf: disallow attaching modify_return tracing functions to other BPF programs [5.9,344/757] selftests: Remove fmod_ret from test_overhead [5.9,345/757] qtnfmac: fix resource leaks on unsupported iftype error return path [5.9,346/757] pinctrl: aspeed: Use the right pinconf mask [5.9,347/757] iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate() [5.9,348/757] iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling [5.9,349/757] net: enic: Cure the enic api locking trainwreck [5.9,350/757] selftests/bpf: Fix endianness issues in sk_lookup/ctx_narrow_access [5.9,351/757] pinctrl: tigerlake: Fix register offsets for TGL-H variant [5.9,352/757] serial: 8250: Discard RTS/DTS setting from clock update method [5.9,353/757] serial: 8250: Skip uninitialized TTY port baud rate update [5.9,354/757] serial: 8250_dw: Fix clk-notifier/port suspend deadlock [5.9,355/757] mfd: syscon: Dont free allocated name for regmap_config [5.9,356/757] mfd: sm501: Fix leaks in probe() [5.9,357/757] dm: fix missing imposition of queue_limits from dm_wq_work() thread [5.9,358/757] pinctrl: single: fix pinctrl_spec.args_count bounds check [5.9,359/757] pinctrl: single: fix debug output when #pinctrl-cells = 2 [5.9,360/757] staging: rtl8712: Fix enqueue_reorder_recvframe() [5.9,361/757] ASoC: wm_adsp: Pass full name to snd_ctl_notify [5.9,362/757] iwlwifi: mvm: split a print to avoid a WARNING in ROC [5.9,363/757] iwlwifi: dbg: remove no filter condition [5.9,364/757] iwlwifi: dbg: run init_cfg function once per driver load [5.9,365/757] usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. [5.9,366/757] usb: gadget: u_serial: clear suspended flag when disconnecting [5.9,367/757] usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well [5.9,368/757] bus: mhi: core: Fix the building of MHI module [5.9,369/757] ocxl: fix kconfig dependency warning for OCXL [5.9,370/757] nl80211: fix non-split wiphy information [5.9,371/757] usb: dwc2: Fix INTR OUT transfers in DDMA mode. [5.9,372/757] scsi: target: tcmu: Fix warning: page may be used uninitialized [5.9,373/757] scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() [5.9,374/757] dmaengine: ioat: Allocate correct size for descriptor chunk [5.9,375/757] staging: qlge: fix build breakage with dumping enabled [5.9,376/757] ipmi_si: Fix wrong return value in try_smi_init() [5.9,377/757] tracing: Fix parse_synth_field() error handling [5.9,378/757] ASoC: mediatek: mt8183-da7219: fix wrong ops for I2S3 [5.9,379/757] staging: wfx: fix BA sessions for older firmwares [5.9,380/757] platform/x86: mlx-platform: Remove PSU EEPROM configuration [5.9,381/757] dm: fix request-based DM to not bounce through indirect dm_submit_bio [5.9,382/757] mwifiex: fix double free [5.9,383/757] drm/panfrost: increase readl_relaxed_poll_timeout values [5.9,384/757] drm/amdgpu: Fix invalid number of character { in amdgpu_acpi_init [5.9,385/757] ipvs: clear skb->tstamp in forwarding path [5.9,386/757] bpf, sockmap: Remove skb_orphan and let normal skb_kfree do cleanup [5.9,387/757] net: korina: fix kfree of rx/tx descriptor array [5.9,388/757] netfilter: nf_log: missing vlan offload tag and proto [5.9,389/757] mm/swapfile.c: fix potential memory leak in sys_swapon [5.9,390/757] mm: memcg/slab: fix racy access to page->mem_cgroup in mem_cgroup_from_obj() [5.9,391/757] mm/memcg: fix device private memcg accounting [5.9,392/757] mm/mmap.c: replace do_brk with do_brk_flags in comment of insert_vm_struct() [5.9,393/757] mm/page_alloc.c: fix freeing non-compound pages [5.9,394/757] mm, oom_adj: dont loop through tasks in __set_oom_adj when not necessary [5.9,395/757] fs: fix NULL dereference due to data race in prepend_path() [5.9,396/757] selftests/ftrace: Change synthetic event name for inter-event-combined test [5.9,397/757] tracing: Handle synthetic event array field type checking correctly [5.9,398/757] i3c: master add i3c_master_attach_boardinfo to preserve boardinfo [5.9,399/757] IB/mlx4: Fix starvation in paravirt mux/demux [5.9,400/757] IB/mlx4: Adjust delayed work when a dup is observed [5.9,401/757] powerpc/pseries: Fix missing of_node_put() in rng_init() [5.9,402/757] powerpc/icp-hv: Fix missing of_node_put() in success path [5.9,403/757] rcu/tree: Force quiescent state on callback overload [5.9,404/757] rcutorture: Properly set rcu_fwds for OOM handling [5.9,405/757] refperf: Avoid null pointer dereference when buf fails to allocate [5.9,406/757] RDMA/ucma: Fix locking for ctx->events_reported [5.9,407/757] RDMA/ucma: Add missing locking around rdma_leave_multicast() [5.9,408/757] mtd: lpddr: fix excessive stack usage with clang [5.9,409/757] RDMA/hns: Add a check for current state before modifying QP [5.9,410/757] RDMA/umem: Fix signature of stub ib_umem_find_best_pgsz() [5.9,411/757] powerpc/pseries: explicitly reschedule during drmem_lmb list traversal [5.9,412/757] pseries/drmem: dont cache node id in drmem_lmb struct [5.9,413/757] RDMA/mlx5: Fix potential race between destroy and CQE poll [5.9,414/757] mtd: mtdoops: Dont write panic data twice [5.9,415/757] selftests/powerpc: Fix prefixes in alignment_handler signal handler [5.9,416/757] perf tools: Make GTK2 support opt-in [5.9,417/757] tools feature: Add missing -lzstd to the fast path feature detection [5.9,418/757] ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values [5.9,419/757] xfs: fix finobt btree block recovery ordering [5.9,420/757] m68knommu: include SDHC support only when hardware has it [5.9,421/757] arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER [5.9,422/757] ida: Free allocated bitmap in error path [5.9,423/757] xfs: limit entries returned when counting fsmap records [5.9,424/757] xfs: fix deadlock and streamline xfs_getfsmap performance [5.9,425/757] nfs: add missing "posix" local_lock constant table definition [5.9,426/757] xfs: fix high key handling in the rt allocators query_range function [5.9,427/757] RDMA/rtrs-srv: Incorporate ib_register_client into rtrs server init [5.9,428/757] RDMA/core: Delete function indirection for alloc/free kernel CQ [5.9,429/757] RDMA: Allow fail of destroy CQ [5.9,430/757] RDMA: Change XRCD destroy return value [5.9,431/757] RDMA: Restore ability to return error for destroy WQ [5.9,432/757] RDMA/umem: Fix ib_umem_find_best_pgsz() for mappings that cross a page boundary [5.9,433/757] RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz() [5.9,434/757] RDMA/qedr: Fix qp structure memory leak [5.9,435/757] RDMA/qedr: Fix doorbell setting [5.9,436/757] RDMA/qedr: Fix use of uninitialized field [5.9,437/757] RDMA/qedr: Fix return code if accept is called on a destroyed qp [5.9,438/757] RDMA/qedr: Fix inline size returned for iWARP [5.9,439/757] powerpc/pseries/svm: Allocate SWIOTLB buffer anywhere in memory [5.9,440/757] powerpc/watchpoint: Fix quadword instruction handling on p10 predecessors [5.9,441/757] powerpc/watchpoint: Fix handling of vector instructions [5.9,442/757] powerpc/watchpoint: Add hw_len wherever missing [5.9,443/757] powerpc/book3s64/hash/4k: Support large linear mapping range with 4K [5.9,444/757] powerpc/tau: Use appropriate temperature sample interval [5.9,445/757] powerpc/tau: Convert from timer to workqueue [5.9,446/757] powerpc/tau: Remove duplicated set_thresholds() call [5.9,447/757] powerpc/tau: Check processor type before enabling TAU interrupt [5.9,448/757] powerpc/tau: Disable TAU between measurements [5.9,449/757] powerpc/kasan: Fix CONFIG_KASAN_VMALLOC for 8xx [5.9,450/757] powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm [5.9,451/757] powerpc/papr_scm: Fix warning triggered by perf_stats_show() [5.9,452/757] RDMA/cma: Combine cma_ndev_work with cma_work [5.9,453/757] RDMA/cma: Remove dead code for kernel rdmacm multicast [5.9,454/757] RDMA/cma: Consolidate the destruction of a cma_multicast in one place [5.9,455/757] RDMA/cma: Fix use after free race in roce multicast join [5.9,456/757] perf intel-pt: Fix "context_switch event has no tid" error [5.9,457/757] perf metricgroup: Fix uncore metric expressions [5.9,458/757] RDMA/qedr: Fix resource leak in qedr_create_qp [5.9,459/757] RDMA/hns: Set the unsupported wr opcode [5.9,460/757] RDMA/mlx5: Use set_mkc_access_pd_addr_fields() in reg_create() [5.9,461/757] RDMA/mlx5: Make mkeys always owned by the kernels PD when not enabled [5.9,462/757] RDMA/mlx5: Disable IB_DEVICE_MEM_MGT_EXTENSIONS if IB_WR_REG_MR cant work [5.9,463/757] i40iw: Add support to make destroy QP synchronous [5.9,464/757] perf stat: Skip duration_time in setup_system_wide [5.9,465/757] RDMA/hns: Add check for the validity of sl configuration [5.9,466/757] RDMA/hns: Solve the overflow of the calc_pg_sz() [5.9,467/757] RDMA/hns: Fix the wrong value of rnr_retry when querying qp [5.9,468/757] RDMA/hns: Fix configuration of ack_req_freq in QPC [5.9,469/757] RDMA/hns: Fix missing sq_sig_type when querying QP [5.9,470/757] RDMA/mlx5: Fix type warning of sizeof in __mlx5_ib_alloc_counters() [5.9,471/757] mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access [5.9,472/757] mtd: rawnand: stm32_fmc2: fix a buffer overflow [5.9,473/757] mtd: rawnand: vf610: disable clk on error handling path in probe [5.9,474/757] mtd: spinand: gigadevice: Only one dummy byte in QUADIO [5.9,475/757] mtd: spinand: gigadevice: Add QE Bit [5.9,476/757] mtd: rawnand: ams-delta: Fix non-OF build warning [5.9,477/757] kdb: Fix pager search for multi-line strings [5.9,478/757] overflow: Include header file with SIZE_MAX declaration [5.9,479/757] mtd: parsers: bcm63xx: Do not make it modular [5.9,480/757] RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces [5.9,481/757] powerpc/64: fix irq replay missing preempt [5.9,482/757] powerpc/64: fix irq replay pt_regs->softe value [5.9,483/757] powerpc: PPC_SECURE_BOOT should not require PowerNV [5.9,484/757] powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group constraints [5.9,485/757] powerpc/perf/hv-gpci: Fix starting index value [5.9,486/757] perf stat: Fix out of bounds CPU map access when handling armv8_pmu events [5.9,487/757] i3c: master: Fix error return in cdns_i3c_master_probe() [5.9,488/757] powerpc/security: Fix link stack flush instruction [5.9,489/757] powerpc/book3s64/radix: Make radix_mem_block_size 64bit [5.9,490/757] powerpc/papr_scm: Add PAPR command family to pass-through command-set [5.9,491/757] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_reboot_notifier [5.9,492/757] IB/rdmavt: Fix sizeof mismatch [5.9,493/757] RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt() [5.9,494/757] f2fs: reject CASEFOLD inode flag without casefold feature [5.9,495/757] um: vector: Use GFP_ATOMIC under spin lock [5.9,496/757] um: time-travel: Fix IRQ handling in time_travel_handle_message() [5.9,497/757] thermal: core: Adding missing nlmsg_free() in thermal_genl_sampling_temp() [5.9,498/757] maiblox: mediatek: Fix handling of platform_get_irq() error [5.9,499/757] perf trace: Fix off by ones in memset() after realloc() in arches using libaudit [5.9,500/757] selftests/powerpc: Fix eeh-basic.sh exit codes [5.9,501/757] f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info [5.9,502/757] afs: Fix rapid cell addition/removal by not using RCU on cells tree [5.9,503/757] afs: Fix cell refcounting by splitting the usage counter [5.9,504/757] afs: Fix cell purging with aliases [5.9,505/757] afs: Fix cell removal [5.9,506/757] RDMA/rxe: Handle skb_clone() failure in rxe_recv.c [5.9,507/757] mm/page_owner: change split_page_owner to take a count [5.9,508/757] mm/huge_memory: fix split assumption of page size [5.9,509/757] mm: fix a race during THP splitting [5.9,510/757] lib/crc32.c: fix trivial typo in preprocessor condition [5.9,511/757] ramfs: fix nommu mmap with gaps in the page cache [5.9,512/757] rapidio: fix error handling path [5.9,513/757] rapidio: fix the missed put_device() for rio_mport_add_riodev [5.9,514/757] mailbox: avoid timer start from callback [5.9,515/757] clk: meson: axg-audio: separate axg and g12a regmap tables [5.9,516/757] rtc: ds1307: Clear OSF flag on DS1388 when setting time [5.9,517/757] i2c: rcar: Auto select RESET_CONTROLLER [5.9,518/757] clk: meson: g12a: mark fclk_div2 as critical [5.9,519/757] PCI: designware-ep: Fix the Header Type check [5.9,520/757] PCI: aardvark: Fix compilation on s390 [5.9,521/757] PCI: aardvark: Check for errors from pci_bridge_emul_init() call [5.9,522/757] PCI: iproc: Set affinity mask on MSI interrupts [5.9,523/757] rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge() [5.9,524/757] rpmsg: Avoid double-free in mtk_rpmsg_register_device [5.9,525/757] remoteproc: stm32: Fix pointer assignement [5.9,526/757] PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY [5.9,527/757] vfio: add a singleton check for vfio_group_pin_pages [5.9,528/757] s390/pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY [5.9,529/757] vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn [5.9,530/757] vfio: fix a missed vfio group put in vfio_pin_pages [5.9,531/757] vfio/type1: fix dirty bitmap calculation in vfio_dma_rw [5.9,532/757] clk: qcom: gcc-sdm660: Fix wrong parent_map [5.9,533/757] clk: keystone: sci-clk: fix parsing assigned-clock data during probe [5.9,534/757] pwm: rockchip: Keep enabled PWMs running while probing [5.9,535/757] pwm: img: Fix null pointer access in probe [5.9,536/757] nfsd: Cache R, RW, and W opens separately [5.9,537/757] remoteproc/mediatek: fix null pointer dereference on null scp pointer [5.9,538/757] PCI: hv: Fix hibernation in case interrupts are not re-created [5.9,539/757] clk: rockchip: Initialize hw to error to avoid undefined behavior [5.9,540/757] clk: mediatek: add UART0 clock support [5.9,541/757] module: statically initialize init section freeing data [5.9,542/757] clk: at91: clk-main: update key before writing AT91_CKGR_MOR [5.9,543/757] clk: bcm2835: add missing release if devm_clk_hw_register fails [5.9,544/757] kbuild: deb-pkg: do not build linux-headers package if CONFIG_MODULES=n [5.9,545/757] watchdog: Fix memleak in watchdog_cdev_register [5.9,546/757] watchdog: Use put_device on error [5.9,547/757] watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3 [5.9,548/757] clk: at91: sam9x60: support only two programmable clocks [5.9,549/757] svcrdma: fix bounce buffers for unaligned offsets and multiple pages [5.9,550/757] ext4: fix dead loop in ext4_mb_new_blocks [5.9,551/757] ext4: discard preallocations before releasing group lock [5.9,552/757] ext4: disallow modifying DAX inode flag if inline_data has been set [5.9,553/757] ext4: limit entries returned when counting fsmap records [5.9,554/757] vfio/pci: Clear token on bypass registration failure [5.9,555/757] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages [5.9,556/757] clk: qcom: gdsc: Keep RETAIN_FF bit set if gdsc is already on [5.9,557/757] clk: imx8mq: Fix usdhc parents order [5.9,558/757] SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() [5.9,559/757] NFSv4.2: Fix NFS4ERR_STALE error when doing inter server copy [5.9,560/757] platform/chrome: cros_ec_typec: Send enum values to usb_role_switch_set_role() [5.9,561/757] platform/chrome: cros_ec_lightbar: Reduce ligthbar get version command [5.9,562/757] Input: elants_i2c - fix typo for an attribute to show calibration count [5.9,563/757] Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() [5.9,564/757] Input: stmfts - fix a & vs && typo [5.9,565/757] Input: ep93xx_keypad - fix handling of platform_get_irq() error [5.9,566/757] Input: omap4-keypad - fix handling of platform_get_irq() error [5.9,567/757] Input: twl4030_keypad - fix handling of platform_get_irq() error [5.9,568/757] Input: sun4i-ps2 - fix handling of platform_get_irq() error [5.9,569/757] KVM: x86: emulating RDPID failure shall return #UD rather than #GP [5.9,570/757] KVM: nSVM: CR3 MBZ bits are only 63:52 [5.9,571/757] scsi: bfa: Fix error return in bfad_pci_init() [5.9,572/757] arm64: mm: use single quantity to represent the PA to VA translation [5.9,573/757] bpf: Enforce id generation for all may-be-null register type [5.9,574/757] net: dsa: seville: the packet buffer is 2 megabits, not megabytes [5.9,575/757] netfilter: conntrack: connection timeout after re-register [5.9,576/757] netfilter: ebtables: Fixes dropping of small packets in bridge nat [5.9,577/757] vdpa/mlx5: Make use of a specific 16 bit endianness API [5.9,578/757] vdpa/mlx5: Fix failure to bring link up [5.9,579/757] vdpa/mlx5: Setup driver only if VIRTIO_CONFIG_S_DRIVER_OK [5.9,580/757] selftests: mptcp: depends on built-in IPv6 [5.9,581/757] netfilter: nf_fwd_netdev: clear timestamp in forwarding path [5.9,582/757] soc: xilinx: Fix error code in zynqmp_pm_probe() [5.9,583/757] arm64: dts: meson: vim3: correct led polarity [5.9,584/757] ARM: dts: imx6sl: fix rng node [5.9,585/757] ARM: at91: pm: of_node_put() after its usage [5.9,586/757] ARM: s3c24xx: fix mmc gpio lookup tables [5.9,587/757] memory: brcmstb_dpfe: fix array index out of bounds [5.9,588/757] ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator [5.9,589/757] arm64: dts: allwinner: h5: remove Mali GPU PMU module [5.9,590/757] memory: omap-gpmc: Fix a couple off by ones [5.9,591/757] memory: omap-gpmc: Fix build error without CONFIG_OF [5.9,592/757] arm64: dts: qcom: msm8992: Fix UART interrupt property [5.9,593/757] arm64: dts: qcom: sdm845-db845c: Fix hdmi nodes [5.9,594/757] arm64: dts: qcom: sm8150: fix up primary USB nodes [5.9,595/757] arm64: dts: qcom: sc7180: Fix the LLCC base register size [5.9,596/757] memory: fsl-corenet-cf: Fix handling of platform_get_irq() error [5.9,597/757] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free [5.9,598/757] arm64: dts: mt8173-elm: fix supported values for regulator-allowed-modes of da9211 [5.9,599/757] arm64: dts: qcom: sm8250: Rename UART2 node to UART12 [5.9,600/757] dmaengine: ti: k3-udma-glue: Fix parameters for rx ring pair request [5.9,601/757] arm64: dts: imx8mq: Add missing interrupts to GPC [5.9,602/757] arm64: dts: qcom: sc7180: Drop flags on mdss irqs [5.9,603/757] arm64: dts: sdm845: Fixup OPP table for all qup devices [5.9,604/757] soc: qcom: pdr: Fixup array type of get_domain_list_resp message [5.9,605/757] arm64: dts: qcom: msm8916: Remove one more thermal trip point unit name [5.9,606/757] arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec [5.9,607/757] arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts [5.9,608/757] soc: qcom: apr: Fixup the error displayed on lookup failure [5.9,609/757] dt-bindings: crypto: Specify that allwinner, sun8i-a33-crypto needs reset [5.9,610/757] arm64: dts: renesas: r8a77990: Fix MSIOF1 DMA channels [5.9,611/757] arm64: dts: renesas: r8a774c0: Fix MSIOF1 DMA channels [5.9,612/757] arm64: dts: mt8173: elm: Fix nor_flash node property [5.9,613/757] arm64: dts: ti: k3-j721e: Rename mux header and update macro names [5.9,614/757] arm64: dts: actions: limit address range for pinctrl node [5.9,615/757] ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers [5.9,616/757] soc: fsl: qbman: Fix return value on success [5.9,617/757] ARM: OMAP2+: Restore MPU power domain if cpu_cluster_pm_enter() fails [5.9,618/757] ARM: dts: stm32: Fix sdmmc2 pins on AV96 [5.9,619/757] ARM: dts: stm32: lxa-mc1: Fix kernel warning about PHY delays [5.9,620/757] ARM: dts: stm32: Move ethernet PHY into DH SoM DT [5.9,621/757] ARM: dts: stm32: Swap PHY reset GPIO and TSC2004 IRQ on DHCOM SOM [5.9,622/757] ARM: dts: stm32: Fix DH PDK2 display PWM channel [5.9,623/757] ARM: dts: iwg20d-q7-common: Fix touch controller probe failure [5.9,624/757] soc: mediatek: cmdq: add clear option in cmdq_pkt_wfe api [5.9,625/757] drm/mediatek: reduce clear event [5.9,626/757] arm64: dts: zynqmp: Remove additional compatible string for i2c IPs [5.9,627/757] ARM: dts: meson8: remove two invalid interrupt lines from the GPU node [5.9,628/757] lightnvm: fix out-of-bounds write to array devices->info[] [5.9,629/757] powerpc/powernv/dump: Fix race while processing OPAL dump [5.9,630/757] powerpc/64s: Remove TM from Power10 features [5.9,631/757] powerpc/pseries: Avoid using addr_to_pfn in real mode [5.9,632/757] nvmet: fix uninitialized work for zero kato [5.9,633/757] nvmet: limit passthru MTDS by BIO_MAX_PAGES [5.9,634/757] KVM: ioapic: break infinite recursion on lazy EOI [5.9,635/757] NTB: hw: amd: fix an issue about leak system resources [5.9,636/757] ntb: intel: Fix memleak in intel_ntb_pci_probe [5.9,637/757] sched/features: Fix !CONFIG_JUMP_LABEL case [5.9,638/757] perf: correct SNOOPX field offset [5.9,639/757] random32: make prandom_u32() output unpredictable [5.9,640/757] i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the... [5.9,641/757] md/bitmap: fix memory leak of temporary bitmap [5.9,642/757] block: ratelimit handle_bad_sector() message [5.9,643/757] x86/dumpstack: Fix misleading instruction pointer error message [5.9,644/757] crypto: ccp - fix error handling [5.9,645/757] x86/asm: Replace __force_order with a memory clobber [5.9,646/757] x86/mce: Add Skylake quirk for patrol scrub reported errors [5.9,647/757] media: firewire: fix memory leak [5.9,648/757] media: ati_remote: sanity check for both endpoints [5.9,649/757] media: st-delta: Fix reference count leak in delta_run_work [5.9,650/757] media: sti: Fix reference count leaks [5.9,651/757] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync [5.9,652/757] media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync [5.9,653/757] media: exynos4-is: Fix a reference count leak [5.9,654/757] media: vsp1: Fix runtime PM imbalance on error [5.9,655/757] media: platform: s3c-camif: Fix runtime PM imbalance on error [5.9,656/757] media: platform: sti: hva: Fix runtime PM imbalance on error [5.9,657/757] media: bdisp: Fix runtime PM imbalance on error [5.9,658/757] media: media/pci: prevent memory leak in bttv_probe [5.9,659/757] x86/mce: Annotate mce_rd/wrmsrl() with noinstr [5.9,660/757] crypto: hisilicon - fixed memory allocation error [5.9,661/757] spi: fsi: Fix clock running too fast [5.9,662/757] blk-mq: always allow reserved allocation in hctx_may_queue [5.9,663/757] x86/mce: Make mce_rdmsrl() panic on an inaccessible MSR [5.9,664/757] media: uvcvideo: Ensure all probed info is returned to v4l2 [5.9,665/757] mmc: sdio: Check for CISTPL_VERS_1 buffer size [5.9,666/757] media: saa7134: avoid a shift overflow [5.9,667/757] media: atomisp: fix memleak in ia_css_stream_create [5.9,668/757] media: venus: fixes for list corruption [5.9,669/757] notifier: Fix broken error handling pattern [5.9,670/757] fs: dlm: fix configfs memory leak [5.9,671/757] media: venus: core: Fix error handling in probe [5.9,672/757] media: venus: core: Fix runtime PM imbalance in venus_probe [5.9,673/757] ntfs: add check for mft record size in superblock [5.9,674/757] ip_gre: set dev->hard_header_len and dev->needed_headroom properly [5.9,675/757] mac80211: handle lack of sband->bitrates in rates [5.9,676/757] staging: wfx: fix handling of MMIC error [5.9,677/757] libbpf: Close map fd if init map slots failed [5.9,678/757] bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI [5.9,679/757] PM: hibernate: remove the bogus call to get_gendisk() in software_resume() [5.9,680/757] scsi: mvumi: Fix error return in mvumi_io_attach() [5.9,681/757] scsi: target: core: Add CONTROL field for trace events [5.9,682/757] mic: vop: copy data to kernel space then write to io memory [5.9,683/757] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic [5.9,684/757] usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc [5.9,685/757] usb: gadget: function: printer: fix use-after-free in __lock_acquire [5.9,686/757] rtw88: pci: Power cycle device during shutdown [5.9,687/757] udf: Limit sparing table size [5.9,688/757] udf: Avoid accessing uninitialized data on failed inode read [5.9,689/757] rtw88: increse the size of rx buffer size [5.9,690/757] selftests/bpf: Fix overflow tests to reflect iter size increase [5.9,691/757] USB: cdc-acm: handle broken union descriptors [5.9,692/757] mt76: mt7915: do not do any work in napi poll after calling napi_complete_done() [5.9,693/757] usb: dwc3: simple: add support for Hikey 970 [5.9,694/757] habanalabs: cast to u64 before shift > 31 bits [5.9,695/757] can: flexcan: flexcan_chip_stop(): add error handling and propagate error value [5.9,696/757] HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons [5.9,697/757] ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() [5.9,698/757] drm/panfrost: add Amlogic GPU integration quirks [5.9,699/757] drm/panfrost: add amlogic reset quirk callback [5.9,700/757] drm/panfrost: add support for vendor quirk [5.9,701/757] bpf: Limit callers stack depth 256 for subprogs with tailcalls [5.9,702/757] dma-direct: Fix potential NULL pointer dereference [5.9,703/757] misc: rtsx: Fix memory leak in rtsx_pci_probe [5.9,704/757] reiserfs: only call unlock_new_inode() if I_NEW [5.9,705/757] opp: Prevent memory leak in dev_pm_opp_attach_genpd() [5.9,706/757] xfs: make sure the rt allocator doesnt run off the end [5.9,707/757] usb: ohci: Default to per-port over-current protection [5.9,708/757] drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create [5.9,709/757] Bluetooth: Only mark socket zapped after unlocking [5.9,710/757] drm/msm/a6xx: fix a potential overflow issue [5.9,711/757] drm/xlnx: Use devm_drm_dev_alloc [5.9,712/757] iomap: fix WARN_ON_ONCE() from unprivileged users [5.9,713/757] scsi: ibmvfc: Fix error return in ibmvfc_probe() [5.9,714/757] scsi: qla2xxx: Warn if done() or free() are called on an already freed srb [5.9,715/757] selftests/bpf: Fix test_sysctl_loop{1, 2} failure due to clang change [5.9,716/757] soundwire: cadence: fix race condition between suspend and Slave device alerts [5.9,717/757] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy [5.9,718/757] rtl8xxxu: prevent potential memory leak [5.9,719/757] Fix use after free in get_capset_info callback. [5.9,720/757] HID: ite: Add USB id match for Acer One S1003 keyboard dock [5.9,721/757] scsi: qedf: Return SUCCESS if stale rport is encountered [5.9,722/757] scsi: qedi: Mark all connections for recovery on link down event [5.9,723/757] scsi: qedi: Protect active command list to avoid list corruption [5.9,724/757] scsi: qedi: Fix list_del corruption while removing active I/O [5.9,725/757] fbmem: add margin check to fb_check_caps() [5.9,726/757] tty: ipwireless: fix error handling [5.9,727/757] Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb [5.9,728/757] ipvs: Fix uninit-value in do_ip_vs_set_ctl() [5.9,729/757] reiserfs: Fix memory leak in reiserfs_parse_options() [5.9,730/757] s390/qeth: strictly order bridge address events [5.9,731/757] mwifiex: dont call del_timer_sync() on uninitialized timer [5.9,732/757] ALSA: hda/ca0132 - Add AE-7 microphone selection commands. [5.9,733/757] ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7. [5.9,734/757] ASoC: SOF: Add topology filename override based on dmi data match [5.9,735/757] ASoC: Intel: sof_rt5682: override quirk data for tgl_max98373_rt5682 [5.9,736/757] scsi: smartpqi: Avoid crashing kernel for controller issues [5.9,737/757] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach [5.9,738/757] usb: core: Solve race condition in anchor cleanup functions [5.9,739/757] soundwire: intel: reinitialize IP+DSP in .prepare(), but only when resuming [5.9,740/757] scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config() [5.9,741/757] drm/amd/display: Screen corruption on dual displays (DP+USB-C) [5.9,742/757] dmaengine: dw: Add DMA-channels mask cell support [5.9,743/757] dmaengine: dw: Activate FIFO-mode for memory peripherals only [5.9,744/757] drm/hisilicon: Code refactoring for hibmc_drv_de [5.9,745/757] drm/amd/display: Disconnect pipe separetely when disable pipe split [5.9,746/757] drm/panfrost: perfcnt: fix ref count leak in panfrost_perfcnt_enable_locked [5.9,747/757] ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() [5.9,748/757] net: korina: cast KSEG0 address to pointer in kfree [5.9,749/757] s390/qeth: dont let HW override the configured port role [5.9,750/757] tty: serial: lpuart: fix lpuart32_write usage [5.9,751/757] tty: serial: fsl_lpuart: fix lpuart32_poll_get_char [5.9,752/757] usb: gadget: bcm63xx_udc: fix up the error of undeclared usb_debug_root [5.9,753/757] usb: cdc-acm: add quirk to blacklist ETAS ES58X devices [5.9,754/757] USB: cdc-wdm: Make wdm_flush() interruptible and add wdm_fsync(). [5.9,755/757] usb: cdns3: gadget: free interrupt after gadget has deleted [5.9,756/757] eeprom: at25: set minimum read/write access stride to 1 [5.9,757/757] usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets.

Commit Message

Greg KH Oct. 27, 2020, 1:45 p.m. UTC

From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>

commit f6426ab9c957e97418ac5b0466538792767b1738 upstream.

The function amd_ir_set_vcpu_affinity makes use of the parameter struct
amd_iommu_pi_data.prev_ga_tag to determine if it should delete struct
amd_iommu_pi_data from a list when not running in AVIC mode.

However, prev_ga_tag is initialized only when AVIC is enabled. The non-zero
uninitialized value can cause unintended code path, which ends up making
use of the struct vcpu_svm.ir_list and ir_list_lock without being
initialized (since they are intended only for the AVIC case).

This triggers NULL pointer dereference bug in the function vm_ir_list_del
with the following call trace:

    svm_update_pi_irte+0x3c2/0x550 [kvm_amd]
    ? proc_create_single_data+0x41/0x50
    kvm_arch_irq_bypass_add_producer+0x40/0x60 [kvm]
    __connect+0x5f/0xb0 [irqbypass]
    irq_bypass_register_producer+0xf8/0x120 [irqbypass]
    vfio_msi_set_vector_signal+0x1de/0x2d0 [vfio_pci]
    vfio_msi_set_block+0x77/0xe0 [vfio_pci]
    vfio_pci_set_msi_trigger+0x25c/0x2f0 [vfio_pci]
    vfio_pci_set_irqs_ioctl+0x88/0xb0 [vfio_pci]
    vfio_pci_ioctl+0x2ea/0xed0 [vfio_pci]
    ? alloc_file_pseudo+0xa5/0x100
    vfio_device_fops_unl_ioctl+0x26/0x30 [vfio]
    ? vfio_device_fops_unl_ioctl+0x26/0x30 [vfio]
    __x64_sys_ioctl+0x96/0xd0
    do_syscall_64+0x37/0x80
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

Therefore, initialize prev_ga_tag to zero before use. This should be safe
because ga_tag value 0 is invalid (see function avic_vm_init).

Fixes: dfa20099e26e ("KVM: SVM: Refactor AVIC vcpu initialization into avic_init_vcpu()")
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20201003232707.4662-1-suravee.suthikulpanit@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kvm/svm/avic.c |    1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

--- a/arch/x86/kvm/svm/avic.c
+++ b/arch/x86/kvm/svm/avic.c
@@ -868,6 +868,7 @@  int svm_update_pi_irte(struct kvm *kvm,
 			 * - Tell IOMMU to use legacy mode for this interrupt.
 			 * - Retrieve ga_tag of prior interrupt remapping data.
 			 */
+			pi.prev_ga_tag = 0;
 			pi.is_guest_mode = false;
 			ret = irq_set_vcpu_affinity(host_irq, &pi);