merge-upstream/v5.15.166 from branch/tag: upstream/v5.15.166 into branch: main-R105-cos-5.15
Changelog:
-------------------------------------------------------------
Abhinav Kumar (1):
drm/msm/dp: reset the link phy params before link training
Adrian Hunter (1):
clocksource: Make watchdog and suspend-timing multiplication overflow safe
Al Viro (4):
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
memcg_write_event_control(): fix a user-triggerable oops
afs: fix __afs_break_callback() / afs_drop_open_mmap() race
fuse: fix UAF in rcu pathwalks
Aleksandr Mishin (1):
nfc: pn533: Add poll mod list filling check
Alex Deucher (2):
drm/amdgpu/jpeg2: properly set atomics vmid field
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
Alex Hung (2):
drm/amd/display: Validate hw_points_num before using it
Revert "drm/amd/display: Validate hw_points_num before using it"
Alexander Gordeev (1):
s390/iucv: fix receive buffer virtual vs physical address confusion
Alexander Lobakin (5):
fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
s390/cio: rename bitmap_size() -> idset_bitmap_size()
btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
bitmap: introduce generic optimized bitmap_size()
tools: move alignment-related macros to new <linux/align.h>
Allison Henderson (1):
net:rds: Fix possible deadlock in rds_message_put
Andreas Gruenbacher (1):
gfs2: setattr_chown: Add missing initialization
Antoniu Miclaus (1):
hwmon: (ltc2992) Avoid division by zero
Ashish Mhetre (1):
memory: tegra: Skip SID programming if SID registers aren't set
Aurelien Jarno (1):
media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
Baokun Li (2):
ext4: do not trim the group with corrupted block bitmap
ext4: set the type of max_zeroout to unsigned int to avoid overflow
Bas Nieuwenhuizen (1):
drm/amdgpu: Actually check flags for all context ops.
Ben Hutchings (1):
scsi: aacraid: Fix double-free on probe failure
Ben Whitten (1):
mmc: dw_mmc: allow biu and ciu clocks to defer
Chaotian Jing (1):
scsi: core: Fix the return value of scsi_logical_block_count()
Chen Ridong (1):
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
Chengfeng Ye (2):
staging: ks7010: disable bh on tx_dev_lock
IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
Christian Brauner (1):
binfmt_misc: cleanup on filesystem umount
Christophe Kerello (1):
memory: stm32-fmc2-ebi: check regmap_read return value
Chuck Lever (6):
NFSD: Refactor nfsd_reply_cache_free_locked()
NFSD: Rename nfsd_reply_cache_alloc()
NFSD: Replace nfsd_prune_bucket()
NFSD: Refactor the duplicate reply cache shrinker
NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
NFSD: Fix frame size warning in svc_export_parse()
Claudio Imbrenda (1):
s390/uv: Panic for set and remove shared access UVC errors
Cong Wang (1):
gtp: fix a potential NULL pointer dereference
Cosmin Ratiu (1):
net/mlx5e: Correctly report errors for ethtool rx flows
Dan Carpenter (3):
atm: idt77252: prevent use after free in dequeue_rx()
dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
mmc: mmc_test: Fix NULL dereference on allocation failure
Daniel Wagner (1):
nvmet-trace: avoid dereferencing pointer too early
David Lechner (1):
staging: iio: resolver: ad2s1210: fix use before initialization
David Sterba (5):
btrfs: change BUG_ON to assertion when checking for delayed_node root
btrfs: handle invalid root reference found in may_destroy_subvol()
btrfs: send: handle unexpected data in header buffer in begin_cmd()
btrfs: change BUG_ON to assertion in tree_move_down()
btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
David Thompson (1):
mlxbf_gige: disable RX filters until RX path initialized
Dmitry Baryshkov (2):
drm/msm/dpu: don't play tricks with debug macros
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
Donald Hunter (1):
netfilter: flowtable: initialise extack before use
Eli Billauer (3):
char: xillybus: Don't destroy workqueue from work item running on it
char: xillybus: Refine workqueue handling
char: xillybus: Check USB endpoints when probing device
Eric Dumazet (6):
netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
gtp: pull network headers in gtp_dev_xmit()
ipv6: prevent UAF in ip6_send_skb()
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: prevent possible UAF in ip6_xmit()
net: busy-poll: use ktime_get_ns() instead of local_clock()
Erico Nunes (1):
drm/lima: set gp bus_stop bit before hard reset
Eugene Syromiatnikov (1):
mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
Faizal Rahim (3):
igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
igc: Fix reset adapter logics when tx mode change
igc: Fix qbv tx latency by setting gtxoffset
Florian Westphal (1):
netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
Gergo Koteles (1):
platform/x86: lg-laptop: fix %s null argument warning
Greg Kroah-Hartman (2):
Revert "MIPS: Loongson64: reset: Prioritise firmware service"
Linux 5.15.166
Griffin Kroah-Hartman (1):
Bluetooth: MGMT: Add error handling to pair_device()
Guanrui Huang (1):
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
Guenter Roeck (1):
apparmor: fix policy_unpack_test on big endian systems
Haibo Xu (1):
arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
Haiyang Zhang (1):
net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
Hannes Reinecke (1):
nvmet-tcp: do not continue for invalid icreq
Hans J. Schultz (1):
net: dsa: mv88e6xxx: read FID when handling ATU violations
Hans Verkuil (3):
media: radio-isa: use dev_name to fill in bus_info
media: qcom: venus: fix incorrect return value
media: pci: cx23885: check cx23885_vdev_init() return
Heiko Carstens (1):
s390/smp,mcck: fix early IPI handling
Helge Deller (1):
parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
Huang-Huang Bao (1):
pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
Ian Ray (1):
cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
Jamie Bainbridge (1):
ethtool: check device is present when getting link settings
Jan Kara (1):
quota: Remove BUG_ON from dqget()
Jann Horn (1):
fuse: Initialize beyond-EOF page contents before setting uptodate
Jarkko Nikula (2):
i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
Jason Gerecke (1):
HID: wacom: Defer calculation of resolution until resolution_code is known
Javier Carrasco (1):
hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
Jeff Johnson (1):
wifi: cw1200: Avoid processing an invalid TIM IE
Jeff Layton (2):
nfsd: move reply cache initialization into nfsd startup
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
Jesse Zhang (1):
drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
Jian Shen (1):
net: hns3: add checking for vf id of mailbox
Jiaxun Yang (1):
MIPS: Loongson64: Set timer mode in cpu-probe
Jie Wang (2):
net: hns3: fix wrong use of semaphore up
net: hns3: fix a deadlock problem when config TC during resetting
Johannes Berg (2):
wifi: cfg80211: check wiphy mutex is held for wdev mutex
wifi: mac80211: fix BA session teardown race
Josef Bacik (11):
sunrpc: don't change ->sv_stats if it doesn't exist
nfsd: stop setting ->pg_stats for unused stats
sunrpc: pass in the sv_stats struct through svc_create_pooled
sunrpc: remove ->pg_stats from svc_program
sunrpc: use the struct net as the svc proc private
nfsd: rename NFSD_NET_* to NFSD_STATS_*
nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
nfsd: make all of the nfsd stats per-network namespace
nfsd: remove nfsd_stats, make th_cnt a global counter
nfsd: make svc_stat per-network namespace instead of global
btrfs: run delayed iputs when flushing delalloc
Joseph Huang (1):
net: dsa: mv88e6xxx: Fix out-of-bound access
Juan José Arboleda (1):
ALSA: usb-audio: Support Yamaha P-125 quirk entry
Justin Tee (1):
scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
Kees Cook (2):
net/sun3_82586: Avoid reading past buffer in debug output
x86: Increase brk randomness entropy for 64-bit systems
Khazhismel Kumykov (1):
dm resume: don't return EINVAL when signalled
Krishna Kurapati (1):
usb: dwc3: core: Skip setting event buffers for host only controllers
Krzysztof Kozlowski (4):
soundwire: stream: fix programming slave ports for non-continous port maps
usb: dwc3: omap: add missing depopulate in probe error path
usb: dwc3: st: fix probed platform device ref count on probe error path
usb: dwc3: st: add missing depopulate in probe error path
Kuniyuki Iwashima (1):
kcm: Serialise kcm_sendmsg() for the same socket.
Kunwu Chan (1):
powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
Lee, Chun-Yi (1):
Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
Li Nan (1):
md: clean up invalid BUG_ON in md_ioctl
Li zeming (1):
powerpc/boot: Handle allocation failure in simple_realloc()
Lianqin Hu (1):
ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
Long Li (1):
net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings
Luiz Augusto von Dentz (3):
Bluetooth: bnep: Fix out-of-bound access
Bluetooth: hci_core: Fix LE quote calculation
Bluetooth: SMP: Fix assumption of Central always being Initiator
Ma Ke (1):
pinctrl: single: fix potential NULL dereference in pcs_get_function()
Maciej Fijalkowski (1):
ice: fix ICE_LAST_OFFSET formula
Marc Zyngier (1):
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
Martin Blumenstingl (1):
clocksource/drivers/arm_global_timer: Guard against division by zero
Mathias Nyman (1):
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
Matthieu Baerts (NGI0) (1):
mptcp: sched: check both backup in retrans
Max Filippov (1):
fs: binfmt_elf_efpic: don't use missing interpreter's properties
Maximilian Luz (1):
platform/surface: aggregator: Fix warning when controller is destroyed in probe
Michael Ellerman (1):
powerpc/boot: Only free if realloc() succeeds
Mika Westerberg (1):
thunderbolt: Mark XDomain as unplugged when router is removed
Mike Christie (1):
scsi: spi: Fix sshdr use
Mikulas Patocka (2):
dm persistent data: fix memory allocation failure
dm suspend: return -ERESTARTSYS instead of -EINTR
Miri Korenblit (1):
wifi: iwlwifi: abort scan when rfkill on but device enabled
Muhammad Husaini Zulkifli (2):
igc: Correct the launchtime offset
igc: remove I226 Qbv BaseTime restriction
Mukesh Sisodiya (1):
wifi: iwlwifi: fw: Fix debugfs command sending
NeilBrown (1):
NFS: avoid infinite loop in pnfs_update_layout.
Niklas Cassel (1):
ata: libata-core: Fix null pointer dereference on error
Nikolay Aleksandrov (4):
bonding: fix bond_ipsec_offload_ok return type
bonding: fix null pointer deref in bond_ipsec_offload_ok
bonding: fix xfrm real_dev null pointer dereference
bonding: fix xfrm state handling when clearing active slave
Nikolay Kuratov (1):
cxgb4: add forgotten u64 ivlan cast before shift
Oreoluwa Babatunde (1):
openrisc: Call setup_memory() earlier in the init sequence
Pablo Neira Ayuso (1):
netfilter: flowtable: validate vlan header
Parsa Poorshikhian (1):
ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
Paul Cercueil (3):
PM: core: Remove DEFINE_UNIVERSAL_DEV_PM_OPS() macro
PM: core: Add EXPORT[_GPL]_SIMPLE_DEV_PM_OPS macros
PM: runtime: Add DEFINE_RUNTIME_DEV_PM_OPS() macro
Pawel Dembicki (3):
net: dsa: vsc73xx: pass value in phy_write operation
net: dsa: vsc73xx: use read_poll_timeout instead delay loop
net: dsa: vsc73xx: check busy flag in MDIO operations
Pawel Laszczak (2):
usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
usb: cdnsp: fix for Link TRB with TC
Phil Chang (1):
hrtimer: Prevent queuing of hrtimer without a function callback
Philipp Stanner (1):
media: drivers/media/dvb-core: copy user arrays safely
Piyush Mehta (3):
phy: xilinx: add runtime PM support
phy: xilinx: phy-zynqmp: dynamic clock support for power-save
phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
Qu Wenruo (1):
btrfs: tree-checker: add dev extent item checks
Radhey Shyam Pandey (1):
net: axienet: Fix register defines comment description
Rand Deeb (1):
ssb: Fix division by zero issue in ssb_calc_clock_rate
Sagi Grimberg (1):
nvmet-rdma: fix possible bad dereference when freeing rsps
Samuel Holland (1):
arm64: Fix KASAN random tag seed initialization
Sascha Hauer (1):
wifi: mwifiex: duplicate static structs used in driver instances
Sean Anderson (3):
net: xilinx: axienet: Always disable promiscuous mode
net: xilinx: axienet: Fix dangling multicast addresses
phy: zynqmp: Enable reference clock correctly
Sebastian Andrzej Siewior (2):
netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
Selvarasu Ganesan (1):
usb: dwc3: core: Prevent USB core invalid event buffer address access
Serge Semin (2):
dmaengine: dw: Add peripheral bus width verification
dmaengine: dw: Add memory bus width verification
Siarhei Vishniakou (1):
HID: microsoft: Add rumble support to latest xbox controllers
Simon Horman (1):
tc-testing: don't access non-existent variable on exception
Stefan Haberland (1):
s390/dasd: fix error recovery leading to data corruption on ESE devices
Stefan Hajnoczi (1):
virtiofs: forbid newlines in tags
Stephen Hemminger (1):
netem: fix return value if duplicate enqueue fails
Takashi Iwai (1):
ALSA: timer: Relax start tick time check for slave timer elements
Tetsuo Handa (2):
block: use "unsigned long" for blk_validate_block_size().
Input: MT - limit max slots
Thomas Bogendoerfer (1):
ip6_tunnel: Fix broken GRO
Tom Hughes (1):
netfilter: allow ipv6 fragments to arrive on different devices
Uwe Kleine-König (1):
usb: gadget: fsl: Increase size of name buffer for endpoints
Vladimir Oltean (1):
net: dsa: mv88e6xxx: replace ATU violation prints with trace points
Volodymyr Babchuk (1):
soc: qcom: cmd-db: Map shared memory as WC, not WB
Wolfram Sang (1):
i2c: riic: avoid potential division by zero
Yue Haibing (1):
mlxbf_gige: Remove two unused function declarations
ZHANG Yuntian (1):
USB: serial: option: add MeiG Smart SRM825L
Zhen Lei (1):
selinux: fix potential counting error in avc_add_xperms_decision()
Zhiguo Niu (1):
f2fs: fix to do sanity check in update_sit_entry
Zhihao Cheng (1):
vfs: Don't evict inode under the inode lru traversing context
Zhu Yanjun (1):
RDMA/rtrs: Fix the problem of variable not initialized fully
Zi Yan (2):
mm/numa: no task_numa_fault() call if PMD is changed
mm/numa: no task_numa_fault() call if PTE is changed
Zijun Hu (1):
usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
BUG=b/364821490
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Updated the Linux kernel to v5.15.166.
Change-Id: If661128e9dc9aaf9a3ef2b92a04e8dbe11fd9fdc
Signed-off-by: COS Kernel Merge Bot <cloud-image-merge-automation@prod.google.com>
