Merge 6.6.48 into android15-6.6-lts
Changes in 6.6.48
tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
tty: atmel_serial: use the correct RTS flag.
Revert "ACPI: EC: Evaluate orphan _REG under EC device"
Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
selinux: revert our use of vma_is_initial_heap()
fuse: Initialize beyond-EOF page contents before setting uptodate
char: xillybus: Don't destroy workqueue from work item running on it
char: xillybus: Refine workqueue handling
char: xillybus: Check USB endpoints when probing device
ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
ALSA: usb-audio: Support Yamaha P-125 quirk entry
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
thunderbolt: Mark XDomain as unplugged when router is removed
ALSA: hda/tas2781: fix wrong calibrated data order
s390/dasd: fix error recovery leading to data corruption on ESE devices
KVM: s390: fix validity interception issue when gisa is switched off
riscv: change XIP's kernel_map.size to be size of the entire kernel
i2c: tegra: Do not mark ACPI devices as irq safe
ACPICA: Add a depth argument to acpi_execute_reg_methods()
ACPI: EC: Evaluate _REG outside the EC scope more carefully
arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
dm resume: don't return EINVAL when signalled
dm persistent data: fix memory allocation failure
vfs: Don't evict inode under the inode lru traversing context
fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
s390/cio: rename bitmap_size() -> idset_bitmap_size()
btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
bitmap: introduce generic optimized bitmap_size()
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
rtla/osnoise: Prevent NULL dereference in error handling
net: mana: Fix RX buf alloc_size alignment and atomic op panic
net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings
wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
fs/netfs/fscache_cookie: add missing "n_accesses" check
selinux: fix potential counting error in avc_add_xperms_decision()
selinux: add the processing of the failure of avc_add_xperms_decision()
mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
btrfs: zoned: properly take lock to read/update block group's zoned variables
btrfs: tree-checker: add dev extent item checks
drm/amdgpu: Actually check flags for all context ops.
memcg_write_event_control(): fix a user-triggerable oops
drm/amdgpu/jpeg2: properly set atomics vmid field
drm/amdgpu/jpeg4: properly set atomics vmid field
s390/uv: Panic for set and remove shared access UVC errors
bpf: Fix updating attached freplace prog in prog_array map
igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
igc: Fix qbv_config_change_errors logics
igc: Fix reset adapter logics when tx mode change
net/mlx5e: Take state lock during tx timeout reporter
net/mlx5e: Correctly report errors for ethtool rx flows
atm: idt77252: prevent use after free in dequeue_rx()
net: axienet: Fix register defines comment description
net: dsa: vsc73xx: pass value in phy_write operation
net: dsa: vsc73xx: use read_poll_timeout instead delay loop
net: dsa: vsc73xx: check busy flag in MDIO operations
net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
mlxbf_gige: disable RX filters until RX path initialized
mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
tcp: Update window clamping condition
netfilter: allow ipv6 fragments to arrive on different devices
netfilter: flowtable: initialise extack before use
netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
netfilter: nf_tables: Audit log dump reset after the fact
netfilter: nf_tables: Drop pointless memset in nf_tables_dump_obj
netfilter: nf_tables: Unconditionally allocate nft_obj_filter
netfilter: nf_tables: A better name for nft_obj_filter
netfilter: nf_tables: Carry s_idx in nft_obj_dump_ctx
netfilter: nf_tables: nft_obj_filter fits into cb->ctx
netfilter: nf_tables: Carry reset boolean in nft_obj_dump_ctx
netfilter: nf_tables: Introduce nf_tables_getobj_single
netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
vsock: fix recursive ->recvmsg calls
selftests: net: lib: ignore possible errors
selftests: net: lib: kill PIDs before del netns
net: hns3: fix wrong use of semaphore up
net: hns3: use the user's cfg after reset
net: hns3: fix a deadlock problem when config TC during resetting
gpio: mlxbf3: Support shutdown() function
ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
drm/amd/pm: fix error flow in sensor fetching
drm/amd/amdgpu/imu_v11_0: Increase buffer size to ensure all possible values can be stored
drm/amdgpu: access RLC_SPM_MC_CNTL through MMIO in SRIOV runtime
ssb: Fix division by zero issue in ssb_calc_clock_rate
ASoC: cs35l45: Checks index of cs35l45_irqs[]
wifi: mac80211: lock wiphy in IP address notifier
wifi: cfg80211: check wiphy mutex is held for wdev mutex
wifi: mac80211: fix BA session teardown race
wifi: iwlwifi: mvm: fix recovery flow in CSA
mm: Remove kmem_valid_obj()
rcu: Dump memory object info if callback function is invalid
rcu: Eliminate rcu_gp_slow_unregister() false positive
net: ethernet: mtk_wed: check update_wo_rx_stats in mtk_wed_update_rx_stats()
sched/topology: Handle NUMA_NO_NODE in sched_numa_find_nth_cpu()
wifi: cw1200: Avoid processing an invalid TIM IE
cgroup: Avoid extra dereference in css_populate_dir()
i2c: riic: avoid potential division by zero
RDMA/rtrs: Fix the problem of variable not initialized fully
s390/smp,mcck: fix early IPI handling
drm/bridge: tc358768: Attempt to fix DSI horizontal timings
wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan
i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
drm/amdkfd: Move dma unmapping after TLB flush
media: radio-isa: use dev_name to fill in bus_info
wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage
staging: iio: resolver: ad2s1210: fix use before initialization
wifi: mt76: fix race condition related to checking tx queue fill status
usb: gadget: uvc: cleanup request when not in correct state
drm/amd/display: Validate hw_points_num before using it
staging: ks7010: disable bh on tx_dev_lock
platform/x86/intel/ifs: Validate image size
media: s5p-mfc: Fix potential deadlock on condlock
accel/habanalabs/gaudi2: unsecure tpc count registers
accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE
accel/habanalabs: fix bug in timestamp interrupt handling
md/raid5-cache: use READ_ONCE/WRITE_ONCE for 'conf->log'
binfmt_misc: cleanup on filesystem umount
drm/tegra: Zero-initialize iosys_map
media: qcom: venus: fix incorrect return value
iommu/arm-smmu-qcom: Add SDM670 MDSS compatible
ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend
scsi: spi: Fix sshdr use
wifi: mac80211: flush STA queues on unauthorization
gfs2: setattr_chown: Add missing initialization
wifi: iwlwifi: abort scan when rfkill on but device enabled
wifi: iwlwifi: fw: Fix debugfs command sending
wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware()
clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider
IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
hwmon: (ltc2992) Avoid division by zero
rust: work around `bindgen` 0.69.0 issue
rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
cpu/SMT: Enable SMT only if a core is online
powerpc/topology: Check if a core is online
arm64: Fix KASAN random tag seed initialization
block: Fix lockdep warning in blk_mq_mark_tag_wait
drm/msm: Reduce fallout of fence signaling vs reclaim hangs
memory: tegra: Skip SID programming if SID registers aren't set
powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data
hwmon: (pc87360) Bounds check data->innr usage
powerpc/pseries/papr-sysparm: Validate buffer object lengths
ionic: prevent pci disable of already disabled device
ionic: no fw read when PCI reset failed
drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode
evm: don't copy up 'security.evm' xattr
Bluetooth: hci_conn: Check non NULL function before calling for HFP offload
gfs2: Refcounting fix in gfs2_thaw_super
EDAC/skx_common: Filter out the invalid address
nvmet-trace: avoid dereferencing pointer too early
ext4: do not trim the group with corrupted block bitmap
btrfs: zlib: fix and simplify the inline extent decompression
afs: fix __afs_break_callback() / afs_drop_open_mmap() race
fuse: fix UAF in rcu pathwalks
wifi: ath12k: Add missing qmi_txn_cancel() calls
quota: Remove BUG_ON from dqget()
riscv: blacklist assembly symbols for kprobe
kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
media: pci: cx23885: check cx23885_vdev_init() return
fs: binfmt_elf_efpic: don't use missing interpreter's properties
scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
media: drivers/media/dvb-core: copy user arrays safely
wifi: iwlwifi: mvm: avoid garbage iPN
net/sun3_82586: Avoid reading past buffer in debug output
drm/lima: set gp bus_stop bit before hard reset
gpio: sysfs: extend the critical section for unregistering sysfs devices
hrtimer: Select housekeeping CPU during migration
virtiofs: forbid newlines in tags
accel/habanalabs: fix debugfs files permissions
clocksource/drivers/arm_global_timer: Guard against division by zero
tick: Move got_idle_tick away from common flags
netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
md: clean up invalid BUG_ON in md_ioctl
x86: Increase brk randomness entropy for 64-bit systems
memory: stm32-fmc2-ebi: check regmap_read return value
parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
rxrpc: Don't pick values out of the wire header when setting up security
f2fs: stop checkpoint when get a out-of-bounds segment
powerpc/boot: Handle allocation failure in simple_realloc()
powerpc/boot: Only free if realloc() succeeds
btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item()
btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves()
btrfs: change BUG_ON to assertion when checking for delayed_node root
btrfs: tests: allocate dummy fs_info and root in test_find_delalloc()
btrfs: push errors up from add_async_extent()
btrfs: handle invalid root reference found in may_destroy_subvol()
btrfs: send: handle unexpected data in header buffer in begin_cmd()
btrfs: send: handle unexpected inode in header process_recorded_refs()
btrfs: change BUG_ON to assertion in tree_move_down()
btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
f2fs: fix to do sanity check in update_sit_entry
usb: gadget: fsl: Increase size of name buffer for endpoints
nvme: clear caller pointer on identify failure
Bluetooth: bnep: Fix out-of-bound access
firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
rtc: nct3018y: fix possible NULL dereference
net: hns3: add checking for vf id of mailbox
nvmet-tcp: do not continue for invalid icreq
NFS: avoid infinite loop in pnfs_update_layout.
openrisc: Call setup_memory() earlier in the init sequence
s390/iucv: fix receive buffer virtual vs physical address confusion
irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time
clocksource: Make watchdog and suspend-timing multiplication overflow safe
platform/x86: lg-laptop: fix %s null argument warning
usb: dwc3: core: Skip setting event buffers for host only controllers
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
ext4: set the type of max_zeroout to unsigned int to avoid overflow
nvmet-rdma: fix possible bad dereference when freeing rsps
selftests/bpf: Fix a few tests for GCC related warnings.
Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
nvme: use srcu for iterating namespace list
drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent
hrtimer: Prevent queuing of hrtimer without a function callback
ionic: use pci_is_enabled not open code
ionic: check cmd_regs before copying in or out
EDAC/skx_common: Allow decoding of SGX addresses
nvme: fix namespace removal list
gtp: pull network headers in gtp_dev_xmit()
jfs: define xtree root and page independently
i2c: stm32f7: Add atomic_xfer method to driver
riscv: entry: always initialize regs->a0 to -ENOSYS
dm suspend: return -ERESTARTSYS instead of -EINTR
mm: fix endless reclaim on machines with unaccepted memory
tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions
selftests/mm: log run_vmtests.sh results in TAP format
selftests: memfd_secret: don't build memfd_secret test on unsupported arches
change alloc_pages name in dma_map_ops to avoid name conflicts
mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
btrfs: replace sb::s_blocksize by fs_info::sectorsize
btrfs: send: allow cloning non-aligned extent if it ends at i_size
drm/amd/display: Adjust cursor position
drm/amd/display: Enable otg synchronization logic for DCN321
drm/amd/display: fix cursor offset on rotation 180
drm/amd/amdgpu: command submission parser for JPEG
platform/surface: aggregator: Fix warning when controller is destroyed in probe
ALSA: hda/tas2781: Use correct endian conversion
drm/amdkfd: reserve the BO before validating it
Bluetooth: hci_core: Fix LE quote calculation
Bluetooth: SMP: Fix assumption of Central always being Initiator
net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection
net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q"
net: mscc: ocelot: serialize access to the injection/extraction groups
tc-testing: don't access non-existent variable on exception
selftests: udpgro: report error when receive failed
tcp/dccp: bypass empty buckets in inet_twsk_purge()
tcp/dccp: do not care about families in inet_twsk_purge()
tcp: prevent concurrent execution of tcp_sk_exit_batch
net: mctp: test: Use correct skb for route input check
kcm: Serialise kcm_sendmsg() for the same socket.
netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
ip6_tunnel: Fix broken GRO
bonding: fix bond_ipsec_offload_ok return type
bonding: fix null pointer deref in bond_ipsec_offload_ok
bonding: fix xfrm real_dev null pointer dereference
bonding: fix xfrm state handling when clearing active slave
ice: fix page reuse when PAGE_SIZE is over 8k
ice: fix ICE_LAST_OFFSET formula
ice: fix truesize operations for PAGE_SIZE >= 8192
dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
igb: cope with large MAX_SKB_FRAGS
net: dsa: mv88e6xxx: Fix out-of-bound access
netem: fix return value if duplicate enqueue fails
udp: fix receiving fraglist GSO packets
ipv6: prevent UAF in ip6_send_skb()
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: prevent possible UAF in ip6_xmit()
bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
netfilter: flowtable: validate vlan header
octeontx2-af: Fix CPT AF register offset calculation
net: xilinx: axienet: Always disable promiscuous mode
net: xilinx: axienet: Fix dangling multicast addresses
net: ovs: fix ovs_drop_reasons error
drm/msm/dpu: don't play tricks with debug macros
drm/msm/dp: fix the max supported bpp logic
drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys
drm/msm/dpu: drop MSM_ENC_VBLANK support
drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
drm/msm/dpu: capture snapshot on the first commit_done timeout
drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()
drm/msm/dp: reset the link phy params before link training
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
drm/msm/dpu: try multirect based on mdp clock limits
drm/msm/dpu: take plane rotation into account for wide planes
drm/msm/mdss: switch mdss to use devm_of_icc_get()
drm/msm/mdss: Rename path references to mdp_path
drm/msm/mdss: Handle the reg bus ICC path
drm/msm: fix the highest_bank_bit for sc7180
mmc: mmc_test: Fix NULL dereference on allocation failure
smb: client: ignore unhandled reparse tags
Bluetooth: MGMT: Add error handling to pair_device()
scsi: core: Fix the return value of scsi_logical_block_count()
ksmbd: the buffer of smb2 query dir response has at least 1 byte
drm/amdgpu: Validate TA binary size
net: dsa: microchip: fix PTP config failure when using multiple ports
MIPS: Loongson64: Set timer mode in cpu-probe
HID: wacom: Defer calculation of resolution until resolution_code is known
Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3
Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination
cxgb4: add forgotten u64 ivlan cast before shift
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
mmc: dw_mmc: allow biu and ciu clocks to defer
pmdomain: imx: scu-pd: Remove duplicated clocks
pmdomain: imx: wait SSAR when i.MX93 power domain on
nouveau/firmware: use dma non-coherent allocator
mptcp: pm: re-using ID of unused removed ADD_ADDR
mptcp: pm: re-using ID of unused removed subflows
mptcp: pm: re-using ID of unused flushed subflows
mptcp: pm: remove mptcp_pm_remove_subflow()
mptcp: pm: only mark 'subflow' endp as available
mptcp: pm: only decrement add_addr_accepted for MPJ req
mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
mptcp: pm: only in-kernel cannot have entries with ID 0
mptcp: pm: fullmesh: select the right ID later
mptcp: pm: avoid possible UaF when selecting endp
selftests: mptcp: join: validate fullmesh endp on 1st sf
selftests: mptcp: join: check re-using ID of closed subflow
Revert "usb: gadget: uvc: cleanup request when not in correct state"
Revert "drm/amd/display: Validate hw_points_num before using it"
platform/x86/intel/ifs: Call release_firmware() when handling errors.
tcp: do not export tcp_twsk_purge()
hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
drm/msm/mdss: specify cfg bandwidth for SDM670
drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
igc: Fix qbv tx latency by setting gtxoffset
ALSA: timer: Relax start tick time check for slave timer elements
mm/numa: no task_numa_fault() call if PMD is changed
mm/numa: no task_numa_fault() call if PTE is changed
bpf: Fix a kernel verifier crash in stacksafe()
selftests/bpf: Add a test to verify previous stacksafe() fix
NFSD: simplify error paths in nfsd_svc()
drm/amdgpu/vcn: identify unified queue in sw init
drm/amdgpu/vcn: not pause dpg for unified queue
ksmbd: fix race condition between destroy_previous_session() and smb2 operations()
net: ngbe: Fix phy mode set to external phy
Revert "s390/dasd: Establish DMA alignment"
Input: MT - limit max slots
tools: move alignment-related macros to new <linux/align.h>
Linux 6.6.48
Change-Id: If343566a5f96a235d26a5409ef01d71e070489cb
Signed-off-by: 
Greg Kroah-Hartman <gregkh@google.com>
Loading
Please sign in to comment