)]}'
{
  "log": [
    {
      "commit": "c066ac93be8c70628f9c95b01b78f24121dc8de5",
      "tree": "d81f70e8129ea391193552643c797b2166512e83",
      "parents": [
        "efe47fcee38b850c4daa061cdf7468d0560510d4",
        "1866ee1a9025bfa9391b71f962e4d2099fc85ed7"
      ],
      "author": {
        "name": "Michael Bestas",
        "email": "mkbestas@lineageos.org",
        "time": "Wed Feb 08 18:28:38 2023 +0200"
      },
      "committer": {
        "name": "Michael Bestas",
        "email": "mkbestas@lineageos.org",
        "time": "Wed Feb 08 18:28:38 2023 +0200"
      },
      "message": "Merge tag \u0027ASB-2023-02-05_11-5.4\u0027 of https://android.googlesource.com/kernel/common into android13-5.4-lahaina\n\nhttps://source.android.com/docs/security/bulletin/2023-02-01\nCVE-2022-39189\nCVE-2022-39842\nCVE-2022-41222\nCVE-2023-20937\nCVE-2023-20938\nCVE-2022-0850\n\n* tag \u0027ASB-2023-02-05_11-5.4\u0027 of https://android.googlesource.com/kernel/common:\n  ANDROID: ABI: Cuttlefish Symbol update\n  UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing\n  ANDROID: abi_gki_aarch64_qcom: Add hrtimer_sleeper_start_expires\n  UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF\n  ANDROID: Revert \"tracing/ring-buffer: Have polling block on watermark\"\n  UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev\n  UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode\n  ANDROID: add TEST_MAPPING for net/, include/net\n  UPSTREAM: nfp: fix use-after-free in area_cache_get()\n  UPSTREAM: proc: avoid integer type confusion in get_proc_long\n  UPSTREAM: proc: proc_skip_spaces() shouldn\u0027t think it is working on C strings\n  ANDROID: usb: f_accessory: Check buffer size when initialised via composite\n  BACKPORT: mm: don\u0027t be stuck to rmap lock on reclaim path\n  ANDROID: Add more hvc devices for virtio-console.\n  Revert \"mmc: sdhci: Fix voltage switch delay\"\n  ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION\n  Linux 5.4.226\n  ipc/sem: Fix dangling sem_array access in semtimedop race\n  v4l2: don\u0027t fall back to follow_pfn() if pin_user_pages_fast() fails\n  proc: proc_skip_spaces() shouldn\u0027t think it is working on C strings\n  proc: avoid integer type confusion in get_proc_long\n  mmc: sdhci: Fix voltage switch delay\n  mmc: sdhci: use FIELD_GET for preset value bit masks\n  char: tpm: Protect tpm_pm_suspend with locks\n  Revert \"clocksource/drivers/riscv: Events are stopped during CPU suspend\"\n  x86/ioremap: Fix page aligned size calculation in __ioremap_caller()\n  Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM\n  x86/pm: Add enumeration check before spec MSRs save/restore setup\n  x86/tsx: Add a feature bit for TSX control MSR support\n  nvme: ensure subsystem reset is single threaded\n  nvme: restrict management ioctls to admin\n  epoll: check for events when removing a timed out thread from the wait queue\n  epoll: call final ep_events_available() check under the lock\n  tracing/ring-buffer: Have polling block on watermark\n  ipv4: Fix route deletion when nexthop info is not specified\n  ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference\n  selftests: net: fix nexthop warning cleanup double ip typo\n  selftests: net: add delete nexthop route warning test\n  Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled\n  parisc: Increase FRAME_WARN to 2048 bytes on parisc\n  xtensa: increase size of gcc stack frame check\n  parisc: Increase size of gcc stack frame check\n  iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()\n  pinctrl: single: Fix potential division by zero\n  ASoC: ops: Fix bounds check for _sx controls\n  mm: Fix \u0027.data.once\u0027 orphan section warning\n  arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72\n  arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors\n  tracing: Free buffers when a used dynamic event is removed\n  mmc: sdhci-sprd: Fix no reset data and command after voltage switch\n  mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check\n  mmc: core: Fix ambiguous TRIM and DISCARD arg\n  mmc: mmc_test: Fix removal of debugfs file\n  pinctrl: intel: Save and restore pins in \"direct IRQ\" mode\n  x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3\n  nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n  tools/vm/slabinfo-gnuplot: use \"grep -E\" instead of \"egrep\"\n  error-injection: Add prompt for function error injection\n  net/mlx5: DR, Fix uninitialized var warning\n  hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()\n  hwmon: (coretemp) Check for null before removing sysfs attrs\n  net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed\n  sctp: fix memory leak in sctp_stream_outq_migrate()\n  packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE\n  net: tun: Fix use-after-free in tun_detach()\n  afs: Fix fileserver probe RTT handling\n  net: hsr: Fix potential use-after-free\n  dsa: lan9303: Correct stat name\n  net: ethernet: nixge: fix NULL dereference\n  net/9p: Fix a potential socket leak in p9_socket_open\n  net: net_netdev: Fix error handling in ntb_netdev_init_module()\n  net: phy: fix null-ptr-deref while probe() failed\n  wifi: cfg80211: fix buffer overflow in elem comparison\n  qlcnic: fix sleep-in-atomic-context bugs caused by msleep\n  can: cc770: cc770_isa_probe(): add missing free_cc770dev()\n  can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()\n  net/mlx5e: Fix use-after-free when reverting termination table\n  net/mlx5: Fix uninitialized variable bug in outlen_write()\n  of: property: decrement node refcount in of_fwnode_get_reference_args()\n  hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails\n  hwmon: (i5500_temp) fix missing pci_disable_device()\n  scripts/faddr2line: Fix regression in name resolution on ppc64le\n  iio: light: rpr0521: add missing Kconfig dependencies\n  iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw\n  iio: health: afe4403: Fix oob read in afe4403_read_raw\n  btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()\n  drm/amdgpu: Partially revert \"drm/amdgpu: update drm_display_info correctly when the edid is read\"\n  drm/amdgpu: update drm_display_info correctly when the edid is read\n  btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker\n  spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock\n  btrfs: free btrfs_path before copying inodes to userspace\n  fuse: lock inode unconditionally in fuse_fallocate()\n  drm/i915: fix TLB invalidation for Gen12 video and compute engines\n  drm/amdgpu: always register an MMU notifier for userptr\n  drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN\n  btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()\n  btrfs: free btrfs_path before copying subvol info to userspace\n  btrfs: free btrfs_path before copying fspath to userspace\n  btrfs: free btrfs_path before copying root refs to userspace\n  binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds\u003d0\n  binder: Address corner cases in deferred copy and fixup\n  binder: fix pointer cast warning\n  binder: defer copies of pre-patched txn data\n  binder: read pre-translated fds from sender buffer\n  binder: avoid potential data leakage when copying txn\n  dm integrity: flush the journal on suspend\n  net: usb: qmi_wwan: add Telit 0x103a composition\n  tcp: configurable source port perturb table size\n  platform/x86: hp-wmi: Ignore Smart Experience App event\n  platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)\n  platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()\n  xen/platform-pci: add missing free_irq() in error path\n  serial: 8250: 8250_omap: Avoid RS485 RTS glitch on -\u003eset_termios()\n  ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01\n  Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode\n  gcov: clang: fix the buffer overflow issue\n  nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty\n  firmware: coreboot: Register bus in module init\n  firmware: google: Release devices before unregistering the bus\n  ceph: avoid putting the realm twice when decoding snaps fails\n  ceph: do not update snapshot context when there is no new snapshot\n  iio: pressure: ms5611: fixed value compensation bug\n  iio: ms5611: Simplify IO callback parameters\n  nios2: add FORCE for vmlinuz.gz\n  init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash\n  iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails\n  iio: light: apds9960: fix wrong register for gesture gain\n  arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency\n  usb: dwc3: exynos: Fix remove() function\n  lib/vdso: use \"grep -E\" instead of \"egrep\"\n  s390/crashdump: fix TOD programmable field size\n  net: thunderx: Fix the ACPI memory leak\n  nfc: st-nci: fix memory leaks in EVT_TRANSACTION\n  nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION\n  s390/dasd: fix no record found for raw_track_access\n  dccp/tcp: Reset saddr on failure after inet6?_hash_connect().\n  bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()\n  regulator: twl6030: re-add TWL6032_SUBCLASS\n  NFC: nci: fix memory leak in nci_rx_data_packet()\n  xfrm: Fix ignored return value in xfrm6_init()\n  tipc: check skb_linearize() return value in tipc_disc_rcv()\n  tipc: add an extra conn_get in tipc_conn_alloc\n  tipc: set con sock in tipc_conn_alloc\n  net/mlx5: Fix FW tracer timestamp calculation\n  Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()\n  Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()\n  nfp: add port from netdev validation for EEPROM access\n  net: pch_gbe: fix pci device refcount leak while module exiting\n  net/qla3xxx: fix potential memleak in ql3xxx_send()\n  net/mlx4: Check retval of mlx4_bitmap_init\n  ARM: mxs: fix memory leak in mxs_machine_init()\n  9p/fd: fix issue of list_del corruption in p9_fd_cancel()\n  net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()\n  nfc/nci: fix race with opening and closing\n  net: liquidio: simplify if expression\n  ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl\n  tee: optee: fix possible memory leak in optee_register_device()\n  bus: sunxi-rsb: Support atomic transfers\n  regulator: core: fix UAF in destroy_regulator()\n  regulator: core: fix kobject release warning and memory leak in regulator_register()\n  ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove\n  ARM: dts: am335x-pcm-953: Define fixed regulators in root node\n  af_key: Fix send_acquire race with pfkey_register\n  MIPS: pic32: treat port as signed integer\n  RISC-V: vdso: Do not add missing symbols to version section in linker script\n  arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.\n  block, bfq: fix null pointer dereference in bfq_bio_bfqg()\n  drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)\n  spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run\n  wifi: mac80211: Fix ack frame idr leak when mesh has no route\n  audit: fix undefined behavior in bit shift for AUDIT_BIT\n  wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support\n  wifi: mac80211: fix memory free error when registering wiphy fail\n  Revert \"can: af_can: fix NULL pointer dereference in can_rx_register()\"\n  Linux 5.4.225\n  ntfs: check overflow when iterating ATTR_RECORDs\n  ntfs: fix out-of-bounds read in ntfs_attr_find()\n  ntfs: fix use-after-free in ntfs_attr_find()\n  mm: fs: initialize fsdata passed to write_begin/write_end interface\n  9p/trans_fd: always use O_NONBLOCK read/write\n  gfs2: Switch from strlcpy to strscpy\n  gfs2: Check sb_bsize_shift after reading superblock\n  9p: trans_fd/p9_conn_cancel: drop client lock earlier\n  kcm: close race conditions on sk_receive_queue\n  bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()\n  kcm: avoid potential race in kcm_tx_work\n  tcp: cdg: allow tcp_cdg_release() to be called multiple times\n  macvlan: enforce a consistent minimal mtu\n  Input: i8042 - fix leaking of platform device on module removal\n  kprobes: Skip clearing aggrprobe\u0027s post_handler in kprobe-on-ftrace case\n  scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()\n  ring-buffer: Include dropped pages in counting dirty patches\n  serial: 8250: Flush DMA Rx on RLSI\n  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()\n  docs: update mediator contact information in CoC doc\n  mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()\n  mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout\n  mmc: core: properly select voltage range without power cycle\n  scsi: zfcp: Fix double free of FSF request when qdio send fails\n  Input: iforce - invert valid length check when fetching device IDs\n  serial: 8250_lpss: Configure DMA also w/o DMA filter\n  serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs\n  dm ioctl: fix misbehavior if list_versions races with module loading\n  iio: pressure: ms5611: changed hardcoded SPI speed to value limited\n  iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()\n  iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()\n  usb: chipidea: fix deadlock in ci_otg_del_timer\n  usb: add NO_LPM quirk for Realforce 87U Keyboard\n  USB: serial: option: add Fibocom FM160 0x0111 composition\n  USB: serial: option: add u-blox LARA-L6 modem\n  USB: serial: option: add u-blox LARA-R6 00B modem\n  USB: serial: option: remove old LARA-R6 PID\n  USB: serial: option: add Sierra Wireless EM9191\n  speakup: fix a segfault caused by switching consoles\n  slimbus: stream: correct presence rate frequencies\n  Revert \"usb: dwc3: disable USB core PHY management\"\n  ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()\n  ring_buffer: Do not deactivate non-existant pages\n  ftrace: Fix null pointer dereference in ftrace_add_mod()\n  ftrace: Optimize the allocation for mcount entries\n  ftrace: Fix the possible incorrect kernel message\n  cifs: add check for returning value of SMB2_set_info_init\n  net: thunderbolt: Fix error handling in tbnet_init()\n  cifs: Fix wrong return value checking when GETFLAGS\n  net/x25: Fix skb leak in x25_lapb_receive_frame()\n  platform/x86/intel: pmc: Don\u0027t unconditionally attach Intel PMC when virtualized\n  drbd: use after free in drbd_create_device()\n  xen/pcpu: fix possible memory leak in register_pcpu()\n  bnxt_en: Remove debugfs when pci_register_driver failed\n  net: caif: fix double disconnect client in chnl_net_open()\n  net: macvlan: Use built-in RCU list checking\n  mISDN: fix misuse of put_device() in mISDN_register_device()\n  net: liquidio: release resources when liquidio driver open failed\n  mISDN: fix possible memory leak in mISDN_dsp_element_register()\n  net: bgmac: Drop free_netdev() from bgmac_enet_remove()\n  ata: libata-transport: fix double ata_host_put() in ata_tport_add()\n  arm64: dts: imx8mn: Fix NAND controller size-cells\n  arm64: dts: imx8mm: Fix NAND controller size-cells\n  pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map\n  parport_pc: Avoid FIFO port location truncation\n  siox: fix possible memory leak in siox_device_add()\n  block: sed-opal: kmalloc the cmd/resp buffers\n  ASoC: soc-utils: Remove __exit for snd_soc_util_exit()\n  tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send\n  serial: imx: Add missing .thaw_noirq hook\n  serial: 8250: omap: Flush PM QOS work on remove\n  serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()\n  serial: 8250_omap: remove wait loop from Errata i202 workaround\n  ASoC: core: Fix use-after-free in snd_soc_exit()\n  spi: stm32: Print summary \u0027callbacks suppressed\u0027 message\n  ASoC: codecs: jz4725b: Fix spelling mistake \"Sourc\" -\u003e \"Source\", \"Routee\" -\u003e \"Route\"\n  Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm\n  btrfs: remove pointless and double ulist frees in error paths of qgroup tests\n  drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid\n  i2c: i801: add lis3lv02d\u0027s I2C address for Vostro 5568\n  NFSv4: Retry LOCK on OLD_STATEID during delegation return\n  selftests/intel_pstate: fix build for ARCH\u003dx86_64\n  selftests/futex: fix build for clang\n  ASoC: codecs: jz4725b: fix capture selector naming\n  ASoC: codecs: jz4725b: use right control for Capture Volume\n  ASoC: codecs: jz4725b: fix reported volume for Master ctl\n  ASoC: codecs: jz4725b: add missed Line In power control bit\n  spi: intel: Fix the offset to get the 64K erase opcode\n  ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK\n  ASoC: wm8997: Revert \"ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe\"\n  ASoC: wm5110: Revert \"ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe\"\n  ASoC: wm5102: Revert \"ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe\"\n  x86/cpu: Restore AMD\u0027s DE_CFG MSR after resume\n  net: tun: call napi_schedule_prep() to ensure we own a napi\n  dmaengine: at_hdmac: Check return code of dma_async_device_register\n  dmaengine: at_hdmac: Fix impossible condition\n  dmaengine: at_hdmac: Don\u0027t allow CPU to reorder channel enable\n  dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors\n  dmaengine: at_hdmac: Don\u0027t start transactions at tx_submit level\n  dmaengine: at_hdmac: Fix at_lli struct definition\n  cert host tools: Stop complaining about deprecated OpenSSL functions\n  can: j1939: j1939_send_one(): fix missing CAN header initialization\n  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()\n  btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()\n  platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi\n  drm/i915/dmabuf: fix sg_table handling in map_dma_buf\n  nilfs2: fix use-after-free bug of ns_writer on remount\n  nilfs2: fix deadlock in nilfs_count_free_blocks()\n  vmlinux.lds.h: Fix placement of \u0027.data..decrypted\u0027 section\n  ALSA: usb-audio: Add DSD support for Accuphase DAC-60\n  ALSA: usb-audio: Add quirk entry for M-Audio Micro\n  ALSA: hda: fix potential memleak in \u0027add_widget_node\u0027\n  ALSA: hda/ca0132: add quirk for EVGA Z390 DARK\n  mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI\n  mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI\n  mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI\n  MIPS: jump_label: Fix compat branch range check\n  arm64: efi: Fix handling of misaligned runtime regions and drop warning\n  riscv: process: fix kernel info leakage\n  net: macvlan: fix memory leaks of macvlan_common_newlink\n  ethernet: tundra: free irq when alloc ring failed in tsi108_open()\n  net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()\n  ethernet: s2io: disable napi when start nic failed in s2io_card_up()\n  cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()\n  net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()\n  net: cpsw: disable napi in cpsw_ndo_open()\n  net/mlx5: Allow async trigger completion execution on single CPU systems\n  net: nixge: disable napi when enable interrupts failed in nixge_open()\n  perf stat: Fix printing os-\u003eprefix in CSV metrics output\n  drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()\n  dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()\n  dmaengine: pxa_dma: use platform_get_irq_optional\n  tipc: fix the msg-\u003ereq tlv len check in tipc_nl_compat_name_table_dump_header\n  can: af_can: fix NULL pointer dereference in can_rx_register()\n  ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network\n  drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()\n  hamradio: fix issue of dev reference count leakage in bpq_device_event()\n  net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()\n  capabilities: fix undefined behavior in bit shift for CAP_TO_MASK\n  net: fman: Unregister ethernet device on removal\n  bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer\n  bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()\n  net: tun: Fix memory leaks of napi_get_frags\n  net: gso: fix panic on frag_list with mixed head alloc types\n  HID: hyperv: fix possible memory leak in mousevsc_probe()\n  bpf, sockmap: Fix the sk-\u003esk_forward_alloc warning of sk_stream_kill_queues\n  wifi: cfg80211: fix memory leak in query_regdb_file()\n  wifi: cfg80211: silence a sparse RCU warning\n  phy: stm32: fix an error code in probe\n  xfs: drain the buf delwri queue before xfsaild idles\n  xfs: preserve inode versioning across remounts\n  xfs: use MMAPLOCK around filemap_map_pages()\n  xfs: redesign the reflink remap loop to fix blkres depletion crash\n  xfs: rename xfs_bmap_is_real_extent to is_written_extent\n  xfs: preserve rmapbt swapext block reservation from freed blocks\n  ANDROID: properly copy the scm_io_uring field in struct sk_buff\n  Linux 5.4.224\n  ipc: remove memcg accounting for sops objects in do_semtimedop()\n  wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()\n  drm/i915/sdvo: Setup DDC fully before output init\n  drm/i915/sdvo: Filter out invalid outputs more sensibly\n  drm/rockchip: dsi: Force synchronous probe\n  mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times\n  KVM: x86: emulator: update the emulation mode after CR0 write\n  KVM: x86: emulator: introduce emulator_recalc_and_set_mode\n  KVM: x86: emulator: em_sysexit should update ctxt-\u003emode\n  KVM: x86: Mask off reserved bits in CPUID.80000008H\n  KVM: x86: Mask off reserved bits in CPUID.8000001AH\n  ext4: fix BUG_ON() when directory entry has invalid rec_len\n  ext4: fix warning in \u0027ext4_da_release_space\u0027\n  parisc: Avoid printing the hardware path twice\n  parisc: Export iosapic_serial_irq() symbol for serial port driver\n  parisc: Make 8250_gsc driver dependend on CONFIG_PARISC\n  ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices\n  perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]\n  perf/x86/intel: Fix pebs event constraints for ICL\n  efi: random: reduce seed size to 32 bytes\n  fuse: add file_modified() to fallocate\n  capabilities: fix potential memleak on error path from vfs_getxattr_alloc()\n  tracing/histogram: Update document for KEYS_MAX size\n  tools/nolibc/string: Fix memcmp() implementation\n  kprobe: reverse kp-\u003eflags when arm_kprobe failed\n  tcp/udp: Make early_demux back namespacified.\n  btrfs: fix type of parameter generation in btrfs_get_dentry\n  binder: fix UAF of alloc-\u003evma in race with munmap()\n  memcg: enable accounting of ipc resources\n  tcp/udp: Fix memory leak in ipv6_renew_options().\n  block, bfq: protect \u0027bfqd-\u003equeued\u0027 by \u0027bfqd-\u003elock\u0027\n  Bluetooth: L2CAP: Fix attempting to access uninitialized memory\n  xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()\n  xfs: don\u0027t fail unwritten extent conversion on writeback due to edquot\n  xfs: group quota should return EDQUOT when prj quota enabled\n  xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()\n  xfs: use ordered buffers to initialize dquot buffers during quotacheck\n  xfs: don\u0027t fail verifier on empty attr3 leaf block\n  i2c: xiic: Add platform module alias\n  HID: saitek: add madcatz variant of MMO7 mouse device ID\n  scsi: core: Restrict legal sdev_state transitions via sysfs\n  media: meson: vdec: fix possible refcount leak in vdec_probe()\n  media: dvb-frontends/drxk: initialize err to 0\n  media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE\n  media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE\n  ipv6: fix WARNING in ip6_route_net_exit_late()\n  net, neigh: Fix null-ptr-deref in neigh_table_clear()\n  net: mdio: fix undefined behavior in bit shift for __mdiobus_register\n  Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()\n  Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu\n  btrfs: fix ulist leaks in error paths of qgroup self tests\n  btrfs: fix inode list leak during backref walking at find_parent_nodes()\n  btrfs: fix inode list leak during backref walking at resolve_indirect_refs()\n  isdn: mISDN: netjet: fix wrong check of device registration\n  mISDN: fix possible memory leak in mISDN_register_device()\n  rose: Fix NULL pointer dereference in rose_send_frame()\n  ipvs: fix WARNING in ip_vs_app_net_cleanup()\n  ipvs: fix WARNING in __ip_vs_cleanup_batch()\n  ipvs: use explicitly signed chars\n  netfilter: nf_tables: release flow rule object from commit path\n  net: tun: fix bugs for oversize packet when napi frags enabled\n  net: sched: Fix use after free in red_enqueue()\n  ata: pata_legacy: fix pdc20230_set_piomode()\n  net: fec: fix improper use of NETDEV_TX_BUSY\n  nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()\n  nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()\n  RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()\n  RDMA/core: Fix null-ptr-deref in ib_core_cleanup()\n  net: dsa: Fix possible memory leaks in dsa_loop_init()\n  nfs4: Fix kmemleak when allocate slot failed\n  NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot\n  NFSv4.1: Handle RECLAIM_COMPLETE trunking errors\n  IB/hfi1: Correctly move list in sc_disable()\n  RDMA/cma: Use output interface for net_dev check\n  Linux 5.4.223\n  can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive\n  net: enetc: survive memory pressure without crashing\n  net/mlx5: Fix possible use-after-free in async command interface\n  net/mlx5e: Do not increment ESN when updating IPsec ESN state\n  nh: fix scope used to find saddr when adding non gw nh\n  net: ehea: fix possible memory leak in ehea_register_port()\n  openvswitch: switch from WARN to pr_warn\n  ALSA: aoa: Fix I2S device accounting\n  ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()\n  PM: domains: Fix handling of unavailable/disabled idle states\n  net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()\n  i40e: Fix flow-type by setting GL_HASH_INSET registers\n  i40e: Fix VF hang when reset is triggered on another VF\n  i40e: Fix ethtool rx-flow-hash setting for X722\n  media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check \u0027interlaced\u0027\n  media: v4l2-dv-timings: add sanity checks for blanking values\n  media: vivid: dev-\u003ebitmap_cap wasn\u0027t freed in all cases\n  media: vivid: s_fbuf: add more sanity checks\n  PM: hibernate: Allow hybrid sleep to work with s2idle\n  can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path\n  tcp: fix indefinite deferral of RTO with SACK reneging\n  net: lantiq_etop: don\u0027t free skb when returning NETDEV_TX_BUSY\n  net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed\n  kcm: annotate data-races around kcm-\u003erx_wait\n  kcm: annotate data-races around kcm-\u003erx_psock\n  amd-xgbe: add the bit rate quirk for Molex cables\n  amd-xgbe: fix the SFP compliance codes check for DAC cables\n  x86/unwind/orc: Fix unreliable stack dump with gcov\n  net: netsec: fix error handling in netsec_register_mdio()\n  tipc: fix a null-ptr-deref in tipc_topsrv_accept\n  ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()\n  arc: iounmap() arg is volatile\n  drm/msm: Fix return type of mdp4_lvds_connector_mode_valid\n  media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation\n  net: ieee802154: fix error return code in dgram_bind()\n  mm,hugetlb: take hugetlb_lock before decrementing h-\u003eresv_huge_pages\n  cgroup-v1: add disabled controller check in cgroup1_parse_param()\n  xen/gntdev: Prevent leaking grants\n  Xen/gntdev: don\u0027t ignore kernel unmapping error\n  xfs: force the log after remapping a synchronous-writes file\n  xfs: clear XFS_DQ_FREEING if we can\u0027t lock the dquot buffer to flush\n  xfs: finish dfops on every insert range shift iteration\n  s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()\n  s390/futex: add missing EX_TABLE entry to __futex_atomic_op()\n  perf auxtrace: Fix address filter symbol name match for modules\n  kernfs: fix use-after-free in __kernfs_remove\n  mmc: core: Fix kernel panic when remove non-standard SDIO card\n  drm/msm/hdmi: fix memory corruption with too many bridges\n  drm/msm/dsi: fix memory corruption with too many bridges\n  mac802154: Fix LQI recording\n  fbdev: smscufx: Fix several use-after-free bugs\n  iio: light: tsl2583: Fix module unloading\n  tools: iio: iio_utils: fix digit calculation\n  xhci: Remove device endpoints from bandwidth list when freeing the device\n  mtd: rawnand: marvell: Use correct logic for nand-keep-config\n  usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller\n  usb: bdc: change state when port disconnected\n  usb: dwc3: gadget: Don\u0027t set IMI for no_interrupt\n  usb: dwc3: gadget: Stop processing more requests on IMI\n  USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM\n  ALSA: au88x0: use explicitly signed char\n  ALSA: Use del_timer_sync() before freeing timer\n  can: kvaser_usb: Fix possible completions during init_completion\n  can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()\n  UPSTREAM: once: fix section mismatch on clang builds\n  ANDROID: fix up struct sk_buf ABI breakage\n  ANDROID: fix up CRC issue with struct tcp_sock\n  Linux 5.4.222\n  once: fix section mismatch on clang builds\n  ANDROID: fix up 131287ff833d (\"once: add DO_ONCE_SLOW() for sleepable contexts\")\n  Revert \"serial: 8250: Fix restoring termios speed after suspend\"\n  Linux 5.4.221\n  mm: /proc/pid/smaps_rollup: fix no vma\u0027s null-deref\n  hv_netvsc: Fix race between VF offering and VF association message from host\n  Makefile.debug: re-enable debug info for .S files\n  ACPI: video: Force backlight native for more TongFang devices\n  riscv: topology: fix default topology reporting\n  arm64: topology: move store_cpu_topology() to shared code\n  iommu/vt-d: Clean up si_domain in the init_dmars() error path\n  net: hns: fix possible memory leak in hnae_ae_register()\n  net: sched: cake: fix null pointer access issue when cake_init() fails\n  net: phy: dp83867: Extend RX strap quirk for SGMII mode\n  net/atm: fix proc_mpc_write incorrect return value\n  HID: magicmouse: Do not set BTN_MOUSE on double report\n  tipc: fix an information leak in tipc_topsrv_kern_subscr\n  tipc: Fix recognition of trial period\n  ACPI: extlog: Handle multiple records\n  btrfs: fix processing of delayed tree block refs during backref walking\n  btrfs: fix processing of delayed data refs during backref walking\n  r8152: add PID for the Lenovo OneLink+ Dock\n  arm64: errata: Remove AES hwcap for COMPAT tasks\n  media: venus: dec: Handle the case where find_format fails\n  KVM: arm64: vgic: Fix exit condition in scan_its_table()\n  ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n  ata: ahci-imx: Fix MODULE_ALIAS\n  hwmon/coretemp: Handle large core ID value\n  x86/microcode/AMD: Apply the patch early on every logical thread\n  ocfs2: fix BUG when iput after ocfs2_mknod fails\n  ocfs2: clear dinode links count in case of error\n  xfs: fix use-after-free on CIL context on shutdown\n  xfs: move inode flush to the sync workqueue\n  xfs: reflink should force the log out if mounted with wsync\n  xfs: factor out a new xfs_log_force_inode helper\n  xfs: trylock underlying buffer on dquot flush\n  xfs: don\u0027t write a corrupt unmount record to force summary counter recalc\n  xfs: tail updates only need to occur when LSN changes\n  xfs: factor common AIL item deletion code\n  xfs: Throttle commits on delayed background CIL push\n  xfs: Lower CIL flush limit for large logs\n  xfs: preserve default grace interval during quotacheck\n  xfs: fix unmount hang and memory leak on shutdown during quotaoff\n  xfs: factor out quotaoff intent AIL removal and memory free\n  xfs: Replace function declaration by actual definition\n  xfs: remove the xfs_qoff_logitem_t typedef\n  xfs: remove the xfs_dq_logitem_t typedef\n  xfs: remove the xfs_disk_dquot_t and xfs_dquot_t\n  xfs: Use scnprintf() for avoiding potential buffer overflow\n  xfs: check owner of dir3 blocks\n  xfs: check owner of dir3 data blocks\n  xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails\n  xfs: xfs_buf_corruption_error should take __this_address\n  xfs: add a function to deal with corrupt buffers post-verifiers\n  xfs: rework collapse range into an atomic operation\n  xfs: rework insert range into an atomic operation\n  xfs: open code insert range extent split helper\n  Linux 5.4.220\n  thermal: intel_powerclamp: Use first online CPU as control_cpu\n  inet: fully convert sk-\u003esk_rx_dst to RCU rules\n  efi: libstub: drop pointless get_memory_map() call\n  md: Replace snprintf with scnprintf\n  ext4: continue to expand file system when the target size doesn\u0027t reach\n  net/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\n  Revert \"net/ieee802154: reject zero-sized raw_sendmsg()\"\n  net: ieee802154: return -EINVAL for unknown addr type\n  io_uring/af_unix: defer registered files gc to io_uring release\n  perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc\n  clk: bcm2835: Make peripheral PLLC critical\n  usb: idmouse: fix an uninit-value in idmouse_open\n  nvmet-tcp: add bounds check on Transfer Tag\n  nvme: copy firmware_rev on each init\n  staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()\n  Revert \"usb: storage: Add quirk for Samsung Fit flash\"\n  usb: musb: Fix musb_gadget.c rxstate overflow bug\n  usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()\n  md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\n  HID: roccat: Fix use-after-free in roccat_read()\n  bcache: fix set_at_max_writeback_rate() for multiple attached devices\n  ata: libahci_platform: Sanity check the DT child nodes number\n  staging: vt6655: fix potential memory leak\n  power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()\n  nbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n  scsi: 3w-9xxx: Avoid disabling device if failing to enable it\n  clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate\n  media: cx88: Fix a null-ptr-deref bug in buffer_prepare()\n  clk: zynqmp: Fix stack-out-of-bounds in strncpy`\n  btrfs: scrub: try to fix super block errors\n  ARM: dts: imx6sx: add missing properties for sram\n  ARM: dts: imx6sll: add missing properties for sram\n  ARM: dts: imx6sl: add missing properties for sram\n  ARM: dts: imx6qp: add missing properties for sram\n  ARM: dts: imx6dl: add missing properties for sram\n  ARM: dts: imx6q: add missing properties for sram\n  ARM: dts: imx7d-sdb: config the max pressure for tsc2046\n  mmc: sdhci-msm: add compatible string check for sdm670\n  drm/amdgpu: fix initial connector audio value\n  platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading\n  drm: panel-orientation-quirks: Add quirk for Anbernic Win600\n  drm/vc4: vec: Fix timings for VEC modes\n  drm/amd/display: fix overflow on MIN_I64 definition\n  drm: Prevent drm_copy_field() to attempt copying a NULL pointer\n  drm: Use size_t type for len variable in drm_copy_field()\n  drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()\n  r8152: Rate limit overflow messages\n  Bluetooth: L2CAP: Fix user-after-free\n  net: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory\n  wifi: rt2x00: correctly set BBP register 86 for MT7620\n  wifi: rt2x00: set SoC wmac clock register\n  wifi: rt2x00: set VGC gain for both chains of MT7620\n  wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620\n  wifi: rt2x00: don\u0027t run Rt5592 IQ calibration on MT7620\n  can: bcm: check the result of can_send() in bcm_can_tx()\n  Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times\n  Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()\n  wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n  xfrm: Update ipcomp_scratches with NULL when freed\n  wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()\n  tcp: annotate data-race around tcp_md5sig_pool_populated\n  openvswitch: Fix overreporting of drops in dropwatch\n  openvswitch: Fix double reporting of drops in dropwatch\n  bpftool: Clear errno after libcap\u0027s checks\n  wifi: brcmfmac: fix invalid address access when enabling SCAN log level\n  NFSD: Return nfserr_serverfault if splice_ok but buf-\u003epages have data\n  thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash\n  powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue\n  MIPS: BCM47XX: Cast memcmp() of function to (void *)\n  ACPI: video: Add Toshiba Satellite/Portege Z830 quirk\n  f2fs: fix race condition on setting FI_NO_EXTENT flag\n  crypto: cavium - prevent integer overflow loading firmware\n  kbuild: remove the target in signal traps when interrupted\n  iommu/iova: Fix module config properly\n  crypto: ccp - Release dma channels before dmaengine unrgister\n  crypto: akcipher - default implementation for setting a private key\n  iommu/omap: Fix buffer overflow in debugfs\n  cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset\n  powerpc: Fix SPE Power ISA properties for e500v1 platforms\n  powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5\n  x86/hyperv: Fix \u0027struct hv_enlightened_vmcs\u0027 definition\n  powerpc/powernv: add missing of_node_put() in opal_export_attrs()\n  powerpc/pci_dn: Add missing of_node_put()\n  powerpc/sysdev/fsl_msi: Add missing of_node_put()\n  powerpc/math_emu/efp: Include module.h\n  mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg\n  clk: ast2600: BCLK comes from EPLL\n  clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe\n  clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration\n  spmi: pmic-arb: correct duplicate APID to PPID mapping logic\n  dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()\n  clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent\n  mfd: sm501: Add check for platform_driver_register()\n  mfd: fsl-imx25: Fix check for platform_get_irq() errors\n  mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()\n  mfd: lp8788: Fix an error handling path in lp8788_probe()\n  mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()\n  mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()\n  fsi: core: Check error number after calling ida_simple_get\n  scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n  serial: 8250: Fix restoring termios speed after suspend\n  firmware: google: Test spinlock on panic path to avoid lockups\n  staging: vt6655: fix some erroneous memory clean-up loops\n  phy: qualcomm: call clk_disable_unprepare in the error handling\n  tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown\n  drivers: serial: jsm: fix some leaks in probe\n  usb: gadget: function: fix dangling pnp_string in f_printer.c\n  xhci: Don\u0027t show warning for reinit on known broken suspend\n  md/raid5: Ensure stripe_fill happens on non-read IO with journal\n  mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()\n  ata: fix ata_id_has_dipm()\n  ata: fix ata_id_has_ncq_autosense()\n  ata: fix ata_id_has_devslp()\n  ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()\n  RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.\n  mtd: devices: docg3: check the return value of devm_ioremap() in the probe\n  dyndbg: let query-modname override actual module name\n  dyndbg: fix module.dyndbg handling\n  misc: ocxl: fix possible refcount leak in afu_ioctl()\n  RDMA/rxe: Fix the error caused by qp-\u003esk\n  RDMA/rxe: Fix \"kernel NULL pointer dereference\" error\n  media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init\n  tty: xilinx_uartps: Fix the ignore_status\n  media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop\n  HSI: omap_ssi_port: Fix dma_map_sg error check\n  HSI: omap_ssi: Fix refcount leak in ssi_probe\n  clk: tegra20: Fix refcount leak in tegra20_clock_init\n  clk: tegra: Fix refcount leak in tegra114_clock_init\n  clk: tegra: Fix refcount leak in tegra210_clock_init\n  clk: berlin: Add of_node_put() for of_get_parent()\n  clk: oxnas: Hold reference returned by of_get_parent()\n  clk: meson: Hold reference returned by of_get_parent()\n  iio: ABI: Fix wrong format of differential capacitance channel ABI.\n  iio: inkern: only release the device node when done with it\n  iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq\n  iio: adc: at91-sama5d2_adc: check return status for pressure and touch\n  iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX\n  ARM: dts: exynos: fix polarity of VBUS GPIO of Origen\n  ARM: Drop CMDLINE_* dependency on ATAGS\n  ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family\n  ARM: dts: kirkwood: lsxl: remove first ethernet port\n  ARM: dts: kirkwood: lsxl: fix serial line\n  ARM: dts: turris-omnia: Fix mpp26 pin name and comment\n  soc: qcom: smem_state: Add refcounting for the \u0027state-\u003eof_node\u0027\n  soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()\n  memory: of: Fix refcount leak bug in of_get_ddr_timings()\n  memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()\n  ALSA: hda/hdmi: Don\u0027t skip notification handling during PM operation\n  ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe\n  ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe\n  ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe\n  mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()\n  ALSA: dmaengine: increment buffer pointer atomically\n  drm/msm/dpu: index dpu_kms-\u003ehw_vbif using vbif_idx\n  ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API\n  mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()\n  drm/omap: dss: Fix refcount leak bugs\n  ALSA: hda: beep: Simplify keep-power-at-enable behavior\n  ASoC: rsnd: Add check for rsnd_mod_power_on\n  drm/bridge: megachips: Fix a null pointer dereference bug\n  drm: fix drm_mipi_dbi build errors\n  platform/x86: msi-laptop: Fix resource cleanup\n  platform/x86: msi-laptop: Fix old-ec check for backlight registering\n  platform/chrome: fix memory corruption in ioctl\n  platform/chrome: fix double-free in chromeos_laptop_prepare()\n  drm/mipi-dsi: Detach devices when removing the host\n  drm: bridge: adv7511: fix CEC power down control register offset\n  net: mvpp2: fix mvpp2 debugfs leak\n  once: add DO_ONCE_SLOW() for sleepable contexts\n  net/ieee802154: reject zero-sized raw_sendmsg()\n  bnx2x: fix potential memory leak in bnx2x_tpa_stop()\n  net: rds: don\u0027t hold sock lock when cancelling work from rds_tcp_reset_callbacks()\n  tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited\n  sctp: handle the error returned from sctp_auth_asoc_init_active_key\n  mISDN: fix use-after-free bugs in l1oip timer handlers\n  vhost/vsock: Use kvmalloc/kvfree for larger packets.\n  spi: s3c64xx: Fix large transfers with DMA\n  netfilter: nft_fib: Fix for rpath check with VRF devices\n  spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe\n  x86/microcode/AMD: Track patch allocation size explicitly\n  bpf: Ensure correct locking around vulnerable function find_vpid()\n  net: fs_enet: Fix wrong check in do_pd_setup\n  wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration\n  bpf: btf: fix truncated last_member_type_id in btf_struct_resolve\n  wifi: rtl8xxxu: Fix skb misuse in TX queue selection\n  spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()\n  spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()\n  wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()\n  x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register\n  bpftool: Fix a wrong type cast in btf_dumper_int\n  wifi: mac80211: allow bw change during channel switch in mesh\n  wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()\n  nfsd: Fix a memory leak in an error handling path\n  ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE\n  sh: machvec: Use char[] for section boundaries\n  userfaultfd: open userfaultfds with O_RDONLY\n  tracing: Disable interrupt or preemption before acquiring arch_spinlock_t\n  selinux: use \"grep -E\" instead of \"egrep\"\n  drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()\n  gcov: support GCC 12.1 and newer compilers\n  KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS\n  KVM: nVMX: Unconditionally purge queued/injected events on nested \"exit\"\n  KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility\n  media: cedrus: Set the platform driver data earlier\n  ring-buffer: Fix race between reset page and reading page\n  ring-buffer: Check pending waiters when doing wake ups as well\n  ring-buffer: Have the shortest_full queue be the shortest not longest\n  ring-buffer: Allow splice to read previous partially read pages\n  ftrace: Properly unset FTRACE_HASH_FL_MOD\n  livepatch: fix race between fork and KLP transition\n  ext4: place buffer head allocation before handle start\n  ext4: make ext4_lazyinit_thread freezable\n  ext4: fix null-ptr-deref in ext4_write_info\n  ext4: avoid crash when inline data creation follows DIO write\n  jbd2: wake up journal waiters in FIFO order, not LIFO\n  nilfs2: fix use-after-free bug of struct nilfs_root\n  f2fs: fix to do sanity check on summary info\n  f2fs: fix to do sanity check on destination blkaddr during recovery\n  f2fs: increase the limit for reserve_root\n  btrfs: fix race between quota enable and quota rescan ioctl\n  fbdev: smscufx: Fix use-after-free in ufx_ops_open()\n  powerpc/boot: Explicitly disable usage of SPE instructions\n  PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge\n  UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n  riscv: Pass -mno-relax only on lld \u003c 15.0.0\n  riscv: Allow PROT_WRITE-only mmap()\n  parisc: fbdev/stifb: Align graphics memory size to 4MB\n  RISC-V: Make port I/O string accessors actually work\n  regulator: qcom_rpm: Fix circular deferral regression\n  ASoC: wcd9335: fix order of Slimbus unprepare/disable\n  quota: Check next/prev free block number after reading from quota file\n  HID: multitouch: Add memory barriers\n  fs: dlm: handle -EBUSY first in lock arg validation\n  fs: dlm: fix race between test_bit() and queue_work()\n  mmc: sdhci-sprd: Fix minimum clock limit\n  can: kvaser_usb_leaf: Fix CAN state after restart\n  can: kvaser_usb_leaf: Fix TX queue out of sync after restart\n  can: kvaser_usb_leaf: Fix overread with an invalid command\n  can: kvaser_usb: Fix use of uninitialized completion\n  usb: add quirks for Lenovo OneLink+ Dock\n  iio: pressure: dps310: Reset chip after timeout\n  iio: pressure: dps310: Refactor startup procedure\n  iio: dac: ad5593r: Fix i2c read protocol requirements\n  cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message\n  cifs: destage dirty pages before re-reading them for cache\u003dnone\n  mtd: rawnand: atmel: Unmap streaming DMA mappings\n  ALSA: hda/realtek: Add Intel Reference SSID to support headset keys\n  ALSA: hda/realtek: Add quirk for ASUS GV601R laptop\n  ALSA: hda/realtek: Correct pin configs for ASUS G533Z\n  ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530\n  ALSA: usb-audio: Fix NULL dererence at error path\n  ALSA: usb-audio: Fix potential memory leaks\n  ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()\n  ALSA: oss: Fix potential deadlock at unregistration\n\n Conflicts:\n\tdrivers/android/binder.c\n\tinclude/linux/rmap.h\n\tkernel/cgroup/cpuset.c\n\tmm/rmap.c\n\nChange-Id: I34fe2d5c9b0d5844560de9c983867511b5d57265\n"
    },
    {
      "commit": "6b029aa535ddad22fc09fe5b1e6c37f10cda8724",
      "tree": "742838d18cecf52fa32beff1a2db964cb70e2ffb",
      "parents": [
        "cb8a045992c4960f1dfb1aa98712b07a065594c4",
        "fe18f1af38a7999e05a6564c80d63e8d9df5ee60"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Oct 29 10:45:08 2022 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Oct 29 10:45:08 2022 +0200"
      },
      "message": "Merge 5.4.220 into android11-5.4-lts\n\nChanges in 5.4.220\n\tALSA: oss: Fix potential deadlock at unregistration\n\tALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()\n\tALSA: usb-audio: Fix potential memory leaks\n\tALSA: usb-audio: Fix NULL dererence at error path\n\tALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530\n\tALSA: hda/realtek: Correct pin configs for ASUS G533Z\n\tALSA: hda/realtek: Add quirk for ASUS GV601R laptop\n\tALSA: hda/realtek: Add Intel Reference SSID to support headset keys\n\tmtd: rawnand: atmel: Unmap streaming DMA mappings\n\tcifs: destage dirty pages before re-reading them for cache\u003dnone\n\tcifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message\n\tiio: dac: ad5593r: Fix i2c read protocol requirements\n\tiio: pressure: dps310: Refactor startup procedure\n\tiio: pressure: dps310: Reset chip after timeout\n\tusb: add quirks for Lenovo OneLink+ Dock\n\tcan: kvaser_usb: Fix use of uninitialized completion\n\tcan: kvaser_usb_leaf: Fix overread with an invalid command\n\tcan: kvaser_usb_leaf: Fix TX queue out of sync after restart\n\tcan: kvaser_usb_leaf: Fix CAN state after restart\n\tmmc: sdhci-sprd: Fix minimum clock limit\n\tfs: dlm: fix race between test_bit() and queue_work()\n\tfs: dlm: handle -EBUSY first in lock arg validation\n\tHID: multitouch: Add memory barriers\n\tquota: Check next/prev free block number after reading from quota file\n\tASoC: wcd9335: fix order of Slimbus unprepare/disable\n\tregulator: qcom_rpm: Fix circular deferral regression\n\tRISC-V: Make port I/O string accessors actually work\n\tparisc: fbdev/stifb: Align graphics memory size to 4MB\n\triscv: Allow PROT_WRITE-only mmap()\n\triscv: Pass -mno-relax only on lld \u003c 15.0.0\n\tUM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\tPCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge\n\tpowerpc/boot: Explicitly disable usage of SPE instructions\n\tfbdev: smscufx: Fix use-after-free in ufx_ops_open()\n\tbtrfs: fix race between quota enable and quota rescan ioctl\n\tf2fs: increase the limit for reserve_root\n\tf2fs: fix to do sanity check on destination blkaddr during recovery\n\tf2fs: fix to do sanity check on summary info\n\tnilfs2: fix use-after-free bug of struct nilfs_root\n\tjbd2: wake up journal waiters in FIFO order, not LIFO\n\text4: avoid crash when inline data creation follows DIO write\n\text4: fix null-ptr-deref in ext4_write_info\n\text4: make ext4_lazyinit_thread freezable\n\text4: place buffer head allocation before handle start\n\tlivepatch: fix race between fork and KLP transition\n\tftrace: Properly unset FTRACE_HASH_FL_MOD\n\tring-buffer: Allow splice to read previous partially read pages\n\tring-buffer: Have the shortest_full queue be the shortest not longest\n\tring-buffer: Check pending waiters when doing wake ups as well\n\tring-buffer: Fix race between reset page and reading page\n\tmedia: cedrus: Set the platform driver data earlier\n\tKVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility\n\tKVM: nVMX: Unconditionally purge queued/injected events on nested \"exit\"\n\tKVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS\n\tgcov: support GCC 12.1 and newer compilers\n\tdrm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()\n\tselinux: use \"grep -E\" instead of \"egrep\"\n\ttracing: Disable interrupt or preemption before acquiring arch_spinlock_t\n\tuserfaultfd: open userfaultfds with O_RDONLY\n\tsh: machvec: Use char[] for section boundaries\n\tARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE\n\tnfsd: Fix a memory leak in an error handling path\n\twifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()\n\twifi: mac80211: allow bw change during channel switch in mesh\n\tbpftool: Fix a wrong type cast in btf_dumper_int\n\tx86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register\n\twifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()\n\tspi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()\n\tspi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()\n\twifi: rtl8xxxu: Fix skb misuse in TX queue selection\n\tbpf: btf: fix truncated last_member_type_id in btf_struct_resolve\n\twifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration\n\tnet: fs_enet: Fix wrong check in do_pd_setup\n\tbpf: Ensure correct locking around vulnerable function find_vpid()\n\tx86/microcode/AMD: Track patch allocation size explicitly\n\tspi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe\n\tnetfilter: nft_fib: Fix for rpath check with VRF devices\n\tspi: s3c64xx: Fix large transfers with DMA\n\tvhost/vsock: Use kvmalloc/kvfree for larger packets.\n\tmISDN: fix use-after-free bugs in l1oip timer handlers\n\tsctp: handle the error returned from sctp_auth_asoc_init_active_key\n\ttcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited\n\tnet: rds: don\u0027t hold sock lock when cancelling work from rds_tcp_reset_callbacks()\n\tbnx2x: fix potential memory leak in bnx2x_tpa_stop()\n\tnet/ieee802154: reject zero-sized raw_sendmsg()\n\tonce: add DO_ONCE_SLOW() for sleepable contexts\n\tnet: mvpp2: fix mvpp2 debugfs leak\n\tdrm: bridge: adv7511: fix CEC power down control register offset\n\tdrm/mipi-dsi: Detach devices when removing the host\n\tplatform/chrome: fix double-free in chromeos_laptop_prepare()\n\tplatform/chrome: fix memory corruption in ioctl\n\tplatform/x86: msi-laptop: Fix old-ec check for backlight registering\n\tplatform/x86: msi-laptop: Fix resource cleanup\n\tdrm: fix drm_mipi_dbi build errors\n\tdrm/bridge: megachips: Fix a null pointer dereference bug\n\tASoC: rsnd: Add check for rsnd_mod_power_on\n\tALSA: hda: beep: Simplify keep-power-at-enable behavior\n\tdrm/omap: dss: Fix refcount leak bugs\n\tmmc: au1xmmc: Fix an error handling path in au1xmmc_probe()\n\tASoC: eureka-tlv320: Hold reference returned from of_find_xxx API\n\tdrm/msm/dpu: index dpu_kms-\u003ehw_vbif using vbif_idx\n\tALSA: dmaengine: increment buffer pointer atomically\n\tmmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()\n\tASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe\n\tASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe\n\tASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe\n\tALSA: hda/hdmi: Don\u0027t skip notification handling during PM operation\n\tmemory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()\n\tmemory: of: Fix refcount leak bug in of_get_ddr_timings()\n\tsoc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()\n\tsoc: qcom: smem_state: Add refcounting for the \u0027state-\u003eof_node\u0027\n\tARM: dts: turris-omnia: Fix mpp26 pin name and comment\n\tARM: dts: kirkwood: lsxl: fix serial line\n\tARM: dts: kirkwood: lsxl: remove first ethernet port\n\tARM: dts: exynos: correct s5k6a3 reset polarity on Midas family\n\tARM: Drop CMDLINE_* dependency on ATAGS\n\tARM: dts: exynos: fix polarity of VBUS GPIO of Origen\n\tiio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX\n\tiio: adc: at91-sama5d2_adc: check return status for pressure and touch\n\tiio: adc: at91-sama5d2_adc: lock around oversampling and sample freq\n\tiio: inkern: only release the device node when done with it\n\tiio: ABI: Fix wrong format of differential capacitance channel ABI.\n\tclk: meson: Hold reference returned by of_get_parent()\n\tclk: oxnas: Hold reference returned by of_get_parent()\n\tclk: berlin: Add of_node_put() for of_get_parent()\n\tclk: tegra: Fix refcount leak in tegra210_clock_init\n\tclk: tegra: Fix refcount leak in tegra114_clock_init\n\tclk: tegra20: Fix refcount leak in tegra20_clock_init\n\tHSI: omap_ssi: Fix refcount leak in ssi_probe\n\tHSI: omap_ssi_port: Fix dma_map_sg error check\n\tmedia: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop\n\ttty: xilinx_uartps: Fix the ignore_status\n\tmedia: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init\n\tRDMA/rxe: Fix \"kernel NULL pointer dereference\" error\n\tRDMA/rxe: Fix the error caused by qp-\u003esk\n\tmisc: ocxl: fix possible refcount leak in afu_ioctl()\n\tdyndbg: fix module.dyndbg handling\n\tdyndbg: let query-modname override actual module name\n\tmtd: devices: docg3: check the return value of devm_ioremap() in the probe\n\tRDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.\n\tata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()\n\tata: fix ata_id_has_devslp()\n\tata: fix ata_id_has_ncq_autosense()\n\tata: fix ata_id_has_dipm()\n\tmtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()\n\tmd/raid5: Ensure stripe_fill happens on non-read IO with journal\n\txhci: Don\u0027t show warning for reinit on known broken suspend\n\tusb: gadget: function: fix dangling pnp_string in f_printer.c\n\tdrivers: serial: jsm: fix some leaks in probe\n\ttty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown\n\tphy: qualcomm: call clk_disable_unprepare in the error handling\n\tstaging: vt6655: fix some erroneous memory clean-up loops\n\tfirmware: google: Test spinlock on panic path to avoid lockups\n\tserial: 8250: Fix restoring termios speed after suspend\n\tscsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n\tfsi: core: Check error number after calling ida_simple_get\n\tmfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()\n\tmfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()\n\tmfd: lp8788: Fix an error handling path in lp8788_probe()\n\tmfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()\n\tmfd: fsl-imx25: Fix check for platform_get_irq() errors\n\tmfd: sm501: Add check for platform_driver_register()\n\tclk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent\n\tdmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()\n\tspmi: pmic-arb: correct duplicate APID to PPID mapping logic\n\tclk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration\n\tclk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe\n\tclk: ast2600: BCLK comes from EPLL\n\tmailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg\n\tpowerpc/math_emu/efp: Include module.h\n\tpowerpc/sysdev/fsl_msi: Add missing of_node_put()\n\tpowerpc/pci_dn: Add missing of_node_put()\n\tpowerpc/powernv: add missing of_node_put() in opal_export_attrs()\n\tx86/hyperv: Fix \u0027struct hv_enlightened_vmcs\u0027 definition\n\tpowerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5\n\tpowerpc: Fix SPE Power ISA properties for e500v1 platforms\n\tcgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset\n\tiommu/omap: Fix buffer overflow in debugfs\n\tcrypto: akcipher - default implementation for setting a private key\n\tcrypto: ccp - Release dma channels before dmaengine unrgister\n\tiommu/iova: Fix module config properly\n\tkbuild: remove the target in signal traps when interrupted\n\tcrypto: cavium - prevent integer overflow loading firmware\n\tf2fs: fix race condition on setting FI_NO_EXTENT flag\n\tACPI: video: Add Toshiba Satellite/Portege Z830 quirk\n\tMIPS: BCM47XX: Cast memcmp() of function to (void *)\n\tpowercap: intel_rapl: fix UBSAN shift-out-of-bounds issue\n\tthermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash\n\tNFSD: Return nfserr_serverfault if splice_ok but buf-\u003epages have data\n\twifi: brcmfmac: fix invalid address access when enabling SCAN log level\n\tbpftool: Clear errno after libcap\u0027s checks\n\topenvswitch: Fix double reporting of drops in dropwatch\n\topenvswitch: Fix overreporting of drops in dropwatch\n\ttcp: annotate data-race around tcp_md5sig_pool_populated\n\twifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()\n\txfrm: Update ipcomp_scratches with NULL when freed\n\twifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n\tBluetooth: L2CAP: initialize delayed works at l2cap_chan_create()\n\tBluetooth: hci_sysfs: Fix attempting to call device_add multiple times\n\tcan: bcm: check the result of can_send() in bcm_can_tx()\n\twifi: rt2x00: don\u0027t run Rt5592 IQ calibration on MT7620\n\twifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620\n\twifi: rt2x00: set VGC gain for both chains of MT7620\n\twifi: rt2x00: set SoC wmac clock register\n\twifi: rt2x00: correctly set BBP register 86 for MT7620\n\tnet: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory\n\tBluetooth: L2CAP: Fix user-after-free\n\tr8152: Rate limit overflow messages\n\tdrm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()\n\tdrm: Use size_t type for len variable in drm_copy_field()\n\tdrm: Prevent drm_copy_field() to attempt copying a NULL pointer\n\tdrm/amd/display: fix overflow on MIN_I64 definition\n\tdrm/vc4: vec: Fix timings for VEC modes\n\tdrm: panel-orientation-quirks: Add quirk for Anbernic Win600\n\tplatform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading\n\tdrm/amdgpu: fix initial connector audio value\n\tmmc: sdhci-msm: add compatible string check for sdm670\n\tARM: dts: imx7d-sdb: config the max pressure for tsc2046\n\tARM: dts: imx6q: add missing properties for sram\n\tARM: dts: imx6dl: add missing properties for sram\n\tARM: dts: imx6qp: add missing properties for sram\n\tARM: dts: imx6sl: add missing properties for sram\n\tARM: dts: imx6sll: add missing properties for sram\n\tARM: dts: imx6sx: add missing properties for sram\n\tbtrfs: scrub: try to fix super block errors\n\tclk: zynqmp: Fix stack-out-of-bounds in strncpy`\n\tmedia: cx88: Fix a null-ptr-deref bug in buffer_prepare()\n\tclk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate\n\tscsi: 3w-9xxx: Avoid disabling device if failing to enable it\n\tnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\tpower: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()\n\tstaging: vt6655: fix potential memory leak\n\tata: libahci_platform: Sanity check the DT child nodes number\n\tbcache: fix set_at_max_writeback_rate() for multiple attached devices\n\tHID: roccat: Fix use-after-free in roccat_read()\n\tmd/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d\n\tusb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()\n\tusb: musb: Fix musb_gadget.c rxstate overflow bug\n\tRevert \"usb: storage: Add quirk for Samsung Fit flash\"\n\tstaging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()\n\tnvme: copy firmware_rev on each init\n\tnvmet-tcp: add bounds check on Transfer Tag\n\tusb: idmouse: fix an uninit-value in idmouse_open\n\tclk: bcm2835: Make peripheral PLLC critical\n\tperf intel-pt: Fix segfault in intel_pt_print_info() with uClibc\n\tio_uring/af_unix: defer registered files gc to io_uring release\n\tnet: ieee802154: return -EINVAL for unknown addr type\n\tRevert \"net/ieee802154: reject zero-sized raw_sendmsg()\"\n\tnet/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\n\text4: continue to expand file system when the target size doesn\u0027t reach\n\tmd: Replace snprintf with scnprintf\n\tefi: libstub: drop pointless get_memory_map() call\n\tinet: fully convert sk-\u003esk_rx_dst to RCU rules\n\tthermal: intel_powerclamp: Use first online CPU as control_cpu\n\tLinux 5.4.220\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: I91859d6b79f44ab654cb0c88d0d6c9c46f62131b\n"
    },
    {
      "commit": "c0f4be8303d0b771be1e2e8446c8fb28861e3386",
      "tree": "a47b6346be2fda61b295b006b53c0cc282128552",
      "parents": [
        "29d0c45cf16e5be1b33561b3d3184dbd56e45586"
      ],
      "author": {
        "name": "Ondrej Mosnacek",
        "email": "omosnace@redhat.com",
        "time": "Fri Jul 08 11:34:51 2022 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Oct 26 13:22:21 2022 +0200"
      },
      "message": "userfaultfd: open userfaultfds with O_RDONLY\n\n[ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ]\n\nSince userfaultfd doesn\u0027t implement a write operation, it is more\nappropriate to open it read-only.\n\nWhen userfaultfds are opened read-write like it is now, and such fd is\npassed from one process to another, SELinux will check both read and\nwrite permissions for the target process, even though it can\u0027t actually\ndo any write operation on the fd later.\n\nInspired by the following bug report, which has hit the SELinux scenario\ndescribed above:\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d1974559\n\nReported-by: Robert O\u0027Callahan \u003croc@ocallahan.org\u003e\nFixes: 86039bd3b4e6 (\"userfaultfd: add new syscall to provide memory externalization\")\nSigned-off-by: Ondrej Mosnacek \u003comosnace@redhat.com\u003e\nAcked-by: Peter Xu \u003cpeterx@redhat.com\u003e\nAcked-by: Christian Brauner (Microsoft) \u003cbrauner@kernel.org\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n"
    },
    {
      "commit": "16e939c6e4f8f81e8eb75a118774026fb2947a60",
      "tree": "1b68572b1c603d1c60c0cef6949f5ba55c5f2bd2",
      "parents": [
        "f3f68f9615656a7990683abcc83f75b5f849c65c",
        "b9d179c605d3bbaf1ca38f1a1039416b5e57680c"
      ],
      "author": {
        "name": "Srinivasarao Pathipati",
        "email": "quic_spathi@quicinc.com",
        "time": "Mon Feb 07 10:26:43 2022 +0530"
      },
      "committer": {
        "name": "Srinivasarao Pathipati",
        "email": "quic_spathi@quicinc.com",
        "time": "Mon Feb 07 22:29:21 2022 +0530"
      },
      "message": "Merge android11-5.4.161+ (b9d179c) into msm-5.4\n\n* refs/heads/tmp-b9d179c:\n  UPSTREAM: driver core: Fix possible memory leak in device_link_add()\n  UPSTREAM: blk-mq: fix kernel panic during iterating over flush request\n  UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg\n  UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings\n  ANDROID: incremental-fs: fix mount_fs issue\n  UPSTREAM: vfs: fs_context: fix up param length parsing in legacy_parse_param\n  ANDROID: GKI: disable CONFIG_FORTIFY_SOURCE\n  Linux 5.4.161\n  erofs: fix unsafe pagevec reuse of hooked pclusters\n  erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()\n  PCI: Add MSI masking quirk for Nvidia ION AHCI\n  PCI/MSI: Deal with devices lying about their MSI mask capability\n  PCI/MSI: Destroy sysfs before freeing entries\n  parisc/entry: fix trace test in syscall exit path\n  fortify: Explicitly disable Clang support\n  scsi: ufs: Fix tm request when non-fatal error happens\n  ext4: fix lazy initialization next schedule time computation in more granular unit\n  MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL\n  scsi: ufs: Fix interrupt error message for shared interrupts\n  soc/tegra: pmc: Fix imbalanced clock disabling in error code path\n  Revert \"net: sched: update default qdisc visibility after Tx queue cnt changes\"\n  Revert \"serial: core: Fix initializing and restoring termios speed\"\n  Linux 5.4.160\n  selftests/bpf: Fix also no-alu32 strobemeta selftest\n  ath10k: fix invalid dma_addr_t token assignment\n  SUNRPC: Partial revert of commit 6f9f17287e78\n  PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros\n  powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload\n  s390/cio: make ccw_device_dma_* more robust\n  s390/tape: fix timer initialization in tape_std_assign()\n  s390/cio: check the subchannel validity for dev_busid\n  video: backlight: Drop maximum brightness override for brightness zero\n  mm, oom: do not trigger out_of_memory from the #PF\n  mm, oom: pagefault_out_of_memory: don\u0027t force global OOM for dying tasks\n  powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC\n  powerpc/security: Add a helper to query stf_barrier type\n  powerpc/bpf: Fix BPF_SUB when imm \u003d\u003d 0x80000000\n  powerpc/bpf: Validate branch ranges\n  powerpc/lib: Add helper to check if offset is within conditional branch range\n  ovl: fix deadlock in splice write\n  9p/net: fix missing error check in p9_check_errors\n  net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE\n  f2fs: should use GFP_NOFS for directory inodes\n  irqchip/sifive-plic: Fixup EOI failed when masked\n  parisc: Fix set_fixmap() on PA1.x CPUs\n  parisc: Fix backtrace to always include init funtion names\n  ARM: 9156/1: drop cc-option fallbacks for architecture selection\n  ARM: 9155/1: fix early early_iounmap()\n  selftests/net: udpgso_bench_rx: fix port argument\n  cxgb4: fix eeprom len when diagnostics not implemented\n  net/smc: fix sk_refcnt underflow on linkdown and fallback\n  vsock: prevent unnecessary refcnt inc for nonblocking connect\n  net: hns3: allow configure ETS bandwidth of all TCs\n  net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any\n  bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding\n  arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions\n  nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails\n  llc: fix out-of-bound array index in llc_sk_dev_hash()\n  perf bpf: Add missing free to bpf_event__print_bpf_prog_info()\n  zram: off by one in read_block_state()\n  mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()\n  bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed\n  ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses\n  net: vlan: fix a UAF in vlan_dev_real_dev()\n  net: davinci_emac: Fix interrupt pacing disable\n  xen-pciback: Fix return in pm_ctrl_init()\n  i2c: xlr: Fix a resource leak in the error handling path of \u0027xlr_i2c_probe()\u0027\n  NFSv4: Fix a regression in nfs_set_open_stateid_locked()\n  scsi: qla2xxx: Turn off target reset during issue_lip\n  scsi: qla2xxx: Fix gnl list corruption\n  ar7: fix kernel builds for compiler test\n  watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT\n  m68k: set a default value for MEMORY_RESERVE\n  signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)\n  dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`\n  netfilter: nfnetlink_queue: fix OOB when mac header was cleared\n  soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read\n  auxdisplay: ht16k33: Fix frame buffer device blanking\n  auxdisplay: ht16k33: Connect backlight to fbdev\n  auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string\n  dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro\n  mtd: core: don\u0027t remove debugfs directory if device is in use\n  mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()\n  fs: orangefs: fix error return code of orangefs_revalidate_lookup()\n  NFS: Fix deadlocks in nfs_scan_commit_list()\n  opp: Fix return in _opp_add_static_v2()\n  PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge\n  PCI: aardvark: Don\u0027t spam about PIO Response Status\n  drm/plane-helper: fix uninitialized variable reference\n  pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds\n  rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined\n  apparmor: fix error check\n  power: supply: bq27xxx: Fix kernel crash on IRQ handler register error\n  mips: cm: Convert to bitfield API to fix out-of-bounds access\n  powerpc/44x/fsp2: add missing of_node_put\n  HID: u2fzero: properly handle timeouts in usb_submit_urb\n  HID: u2fzero: clarify error check and length calculations\n  serial: xilinx_uartps: Fix race condition causing stuck TX\n  phy: qcom-qusb2: Fix a memory leak on probe\n  ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER\n  ASoC: cs42l42: Correct some register default values\n  ARM: dts: stm32: fix SAI sub nodes register range\n  staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC\n  RDMA/mlx4: Return missed an error if device doesn\u0027t support steering\n  scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()\n  power: supply: rt5033_battery: Change voltage values to µV\n  usb: gadget: hid: fix error code in do_config()\n  serial: 8250_dw: Drop wrong use of ACPI_PTR()\n  video: fbdev: chipsfb: use memset_io() instead of memset()\n  clk: at91: check pmc node status before registering syscore ops\n  memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe\n  soc/tegra: Fix an error handling path in tegra_powergate_power_up()\n  arm: dts: omap3-gta04a4: accelerometer irq fix\n  ALSA: hda: Reduce udelay() at SKL+ position reporting\n  JFS: fix memleak in jfs_mount\n  MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT\n  scsi: dc395: Fix error case unwinding\n  ARM: dts: at91: tse850: the emac\u003c-\u003ephy interface is rmii\n  arm64: dts: meson-g12a: Fix the pwm regulator supply properties\n  RDMA/bnxt_re: Fix query SRQ failure\n  ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY\n  arm64: dts: rockchip: Fix GPU register width for RK3328\n  ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()\n  clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths\n  RDMA/rxe: Fix wrong port_cap_flags\n  ibmvnic: Process crqs after enabling interrupts\n  ibmvnic: don\u0027t stop queue in xmit\n  udp6: allow SO_MARK ctrl msg to affect routing\n  selftests/bpf: Fix fclose/pclose mismatch in test_progs\n  crypto: pcrypt - Delay write to padata-\u003einfo\n  net: phylink: avoid mvneta warning when setting pause parameters\n  net: amd-xgbe: Toggle PLL settings during rate change\n  drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits\n  wcn36xx: add proper DMA memory barriers in rx path\n  libertas: Fix possible memory leak in probe and disconnect\n  libertas_tf: Fix possible memory leak in probe and disconnect\n  KVM: s390: Fix handle_sske page fault handling\n  samples/kretprobes: Fix return value if register_kretprobe() failed\n  tcp: don\u0027t free a FIN sk_buff in tcp_remove_empty_skb()\n  irq: mips: avoid nested irq_enter()\n  s390/gmap: don\u0027t unconditionally call pte_unmap_unlock() in __gmap_zap()\n  libbpf: Fix BTF data layout checks and allow empty BTF\n  smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi\n  drm/msm: Fix potential NULL dereference in DPU SSPP\n  clocksource/drivers/timer-ti-dm: Select TIMER_OF\n  PM: hibernate: fix sparse warnings\n  nvme-rdma: fix error code in nvme_rdma_setup_ctrl\n  phy: micrel: ksz8041nl: do not use power down mode\n  mwifiex: Send DELBA requests according to spec\n  rsi: stop thread firstly in rsi_91x_init() error handling\n  mt76: mt76x02: fix endianness warnings in mt76x02_mac.c\n  platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning\n  block: ataflop: fix breakage introduced at blk-mq refactoring\n  mmc: mxs-mmc: disable regulator on error and in the remove function\n  net: stream: don\u0027t purge sk_error_queue in sk_stream_kill_queues()\n  drm/msm: uninitialized variable in msm_gem_import()\n  ath10k: fix max antenna gain unit\n  hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff\n  hwmon: Fix possible memleak in __hwmon_device_register()\n  net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE\n  memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()\n  memstick: avoid out-of-range warning\n  mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured\n  b43: fix a lower bounds test\n  b43legacy: fix a lower bounds test\n  hwrng: mtk - Force runtime pm ops for sleep ops\n  crypto: qat - disregard spurious PFVF interrupts\n  crypto: qat - detect PFVF collision after ACK\n  media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()\n  netfilter: nft_dynset: relax superfluous check on set updates\n  EDAC/amd64: Handle three rank interleaving mode\n  ath9k: Fix potential interrupt storm on queue reset\n  media: em28xx: Don\u0027t use ops-\u003esuspend if it is NULL\n  cpuidle: Fix kobject memory leaks in error paths\n  crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency\n  kprobes: Do not use local variable when creating debugfs file\n  media: cx23885: Fix snd_card_free call on null card pointer\n  media: tm6000: Avoid card name truncation\n  media: si470x: Avoid card name truncation\n  media: radio-wl1273: Avoid card name truncation\n  media: mtk-vpu: Fix a resource leak in the error handling path of \u0027mtk_vpu_probe()\u0027\n  media: TDA1997x: handle short reads of hdmi info frame.\n  media: dvb-usb: fix ununit-value in az6027_rc_query\n  media: cxd2880-spi: Fix a null pointer dereference on error handling path\n  media: em28xx: add missing em28xx_close_extension\n  drm/amdgpu: fix warning for overflow check\n  ath10k: Fix missing frame timestamp for beacon/probe-resp\n  net: dsa: rtl8366rb: Fix off-by-one bug\n  rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()\n  crypto: caam - disable pkc for non-E SoCs\n  Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync\n  wilc1000: fix possible memory leak in cfg_scan_result()\n  cgroup: Make rebind_subsystems() disable v2 controllers all at once\n  net: net_namespace: Fix undefined member in key_remove_domain()\n  virtio-gpu: fix possible memory allocation failure\n  drm/v3d: fix wait for TMU write combiner flush\n  rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()\n  Bluetooth: fix init and cleanup of sco_conn.timeout_work\n  selftests/bpf: Fix strobemeta selftest regression\n  netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state\n  parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling\n  parisc/unwind: fix unwinder when CONFIG_64BIT is enabled\n  task_stack: Fix end_of_stack() for architectures with upwards-growing stack\n  parisc: fix warning in flush_tlb_all\n  x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted\n  spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()\n  btrfs: do not take the uuid_mutex in btrfs_rm_device\n  net: annotate data-race in neigh_output()\n  vrf: run conntrack only in context of lower/physdev for locally generated packets\n  ARM: 9136/1: ARMv7-M uses BE-8, not BE-32\n  gre/sit: Don\u0027t generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE\n  ARM: clang: Do not rely on lr register for stacktrace\n  smackfs: use __GFP_NOFAIL for smk_cipso_doi()\n  iwlwifi: mvm: disable RX-diversity in powersave\n  selftests: kvm: fix mismatched fclose() after popen()\n  PM: hibernate: Get block device exclusively in swsusp_check()\n  nvme: drop scan_lock and always kick requeue list when removing namespaces\n  nvmet-tcp: fix use-after-free when a port is removed\n  nvmet: fix use-after-free when a port is removed\n  block: remove inaccurate requeue check\n  mwl8k: Fix use-after-free in mwl8k_fw_state_machine()\n  tracing/cfi: Fix cmp_entries_* functions signature mismatch\n  workqueue: make sysfs of unbound kworker cpumask more clever\n  lib/xz: Validate the value before assigning it to an enum variable\n  lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression\n  memstick: r592: Fix a UAF bug when removing the driver\n  leaking_addresses: Always print a trailing newline\n  ACPI: battery: Accept charges over the design capacity as full\n  iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value\n  ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()\n  tracefs: Have tracefs directories not set OTH permission bits by default\n  net-sysfs: try not to restart the syscall if it will fail eventually\n  media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()\n  media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info\n  media: ipu3-imgu: imgu_fmt: Handle properly try\n  ACPICA: Avoid evaluating methods too early during system resume\n  ipmi: Disable some operations during a panic\n  media: rcar-csi2: Add checking to rcsi2_start_receiver()\n  brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet\n  ia64: don\u0027t do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK\n  media: mceusb: return without resubmitting URB in case of -EPROTO error.\n  media: imx: set a media_device bus_info string\n  media: s5p-mfc: Add checking to s5p_mfc_probe().\n  media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()\n  media: uvcvideo: Set unique vdev name based in type\n  media: uvcvideo: Return -EIO for control errors\n  media: uvcvideo: Set capability in s_param\n  media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()\n  media: netup_unidvb: handle interrupt properly according to the firmware\n  media: mt9p031: Fix corrupted frame after restarting stream\n  ath10k: high latency fixes for beacon buffer\n  mwifiex: Properly initialize private structure on interface type changes\n  mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type\n  x86: Increase exception stack sizes\n  smackfs: Fix use-after-free in netlbl_catmap_walk()\n  net: sched: update default qdisc visibility after Tx queue cnt changes\n  locking/lockdep: Avoid RCU-induced noinstr fail\n  MIPS: lantiq: dma: reset correct number of channel\n  MIPS: lantiq: dma: add small delay after reset\n  platform/x86: wmi: do not fail if disabling fails\n  drm/panel-orientation-quirks: add Valve Steam Deck\n  Bluetooth: fix use-after-free error in lock_sock_nested()\n  Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()\n  drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6\n  drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1\n  drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)\n  dma-buf: WARN on dmabuf release with pending attachments\n  USB: chipidea: fix interrupt deadlock\n  USB: iowarrior: fix control-message timeouts\n  USB: serial: keyspan: fix memleak on probe errors\n  iio: dac: ad5446: Fix ad5622_write() return value\n  pinctrl: core: fix possible memory leak in pinctrl_enable()\n  quota: correct error number in free_dqentry()\n  quota: check block number when reading the block in quota file\n  PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG\n  PCI: aardvark: Fix return value of MSI domain .alloc() method\n  PCI: aardvark: Fix reporting Data Link Layer Link Active\n  PCI: aardvark: Do not unmask unused interrupts\n  PCI: aardvark: Fix checking for link up via LTSSM state\n  PCI: aardvark: Do not clear status bits of masked interrupts\n  PCI: pci-bridge-emul: Fix emulation of W1C bits\n  xen/balloon: add late_initcall_sync() for initial ballooning done\n  ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume\n  ALSA: mixer: oss: Fix racy access to slots\n  serial: core: Fix initializing and restoring termios speed\n  powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found\n  can: j1939: j1939_can_recv(): ignore messages with invalid source address\n  can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport\n  KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use\n  power: supply: max17042_battery: use VFSOC for capacity when no rsns\n  power: supply: max17042_battery: Prevent int underflow in set_soc_threshold\n  signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT\n  signal: Remove the bogus sigkill_pending in ptrace_stop\n  RDMA/qedr: Fix NULL deref for query_qp on the GSI QP\n  rsi: Fix module dev_oper_mode parameter description\n  rsi: fix rate mask set leading to P2P failure\n  rsi: fix key enabled check causing unwanted encryption for vap_id \u003e 0\n  rsi: fix occasional initialisation failure with BT coex\n  wcn36xx: handle connection loss indication\n  libata: fix checking of DMA state\n  mwifiex: Read a PCI register after writing the TX ring write pointer\n  wcn36xx: Fix HT40 capability for 2Ghz band\n  evm: mark evm_fixmode as __ro_after_init\n  rtl8187: fix control-message timeouts\n  PCI: Mark Atheros QCA6174 to avoid bus reset\n  ath10k: fix division by zero in send path\n  ath10k: fix control-message timeout\n  ath6kl: fix control-message timeout\n  ath6kl: fix division by zero in send path\n  mwifiex: fix division by zero in fw download path\n  EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell\n  regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property\n  regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled\n  hwmon: (pmbus/lm25066) Add offset coefficients\n  ia64: kprobes: Fix to pass correct trampoline address to the handler\n  btrfs: call btrfs_check_rw_degradable only if there is a missing device\n  btrfs: fix lost error handling when replaying directory deletes\n  btrfs: clear MISSING device status bit in btrfs_close_one_device\n  net/smc: Correct spelling mistake to TCPF_SYN_RECV\n  nfp: bpf: relax prog rejection for mtu check through max_pkt_offset\n  vmxnet3: do not stop tx queues after netif_device_detach()\n  r8169: Add device 10ec:8162 to driver r8169\n  nvmet-tcp: fix header digest verification\n  drm: panel-orientation-quirks: Add quirk for GPD Win3\n  watchdog: Fix OMAP watchdog early handling\n  net: multicast: calculate csum of looped-back and forwarded packets\n  spi: spl022: fix Microwire full duplex mode\n  nvmet-tcp: fix a memory leak when releasing a queue\n  xen/netfront: stop tx queues during live migration\n  bpf: Prevent increasing bpf_jit_limit above max\n  bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT\n  drm: panel-orientation-quirks: Add quirk for Aya Neo 2021\n  mmc: winbond: don\u0027t build on M68K\n  reset: socfpga: add empty driver allowing consumers to probe\n  ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode\n  hyperv/vmbus: include linux/bitops.h\n  sfc: Don\u0027t use netif_info before net_device setup\n  cavium: Fix return values of the probe function\n  scsi: qla2xxx: Fix unmap of already freed sgl\n  scsi: qla2xxx: Return -ENOMEM if kzalloc() fails\n  cavium: Return negative value when pci_alloc_irq_vectors() fails\n  x86/irq: Ensure PI wakeup handler is unregistered before module unload\n  x86/cpu: Fix migration safety with X86_BUG_NULL_SEL\n  x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c\n  fuse: fix page stealing\n  ALSA: timer: Unconditionally unlink slave instances, too\n  ALSA: timer: Fix use-after-free problem\n  ALSA: synth: missing check for possible NULL after the call to kstrdup\n  ALSA: usb-audio: Add registration quirk for JBL Quantum 400\n  ALSA: line6: fix control and interrupt message timeouts\n  ALSA: 6fire: fix control and bulk message timeouts\n  ALSA: ua101: fix division by zero at probe\n  ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED\n  ALSA: hda/realtek: Add quirk for ASUS UX550VE\n  ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N\n  ALSA: hda/realtek: Add quirk for Clevo PC70HS\n  media: v4l2-ioctl: Fix check_ext_ctrls\n  media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers\n  media: ite-cir: IR receiver stop working after receive overflow\n  crypto: s5p-sss - Add error handling in s5p_aes_probe()\n  firmware/psci: fix application of sizeof to pointer\n  tpm: Check for integer overflow in tpm2_map_response_body()\n  parisc: Fix ptrace check on syscall return\n  mmc: dw_mmc: Dont wait for DRTO on Write RSP error\n  scsi: qla2xxx: Fix use after free in eh_abort path\n  scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file\n  ocfs2: fix data corruption on truncate\n  libata: fix read log timeout value\n  Input: i8042 - Add quirk for Fujitsu Lifebook T725\n  Input: elantench - fix misreporting trackpoint coordinates\n  Input: iforce - fix control-message timeout\n  binder: use cred instead of task for getsecid\n  binder: use cred instead of task for selinux checks\n  binder: use euid from cred instead of using task\n  usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform\n  xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay\n  Linux 5.4.159\n  rsi: fix control-message timeout\n  media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init\n  staging: rtl8192u: fix control-message timeouts\n  staging: r8712u: fix control-message timeout\n  comedi: vmk80xx: fix bulk and interrupt message timeouts\n  comedi: vmk80xx: fix bulk-buffer overflow\n  comedi: vmk80xx: fix transfer-buffer overflows\n  comedi: ni_usb6501: fix NULL-deref in command paths\n  comedi: dt9812: fix DMA buffers on stack\n  isofs: Fix out of bound access for corrupted isofs image\n  printk/console: Allow to disable console output by using console\u003d\"\" or console\u003dnull\n  binder: don\u0027t detect sender/target during buffer cleanup\n  usb-storage: Add compatibility quirk flags for iODD 2531/2541\n  usb: musb: Balance list entry in musb_gadget_queue\n  usb: gadget: Mark USB_FSL_QE broken on 64-bit\n  usb: ehci: handshake CMD_RUN instead of STS_HALT\n  Revert \"x86/kvm: fix vcpu-id indexed array sizes\"\n  Linux 5.4.158\n  ARM: 9120/1: Revert \"amba: make use of -1 IRQs warn\"\n  Revert \"drm/ttm: fix memleak in ttm_transfered_destroy\"\n  sfc: Fix reading non-legacy supported link modes\n  Revert \"usb: core: hcd: Add support for deferring roothub registration\"\n  Revert \"xhci: Set HCD flag to defer primary roothub registration\"\n  media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()\n  net: ethernet: microchip: lan743x: Fix skb allocation failure\n  vrf: Revert \"Reset skb conntrack connection...\"\n  scsi: core: Put LLD module refcnt after SCSI device is released\n  Linux 5.4.157\n  perf script: Check session-\u003eheader.env.arch before using it\n  KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu\n  KVM: s390: clear kicked_mask before sleeping again\n  cfg80211: correct bridge/4addr mode check\n  net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT\n  sctp: add vtag check in sctp_sf_ootb\n  sctp: add vtag check in sctp_sf_do_8_5_1_E_sa\n  sctp: add vtag check in sctp_sf_violation\n  sctp: fix the processing for COOKIE_ECHO chunk\n  sctp: fix the processing for INIT_ACK chunk\n  sctp: use init_tag from inithdr for ABORT chunk\n  phy: phy_start_aneg: Add an unlocked version\n  phy: phy_ethtool_ksettings_get: Lock the phy for consistency\n  net/tls: Fix flipped sign in async_wait.err assignment\n  net: nxp: lpc_eth.c: avoid hang when bringing interface down\n  net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent\n  net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails\n  nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST\n  RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string\n  net: Prevent infinite while loop in skb_tx_hash()\n  net: batman-adv: fix error handling\n  regmap: Fix possible double-free in regcache_rbtree_exit()\n  arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node\n  RDMA/mlx5: Set user priority for DCT\n  nvme-tcp: fix data digest pointer calculation\n  nvmet-tcp: fix data digest pointer calculation\n  IB/hfi1: Fix abba locking issue with sc_disable()\n  IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields\n  tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function\n  drm/ttm: fix memleak in ttm_transfered_destroy\n  net: lan78xx: fix division by zero in send path\n  cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()\n  mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit\n  mmc: sdhci: Map more voltage level to SDHCI_POWER_330\n  mmc: dw_mmc: exynos: fix the finding clock sample value\n  mmc: cqhci: clear HALT state after CQE enable\n  mmc: vub300: fix control-message timeouts\n  net/tls: Fix flipped sign in tls_err_abort() calls\n  Revert \"net: mdiobus: Fix memory leak in __mdiobus_register\"\n  nfc: port100: fix using -ERRNO as command type mask\n  ata: sata_mv: Fix the error handling of mv_chip_id()\n  Revert \"pinctrl: bcm: ns: support updated DT binding as syscon subnode\"\n  usbnet: fix error return code in usbnet_probe()\n  usbnet: sanity check for maxpacket\n  ipv4: use siphash instead of Jenkins in fnhe_hashfun()\n  ipv6: use siphash in rt6_exception_hash()\n  powerpc/bpf: Fix BPF_MOD when imm \u003d\u003d 1\n  ARM: 9141/1: only warn about XIP address when not compile testing\n  ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype\n  ARM: 9134/1: remove duplicate memcpy() definition\n  ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned\n  Linux 5.4.156\n  pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()\n  ARM: 9122/1: select HAVE_FUTEX_CMPXCHG\n  tracing: Have all levels of checks prevent recursion\n  net: mdiobus: Fix memory leak in __mdiobus_register\n  scsi: core: Fix shost-\u003ecmd_per_lun calculation in scsi_add_host_with_dma()\n  Input: snvs_pwrkey - add clk handling\n  ALSA: hda: avoid write to STATESTS if controller is in reset\n  platform/x86: intel_scu_ipc: Update timeout value in comment\n  isdn: mISDN: Fix sleeping function called from invalid context\n  ARM: dts: spear3xx: Fix gmac node\n  net: stmmac: add support for dwmac 3.40a\n  btrfs: deal with errors when checking if a dir entry exists during log replay\n  gcc-plugins/structleak: add makefile var for disabling structleak\n  selftests: netfilter: remove stray bash debug line\n  netfilter: Kconfig: use \u0027default y\u0027 instead of \u0027m\u0027 for bool config option\n  isdn: cpai: check ctr-\u003ecnr to avoid array index out of bound\n  nfc: nci: fix the UAF of rf_conn_info object\n  mm, slub: fix potential memoryleak in kmem_cache_open()\n  mm, slub: fix mismatch between reconstructed freelist depth and cnt\n  powerpc/idle: Don\u0027t corrupt back chain when going idle\n  KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest\n  KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()\n  powerpc64/idle: Fix SP offsets when saving GPRs\n  audit: fix possible null-pointer dereference in audit_filter_rules\n  ASoC: DAPM: Fix missing kctl change notifications\n  ALSA: hda/realtek: Add quirk for Clevo PC50HS\n  ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset\n  vfs: check fd has read access in kernel_read_file_from_fd()\n  elfcore: correct reference to CONFIG_UML\n  ocfs2: mount fails with buffer overflow in strlen\n  ocfs2: fix data corruption after conversion from inline format\n  ceph: fix handling of \"meta\" errors\n  can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes\n  can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length\n  can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv\n  can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer\n  can: peak_pci: peak_pci_remove(): fix UAF\n  can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification\n  can: rcar_can: fix suspend/resume\n  net: enetc: fix ethtool counter name for PM0_TERR\n  net: stmmac: Fix E2E delay mechanism\n  net: hns3: disable sriov before unload hclge layer\n  net: hns3: add limit ets dwrr bandwidth cannot be 0\n  net: hns3: reset DWRR of unused tc to zero\n  NIOS2: irqflags: rename a redefined register name\n  net: dsa: lantiq_gswip: fix register definition\n  lan78xx: select CRC32\n  netfilter: ipvs: make global sysctl readonly in non-init netns\n  ASoC: wm8960: Fix clock configuration on slave mode\n  dma-debug: fix sg checks in debug_dma_map_sg()\n  NFSD: Keep existing listeners on portlist error\n  xtensa: xtfpga: Try software restart before simulating CPU reset\n  xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF\n  ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default\n  tee: optee: Fix missing devices unregister during optee_remove\n  net: switchdev: do not propagate bridge updates across bridges\n  parisc: math-emu: Fix fall-through warnings\n  Linux 5.4.155\n  ionic: don\u0027t remove netdev-\u003edev_addr when syncing uc list\n  r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256\n  qed: Fix missing error code in qed_slowpath_start()\n  mqprio: Correct stats in mqprio_dump_class_stats().\n  acpi/arm64: fix next_platform_timer() section mismatch error\n  drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling\n  drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()\n  drm/msm: Fix null pointer dereference on pointer edp\n  drm/panel: olimex-lcd-olinuxino: select CRC32\n  platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call\n  mlxsw: thermal: Fix out-of-bounds memory accesses\n  ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators()\n  pata_legacy: fix a couple uninitialized variable bugs\n  NFC: digital: fix possible memory leak in digital_in_send_sdd_req()\n  NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()\n  nfc: fix error handling of nfc_proto_register()\n  ethernet: s2io: fix setting mac address during resume\n  net: encx24j600: check error in devm_regmap_init_encx24j600\n  net: stmmac: fix get_hw_feature() on old hardware\n  net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp\n  net: korina: select CRC32\n  net: arc: select CRC32\n  gpio: pca953x: Improve bias setting\n  sctp: account stream padding length for reconf chunk\n  iio: dac: ti-dac5571: fix an error code in probe()\n  iio: ssp_sensors: fix error code in ssp_print_mcu_debug()\n  iio: ssp_sensors: add more range checking in ssp_parse_dataframe()\n  iio: light: opt3001: Fixed timeout error when 0 lux\n  iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED\n  iio: adc128s052: Fix the error handling path of \u0027adc128_probe()\u0027\n  iio: adc: aspeed: set driver data when adc probe.\n  powerpc/xive: Discard disabled interrupts in get_irqchip_state()\n  x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically\n  nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells\n  EDAC/armada-xp: Fix output of uncorrectable error counter\n  virtio: write back F_VERSION_1 before validate\n  USB: serial: option: add prod. id for Quectel EG91\n  USB: serial: option: add Telit LE910Cx composition 0x1204\n  USB: serial: option: add Quectel EC200S-CN module support\n  USB: serial: qcserial: add EM9191 QDL support\n  Input: xpad - add support for another USB ID of Nacon GC-100\n  usb: musb: dsps: Fix the probe error path\n  efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()\n  efi/cper: use stack buffer for error record decoding\n  cb710: avoid NULL pointer subtraction\n  xhci: Enable trust tx length quirk for Fresco FL11 USB controller\n  xhci: Fix command ring pointer corruption while aborting a command\n  xhci: guard accesses to ep_state in xhci_endpoint_reset()\n  mei: me: add Ice Lake-N device id.\n  x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails\n  watchdog: orion: use 0 for unset heartbeat\n  btrfs: check for error when looking up inode during dir entry replay\n  btrfs: deal with errors when adding inode reference during log replay\n  btrfs: deal with errors when replaying dir entry during log replay\n  btrfs: unlock newly allocated extent buffer after error\n  csky: Fixup regs.sr broken in ptrace\n  csky: don\u0027t let sigreturn play with priveleged bits of status register\n  s390: fix strrchr() implementation\n  nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^\u0027\n  ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW\n  ALSA: hda/realtek - ALC236 headset MIC recording issue\n  ALSA: hda/realtek: Add quirk for Clevo X170KM-G\n  ALSA: hda/realtek: Complete partial device name to avoid ambiguity\n  ALSA: seq: Fix a potential UAF by wrong private_free call order\n  ALSA: usb-audio: Add quirk for VF0770\n  ovl: simplify file splice\n  Linux 5.4.154\n  sched: Always inline is_percpu_thread()\n  scsi: virtio_scsi: Fix spelling mistake \"Unsupport\" -\u003e \"Unsupported\"\n  scsi: ses: Fix unsigned comparison with less than zero\n  drm/amdgpu: fix gart.bo pin_count leak\n  net: sun: SUNVNET_COMMON should depend on INET\n  mac80211: check return value of rhashtable_init\n  net: prevent user from passing illegal stab size\n  m68k: Handle arrivals of multiple signals correctly\n  mac80211: Drop frames from invalid MAC address in ad-hoc mode\n  netfilter: nf_nat_masquerade: defer conntrack walk to work queue\n  netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic\n  HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs\n  netfilter: ip6_tables: zero-initialize fragment offset\n  HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS\n  ext4: correct the error path of ext4_write_inline_data_end()\n  net: phy: bcm7xxx: Fixed indirect MMD operations\n  UPSTREAM: ovl: simplify file splice\n  Linux 5.4.153\n  x86/Kconfig: Correct reference to MWINCHIP3D\n  x86/hpet: Use another crystalball to evaluate HPET usability\n  x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI\n  RISC-V: Include clone3() on rv32\n  bpf, s390: Fix potential memory leak about jit_data\n  i2c: acpi: fix resource leak in reconfiguration device addition\n  net: prefer socket bound to interface when not in VRF\n  i40e: Fix freeing of uninitialized misc IRQ vector\n  i40e: fix endless loop under rtnl\n  gve: fix gve_get_stats()\n  rtnetlink: fix if_nlmsg_stats_size() under estimation\n  gve: Correct available tx qpl check\n  drm/nouveau/debugfs: fix file release memory leak\n  video: fbdev: gbefb: Only instantiate device when built for IP32\n  bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893\n  netlink: annotate data races around nlk-\u003ebound\n  net: sfp: Fix typo in state machine debug string\n  net/sched: sch_taprio: properly cancel timer from taprio_destroy()\n  net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()\n  ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence\n  arm64: dts: ls1028a: add missing CAN nodes\n  arm64: dts: freescale: Fix SP805 clock-names\n  ptp_pch: Load module automatically if ID matches\n  powerpc/fsl/dts: Fix phy-connection-type for fm1mac3\n  net_sched: fix NULL deref in fifo_set_limit()\n  phy: mdio: fix memory leak\n  bpf: Fix integer overflow in prealloc_elems_and_freelist()\n  bpf, arm: Fix register clobbering in div/mod implementation\n  xtensa: call irqchip_init only when CONFIG_USE_OF is selected\n  xtensa: use CONFIG_USE_OF instead of CONFIG_OF\n  xtensa: move XCHAL_KIO_* definitions to kmem_layout.h\n  arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding\n  ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo\n  ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo\n  soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment\n  ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference\n  soc: qcom: socinfo: Fixed argument passed to platform_set_data()\n  bpf, mips: Validate conditional branch offsets\n  MIPS: BPF: Restore MIPS32 cBPF JIT\n  ARM: dts: qcom: apq8064: use compatible which contains chipid\n  ARM: dts: omap3430-sdp: Fix NAND device node\n  xen/balloon: fix cancelled balloon action\n  nfsd4: Handle the NFSv4 READDIR \u0027dircount\u0027 hint being zero\n  nfsd: fix error handling of register_pernet_subsys() in init_nfsd()\n  ovl: fix missing negative dentry check in ovl_rename()\n  mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk\n  xen/privcmd: fix error handling in mmap-resource processing\n  usb: typec: tcpm: handle SRC_STARTUP state if cc changes\n  USB: cdc-acm: fix break reporting\n  USB: cdc-acm: fix racy tty buffer accesses\n  Partially revert \"usb: Kconfig: using select for USB_COMMON dependency\"\n  ANDROID: Different fix for KABI breakage in 5.4.151 in struct sock\n  Linux 5.4.152\n  libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.\n  silence nfscache allocation warnings with kvzalloc\n  perf/x86: Reset destroy callback on event init failure\n  kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[]\n  KVM: do not shrink halt_poll_ns below grow_start\n  tools/vm/page-types: remove dependency on opt_file for idle page tracking\n  scsi: ses: Retry failed Send/Receive Diagnostic commands\n  selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn\n  selftests: be sure to make khdr before other targets\n  usb: dwc2: check return value after calling platform_get_resource()\n  usb: testusb: Fix for showing the connection speed\n  scsi: sd: Free scsi_disk device via put_device()\n  ext2: fix sleeping in atomic bugs on error\n  sparc64: fix pci_iounmap() when CONFIG_PCI is not set\n  xen-netback: correct success/error reporting for the SKB-with-fraglist case\n  net: mdio: introduce a shutdown method to mdio device drivers\n  ANDROID: Fix up KABI breakage in 5.4.151 in struct sock\n  Linux 5.4.151\n  HID: usbhid: free raw_report buffers in usbhid_stop\n  netfilter: ipset: Fix oversized kvmalloc() calls\n  HID: betop: fix slab-out-of-bounds Write in betop_probe\n  crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()\n  usb: hso: remove the bailout parameter\n  usb: hso: fix error handling code of hso_create_net_device\n  hso: fix bailout in error case of probe\n  libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind\n  PCI: Fix pci_host_bridge struct device release/free handling\n  net: stmmac: don\u0027t attach interface until resume finishes\n  net: udp: annotate data race around udp_sk(sk)-\u003ecorkflag\n  HID: u2fzero: ignore incomplete packets without data\n  ext4: fix potential infinite loop in ext4_dx_readdir()\n  ext4: fix reserved space counter leakage\n  ext4: fix loff_t overflow in ext4_max_bitmap_size()\n  ipack: ipoctal: fix module reference leak\n  ipack: ipoctal: fix missing allocation-failure check\n  ipack: ipoctal: fix tty-registration error handling\n  ipack: ipoctal: fix tty registration race\n  ipack: ipoctal: fix stack information leak\n  debugfs: debugfs_create_file_size(): use IS_ERR to check for error\n  elf: don\u0027t use MAP_FIXED_NOREPLACE for elf interpreter mappings\n  perf/x86/intel: Update event constraints for ICX\n  af_unix: fix races in sk_peer_pid and sk_peer_cred accesses\n  net: sched: flower: protect fl_walk() with rcu\n  net: hns3: do not allow call hns3_nic_net_open repeatedly\n  scsi: csiostor: Add module softdep on cxgb4\n  Revert \"block, bfq: honor already-setup queue merges\"\n  selftests, bpf: test_lwt_ip_encap: Really disable rp_filter\n  e100: fix buffer overrun in e100_get_regs\n  e100: fix length calculation in e100_get_regs_len\n  net: ipv4: Fix rtnexthop len when RTA_FLOW is present\n  hwmon: (tmp421) fix rounding for negative values\n  hwmon: (tmp421) report /PVLD condition as fault\n  sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb\n  mac80211-hwsim: fix late beacon hrtimer handling\n  mac80211: mesh: fix potentially unaligned access\n  mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap\n  mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug\n  hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs\n  ipvs: check that ip_vs_conn_tab_bits is between 8 and 20\n  drm/amd/display: Pass PCI deviceid into DC\n  x86/kvmclock: Move this_cpu_pvti into kvmclock.h\n  mac80211: fix use-after-free in CCMP/GCMP RX\n  scsi: ufs: Fix illegal offset in UPIU event trace\n  hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n  hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field\n  hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field\n  fs-verity: fix signed integer overflow with i_size near S64_MAX\n  usb: cdns3: fix race condition before setting doorbell\n  cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory\n  cpufreq: schedutil: Use kobject release() method to free sugov_tunables\n  tty: Fix out-of-bound vmalloc access in imageblit\n  Revert \"crypto: public_key: fix overflow during implicit conversion\"\n  Linux 5.4.150\n  qnx4: work around gcc false positive warning bug\n  xen/balloon: fix balloon kthread freezing\n  arm64: dts: marvell: armada-37xx: Extend PCIe MEM space\n  thermal/drivers/int340x: Do not set a wrong tcc offset on resume\n  EDAC/synopsys: Fix wrong value type assignment for edac_mode\n  spi: Fix tegra20 build with CONFIG_PM\u003dn\n  net: 6pack: Fix tx timeout and slot time\n  alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile\n  arm64: Mark __stack_chk_guard as __ro_after_init\n  parisc: Use absolute_pointer() to define PAGE0\n  qnx4: avoid stringop-overread errors\n  sparc: avoid stringop-overread errors\n  net: i825xx: Use absolute_pointer for memcpy from fixed memory location\n  compiler.h: Introduce absolute_pointer macro\n  blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd\n  sparc32: page align size in arch_dma_alloc\n  nvme-multipath: fix ANA state updates when a namespace is not present\n  xen/balloon: use a kernel thread instead a workqueue\n  bpf: Add oversize check before call kvcalloc()\n  ipv6: delay fib6_sernum increase in fib6_add\n  m68k: Double cast io functions to unsigned long\n  net: stmmac: allow CSR clock of 300MHz\n  net: macb: fix use after free on rmmod\n  blktrace: Fix uaf in blk_trace access after removing by sysfs\n  md: fix a lock order reversal in md_alloc\n  irqchip/gic-v3-its: Fix potential VPE leak on error\n  irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build\n  scsi: lpfc: Use correct scnprintf() limit\n  scsi: qla2xxx: Restore initiator in dual mode\n  cifs: fix a sign extension bug\n  thermal/core: Potential buffer overflow in thermal_build_list_of_policies()\n  fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()\n  fpga: machxo2-spi: Return an error on failure\n  tty: synclink_gt: rename a conflicting function name\n  tty: synclink_gt, drop unneeded forward declarations\n  scsi: iscsi: Adjust iface sysfs attr detection\n  net/mlx4_en: Don\u0027t allow aRFS for encapsulated packets\n  qed: rdma - don\u0027t wait for resources under hw error recovery flow\n  gpio: uniphier: Fix void functions to remove return value\n  net/smc: add missing error check in smc_clc_prfx_set()\n  bnxt_en: Fix TX timeout when TX ring size is set to the smallest\n  enetc: Fix illegal access when reading affinity_hint\n  platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR()\n  afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation\n  net: hso: fix muxed tty registration\n  serial: mvebu-uart: fix driver\u0027s tx_empty callback\n  xhci: Set HCD flag to defer primary roothub registration\n  btrfs: prevent __btrfs_dump_space_info() to underflow its free space\n  erofs: fix up erofs_lookup tracepoint\n  mcb: fix error handling in mcb_alloc_bus()\n  USB: serial: option: add device id for Foxconn T99W265\n  USB: serial: option: remove duplicate USB device ID\n  USB: serial: option: add Telit LN920 compositions\n  USB: serial: mos7840: remove duplicated 0xac24 device ID\n  usb: core: hcd: Add support for deferring roothub registration\n  Re-enable UAS for LaCie Rugged USB3-FW with fk quirk\n  staging: greybus: uart: fix tty use after free\n  binder: make sure fd closes complete\n  USB: cdc-acm: fix minor-number release\n  USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter\n  usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c\n  xen/x86: fix PV trap handling on secondary processors\n  cifs: fix incorrect check for null pointer in header_assemble\n  usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()\n  usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA\n  usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave\n  usb: gadget: r8a66597: fix a loop in set_feature()\n  ocfs2: drop acl cache for directories too\n  Linux 5.4.149\n  drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV\n  rtc: rx8010: select REGMAP_I2C\n  blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()\n  pwm: stm32-lp: Don\u0027t modify HW state in .remove() callback\n  pwm: rockchip: Don\u0027t modify HW state in .remove() callback\n  pwm: img: Don\u0027t modify HW state in .remove() callback\n  nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group\n  nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group\n  nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group\n  nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group\n  nilfs2: fix NULL pointer in nilfs_##name##_attr_release\n  nilfs2: fix memory leak in nilfs_sysfs_create_device_group\n  btrfs: fix lockdep warning while mounting sprout fs\n  ceph: lockdep annotations for try_nonblocking_invalidate\n  ceph: request Fw caps before updating the mtime in ceph_write_iter\n  dmaengine: xilinx_dma: Set DMA mask for coherent APIs\n  dmaengine: ioat: depends on !UML\n  dmaengine: sprd: Add missing MODULE_DEVICE_TABLE\n  parisc: Move pci_dev_is_behind_card_dino to where it is used\n  drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()\n  thermal/core: Fix thermal_cooling_device_register() prototype\n  Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH\n  net: stmmac: reset Tx desc base address before restarting Tx\n  phy: avoid unnecessary link-up delay in polling mode\n  pwm: lpc32xx: Don\u0027t modify HW state in .probe() after the PWM chip was registered\n  profiling: fix shift-out-of-bounds bugs\n  nilfs2: use refcount_dec_and_lock() to fix potential UAF\n  prctl: allow to setup brk for et_dyn executables\n  9p/trans_virtio: Remove sysfs file on probe failure\n  thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()\n  dmaengine: acpi: Avoid comparison GSI with Linux vIRQ\n  um: virtio_uml: fix memory leak on init failures\n  staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb()\n  sctp: add param size validation for SCTP_PARAM_SET_PRIMARY\n  sctp: validate chunk size in __rcv_asconf_lookup\n  ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE\n  ARM: 9079/1: ftrace: Add MODULE_PLTS support\n  ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()\n  ARM: 9077/1: PLT: Move struct plt_entries definition to header\n  apparmor: remove duplicate macro list_entry_is_head()\n  ARM: Qualify enabling of swiotlb_init()\n  s390/pci_mmio: fully validate the VMA before calling follow_pte()\n  console: consume APC, DM, DCS\n  KVM: remember position in kvm-\u003evcpus array\n  PCI/ACPI: Add Ampere Altra SOC MCFG quirk\n  PCI: aardvark: Fix reporting CRS value\n  PCI: pci-bridge-emul: Add PCIe Root Capabilities Register\n  PCI: aardvark: Indicate error in \u0027val\u0027 when config read fails\n  PCI: pci-bridge-emul: Fix big-endian support\n  Linux 5.4.148\n  s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant\n  s390/bpf: Fix optimizing out zero-extensions\n  net: renesas: sh_eth: Fix freeing wrong tx descriptor\n  ip_gre: validate csum_start only on pull\n  qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom\n  fq_codel: reject silly quantum parameters\n  netfilter: socket: icmp6: fix use-after-scope\n  net: dsa: b53: Fix calculating number of switch ports\n  perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}\n  ARC: export clear_user_page() for modules\n  mtd: rawnand: cafe: Fix a resource leak in the error handling path of \u0027cafe_nand_probe()\u0027\n  PCI: Sync __pci_register_driver() stub for CONFIG_PCI\u003dn\n  KVM: arm64: Handle PSCI resets before userspace touches vCPU state\n  mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set\n  PCI: Fix pci_dev_str_match_path() alloc while atomic bug\n  mfd: axp20x: Update AXP288 volatile ranges\n  NTB: perf: Fix an error code in perf_setup_inbuf()\n  NTB: Fix an error code in ntb_msit_probe()\n  ethtool: Fix an error code in cxgb2.c\n  PCI: ibmphp: Fix double unmap of io_mem\n  block, bfq: honor already-setup queue merges\n  net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920\n  Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6\n  PCI: Add ACS quirks for Cavium multi-function devices\n  tracing/probes: Reject events which have the same name of existing one\n  mfd: Don\u0027t use irq_create_mapping() to resolve a mapping\n  fuse: fix use after free in fuse_read_interrupt()\n  PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms\n  mfd: db8500-prcmu: Adjust map to reality\n  dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation\n  mm/memory_hotplug: use \"unsigned long\" for PFN in zone_for_pfn_range()\n  net: hns3: fix the timing issue of VF clearing interrupt sources\n  net: hns3: disable mac in flr process\n  net: hns3: change affinity_mask to numa node range\n  net: hns3: pad the short tunnel frame before sending to hardware\n  KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers\n  ibmvnic: check failover_pending in login response\n  dt-bindings: arm: Fix Toradex compatible typo\n  qed: Handle management FW error\n  tcp: fix tp-\u003eundo_retrans accounting in tcp_sacktag_one()\n  net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup\n  net/af_unix: fix a data-race in unix_dgram_poll\n  vhost_net: fix OoB on sendmsg() failure.\n  events: Reuse value read using READ_ONCE instead of re-reading it\n  net/mlx5: Fix potential sleeping in atomic context\n  net/mlx5: FWTrace, cancel work on alloc pd error flow\n  perf machine: Initialize srcline string member in add_location struct\n  tipc: increase timeout in tipc_sk_enqueue()\n  r6040: Restore MDIO clock frequency after MAC reset\n  net/l2tp: Fix reference count leak in l2tp_udp_recv_core\n  dccp: don\u0027t duplicate ccid when cloning dccp sock\n  ptp: dp83640: don\u0027t define PAGE0\n  net-caif: avoid user-triggerable WARN_ON(1)\n  tipc: fix an use-after-free issue in tipc_recvmsg\n  x86/mm: Fix kern_addr_valid() to cope with existing but not present entries\n  s390/sclp: fix Secure-IPL facility detection\n  drm/etnaviv: add missing MMU context put when reaping MMU mapping\n  drm/etnaviv: reference MMU context when setting up hardware state\n  drm/etnaviv: fix MMU context leak on GPU reset\n  drm/etnaviv: exec and MMU state is lost when resetting the GPU\n  drm/etnaviv: keep MMU context across runtime suspend/resume\n  drm/etnaviv: stop abusing mmu_context as FE running marker\n  drm/etnaviv: put submit prev MMU context when it exists\n  drm/etnaviv: return context from etnaviv_iommu_context_get\n  drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10\n  PCI: Add AMD GPU multi-function power dependencies\n  PM: base: power: don\u0027t try to use non-existing RTC for storing data\n  arm64/sve: Use correct size when reinitialising SVE state\n  bnx2x: Fix enabling network interfaces without VFs\n  xen: reset legacy rtc flag for PV domU\n  btrfs: fix upper limit for max_inline for page size 64K\n  drm/panfrost: Clamp lock region to Bifrost minimum\n  drm/panfrost: Use u64 for size in lock_region\n  drm/panfrost: Simplify lock_region calculation\n  drm/amdgpu: Fix BUG_ON assert\n  drm/msi/mdp4: populate priv-\u003ekms in mdp4_kms_init\n  net: dsa: lantiq_gswip: fix maximum frame length\n  lib/test_stackinit: Fix static initializer test\n  platform/chrome: cros_ec_proto: Send command again when timeout occurs\n  memcg: enable accounting for pids in nested pid namespaces\n  mm,vmscan: fix divide by zero in get_scan_count\n  mm/hugetlb: initialize hugetlb_usage in mm_init\n  s390/pv: fix the forcing of the swiotlb\n  cpufreq: powernv: Fix init_chip_info initialization in numa\u003doff\n  scsi: qla2xxx: Sync queue idx with queue_pair_map idx\n  scsi: qla2xxx: Changes to support kdump kernel\n  scsi: BusLogic: Fix missing pr_cont() use\n  ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()\n  parisc: fix crash with signals and alloca\n  net: w5100: check return value after calling platform_get_resource()\n  fix array-index-out-of-bounds in taprio_change\n  net: fix NULL pointer reference in cipso_v4_doi_free\n  ath9k: fix sleeping in atomic context\n  ath9k: fix OOB read ar9300_eeprom_restore_internal\n  parport: remove non-zero check on count\n  net/mlx5: DR, Enable QP retransmission\n  iwlwifi: mvm: fix access to BSS elements\n  iwlwifi: mvm: avoid static queue number aliasing\n  iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed\n  drm/amdkfd: Account for SH/SE count when setting up cu masks.\n  ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B\n  ASoC: rockchip: i2s: Fix regmap_ops hang\n  usbip:vhci_hcd USB port can get stuck in the disabled state\n  usbip: give back URBs for unsent unlink requests during cleanup\n  usb: musb: musb_dsps: request_irq() after initializing musb\n  Revert \"USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set\"\n  cifs: fix wrong release in sess_alloc_buffer() failed path\n  mmc: core: Return correct emmc response in case of ioctl error\n  selftests/bpf: Enlarge select() timeout for test_maps\n  mmc: rtsx_pci: Fix long reads when clock is prescaled\n  mmc: sdhci-of-arasan: Check return value of non-void funtions\n  of: Don\u0027t allow __of_attached_node_sysfs() without CONFIG_SYSFS\n  ASoC: Intel: Skylake: Fix passing loadable flag for module\n  ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER\n  btrfs: tree-log: check btrfs_lookup_data_extent return value\n  m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch\n  drm/exynos: Always initialize mapping in exynos_drm_register_dma()\n  lockd: lockd server-side shouldn\u0027t set fl_ops\n  usb: chipidea: host: fix port index underflow and UBSAN complains\n  gfs2: Don\u0027t call dlm after protocol is unmounted\n  staging: rts5208: Fix get_ms_information() heap buffer size\n  rpc: fix gss_svc_init cleanup on failure\n  tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD\n  serial: sh-sci: fix break handling for sysrq\n  opp: Don\u0027t print an error if required-opps is missing\n  Bluetooth: Fix handling of LE Enhanced Connection Complete\n  nvme-tcp: don\u0027t check blk_mq_tag_to_rq when receiving pdu data\n  arm64: dts: ls1046a: fix eeprom entries\n  arm64: tegra: Fix compatible string for Tegra132 CPUs\n  ARM: tegra: tamonten: Fix UART pad setting\n  mac80211: Fix monitor MTU limit so that A-MSDUs get through\n  drm/display: fix possible null-pointer dereference in dcn10_set_clock()\n  gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()\n  net/mlx5: Fix variable type to match 64bit\n  Bluetooth: avoid circular locks in sco_sock_connect\n  Bluetooth: schedule SCO timeouts with delayed_work\n  selftests/bpf: Fix xdp_tx.c prog section name\n  drm/msm: mdp4: drop vblank get/put from prepare/complete_commit\n  net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()\n  arm64: dts: qcom: sdm660: use reg value for memory node\n  ARM: dts: imx53-ppd: Fix ACHC entry\n  media: tegra-cec: Handle errors of clk_prepare_enable()\n  media: TDA1997x: fix tda1997x_query_dv_timings() return value\n  media: v4l2-dv-timings.c: fix wrong condition in two for-loops\n  media: imx258: Limit the max analogue gain to 480\n  media: imx258: Rectify mismatch of VTS value\n  ASoC: Intel: bytcr_rt5640: Move \"Platform Clock\" routes to the maps for the matching in-/output\n  arm64: tegra: Fix Tegra194 PCIe EP compatible string\n  bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()\n  workqueue: Fix possible memory leaks in wq_numa_init()\n  Bluetooth: skip invalid hci_sync_conn_complete_evt\n  ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()\n  samples: bpf: Fix tracex7 error raised on the missing argument\n  staging: ks7010: Fix the initialization of the \u0027sleep_status\u0027 structure\n  serial: 8250_pci: make setup_port() parameters explicitly unsigned\n  hvsi: don\u0027t panic on tty_register_driver failure\n  xtensa: ISS: don\u0027t panic in rs_init\n  serial: 8250: Define RX trigger levels for OxSemi 950 devices\n  s390: make PCI mio support a machine flag\n  s390/jump_label: print real address in a case of a jump label bug\n  flow_dissector: Fix out-of-bounds warnings\n  ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()\n  video: fbdev: riva: Error out if \u0027pixclock\u0027 equals zero\n  video: fbdev: kyro: Error out if \u0027pixclock\u0027 equals zero\n  video: fbdev: asiliantfb: Error out if \u0027pixclock\u0027 equals zero\n  bpf/tests: Do not PASS tests without actually testing the result\n  bpf/tests: Fix copy-and-paste error in double word test\n  drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex\n  drm/amd/display: Fix timer_per_pixel unit error\n  tty: serial: jsm: hold port lock when reporting modem line changes\n  staging: board: Fix uninitialized spinlock when attaching genpd\n  usb: gadget: composite: Allow bMaxPower\u003d0 if self-powered\n  USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()\n  usb: gadget: u_ether: fix a potential null pointer dereference\n  usb: host: fotg210: fix the actual_length of an iso packet\n  usb: host: fotg210: fix the endpoint\u0027s transactional opportunities calculation\n  igc: Check if num of q_vectors is smaller than max before array access\n  drm: avoid blocking in drm_clients_info\u0027s rcu section\n  Smack: Fix wrong semantics in smk_access_entry()\n  netlink: Deal with ESRCH error in nlmsg_notify()\n  video: fbdev: kyro: fix a DoS bug by restricting user input\n  ARM: dts: qcom: apq8064: correct clock names\n  iavf: fix locking of critical sections\n  iavf: do not override the adapter state in the watchdog task\n  iio: dac: ad5624r: Fix incorrect handling of an optional regulator.\n  tipc: keep the skb in rcv queue until the whole data is read\n  PCI: Use pci_update_current_state() in pci_enable_device_flags()\n  crypto: mxs-dcp - Use sg_mapping_iter to copy data\n  media: dib8000: rewrite the init prbs logic\n  ASoC: atmel: ATMEL drivers don\u0027t need HAS_DMA\n  drm/amdgpu: Fix amdgpu_ras_eeprom_init()\n  userfaultfd: prevent concurrent API initialization\n  kbuild: Fix \u0027no symbols\u0027 warning when CONFIG_TRIM_UNUSD_KSYMS\u003dy\n  MIPS: Malta: fix alignment of the devicetree buffer\n  f2fs: fix to unmap pages from userspace process in punch_hole()\n  f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()\n  f2fs: fix to account missing .skipped_gc_rwsem\n  KVM: PPC: Fix clearing never mapped TCEs in realmode\n  clk: at91: clk-generated: Limit the requested rate to our range\n  clk: at91: clk-generated: pass the id of changeable parent at registration\n  clk: at91: sam9x60: Don\u0027t use audio PLL\n  fscache: Fix cookie key hashing\n  platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call\n  KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live\n  HID: i2c-hid: Fix Elan touchpad regression\n  scsi: target: avoid per-loop XCOPY buffer allocations\n  powerpc/config: Renable MTD_PHYSMAP_OF\n  scsi: qedf: Fix error codes in qedf_alloc_global_queues()\n  scsi: qedi: Fix error codes in qedi_alloc_global_queues()\n  scsi: smartpqi: Fix an error code in pqi_get_raid_map()\n  pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()\n  scsi: fdomain: Fix error return code in fdomain_probe()\n  SUNRPC: Fix potential memory corruption\n  dma-debug: fix debugfs initialization order\n  openrisc: don\u0027t printk() unconditionally\n  f2fs: reduce the scope of setting fsck tag when de-\u003ename_len is zero\n  f2fs: show f2fs instance in printk_ratelimited\n  RDMA/efa: Remove double QP type assignment\n  powerpc/stacktrace: Include linux/delay.h\n  vfio: Use config not menuconfig for VFIO_NOIOMMU\n  pinctrl: samsung: Fix pinctrl bank pin count\n  docs: Fix infiniband uverbs minor number\n  RDMA/iwcm: Release resources if iw_cm module initialization fails\n  IB/hfi1: Adjust pkey entry in index 0\n  scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND\n  f2fs: quota: fix potential deadlock\n  HID: input: do not report stylus battery state as \"full\"\n  PCI: aardvark: Fix masking and unmasking legacy INTx interrupts\n  PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response\n  PCI: aardvark: Fix checking for PIO status\n  PCI: xilinx-nwl: Enable the clock through CCF\n  PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure\n  PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported\n  PCI/portdrv: Enable Bandwidth Notification only if port supports it\n  ARM: 9105/1: atags_to_fdt: don\u0027t warn about stack size\n  libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs\n  dmaengine: imx-sdma: remove duplicated sdma_load_context\n  Revert \"dmaengine: imx-sdma: refine to load context only once\"\n  media: rc-loopback: return number of emitters rather than error\n  media: uvc: don\u0027t do DMA on stack\n  VMCI: fix NULL pointer dereference when unmapping queue pair\n  dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()\n  power: supply: max17042: handle fails of reading status register\n  block: bfq: fix bfq_set_next_ioprio_data()\n  crypto: public_key: fix overflow during implicit conversion\n  arm64: head: avoid over-mapping in map_memory\n  soc: aspeed: p2a-ctrl: Fix boundary check for mmap\n  soc: aspeed: lpc-ctrl: Fix boundary check for mmap\n  soc: qcom: aoss: Fix the out of bound usage of cooling_devs\n  pinctrl: ingenic: Fix incorrect pull up/down info\n  pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast\n  tools/thermal/tmon: Add cross compiling support\n  9p/xen: Fix end of loop tests for list_for_each_entry\n  include/linux/list.h: add a macro to test if entry is pointing to the head\n  xen: fix setting of max_pfn in shared_info\n  powerpc/perf/hv-gpci: Fix counter value parsing\n  PCI/MSI: Skip masking MSI-X on Xen PV\n  blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN\n  blk-zoned: allow zone management send operations without CAP_SYS_ADMIN\n  btrfs: reset replace target device to allocation state on close\n  btrfs: wake up async_delalloc_pages waiters after submit\n  rtc: tps65910: Correct driver module alias\n\n Conflicts:\n\tDocumentation/devicetree/bindings\n\tDocumentation/devicetree/bindings/arm/tegra.yaml\n\tDocumentation/devicetree/bindings/mtd/gpmc-nand.txt\n\tDocumentation/devicetree/bindings/regulator/samsung,s5m8767.txt\n\tkernel/sched/cpufreq_schedutil.c\n\nChange-Id: Id17c4366cdc6854cd23fba0f41d335b09fc6100e\nSigned-off-by: Srinivasarao Pathipati \u003cquic_spathi@quicinc.com\u003e\n"
    },
    {
      "commit": "828abb51dd43c85662919f6823619503e4a41158",
      "tree": "3f36a2124265234c0d2a43b53ead6b09abab1a8c",
      "parents": [
        "b670ccd79cb07841ad628ad52f56c5621967aad3",
        "412723dbe4ffab3c775a6672a83c6876589bb9ce"
      ],
      "author": {
        "name": "Srinivasarao Pathipati",
        "email": "quic_spathi@quicinc.com",
        "time": "Fri Nov 05 16:37:30 2021 +0530"
      },
      "committer": {
        "name": "Srinivasarao Pathipati",
        "email": "quic_spathi@quicinc.com",
        "time": "Fri Nov 05 17:27:33 2021 +0530"
      },
      "message": "Merge android11-5.4.147+ (dc8c919) into msm-5.4\n\n* refs/heads/tmp-dc8c919:\n  Revert dwc3 changes\n  ANDROID: GKI: Update FCNT KMI symbol list No new symbols added that are not already in the .xml file.\n  ANDROID: GKI : Update symbols to symbol list\n  BACKPORT: crypto: arch - conditionalize crypto api in arch glue for lib code\n  BACKPORT: crypto: arch/lib - limit simd usage to 4k chunks\n  UPSTREAM: crypto: arm/blake2s - fix for big endian\n  ANDROID: gki_defconfig: enable BLAKE2b support\n  BACKPORT: crypto: arm/blake2b - add NEON-accelerated BLAKE2b\n  BACKPORT: crypto: blake2b - update file comment\n  BACKPORT: crypto: blake2b - sync with blake2s implementation\n  UPSTREAM: crypto: arm/blake2s - add ARM scalar optimized BLAKE2s\n  UPSTREAM: crypto: blake2s - include \u003clinux/bug.h\u003e instead of \u003casm/bug.h\u003e\n  UPSTREAM: crypto: blake2s - adjust include guard naming\n  UPSTREAM: crypto: blake2s - add comment for blake2s_state fields\n  UPSTREAM: crypto: blake2s - optimize blake2s initialization\n  BACKPORT: crypto: blake2s - share the \"shash\" API boilerplate code\n  UPSTREAM: crypto: blake2s - move update and final logic to internal/blake2s.h\n  UPSTREAM: crypto: blake2s - remove unneeded includes\n  UPSTREAM: crypto: x86/blake2s - define shash_alg structs using macros\n  UPSTREAM: crypto: blake2s - define shash_alg structs using macros\n  UPSTREAM: crypto: lib/blake2s - Move selftest prototype into header file\n  UPSTREAM: crypto: blake2b - Fix clang optimization for ARMv7-M\n  UPSTREAM: crypto: blake2b - rename tfm context and _setkey callback\n  UPSTREAM: crypto: blake2b - merge _update to api callback\n  UPSTREAM: crypto: blake2b - open code set last block helper\n  UPSTREAM: crypto: blake2b - delete unused structs or members\n  UPSTREAM: crypto: blake2b - simplify key init\n  UPSTREAM: crypto: blake2b - merge blake2 init to api callback\n  UPSTREAM: crypto: blake2b - merge _final implementation to callback\n  BACKPORT: crypto: testmgr - add test vectors for blake2b\n  BACKPORT: crypto: blake2b - add blake2b generic implementation\n  UPSTREAM: crypto: blake2s - x86_64 SIMD implementation\n  UPSTREAM: crypto: blake2s - implement generic shash driver\n  UPSTREAM: crypto: testmgr - add test cases for Blake2s\n  UPSTREAM: crypto: blake2s - generic C library implementation and selftest\n  UPSTREAM: crypto: lib - tidy up lib/crypto Kconfig and Makefile\n  ANDROID: ion heap: init ion heaps in subsys_initcall\n  UPSTREAM: ovl: simplify file splice\n  ANDROID: ABI: update allowed list for galaxy\n  ANDROID: ABI: Update allowed list for QCOM\n  ANDROID: distribute Module.symvers\n  UPSTREAM: usb: max-3421: Prevent corruption of freed memory\n  ANDROID: ABI: Update allowed list for QCOM\n  UPSTREAM: driver core: Prevent warning when removing a device link from unregistered consumer\n  UPSTREAM: udp: properly flush normal packet at GRO time\n  UPSTREAM: net/xfrm/compat: Copy xfrm_spdattr_type_t atributes\n  UPSTREAM: f2fs: Advertise encrypted casefolding in sysfs\n  UPSTREAM: loop: Fix missing discard support when using LOOP_CONFIGURE\n  UPSTREAM: thermal/drivers/sprd: Add missing MODULE_DEVICE_TABLE\n  UPSTREAM: nvmem: sprd: Fix an error message\n  UPSTREAM: usb: musb: Fix an error message\n  UPSTREAM: scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend\n  UPSTREAM: scsi: ufs: core: Do not put UFS power into LPM if link is broken\n  UPSTREAM: selinux: add proper NULL termination to the secclass_map permissions\n  UPSTREAM: of: property: fw_devlink: do not link \".*,nr-gpios\"\n  UPSTREAM: udp: never accept GSO_FRAGLIST packets\n  UPSTREAM: udp: skip L4 aggregation for UDP tunnel packets\n  UPSTREAM: xfrm/compat: Cleanup WARN()s that can be user-triggered\n  UPSTREAM: pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller\n  UPSTREAM: loop: Set correct device size when using LOOP_CONFIGURE\n  UPSTREAM: loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE\n  ANDROID: ion_system_heap: Add __GFP_NOWARN to mid-order allocations\n  ANDROID: drivers: gpu: drm: increase the MAX_DRM_OPEN_COUNT\n  UPSTREAM: af_unix: fix garbage collect vs MSG_PEEK\n  Linux 5.4.147\n  Revert \"time: Handle negative seconds correctly in timespec64_to_ns()\"\n  Revert \"posix-cpu-timers: Force next expiration recalc after itimer reset\"\n  Revert \"block: nbd: add sanity check for first_minor\"\n  Revert \"Bluetooth: Move shutdown callback before flushing tx and rx queue\"\n  Linux 5.4.146\n  clk: kirkwood: Fix a clocking boot regression\n  backlight: pwm_bl: Improve bootloader/kernel device handover\n  fbmem: don\u0027t allow too huge resolutions\n  IMA: remove the dependency on CRYPTO_MD5\n  IMA: remove -Wmissing-prototypes warning\n  fuse: flush extending writes\n  fuse: truncate pagecache on atomic_o_trunc\n  KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter\n  KVM: x86: Update vCPU\u0027s hv_clock before back to guest when tsc_offset is adjusted\n  KVM: s390: index kvm-\u003earch.idle_mask by vcpu_idx\n  x86/resctrl: Fix a maybe-uninitialized build warning treated as error\n  perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op\n  tty: Fix data race between tiocsti() and flush_to_ldisc()\n  time: Handle negative seconds correctly in timespec64_to_ns()\n  bpf: Fix pointer arithmetic mask tightening under state pruning\n  bpf: verifier: Allocate idmap scratch in verifier env\n  bpf: Fix leakage due to insufficient speculative store bypass mitigation\n  bpf: Introduce BPF nospec instruction for mitigating Spectre v4\n  ipv4: fix endianness issue in inet_rtm_getroute_build_skb()\n  octeontx2-af: Fix loop in free and unmap counter\n  net: qualcomm: fix QCA7000 checksum handling\n  net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed\n  ipv4: make exception cache less predictible\n  ipv6: make exception cache less predictible\n  brcmfmac: pcie: fix oops on failure to resume and reprobe\n  bcma: Fix memory leak for internally-handled cores\n  ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()\n  ASoC: wcd9335: Disable irq on slave ports in the remove function\n  ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function\n  ASoC: wcd9335: Fix a double irq free in the remove function\n  tty: serial: fsl_lpuart: fix the wrong mapbase value\n  usb: bdc: Fix an error handling path in \u0027bdc_probe()\u0027 when no suitable DMA config is available\n  usb: ehci-orion: Handle errors of clk_prepare_enable() in probe\n  i2c: mt65xx: fix IRQ check\n  CIFS: Fix a potencially linear read overflow\n  bpf: Fix possible out of bound write in narrow load handling\n  mmc: moxart: Fix issue with uninitialized dma_slave_config\n  mmc: dw_mmc: Fix issue with uninitialized dma_slave_config\n  ASoC: Intel: Skylake: Fix module resource and format selection\n  ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs\n  rsi: fix an error code in rsi_probe()\n  rsi: fix error code in rsi_load_9116_firmware()\n  i2c: s3c2410: fix IRQ check\n  i2c: iop3xx: fix deferred probing\n  Bluetooth: add timeout sanity check to hci_inquiry\n  mm/swap: consider max pages in iomap_swapfile_add_extent\n  usb: gadget: mv_u3d: request_irq() after initializing UDC\n  nfsd4: Fix forced-expiry locking\n  lockd: Fix invalid lockowner cast after vfs_test_lock\n  mac80211: Fix insufficient headroom issue for AMSDU\n  usb: phy: tahvo: add IRQ check\n  usb: host: ohci-tmio: add IRQ check\n  Bluetooth: Move shutdown callback before flushing tx and rx queue\n  usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse\n  usb: phy: twl6030: add IRQ checks\n  usb: phy: fsl-usb: add IRQ check\n  usb: gadget: udc: at91: add IRQ check\n  drm/msm/dsi: Fix some reference counted resource leaks\n  Bluetooth: fix repeated calls to sco_sock_kill\n  counter: 104-quad-8: Return error when invalid mode during ceiling_write\n  arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7\n  drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs\n  PM: EM: Increase energy calculation precision\n  Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow\n  debugfs: Return error during {full/open}_proxy_open() on rmmod\n  soc: qcom: smsm: Fix missed interrupts if state changes while masked\n  PCI: PM: Enable PME if it can be signaled from D3cold\n  PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently\n  media: venus: venc: Fix potential null pointer dereference on pointer fmt\n  media: em28xx-input: fix refcount bug in em28xx_usb_disconnect\n  leds: trigger: audio: Add an activate callback to ensure the initial brightness is set\n  leds: lt3593: Put fwnode in any case during -\u003eprobe()\n  i2c: highlander: add IRQ check\n  net: cipso: fix warnings in netlbl_cipsov4_add_std\n  cgroup/cpuset: Fix a partition bug with hotplug\n  net/mlx5e: Prohibit inner indir TIRs in IPoIB\n  ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties\n  ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties\n  ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties\n  ARM: dts: meson8: Use a higher default GPU clock frequency\n  tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos\n  drm/amdgpu/acp: Make PM domain really work\n  netns: protect netns ID lookups with RCU\n  6lowpan: iphc: Fix an off-by-one check of array index\n  Bluetooth: sco: prevent information leak in sco_conn_defer_accept()\n  media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats\n  media: go7007: remove redundant initialization\n  media: dvb-usb: Fix error handling in dvb_usb_i2c_init\n  media: dvb-usb: fix uninit-value in vp702x_read_mac_addr\n  media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init\n  soc: qcom: rpmhpd: Use corner in power_off\n  arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties\n  ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi\n  bpf: Fix potential memleak and UAF in the verifier.\n  bpf: Fix a typo of reuseport map in bpf.h.\n  media: cxd2880-spi: Fix an error handling path\n  soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally\n  media: TDA1997x: enable EDID support\n  drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()\n  EDAC/i10nm: Fix NVDIMM detection\n  spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible\n  spi: sprd: Fix the wrong WDG_LOAD_VAL\n  regulator: vctrl: Avoid lockdep warning in enable/disable ops\n  regulator: vctrl: Use locked regulator_get_voltage in probe path\n  certs: Trigger creation of RSA module signing key if it\u0027s not an RSA key\n  crypto: qat - use proper type for vf_mask\n  block: nbd: add sanity check for first_minor\n  clocksource/drivers/sh_cmt: Fix wrong setting if don\u0027t request IRQ for clock source channel\n  lib/mpi: use kcalloc in mpi_resize\n  genirq/timings: Fix error return code in irq_timings_test_irqs()\n  spi: spi-pic32: Fix issue with uninitialized dma_slave_config\n  spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config\n  sched: Fix UCLAMP_FLAG_IDLE setting\n  m68k: emu: Fix invalid free in nfeth_cleanup()\n  s390/debug: fix debug area life cycle\n  s390/kasan: fix large PMD pages address alignment check\n  udf_get_extendedattr() had no boundary checks.\n  fcntl: fix potential deadlock for \u0026fasync_struct.fa_lock\n  crypto: qat - do not export adf_iov_putmsg()\n  crypto: qat - fix naming for init/shutdown VF to PF notifications\n  crypto: qat - fix reuse of completion variable\n  crypto: qat - handle both source of interrupt in VF ISR\n  crypto: qat - do not ignore errors from enable_vf2pf_comms()\n  libata: fix ata_host_start()\n  s390/cio: add dev_busid sysfs entry for each subchannel\n  power: supply: max17042_battery: fix typo in MAx17042_TOFF\n  nvmet: pass back cntlid on successful completion\n  nvme-rdma: don\u0027t update queue count when failing to set io queues\n  nvme-tcp: don\u0027t update queue count when failing to set io queues\n  bcache: add proper error unwinding in bcache_device_init\n  isofs: joliet: Fix iocharset\u003dutf8 mount option\n  udf: Fix iocharset\u003dutf8 mount option\n  udf: Check LVID earlier\n  hrtimer: Ensure timerfd notification for HIGHRES\u003dn\n  hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()\n  posix-cpu-timers: Force next expiration recalc after itimer reset\n  rcu/tree: Handle VM stoppage in stall detection\n  sched/deadline: Fix missing clock update in migrate_task_rq_dl()\n  crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()\n  power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors\n  sched/deadline: Fix reset_on_fork reporting of DL tasks\n  crypto: mxs-dcp - Check for DMA mapping errors\n  regmap: fix the offset of register error log\n  locking/mutex: Fix HANDOFF condition\n  ANDROID: GKI: db845c: Update symbols list and ABI for lts v5.4.144\n  Linux 5.4.145\n  PCI: Call Max Payload Size-related fixup quirks early\n  x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions\n  xhci: fix unsafe memory usage in xhci tracing\n  usb: mtu3: fix the wrong HS mult value\n  usb: mtu3: use @mult for HS isoc or intr\n  usb: host: xhci-rcar: Don\u0027t reload firmware after the completion\n  ALSA: usb-audio: Add registration quirk for JBL Quantum 800\n  Revert \"btrfs: compression: don\u0027t try to compress if we don\u0027t have enough pages\"\n  x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating\n  Revert \"r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM\"\n  mm/page_alloc: speed up the iteration of max_order\n  net: ll_temac: Remove left-over debug message\n  powerpc/boot: Delete unneeded .globl _zimage_start\n  ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)\n  USB: serial: mos7720: improve OOM-handling in read_mos_reg()\n  igmp: Add ip_mc_list lock in ip_check_mc_rcu\n  media: stkwebcam: fix memory leak in stk_camera_probe\n  ARC: wireup clone3 syscall\n  ALSA: pcm: fix divide error in snd_pcm_lib_ioctl\n  ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17\n  ARM: 8918/2: only build return_address() if needed\n  cryptoloop: add a deprecation warning\n  perf/x86/amd/power: Assign pmu.module\n  perf/x86/amd/ibs: Work around erratum #1197\n  perf/x86/intel/pt: Fix mask of num_address_ranges\n  qede: Fix memset corruption\n  net: macb: Add a NULL check on desc_ptp\n  qed: Fix the VF msix vectors flow\n  reset: reset-zynqmp: Fixed the argument data type\n  gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats\n  xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG\n  kthread: Fix PF_KTHREAD vs to_kthread() race\n  ubifs: report correct st_size for encrypted symlinks\n  f2fs: report correct st_size for encrypted symlinks\n  ext4: report correct st_size for encrypted symlinks\n  fscrypt: add fscrypt_symlink_getattr() for computing st_size\n  ext4: fix race writing to an inline_data file while its xattrs are changing\n  Revert \"once: Fix panic when module unload\"\n  Linux 5.4.144\n  audit: move put_tree() to avoid trim_trees refcount underflow and UAF\n  net: don\u0027t unconditionally copy_from_user a struct ifreq for socket ioctls\n  Revert \"parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat\"\n  Revert \"floppy: reintroduce O_NDELAY fix\"\n  btrfs: fix NULL pointer dereference when deleting device by invalid id\n  arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88\n  KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs\n  net: dsa: mt7530: fix VLAN traffic leaks again\n  bpf: Fix cast to pointer from integer of different size warning\n  bpf: Track contents of read-only maps as scalars\n  vt_kdsetmode: extend console locking\n  btrfs: fix race between marking inode needs to be logged and log syncing\n  net/rds: dma_map_sg is entitled to merge entries\n  drm/nouveau/disp: power down unused DP links during init\n  drm: Copy drm_wait_vblank to user before returning\n  qed: Fix null-pointer dereference in qed_rdma_create_qp()\n  qed: qed ll2 race condition fixes\n  vringh: Use wiov-\u003eused to check for read/write desc order\n  virtio_pci: Support surprise removal of virtio pci device\n  virtio: Improve vq-\u003ebroken access to avoid any compiler optimization\n  opp: remove WARN when no valid OPPs remain\n  perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32\n  usb: gadget: u_audio: fix race condition on endpoint stop\n  drm/i915: Fix syncmap memory leak\n  net: hns3: fix get wrong pfc_en when query PFC configuration\n  net: hns3: fix duplicate node in VLAN list\n  net: hns3: clear hardware resource when loading driver\n  rtnetlink: Return correct error on changing device netns\n  net: marvell: fix MVNETA_TX_IN_PRGRS bit number\n  xgene-v2: Fix a resource leak in the error handling path of \u0027xge_probe()\u0027\n  ip_gre: add validation for csum_start\n  RDMA/efa: Free IRQ vectors on error flow\n  e1000e: Fix the max snoop/no-snoop latency for 10M\n  IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()\n  RDMA/bnxt_re: Add missing spin lock initialization\n  scsi: core: Fix hang of freezing queue between blocking and running device\n  usb: dwc3: gadget: Stop EP0 transfers during pullup disable\n  usb: dwc3: gadget: Fix dwc3_calc_trbs_left()\n  USB: serial: option: add new VID/PID to support Fibocom FG150\n  Revert \"USB: serial: ch341: fix character loss at high transfer rates\"\n  can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters\n  mm, oom: make the calculation of oom badness more accurate\n  mmc: sdhci-msm: Update the software timeout value for sdhc\n  ovl: fix uninitialized pointer read in ovl_lookup_real_one()\n  once: Fix panic when module unload\n  netfilter: conntrack: collect all entries in one cycle\n  ARC: Fix CONFIG_STACKDEPOT\n  net: qrtr: fix another OOB Read in qrtr_endpoint_post\n  Revert \"virtio: Protect vqs list access\"\n  Revert \"net: igmp: fix data-race in igmp_ifc_timer_expire()\"\n  Revert \"net: igmp: increase size of mr_ifc_count\"\n  Revert \"PCI/MSI: Protect msi_desc::masked for multi-MSI\"\n  Linux 5.4.143\n  netfilter: nft_exthdr: fix endianness of tcp option cast\n  fs: warn about impending deprecation of mandatory locks\n  mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim\n  mm, memcg: avoid stale protection values when cgroup is above protection\n  ASoC: intel: atom: Fix breakage for PCM buffer address setup\n  PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI\n  btrfs: prevent rename2 from exchanging a subvol with a directory from different parents\n  ipack: tpci200: fix memory leak in the tpci200_register\n  ipack: tpci200: fix many double free issues in tpci200_pci_probe\n  slimbus: ngd: reset dma setup during runtime pm\n  slimbus: messaging: check for valid transaction id\n  slimbus: messaging: start transaction ids from 1 instead of zero\n  tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name\n  ALSA: hda - fix the \u0027Capture Switch\u0027 value change notifications\n  mmc: dw_mmc: Fix hang on data CRC error\n  ovl: add splice file read write helper\n  iavf: Fix ping is lost after untrusted VF had tried to change MAC\n  i40e: Fix ATR queue selection\n  ovs: clear skb-\u003etstamp in forwarding path\n  net: mdio-mux: Handle -EPROBE_DEFER correctly\n  net: mdio-mux: Don\u0027t ignore memory allocation errors\n  net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32\n  virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO\n  virtio-net: support XDP when not more queues\n  vrf: Reset skb conntrack connection on VRF rcv\n  bnxt_en: Add missing DMA memory barriers\n  ptp_pch: Restore dependency on PCI\n  net: 6pack: fix slab-out-of-bounds in decode_data\n  bnxt: disable napi before canceling DIM\n  bnxt: don\u0027t lock the tx queue from napi poll\n  bpf: Clear zext_dst of dead insns\n  vhost: Fix the calculation in vhost_overflow()\n  virtio: Protect vqs list access\n  dccp: add do-while-0 stubs for dccp_pr_debug macros\n  cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant\n  iommu: Check if group is NULL before remove device\n  Bluetooth: hidp: use correct wait queue when removing ctrl_wait\n  drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X\n  net: usb: lan78xx: don\u0027t modify phy_device state concurrently\n  ARM: dts: nomadik: Fix up interrupt controller node names\n  scsi: core: Fix capacity set to zero after offlinining device\n  scsi: core: Avoid printing an error if target_alloc() returns -ENXIO\n  scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()\n  scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()\n  dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available\n  ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218\n  dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()\n  dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers\n  USB: core: Avoid WARNings for 0-length descriptor requests\n  media: drivers/media/usb: fix memory leak in zr364xx_probe\n  media: zr364xx: fix memory leaks in probe()\n  media: zr364xx: propagate errors from zr364xx_start_readpipe()\n  mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards\n  ath9k: Postpone key cache entry deletion for TXQ frames reference it\n  ath: Modify ath_key_delete() to not need full key entry\n  ath: Export ath_hw_keysetmac()\n  ath9k: Clear key cache explicitly on disabling hardware\n  ath: Use safer key clearing with key cache entries\n  x86/fpu: Make init_fpstate correct with optimized XSAVE\n  ext4: fix EXT4_MAX_LOGICAL_BLOCK macro\n  Linux 5.4.142\n  KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)\n  KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)\n  iommu/vt-d: Fix agaw for a supported 48 bit guest address width\n  vmlinux.lds.h: Handle clang\u0027s module.{c,d}tor sections\n  ceph: take snap_empty_lock atomically with snaprealm refcount change\n  ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm\n  ceph: add some lockdep assertions around snaprealm handling\n  KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation\n  PCI/MSI: Protect msi_desc::masked for multi-MSI\n  PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()\n  PCI/MSI: Correct misleading comments\n  PCI/MSI: Do not set invalid bits in MSI mask\n  PCI/MSI: Enforce MSI[X] entry updates to be visible\n  PCI/MSI: Enforce that MSI-X table entry is masked for update\n  PCI/MSI: Mask all unused MSI-X entries\n  PCI/MSI: Enable and mask MSI-X early\n  genirq/timings: Prevent potential array overflow in __irq_timings_store()\n  genirq/msi: Ensure deactivation on teardown\n  x86/resctrl: Fix default monitoring groups reporting\n  x86/ioapic: Force affinity setup before startup\n  x86/msi: Force affinity setup before startup\n  genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP\n  x86/tools: Fix objdump version check again\n  powerpc/kprobes: Fix kprobe Oops happens in booke\n  nbd: Aovid double completion of a request\n  vsock/virtio: avoid potential deadlock when vsock device remove\n  xen/events: Fix race in set_evtchn_to_irq\n  net: igmp: increase size of mr_ifc_count\n  tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets\n  net: linkwatch: fix failure to restore device state across suspend/resume\n  net: bridge: fix memleak in br_add_if()\n  net: dsa: sja1105: fix broken backpressure in .port_fdb_dump\n  net: dsa: lantiq: fix broken backpressure in .port_fdb_dump\n  net: dsa: lan9303: fix broken backpressure in .port_fdb_dump\n  net: igmp: fix data-race in igmp_ifc_timer_expire()\n  net: Fix memory leak in ieee802154_raw_deliver\n  net: dsa: microchip: Fix ksz_read64()\n  drm/meson: fix colour distortion from HDR set during vendor u-boot\n  net/mlx5: Fix return value from tracer initialization\n  psample: Add a fwd declaration for skbuff\n  iavf: Set RSS LUT and key in reset handle path\n  net: sched: act_mirred: Reset ct info when mirror/redirect skb\n  ppp: Fix generating ifname when empty IFLA_IFNAME is specified\n  net: phy: micrel: Fix link detection on ksz87xx switch\"\n  platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables\n  platform/x86: pcengines-apuv2: revert wiring up simswitch GPIO as LED\n  net: dsa: mt7530: add the missing RxUnicast MIB counter\n  ASoC: cs42l42: Fix LRCLK frame start edge\n  netfilter: nf_conntrack_bridge: Fix memory leak when error\n  ASoC: cs42l42: Remove duplicate control for WNF filter frequency\n  ASoC: cs42l42: Fix inversion of ADC Notch Switch control\n  ASoC: cs42l42: Don\u0027t allow SND_SOC_DAIFMT_LEFT_J\n  ASoC: cs42l42: Correct definition of ADC Volume control\n  ieee802154: hwsim: fix GPF in hwsim_new_edge_nl\n  ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi\n  libnvdimm/region: Fix label activation vs errors\n  ACPI: NFIT: Fix support for virtual SPA ranges\n  ceph: reduce contention in ceph_check_delayed_caps()\n  i2c: dev: zero out array used for i2c reads from userspace\n  ASoC: intel: atom: Fix reference to PCM buffer address\n  ASoC: xilinx: Fix reference to PCM buffer address\n  iio: adc: Fix incorrect exit of for-loop\n  iio: humidity: hdc100x: Add margin to the conversion time\n  iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels\n  Linux 5.4.141\n  btrfs: don\u0027t flush from btrfs_delayed_inode_reserve_metadata\n  btrfs: export and rename qgroup_reserve_meta\n  btrfs: qgroup: don\u0027t commit transaction when we already hold the handle\n  net: xilinx_emaclite: Do not print real IOMEM pointer\n  btrfs: fix lockdep splat when enabling and disabling qgroups\n  btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT\n  btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED\n  btrfs: qgroup: try to flush qgroup space when we get -EDQUOT\n  btrfs: qgroup: allow to unreserve range without releasing other ranges\n  btrfs: make btrfs_qgroup_reserve_data take btrfs_inode\n  btrfs: make qgroup_free_reserved_data take btrfs_inode\n  ovl: prevent private clone if bind mount is not allowed\n  ppp: Fix generating ppp unit id when ifname is not specified\n  ALSA: hda: Add quirk for ASUS Flow x13\n  USB:ehci:fix Kunpeng920 ehci hardware problem\n  KVM: X86: MMU: Use the correct inherited permissions to get shadow page\n  usb: dwc3: gadget: Avoid runtime resume if disabling pullup\n  usb: dwc3: gadget: Disable gadget IRQ during pullup disable\n  usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable\n  usb: dwc3: gadget: Prevent EP queuing while stopping transfers\n  usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup\n  usb: dwc3: gadget: Allow runtime suspend if UDC unbinded\n  usb: dwc3: Stop active transfers before halting the controller\n  tracing: Reject string operand in the histogram expression\n  media: v4l2-mem2mem: always consider OUTPUT queue during poll\n  tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag\n  KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB\n  Linux 5.4.140\n  arm64: fix compat syscall return truncation\n  net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset\n  alpha: Send stop IPI to send to online CPUs\n  virt_wifi: fix error on connect\n  reiserfs: check directory items on read from disk\n  reiserfs: add check for root_inode in reiserfs_fill_super\n  libata: fix ata_pio_sector for CONFIG_HIGHMEM\n  bpf, selftests: Adjust few selftest result_unpriv outcomes\n  perf/x86/amd: Don\u0027t touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest\n  soc: ixp4xx/qmgr: fix invalid __iomem access\n  spi: meson-spicc: fix memory leak in meson_spicc_remove\n  soc: ixp4xx: fix printing resources\n  arm64: vdso: Avoid ISB after reading from cntvct_el0\n  KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds\n  KVM: Do not leak memory for duplicate debugfs directories\n  KVM: x86: accept userspace interrupt only if no event is injected\n  md/raid10: properly indicate failure when ending a failed write request\n  pcmcia: i82092: fix a null pointer dereference bug\n  timers: Move clearing of base::timer_running under base:: Lock\n  serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.\n  serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver\n  MIPS: Malta: Do not byte-swap accesses to the CBUS UART\n  serial: 8250: Mask out floating 16/32-bit bus bits\n  serial: 8250_mtk: fix uart corruption issue when rx power off\n  serial: tegra: Only print FIFO error message when an error occurs\n  ext4: fix potential htree corruption when growing large_dir directories\n  pipe: increase minimum default pipe size to 2 pages\n  media: rtl28xxu: fix zero-length control request\n  staging: rtl8712: get rid of flush_scheduled_work\n  staging: rtl8723bs: Fix a resource leak in sd_int_dpc\n  tpm_ftpm_tee: Free and unregister TEE shared memory during kexec\n  optee: Fix memory leak when failing to register shm pages\n  tee: add tee_shm_alloc_kernel_buf()\n  optee: Clear stale cache entries during initialization\n  tracing / histogram: Give calculation hist_fields a size\n  scripts/tracing: fix the bug that can\u0027t parse raw_trace_func\n  clk: fix leak on devm_clk_bulk_get_all() unwind\n  usb: otg-fsm: Fix hrtimer list corruption\n  usb: gadget: f_hid: idle uses the highest byte for duration\n  usb: gadget: f_hid: fixed NULL pointer dereference\n  usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers\n  usb: cdns3: Fixed incorrect gadget state\n  ALSA: usb-audio: Add registration quirk for JBL Quantum 600\n  ALSA: hda/realtek: add mic quirk for Acer SF314-42\n  firmware_loader: fix use-after-free in firmware_fallback_sysfs\n  firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback\n  USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2\n  USB: serial: ch341: fix character loss at high transfer rates\n  USB: serial: option: add Telit FD980 composition 0x1056\n  USB: usbtmc: Fix RCU stall warning\n  Bluetooth: defer cleanup of resources in hci_unregister_dev()\n  blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()\n  net: vxge: fix use-after-free in vxge_device_unregister\n  net: fec: fix use-after-free in fec_drv_remove\n  net: pegasus: fix uninit-value in get_interrupt_interval\n  bnx2x: fix an error code in bnx2x_nic_load()\n  mips: Fix non-POSIX regexp\n  net: ipv6: fix returned variable type in ip6_skb_dst_mtu\n  nfp: update ethtool reporting of pauseframe control\n  sctp: move the active_key update after sh_keys is added\n  gpio: tqmx86: really make IRQ optional\n  net: natsemi: Fix missing pci_disable_device() in probe and remove\n  net: phy: micrel: Fix detection of ksz87xx switch\n  net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones\n  net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add\n  net, gro: Set inner transport header offset in tcp/udp GRO hook\n  dmaengine: imx-dma: configure the generic DMA type to make it work\n  media: videobuf2-core: dequeue if start_streaming fails\n  scsi: sr: Return correct event when media event code is 3\n  spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation\n  spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay\n  omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator\n  ARM: dts: am437x-l4: fix typo in can@0 node\n  clk: stm32f4: fix post divisor setup for I2S/SAI PLLs\n  ALSA: usb-audio: fix incorrect clock source setting\n  arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode\n  ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins\n  ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init\n  ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz\n  ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms\n  ARM: imx: add missing clk_disable_unprepare()\n  ARM: imx: add missing iounmap()\n  arm64: dts: ls1028a: fix node name for the sysclk\n  ALSA: seq: Fix racy deletion of subscriber\n  Revert \"ACPICA: Fix memory leak caused by _CID repair function\"\n  ANDROID: GKI: fix up android/abi_gki_aarch64.xml merge\n  Linux 5.4.139\n  spi: mediatek: Fix fifo transfer\n  bpf, selftests: Adjust few selftest outcomes wrt unreachable code\n  bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones\n  bpf: Test_verifier, add alu32 bounds tracking tests\n  bpf: Fix leakage under speculation on mispredicted branches\n  bpf: Do not mark insn as seen under speculative path verification\n  bpf: Inherit expanded/patched seen count from old aux data\n  Revert \"watchdog: iTCO_wdt: Account for rebooting on second timeout\"\n  firmware: arm_scmi: Add delayed response status check\n  firmware: arm_scmi: Ensure drivers provide a probe function\n  Revert \"Bluetooth: Shutdown controller after workqueues are flushed or cancelled\"\n  ACPI: fix NULL pointer dereference\n  nvme: fix nvme_setup_command metadata trace event\n  net: Fix zero-copy head len calculation.\n  qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()\n  r8152: Fix potential PM refcount imbalance\n  ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits\n  spi: stm32h7: fix full duplex irq handler handling\n  regulator: rt5033: Fix n_voltages settings for BUCK and LDO\n  btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction\n  btrfs: fix race causing unnecessary inode logging during link and rename\n  btrfs: do not commit logs and transactions during link and rename operations\n  btrfs: delete duplicated words + other fixes in comments\n  Linux 5.4.138\n  can: j1939: j1939_session_deactivate(): clarify lifetime of session object\n  i40e: Add additional info to PHY type error\n  Revert \"perf map: Fix dso-\u003ensinfo refcounting\"\n  powerpc/pseries: Fix regression while building external modules\n  PCI: mvebu: Setup BAR0 in order to fix MSI\n  can: hi311x: fix a signedness bug in hi3110_cmd()\n  sis900: Fix missing pci_disable_device() in probe and remove\n  tulip: windbond-840: Fix missing pci_disable_device() in probe and remove\n  sctp: fix return value check in __sctp_rcv_asconf_lookup\n  net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()\n  net/mlx5: Fix flow table chaining\n  net: llc: fix skb_over_panic\n  mlx4: Fix missing error code in mlx4_load_one()\n  net: Set true network header for ECN decapsulation\n  tipc: fix sleeping in tipc accept routine\n  i40e: Fix log TC creation failure when max num of queues is exceeded\n  i40e: Fix queue-to-TC mapping on Tx\n  i40e: Fix firmware LLDP agent related warning\n  i40e: Fix logic of disabling queues\n  netfilter: nft_nat: allow to specify layer 4 protocol NAT only\n  netfilter: conntrack: adjust stop timestamp to real expiry value\n  cfg80211: Fix possible memory leak in function cfg80211_bss_update\n  nfc: nfcsim: fix use after free during module unload\n  NIU: fix incorrect error return, missed in previous revert\n  HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT\n  can: esd_usb2: fix memory leak\n  can: ems_usb: fix memory leak\n  can: usb_8dev: fix memory leak\n  can: mcba_usb_start(): add missing urb-\u003etransfer_dma initialization\n  can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF\n  can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms\n  ocfs2: issue zeroout to EOF blocks\n  ocfs2: fix zero out valid data\n  KVM: add missing compat KVM_CLEAR_DIRTY_LOG\n  x86/kvm: fix vcpu-id indexed array sizes\n  Revert \"ACPI: resources: Add checks for ACPI IRQ override\"\n  btrfs: mark compressed range uptodate only if all bio succeed\n  btrfs: fix rw device counting in __btrfs_free_extra_devids\n  x86/asm: Ensure asm/proto.h can be included stand-alone\n  net_sched: check error pointer in tcf_dump_walker()\n  Linux 5.4.137\n  ipv6: ip6_finish_output2: set sk into newly allocated nskb\n  ARM: dts: versatile: Fix up interrupt controller node names\n  iomap: remove the length variable in iomap_seek_hole\n  iomap: remove the length variable in iomap_seek_data\n  cifs: fix the out of range assignment to bit fields in parse_server_interfaces\n  firmware: arm_scmi: Fix range check for the maximum number of pending messages\n  firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow\n  hfs: add lock nesting notation to hfs_find_init\n  hfs: fix high memory mapping in hfs_bnode_read\n  hfs: add missing clean-up in hfs_fill_super\n  ipv6: allocate enough headroom in ip6_finish_output2()\n  sctp: move 198 addresses from unusable to private scope\n  net: annotate data race around sk_ll_usec\n  net/802/garp: fix memleak in garp_request_join()\n  net/802/mrp: fix memleak in mrp_request_join()\n  cgroup1: fix leaked context root causing sporadic NULL deref in LTP\n  workqueue: fix UAF in pwq_unbound_release_workfn()\n  af_unix: fix garbage collect vs MSG_PEEK\n  KVM: x86: determine if an exception has an error code only when injecting it.\n  tools: Allow proper CC/CXX/... override with LLVM\u003d1 in Makefile.include\n  selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c\n  ANDROID: Update android/abi_gki_aarch64.xml\n  ANDROID: Update android/abi_gki_aarch64_goldfish\n  Linux 5.4.136\n  xhci: add xhci_get_virt_ep() helper\n  perf inject: Close inject.output on exit\n  PCI: Mark AMD Navi14 GPU ATS as broken\n  btrfs: compression: don\u0027t try to compress if we don\u0027t have enough pages\n  iio: accel: bma180: Fix BMA25x bandwidth register values\n  iio: accel: bma180: Use explicit member assignment\n  net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear\n  net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz\n  drm: Return -ENOTTY for non-drm ioctls\n  nds32: fix up stack guard gap\n  rbd: always kick acquire on \"acquired\" and \"released\" notifications\n  rbd: don\u0027t hold lock_rwsem while running_list is being drained\n  hugetlbfs: fix mount mode command line processing\n  userfaultfd: do not untag user pointers\n  selftest: use mmap instead of posix_memalign to allocate memory\n  ixgbe: Fix packet corruption due to missing DMA sync\n  media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n  btrfs: check for missing device in btrfs_trim_fs\n  tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.\n  tracing/histogram: Rename \"cpu\" to \"common_cpu\"\n  firmware/efi: Tell memblock about EFI iomem reservations\n  usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.\n  USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick\n  USB: serial: cp210x: fix comments for GE CS1000\n  USB: serial: option: add support for u-blox LARA-R6 family\n  usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()\n  usb: max-3421: Prevent corruption of freed memory\n  USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS\n  usb: hub: Fix link power management max exit latency (MEL) calculations\n  usb: hub: Disable USB 3 device initiated lpm if exit latency is too high\n  KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state\n  KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow\n  xhci: Fix lost USB 2 remote wake\n  ALSA: hdmi: Expose all pins on MSI MS-7C94 board\n  ALSA: sb: Fix potential ABBA deadlock in CSP driver\n  ALSA: usb-audio: Add registration quirk for JBL Quantum headsets\n  ALSA: usb-audio: Add missing proc text entry for BESPOKEN type\n  s390/boot: fix use of expolines in the DMA code\n  s390/ftrace: fix ftrace_update_ftrace_func implementation\n  Revert \"MIPS: add PMD table accounting into MIPS\u0027pmd_alloc_one\"\n  proc: Avoid mixing integer types in mem_rw()\n  drm/panel: raspberrypi-touchscreen: Prevent double-free\n  net: sched: cls_api: Fix the the wrong parameter\n  sctp: update active_key for asoc when old key is being replaced\n  nvme: set the PRACT bit when using Write Zeroes with T10 PI\n  r8169: Avoid duplicate sysfs entry creation error\n  afs: Fix tracepoint string placement with built-in AFS\n  Revert \"USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem\"\n  nvme-pci: don\u0027t WARN_ON in nvme_reset_work if ctrl.state is not RESETTING\n  ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n  net/sched: act_skbmod: Skip non-Ethernet packets\n  net: hns3: fix rx VLAN offload state inconsistent issue\n  net/tcp_fastopen: fix data races around tfo_active_disable_stamp\n  net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition\n  bnxt_en: Check abort error state in bnxt_half_open_nic()\n  bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()\n  bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()\n  bnxt_en: Improve bnxt_ulp_stop()/bnxt_ulp_start() call sequence.\n  spi: cadence: Correct initialisation of runtime PM again\n  scsi: target: Fix protect handling in WRITE SAME(32)\n  scsi: iscsi: Fix iface sysfs attr detection\n  netrom: Decrease sock refcount when sock timers expire\n  net: sched: fix memory leak in tcindex_partial_destroy_work\n  KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n  KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM\u003dn crash\n  net: decnet: Fix sleeping inside in af_decnet\n  efi/tpm: Differentiate missing and invalid final event log table.\n  net: fix uninit-value in caif_seqpkt_sendmsg\n  bpftool: Check malloc return value in mount_bpffs_for_pin\n  bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats\n  s390/bpf: Perform r1 range checking before accessing jit-\u003eseen_reg[r1]\n  liquidio: Fix unintentional sign extension issue on left shift of u16\n  ASoC: rt5631: Fix regcache sync errors on resume\n  spi: mediatek: fix fifo rx mode\n  regulator: hi6421: Fix getting wrong drvdata\n  regulator: hi6421: Use correct variable type for regmap api val argument\n  spi: stm32: fixes pm_runtime calls in probe/remove\n  spi: stm32: Use dma_request_chan() instead dma_request_slave_channel()\n  spi: imx: add a check for speed_hz before calculating the clock\n  perf data: Close all files in close_dir()\n  perf probe-file: Delete namelist in del_events() on the error path\n  perf lzma: Close lzma stream on exit\n  perf script: Fix memory \u0027threads\u0027 and \u0027cpus\u0027 leaks on exit\n  perf dso: Fix memory leak in dso__new_map()\n  perf test event_update: Fix memory leak of evlist\n  perf test session_topology: Delete session-\u003eevlist\n  perf env: Fix sibling_dies memory leak\n  perf probe: Fix dso-\u003ensinfo refcounting\n  perf map: Fix dso-\u003ensinfo refcounting\n  nvme-pci: do not call nvme_dev_remove_admin from nvme_remove\n  cxgb4: fix IRQ free race during driver unload\n  pwm: sprd: Ensure configuring period and duty_cycle isn\u0027t wrongly skipped\n  selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect\n  selftests: icmp_redirect: remove from checking for IPv6 route get\n  ipv6: fix \u0027disable_policy\u0027 for fwd packets\n  gve: Fix an error handling path in \u0027gve_probe()\u0027\n  igb: Fix position of assignment to *ring\n  igb: Check if num of q_vectors is smaller than max before array access\n  iavf: Fix an error handling path in \u0027iavf_probe()\u0027\n  e1000e: Fix an error handling path in \u0027e1000_probe()\u0027\n  fm10k: Fix an error handling path in \u0027fm10k_probe()\u0027\n  igb: Fix an error handling path in \u0027igb_probe()\u0027\n  igc: Fix an error handling path in \u0027igc_probe()\u0027\n  igc: Prefer to use the pci_release_mem_regions method\n  ixgbe: Fix an error handling path in \u0027ixgbe_probe()\u0027\n  igc: change default return of igc_read_phy_reg()\n  igb: Fix use-after-free error during reset\n  igc: Fix use-after-free error during reset\n  Linux 5.4.135\n  udp: annotate data races around unix_sk(sk)-\u003egso_size\n  perf test bpf: Free obj_buf\n  bpftool: Properly close va_list \u0027ap\u0027 by va_end() on error\n  ipv6: tcp: drop silly ICMPv6 packet too big messages\n  tcp: annotate data races around tp-\u003emtu_info\n  dma-buf/sync_file: Don\u0027t leak fences on merge failure\n  net: fddi: fix UAF in fza_probe\n  net: validate lwtstate-\u003edata before returning from skb_tunnel_info()\n  net: send SYNACK packet with accepted fwmark\n  net: ti: fix UAF in tlan_remove_one\n  net: qcom/emac: fix UAF in emac_remove\n  net: moxa: fix UAF in moxart_mac_probe\n  net: ip_tunnel: fix mtu calculation for ETHER tunnel devices\n  net: bcmgenet: Ensure all TX/RX queues DMAs are disabled\n  net: bridge: sync fdb to new unicast-filtering ports\n  net/sched: act_ct: fix err check for nf_conntrack_confirm\n  netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo\n  net: ipv6: fix return value of ip6_skb_dst_mtu\n  net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz\n  net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz\n  dm writecache: return the exact table values that were set\n  mm: slab: fix kmem_cache_create failed when sysfs node not destroyed\n  usb: cdns3: Enable TDL_CHK only for OUT ep\n  f2fs: Show casefolding support only when supported\n  arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file\n  firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string\n  arm64: dts: armada-3720-turris-mox: add firmware node\n  cifs: prevent NULL deref in cifs_compose_mount_options()\n  s390: introduce proper type handling call_on_stack() macro\n  sched/fair: Fix CFS bandwidth hrtimer expiry type\n  scsi: qedf: Add check to synchronize abort and flush\n  scsi: libfc: Fix array index out of bound exception\n  scsi: libsas: Add LUN number check in .slave_alloc callback\n  scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8\n  rtc: max77686: Do not enforce (incorrect) interrupt trigger type\n  kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set\n  thermal/core: Correct function name thermal_zone_device_unregister()\n  arm64: dts: imx8mq: assign PCIe clocks\n  arm64: dts: ls208xa: remove bus-num from dspi node\n  firmware: tegra: bpmp: Fix Tegra234-only builds\n  soc/tegra: fuse: Fix Tegra234-only builds\n  ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15\n  ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings\n  ARM: dts: rockchip: fix supply properties in io-domains nodes\n  arm64: dts: juno: Update SCPI nodes as per the YAML schema\n  ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings\n  ARM: dts: stm32: fix RCC node name on stm32f429 MCU\n  ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards\n  ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios\n  ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios\n  kbuild: sink stdout from cmd for silent build\n  rtc: mxc_v2: add missing MODULE_DEVICE_TABLE\n  ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info\n  ARM: dts: imx6: phyFLEX: Fix UART hardware flow control\n  ARM: dts: Hurricane 2: Fix NAND nodes names\n  ARM: dts: BCM63xx: Fix NAND nodes names\n  ARM: NSP: dts: fix NAND nodes names\n  ARM: Cygnus: dts: fix NAND nodes names\n  ARM: brcmstb: dts: fix NAND nodes names\n  reset: ti-syscon: fix to_ti_syscon_reset_data macro\n  arm64: dts: rockchip: Fix power-controller node names for rk3328\n  arm64: dts: rockchip: Fix power-controller node names for px30\n  ARM: dts: rockchip: Fix power-controller node names for rk3288\n  ARM: dts: rockchip: Fix power-controller node names for rk3188\n  ARM: dts: rockchip: Fix power-controller node names for rk3066a\n  ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x\n  ARM: dts: rockchip: Fix the timer clocks order\n  arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi\n  ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288\n  ARM: dts: gemini: add device_type on pci\n  ARM: dts: gemini: rename mdio to the right name\n\n Conflicts:\n\tdrivers/mmc/host/sdhci-msm.c\n\tdrivers/scsi/ufs/ufshcd.c\n\tdrivers/staging/android/ion/heaps/ion_cma_heap.c\n\tdrivers/usb/dwc3/gadget.c\n\tinclude/linux/oom.h\n\tkernel/time/hrtimer.c\n\tmm/oom_kill.c\n\tnet/qrtr/qrtr.c\n\nChange-Id: I1c29c9ef4233acd05550475b29b8f7d30b6c452d\nSigned-off-by: Srinivasarao Pathipati \u003cquic_spathi@quicinc.com\u003e\n"
    },
    {
      "commit": "c4f92aff870656e9f877de947d343c2563164ebc",
      "tree": "07e157e81306bccfcb3e1b153ce4fde7700e6a94",
      "parents": [
        "4076dc42c44b7b2d96d47cbef13b2e69754dc0b8",
        "07e5f23d3fa6ca98457d1a2177a735fcc65923c2"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Sep 25 14:41:23 2021 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Sep 25 14:41:58 2021 +0200"
      },
      "message": "Merge 5.4.148 into android11-5.4-lts\n\nChanges in 5.4.148\n\trtc: tps65910: Correct driver module alias\n\tbtrfs: wake up async_delalloc_pages waiters after submit\n\tbtrfs: reset replace target device to allocation state on close\n\tblk-zoned: allow zone management send operations without CAP_SYS_ADMIN\n\tblk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN\n\tPCI/MSI: Skip masking MSI-X on Xen PV\n\tpowerpc/perf/hv-gpci: Fix counter value parsing\n\txen: fix setting of max_pfn in shared_info\n\tinclude/linux/list.h: add a macro to test if entry is pointing to the head\n\t9p/xen: Fix end of loop tests for list_for_each_entry\n\ttools/thermal/tmon: Add cross compiling support\n\tpinctrl: stmfx: Fix hazardous u8[] to unsigned long cast\n\tpinctrl: ingenic: Fix incorrect pull up/down info\n\tsoc: qcom: aoss: Fix the out of bound usage of cooling_devs\n\tsoc: aspeed: lpc-ctrl: Fix boundary check for mmap\n\tsoc: aspeed: p2a-ctrl: Fix boundary check for mmap\n\tarm64: head: avoid over-mapping in map_memory\n\tcrypto: public_key: fix overflow during implicit conversion\n\tblock: bfq: fix bfq_set_next_ioprio_data()\n\tpower: supply: max17042: handle fails of reading status register\n\tdm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()\n\tVMCI: fix NULL pointer dereference when unmapping queue pair\n\tmedia: uvc: don\u0027t do DMA on stack\n\tmedia: rc-loopback: return number of emitters rather than error\n\tRevert \"dmaengine: imx-sdma: refine to load context only once\"\n\tdmaengine: imx-sdma: remove duplicated sdma_load_context\n\tlibata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs\n\tARM: 9105/1: atags_to_fdt: don\u0027t warn about stack size\n\tPCI/portdrv: Enable Bandwidth Notification only if port supports it\n\tPCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported\n\tPCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure\n\tPCI: xilinx-nwl: Enable the clock through CCF\n\tPCI: aardvark: Fix checking for PIO status\n\tPCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response\n\tPCI: aardvark: Fix masking and unmasking legacy INTx interrupts\n\tHID: input: do not report stylus battery state as \"full\"\n\tf2fs: quota: fix potential deadlock\n\tscsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND\n\tIB/hfi1: Adjust pkey entry in index 0\n\tRDMA/iwcm: Release resources if iw_cm module initialization fails\n\tdocs: Fix infiniband uverbs minor number\n\tpinctrl: samsung: Fix pinctrl bank pin count\n\tvfio: Use config not menuconfig for VFIO_NOIOMMU\n\tpowerpc/stacktrace: Include linux/delay.h\n\tRDMA/efa: Remove double QP type assignment\n\tf2fs: show f2fs instance in printk_ratelimited\n\tf2fs: reduce the scope of setting fsck tag when de-\u003ename_len is zero\n\topenrisc: don\u0027t printk() unconditionally\n\tdma-debug: fix debugfs initialization order\n\tSUNRPC: Fix potential memory corruption\n\tscsi: fdomain: Fix error return code in fdomain_probe()\n\tpinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()\n\tscsi: smartpqi: Fix an error code in pqi_get_raid_map()\n\tscsi: qedi: Fix error codes in qedi_alloc_global_queues()\n\tscsi: qedf: Fix error codes in qedf_alloc_global_queues()\n\tpowerpc/config: Renable MTD_PHYSMAP_OF\n\tscsi: target: avoid per-loop XCOPY buffer allocations\n\tHID: i2c-hid: Fix Elan touchpad regression\n\tKVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live\n\tplatform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call\n\tfscache: Fix cookie key hashing\n\tclk: at91: sam9x60: Don\u0027t use audio PLL\n\tclk: at91: clk-generated: pass the id of changeable parent at registration\n\tclk: at91: clk-generated: Limit the requested rate to our range\n\tKVM: PPC: Fix clearing never mapped TCEs in realmode\n\tf2fs: fix to account missing .skipped_gc_rwsem\n\tf2fs: fix unexpected ENOENT comes from f2fs_map_blocks()\n\tf2fs: fix to unmap pages from userspace process in punch_hole()\n\tMIPS: Malta: fix alignment of the devicetree buffer\n\tkbuild: Fix \u0027no symbols\u0027 warning when CONFIG_TRIM_UNUSD_KSYMS\u003dy\n\tuserfaultfd: prevent concurrent API initialization\n\tdrm/amdgpu: Fix amdgpu_ras_eeprom_init()\n\tASoC: atmel: ATMEL drivers don\u0027t need HAS_DMA\n\tmedia: dib8000: rewrite the init prbs logic\n\tcrypto: mxs-dcp - Use sg_mapping_iter to copy data\n\tPCI: Use pci_update_current_state() in pci_enable_device_flags()\n\ttipc: keep the skb in rcv queue until the whole data is read\n\tiio: dac: ad5624r: Fix incorrect handling of an optional regulator.\n\tiavf: do not override the adapter state in the watchdog task\n\tiavf: fix locking of critical sections\n\tARM: dts: qcom: apq8064: correct clock names\n\tvideo: fbdev: kyro: fix a DoS bug by restricting user input\n\tnetlink: Deal with ESRCH error in nlmsg_notify()\n\tSmack: Fix wrong semantics in smk_access_entry()\n\tdrm: avoid blocking in drm_clients_info\u0027s rcu section\n\tigc: Check if num of q_vectors is smaller than max before array access\n\tusb: host: fotg210: fix the endpoint\u0027s transactional opportunities calculation\n\tusb: host: fotg210: fix the actual_length of an iso packet\n\tusb: gadget: u_ether: fix a potential null pointer dereference\n\tUSB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()\n\tusb: gadget: composite: Allow bMaxPower\u003d0 if self-powered\n\tstaging: board: Fix uninitialized spinlock when attaching genpd\n\ttty: serial: jsm: hold port lock when reporting modem line changes\n\tdrm/amd/display: Fix timer_per_pixel unit error\n\tdrm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex\n\tbpf/tests: Fix copy-and-paste error in double word test\n\tbpf/tests: Do not PASS tests without actually testing the result\n\tvideo: fbdev: asiliantfb: Error out if \u0027pixclock\u0027 equals zero\n\tvideo: fbdev: kyro: Error out if \u0027pixclock\u0027 equals zero\n\tvideo: fbdev: riva: Error out if \u0027pixclock\u0027 equals zero\n\tipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()\n\tflow_dissector: Fix out-of-bounds warnings\n\ts390/jump_label: print real address in a case of a jump label bug\n\ts390: make PCI mio support a machine flag\n\tserial: 8250: Define RX trigger levels for OxSemi 950 devices\n\txtensa: ISS: don\u0027t panic in rs_init\n\thvsi: don\u0027t panic on tty_register_driver failure\n\tserial: 8250_pci: make setup_port() parameters explicitly unsigned\n\tstaging: ks7010: Fix the initialization of the \u0027sleep_status\u0027 structure\n\tsamples: bpf: Fix tracex7 error raised on the missing argument\n\tata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()\n\tBluetooth: skip invalid hci_sync_conn_complete_evt\n\tworkqueue: Fix possible memory leaks in wq_numa_init()\n\tbonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()\n\tarm64: tegra: Fix Tegra194 PCIe EP compatible string\n\tASoC: Intel: bytcr_rt5640: Move \"Platform Clock\" routes to the maps for the matching in-/output\n\tmedia: imx258: Rectify mismatch of VTS value\n\tmedia: imx258: Limit the max analogue gain to 480\n\tmedia: v4l2-dv-timings.c: fix wrong condition in two for-loops\n\tmedia: TDA1997x: fix tda1997x_query_dv_timings() return value\n\tmedia: tegra-cec: Handle errors of clk_prepare_enable()\n\tARM: dts: imx53-ppd: Fix ACHC entry\n\tarm64: dts: qcom: sdm660: use reg value for memory node\n\tnet: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()\n\tdrm/msm: mdp4: drop vblank get/put from prepare/complete_commit\n\tselftests/bpf: Fix xdp_tx.c prog section name\n\tBluetooth: schedule SCO timeouts with delayed_work\n\tBluetooth: avoid circular locks in sco_sock_connect\n\tnet/mlx5: Fix variable type to match 64bit\n\tgpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()\n\tdrm/display: fix possible null-pointer dereference in dcn10_set_clock()\n\tmac80211: Fix monitor MTU limit so that A-MSDUs get through\n\tARM: tegra: tamonten: Fix UART pad setting\n\tarm64: tegra: Fix compatible string for Tegra132 CPUs\n\tarm64: dts: ls1046a: fix eeprom entries\n\tnvme-tcp: don\u0027t check blk_mq_tag_to_rq when receiving pdu data\n\tBluetooth: Fix handling of LE Enhanced Connection Complete\n\topp: Don\u0027t print an error if required-opps is missing\n\tserial: sh-sci: fix break handling for sysrq\n\ttcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD\n\trpc: fix gss_svc_init cleanup on failure\n\tstaging: rts5208: Fix get_ms_information() heap buffer size\n\tgfs2: Don\u0027t call dlm after protocol is unmounted\n\tusb: chipidea: host: fix port index underflow and UBSAN complains\n\tlockd: lockd server-side shouldn\u0027t set fl_ops\n\tdrm/exynos: Always initialize mapping in exynos_drm_register_dma()\n\tm68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch\n\tbtrfs: tree-log: check btrfs_lookup_data_extent return value\n\tASoC: Intel: Skylake: Fix module configuration for KPB and MIXER\n\tASoC: Intel: Skylake: Fix passing loadable flag for module\n\tof: Don\u0027t allow __of_attached_node_sysfs() without CONFIG_SYSFS\n\tmmc: sdhci-of-arasan: Check return value of non-void funtions\n\tmmc: rtsx_pci: Fix long reads when clock is prescaled\n\tselftests/bpf: Enlarge select() timeout for test_maps\n\tmmc: core: Return correct emmc response in case of ioctl error\n\tcifs: fix wrong release in sess_alloc_buffer() failed path\n\tRevert \"USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set\"\n\tusb: musb: musb_dsps: request_irq() after initializing musb\n\tusbip: give back URBs for unsent unlink requests during cleanup\n\tusbip:vhci_hcd USB port can get stuck in the disabled state\n\tASoC: rockchip: i2s: Fix regmap_ops hang\n\tASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B\n\tdrm/amdkfd: Account for SH/SE count when setting up cu masks.\n\tiwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed\n\tiwlwifi: mvm: avoid static queue number aliasing\n\tiwlwifi: mvm: fix access to BSS elements\n\tnet/mlx5: DR, Enable QP retransmission\n\tparport: remove non-zero check on count\n\tath9k: fix OOB read ar9300_eeprom_restore_internal\n\tath9k: fix sleeping in atomic context\n\tnet: fix NULL pointer reference in cipso_v4_doi_free\n\tfix array-index-out-of-bounds in taprio_change\n\tnet: w5100: check return value after calling platform_get_resource()\n\tparisc: fix crash with signals and alloca\n\tovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()\n\tscsi: BusLogic: Fix missing pr_cont() use\n\tscsi: qla2xxx: Changes to support kdump kernel\n\tscsi: qla2xxx: Sync queue idx with queue_pair_map idx\n\tcpufreq: powernv: Fix init_chip_info initialization in numa\u003doff\n\ts390/pv: fix the forcing of the swiotlb\n\tmm/hugetlb: initialize hugetlb_usage in mm_init\n\tmm,vmscan: fix divide by zero in get_scan_count\n\tmemcg: enable accounting for pids in nested pid namespaces\n\tplatform/chrome: cros_ec_proto: Send command again when timeout occurs\n\tlib/test_stackinit: Fix static initializer test\n\tnet: dsa: lantiq_gswip: fix maximum frame length\n\tdrm/msi/mdp4: populate priv-\u003ekms in mdp4_kms_init\n\tdrm/amdgpu: Fix BUG_ON assert\n\tdrm/panfrost: Simplify lock_region calculation\n\tdrm/panfrost: Use u64 for size in lock_region\n\tdrm/panfrost: Clamp lock region to Bifrost minimum\n\tbtrfs: fix upper limit for max_inline for page size 64K\n\txen: reset legacy rtc flag for PV domU\n\tbnx2x: Fix enabling network interfaces without VFs\n\tarm64/sve: Use correct size when reinitialising SVE state\n\tPM: base: power: don\u0027t try to use non-existing RTC for storing data\n\tPCI: Add AMD GPU multi-function power dependencies\n\tdrm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10\n\tdrm/etnaviv: return context from etnaviv_iommu_context_get\n\tdrm/etnaviv: put submit prev MMU context when it exists\n\tdrm/etnaviv: stop abusing mmu_context as FE running marker\n\tdrm/etnaviv: keep MMU context across runtime suspend/resume\n\tdrm/etnaviv: exec and MMU state is lost when resetting the GPU\n\tdrm/etnaviv: fix MMU context leak on GPU reset\n\tdrm/etnaviv: reference MMU context when setting up hardware state\n\tdrm/etnaviv: add missing MMU context put when reaping MMU mapping\n\ts390/sclp: fix Secure-IPL facility detection\n\tx86/mm: Fix kern_addr_valid() to cope with existing but not present entries\n\ttipc: fix an use-after-free issue in tipc_recvmsg\n\tnet-caif: avoid user-triggerable WARN_ON(1)\n\tptp: dp83640: don\u0027t define PAGE0\n\tdccp: don\u0027t duplicate ccid when cloning dccp sock\n\tnet/l2tp: Fix reference count leak in l2tp_udp_recv_core\n\tr6040: Restore MDIO clock frequency after MAC reset\n\ttipc: increase timeout in tipc_sk_enqueue()\n\tperf machine: Initialize srcline string member in add_location struct\n\tnet/mlx5: FWTrace, cancel work on alloc pd error flow\n\tnet/mlx5: Fix potential sleeping in atomic context\n\tevents: Reuse value read using READ_ONCE instead of re-reading it\n\tvhost_net: fix OoB on sendmsg() failure.\n\tnet/af_unix: fix a data-race in unix_dgram_poll\n\tnet: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup\n\ttcp: fix tp-\u003eundo_retrans accounting in tcp_sacktag_one()\n\tqed: Handle management FW error\n\tdt-bindings: arm: Fix Toradex compatible typo\n\tibmvnic: check failover_pending in login response\n\tKVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers\n\tnet: hns3: pad the short tunnel frame before sending to hardware\n\tnet: hns3: change affinity_mask to numa node range\n\tnet: hns3: disable mac in flr process\n\tnet: hns3: fix the timing issue of VF clearing interrupt sources\n\tmm/memory_hotplug: use \"unsigned long\" for PFN in zone_for_pfn_range()\n\tdt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation\n\tmfd: db8500-prcmu: Adjust map to reality\n\tPCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms\n\tfuse: fix use after free in fuse_read_interrupt()\n\tmfd: Don\u0027t use irq_create_mapping() to resolve a mapping\n\ttracing/probes: Reject events which have the same name of existing one\n\tPCI: Add ACS quirks for Cavium multi-function devices\n\tSet fc_nlinfo in nh_create_ipv4, nh_create_ipv6\n\tnet: usb: cdc_mbim: avoid altsetting toggling for Telit LN920\n\tblock, bfq: honor already-setup queue merges\n\tPCI: ibmphp: Fix double unmap of io_mem\n\tethtool: Fix an error code in cxgb2.c\n\tNTB: Fix an error code in ntb_msit_probe()\n\tNTB: perf: Fix an error code in perf_setup_inbuf()\n\tmfd: axp20x: Update AXP288 volatile ranges\n\tPCI: Fix pci_dev_str_match_path() alloc while atomic bug\n\tmfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set\n\tKVM: arm64: Handle PSCI resets before userspace touches vCPU state\n\tPCI: Sync __pci_register_driver() stub for CONFIG_PCI\u003dn\n\tmtd: rawnand: cafe: Fix a resource leak in the error handling path of \u0027cafe_nand_probe()\u0027\n\tARC: export clear_user_page() for modules\n\tperf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}\n\tnet: dsa: b53: Fix calculating number of switch ports\n\tnetfilter: socket: icmp6: fix use-after-scope\n\tfq_codel: reject silly quantum parameters\n\tqlcnic: Remove redundant unlock in qlcnic_pinit_from_rom\n\tip_gre: validate csum_start only on pull\n\tnet: renesas: sh_eth: Fix freeing wrong tx descriptor\n\ts390/bpf: Fix optimizing out zero-extensions\n\ts390/bpf: Fix 64-bit subtraction of the -0x80000000 constant\n\tLinux 5.4.148\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: I8613b511cb543a7ce0d1623663fc1306aaa45af1\n"
    },
    {
      "commit": "d766826eeec493fbbadcddc869338ae1c43bc5ae",
      "tree": "5eb9426a3043ad18312bb9dab94528fb735dad29",
      "parents": [
        "7bf2913a5bca278702c1b0f736ef0aa1a3e877b2"
      ],
      "author": {
        "name": "Nadav Amit",
        "email": "namit@vmware.com",
        "time": "Thu Sep 02 14:58:59 2021 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Sep 22 12:26:26 2021 +0200"
      },
      "message": "userfaultfd: prevent concurrent API initialization\n\n[ Upstream commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 ]\n\nuserfaultfd assumes that the enabled features are set once and never\nchanged after UFFDIO_API ioctl succeeded.\n\nHowever, currently, UFFDIO_API can be called concurrently from two\ndifferent threads, succeed on both threads and leave userfaultfd\u0027s\nfeatures in non-deterministic state.  Theoretically, other uffd operations\n(ioctl\u0027s and page-faults) can be dispatched while adversely affected by\nsuch changes of features.\n\nMoreover, the writes to ctx-\u003estate and ctx-\u003efeatures are not ordered,\nwhich can - theoretically, again - let userfaultfd_ioctl() think that\nuserfaultfd API completed, while the features are still not initialized.\n\nTo avoid races, it is arguably best to get rid of ctx-\u003estate.  Since there\nare only 2 states, record the API initialization in ctx-\u003efeatures as the\nuppermost bit and remove ctx-\u003estate.\n\nLink: https://lkml.kernel.org/r/20210808020724.1022515-3-namit@vmware.com\nFixes: 9cd75c3cd4c3d (\"userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor\")\nSigned-off-by: Nadav Amit \u003cnamit@vmware.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n"
    },
    {
      "commit": "ccc19b14a17f7a90a25804013ff53bc7238cc57a",
      "tree": "57812bcc2d2331fc557d040e9cc9bfb17947c409",
      "parents": [
        "f40a4f7a60aede4a49f16a0a0abeafa6c53a92a2",
        "253dccefb5cb05c8a017150c34daf810776d914c"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Wed Jul 28 13:46:04 2021 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Wed Jul 28 13:46:04 2021 +0200"
      },
      "message": "Merge 5.4.136 into android11-5.4-lts\n\nChanges in 5.4.136\n\tigc: Fix use-after-free error during reset\n\tigb: Fix use-after-free error during reset\n\tigc: change default return of igc_read_phy_reg()\n\tixgbe: Fix an error handling path in \u0027ixgbe_probe()\u0027\n\tigc: Prefer to use the pci_release_mem_regions method\n\tigc: Fix an error handling path in \u0027igc_probe()\u0027\n\tigb: Fix an error handling path in \u0027igb_probe()\u0027\n\tfm10k: Fix an error handling path in \u0027fm10k_probe()\u0027\n\te1000e: Fix an error handling path in \u0027e1000_probe()\u0027\n\tiavf: Fix an error handling path in \u0027iavf_probe()\u0027\n\tigb: Check if num of q_vectors is smaller than max before array access\n\tigb: Fix position of assignment to *ring\n\tgve: Fix an error handling path in \u0027gve_probe()\u0027\n\tipv6: fix \u0027disable_policy\u0027 for fwd packets\n\tselftests: icmp_redirect: remove from checking for IPv6 route get\n\tselftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect\n\tpwm: sprd: Ensure configuring period and duty_cycle isn\u0027t wrongly skipped\n\tcxgb4: fix IRQ free race during driver unload\n\tnvme-pci: do not call nvme_dev_remove_admin from nvme_remove\n\tperf map: Fix dso-\u003ensinfo refcounting\n\tperf probe: Fix dso-\u003ensinfo refcounting\n\tperf env: Fix sibling_dies memory leak\n\tperf test session_topology: Delete session-\u003eevlist\n\tperf test event_update: Fix memory leak of evlist\n\tperf dso: Fix memory leak in dso__new_map()\n\tperf script: Fix memory \u0027threads\u0027 and \u0027cpus\u0027 leaks on exit\n\tperf lzma: Close lzma stream on exit\n\tperf probe-file: Delete namelist in del_events() on the error path\n\tperf data: Close all files in close_dir()\n\tspi: imx: add a check for speed_hz before calculating the clock\n\tspi: stm32: Use dma_request_chan() instead dma_request_slave_channel()\n\tspi: stm32: fixes pm_runtime calls in probe/remove\n\tregulator: hi6421: Use correct variable type for regmap api val argument\n\tregulator: hi6421: Fix getting wrong drvdata\n\tspi: mediatek: fix fifo rx mode\n\tASoC: rt5631: Fix regcache sync errors on resume\n\tliquidio: Fix unintentional sign extension issue on left shift of u16\n\ts390/bpf: Perform r1 range checking before accessing jit-\u003eseen_reg[r1]\n\tbpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats\n\tbpftool: Check malloc return value in mount_bpffs_for_pin\n\tnet: fix uninit-value in caif_seqpkt_sendmsg\n\tefi/tpm: Differentiate missing and invalid final event log table.\n\tnet: decnet: Fix sleeping inside in af_decnet\n\tKVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM\u003dn crash\n\tKVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak\n\tnet: sched: fix memory leak in tcindex_partial_destroy_work\n\tnetrom: Decrease sock refcount when sock timers expire\n\tscsi: iscsi: Fix iface sysfs attr detection\n\tscsi: target: Fix protect handling in WRITE SAME(32)\n\tspi: cadence: Correct initialisation of runtime PM again\n\tbnxt_en: Improve bnxt_ulp_stop()/bnxt_ulp_start() call sequence.\n\tbnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()\n\tbnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()\n\tbnxt_en: Check abort error state in bnxt_half_open_nic()\n\tnet: hisilicon: rename CACHE_LINE_MASK to avoid redefinition\n\tnet/tcp_fastopen: fix data races around tfo_active_disable_stamp\n\tnet: hns3: fix rx VLAN offload state inconsistent issue\n\tnet/sched: act_skbmod: Skip non-Ethernet packets\n\tipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions\n\tnvme-pci: don\u0027t WARN_ON in nvme_reset_work if ctrl.state is not RESETTING\n\tRevert \"USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem\"\n\tafs: Fix tracepoint string placement with built-in AFS\n\tr8169: Avoid duplicate sysfs entry creation error\n\tnvme: set the PRACT bit when using Write Zeroes with T10 PI\n\tsctp: update active_key for asoc when old key is being replaced\n\tnet: sched: cls_api: Fix the the wrong parameter\n\tdrm/panel: raspberrypi-touchscreen: Prevent double-free\n\tproc: Avoid mixing integer types in mem_rw()\n\tRevert \"MIPS: add PMD table accounting into MIPS\u0027pmd_alloc_one\"\n\ts390/ftrace: fix ftrace_update_ftrace_func implementation\n\ts390/boot: fix use of expolines in the DMA code\n\tALSA: usb-audio: Add missing proc text entry for BESPOKEN type\n\tALSA: usb-audio: Add registration quirk for JBL Quantum headsets\n\tALSA: sb: Fix potential ABBA deadlock in CSP driver\n\tALSA: hdmi: Expose all pins on MSI MS-7C94 board\n\txhci: Fix lost USB 2 remote wake\n\tKVM: PPC: Book3S: Fix H_RTAS rets buffer overflow\n\tKVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state\n\tusb: hub: Disable USB 3 device initiated lpm if exit latency is too high\n\tusb: hub: Fix link power management max exit latency (MEL) calculations\n\tUSB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS\n\tusb: max-3421: Prevent corruption of freed memory\n\tusb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()\n\tUSB: serial: option: add support for u-blox LARA-R6 family\n\tUSB: serial: cp210x: fix comments for GE CS1000\n\tUSB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick\n\tusb: dwc2: gadget: Fix sending zero length packet in DDMA mode.\n\tfirmware/efi: Tell memblock about EFI iomem reservations\n\ttracing/histogram: Rename \"cpu\" to \"common_cpu\"\n\ttracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.\n\tbtrfs: check for missing device in btrfs_trim_fs\n\tmedia: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()\n\tixgbe: Fix packet corruption due to missing DMA sync\n\tselftest: use mmap instead of posix_memalign to allocate memory\n\tuserfaultfd: do not untag user pointers\n\thugetlbfs: fix mount mode command line processing\n\trbd: don\u0027t hold lock_rwsem while running_list is being drained\n\trbd: always kick acquire on \"acquired\" and \"released\" notifications\n\tnds32: fix up stack guard gap\n\tdrm: Return -ENOTTY for non-drm ioctls\n\tnet: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz\n\tnet: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear\n\tiio: accel: bma180: Use explicit member assignment\n\tiio: accel: bma180: Fix BMA25x bandwidth register values\n\tbtrfs: compression: don\u0027t try to compress if we don\u0027t have enough pages\n\tPCI: Mark AMD Navi14 GPU ATS as broken\n\tperf inject: Close inject.output on exit\n\txhci: add xhci_get_virt_ep() helper\n\tLinux 5.4.136\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: I8b7e344b3dd2ee557364f9be285ed9925038a497\n"
    },
    {
      "commit": "60dbbd76f11000d5f9515578308b6bb4ce7ad41f",
      "tree": "b68c937338561da42e408aa566500695e8674d65",
      "parents": [
        "540eee8cbb3d281b0b3789a7ca7b862adce3373c"
      ],
      "author": {
        "name": "Peter Collingbourne",
        "email": "pcc@google.com",
        "time": "Fri Jul 23 15:50:01 2021 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jul 28 13:31:01 2021 +0200"
      },
      "message": "userfaultfd: do not untag user pointers\n\ncommit e71e2ace5721a8b921dca18b045069e7bb411277 upstream.\n\nPatch series \"userfaultfd: do not untag user pointers\", v5.\n\nIf a user program uses userfaultfd on ranges of heap memory, it may end\nup passing a tagged pointer to the kernel in the range.start field of\nthe UFFDIO_REGISTER ioctl.  This can happen when using an MTE-capable\nallocator, or on Android if using the Tagged Pointers feature for MTE\nreadiness [1].\n\nWhen a fault subsequently occurs, the tag is stripped from the fault\naddress returned to the application in the fault.address field of struct\nuffd_msg.  However, from the application\u0027s perspective, the tagged\naddress *is* the memory address, so if the application is unaware of\nmemory tags, it may get confused by receiving an address that is, from\nits point of view, outside of the bounds of the allocation.  We observed\nthis behavior in the kselftest for userfaultfd [2] but other\napplications could have the same problem.\n\nAddress this by not untagging pointers passed to the userfaultfd ioctls.\nInstead, let the system call fail.  Also change the kselftest to use\nmmap so that it doesn\u0027t encounter this problem.\n\n[1] https://source.android.com/devices/tech/debug/tagged-pointers\n[2] tools/testing/selftests/vm/userfaultfd.c\n\nThis patch (of 2):\n\nDo not untag pointers passed to the userfaultfd ioctls.  Instead, let\nthe system call fail.  This will provide an early indication of problems\nwith tag-unaware userspace code instead of letting the code get confused\nlater, and is consistent with how we decided to handle brk/mmap/mremap\nin commit dcde237319e6 (\"mm: Avoid creating virtual address aliases in\nbrk()/mmap()/mremap()\"), as well as being consistent with the existing\ntagged address ABI documentation relating to how ioctl arguments are\nhandled.\n\nThe code change is a revert of commit 7d0325749a6c (\"userfaultfd: untag\nuser pointers\") plus some fixups to some additional calls to\nvalidate_range that have appeared since then.\n\n[1] https://source.android.com/devices/tech/debug/tagged-pointers\n[2] tools/testing/selftests/vm/userfaultfd.c\n\nLink: https://lkml.kernel.org/r/20210714195437.118982-1-pcc@google.com\nLink: https://lkml.kernel.org/r/20210714195437.118982-2-pcc@google.com\nLink: https://linux-review.googlesource.com/id/I761aa9f0344454c482b83fcfcce547db0a25501b\nFixes: 63f0c6037965 (\"arm64: Introduce prctl() options to control the tagged user addresses ABI\")\nSigned-off-by: Peter Collingbourne \u003cpcc@google.com\u003e\nReviewed-by: Andrey Konovalov \u003candreyknvl@gmail.com\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Alistair Delva \u003cadelva@google.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Dave Martin \u003cDave.Martin@arm.com\u003e\nCc: Evgenii Stepanov \u003ceugenis@google.com\u003e\nCc: Lokesh Gidra \u003clokeshgidra@google.com\u003e\nCc: Mitch Phillips \u003cmitchp@google.com\u003e\nCc: Vincenzo Frascino \u003cvincenzo.frascino@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: William McVicker \u003cwillmcvicker@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.4]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "06219e6c87ad8b309d0d8e010dbd06e0e74e889b",
      "tree": "b18bcfcd1d35566794fb9a4094b8229816b87eea",
      "parents": [
        "662540931e57cbfac485c1ba3c9363e15574be1b"
      ],
      "author": {
        "name": "Laurent Dufour",
        "email": "ldufour@linux.vnet.ibm.com",
        "time": "Tue Apr 17 16:33:15 2018 +0200"
      },
      "committer": {
        "name": "Vinayak Menon",
        "email": "vinmenon@codeaurora.org",
        "time": "Tue Jun 09 10:55:00 2020 +0530"
      },
      "message": "mm: protect VMA modifications using VMA sequence count\n\nThe VMA sequence count has been introduced to allow fast detection of\nVMA modification when running a page fault handler without holding\nthe mmap_sem.\n\nThis patch provides protection against the VMA modification done in :\n\t- madvise()\n\t- mpol_rebind_policy()\n\t- vma_replace_policy()\n\t- change_prot_numa()\n\t- mlock(), munlock()\n\t- mprotect()\n\t- mmap_region()\n\t- collapse_huge_page()\n\t- userfaultd registering services\n\nIn addition, VMA fields which will be read during the speculative fault\npath needs to be written using WRITE_ONCE to prevent write to be split\nand intermediate values to be pushed to other CPUs.\n\nChange-Id: Ic36046b7254e538b6baf7144c50ae577ee7f2074\nSigned-off-by: Laurent Dufour \u003cldufour@linux.vnet.ibm.com\u003e\nPatch-mainline: linux-mm @ Tue, 17 Apr 2018 16:33:15\n[vinmenon@codeaurora.org: trivial merge conflict fixes]\nSigned-off-by: Vinayak Menon \u003cvinmenon@codeaurora.org\u003e\n[charante@codeaurora.org: trivial merge conflict fixes]\nSigned-off-by: Charan Teja Reddy \u003ccharante@codeaurora.org\u003e\n"
    },
    {
      "commit": "de197c5a4f59221cb0ca9a2c9d9f3a95ed19b839",
      "tree": "19ab1fc82aacbb4e6d12e12facdbcf6470229570",
      "parents": [
        "4e24886ec01b6d3251fc8e3c2d6f2312951e9719",
        "5825c88e96518d8793f99e8c70aa0b0396642b45"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Jan 04 19:40:03 2020 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sat Jan 04 19:40:03 2020 +0100"
      },
      "message": "Merge 5.4.8 into android-5.4\n\nChanges in 5.4.8\n\tRevert \"MIPS: futex: Restore \\n after sync instructions\"\n\tRevert \"MIPS: futex: Emit Loongson3 sync workarounds within asm\"\n\tscsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()\n\tscsi: lpfc: Fix discovery failures when target device connectivity bounces\n\tscsi: mpt3sas: Fix clear pending bit in ioctl status\n\tscsi: lpfc: Fix locking on mailbox command completion\n\tscsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA\n\tgpio: mxc: Only get the second IRQ when there is more than one IRQ\n\tscsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq\n\tInput: atmel_mxt_ts - disable IRQ across suspend\n\tf2fs: fix to update time in lazytime mode\n\tpowerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set}\n\ttools/power/x86/intel-speed-select: Remove warning for unused result\n\tplatform/x86: peaq-wmi: switch to using polled mode of input devices\n\tiommu: rockchip: Free domain on .domain_free\n\tiommu/tegra-smmu: Fix page tables in \u003e 4 GiB memory\n\tdmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset\n\tscsi: target: compare full CHAP_A Algorithm strings\n\tscsi: lpfc: Fix hardlockup in lpfc_abort_handler\n\tscsi: lpfc: Fix SLI3 hba in loop mode not discovering devices\n\tscsi: csiostor: Don\u0027t enable IRQs too early\n\tscsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()\n\tscsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails\n\tpowerpc/pseries: Mark accumulate_stolen_time() as notrace\n\tpowerpc/pseries: Don\u0027t fail hash page table insert for bolted mapping\n\tInput: st1232 - do not reset the chip too early\n\tselftests/powerpc: Fixup clobbers for TM tests\n\tpowerpc/tools: Don\u0027t quote $objdump in scripts\n\tdma-debug: add a schedule point in debug_dma_dump_mappings()\n\tdma-mapping: Add vmap checks to dma_map_single()\n\tdma-mapping: fix handling of dma-ranges for reserved memory (again)\n\tdmaengine: fsl-qdma: Handle invalid qdma-queue0 IRQ\n\tleds: lm3692x: Handle failure to probe the regulator\n\tleds: an30259a: add a check for devm_regmap_init_i2c\n\tleds: trigger: netdev: fix handling on interface rename\n\tclocksource/drivers/asm9260: Add a check for of_clk_get\n\tclocksource/drivers/timer-of: Use unique device name instead of timer\n\tdtc: Use pkg-config to locate libyaml\n\tselftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available\n\tpowerpc/security/book3s64: Report L1TF status in sysfs\n\tpowerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning\n\text4: update direct I/O read lock pattern for IOCB_NOWAIT\n\text4: iomap that extends beyond EOF should be marked dirty\n\tjbd2: Fix statistics for the number of logged blocks\n\tscsi: tracing: Fix handling of TRANSFER LENGTH \u003d\u003d 0 for READ(6) and WRITE(6)\n\tscsi: lpfc: Fix unexpected error messages during RSCN handling\n\tscsi: lpfc: Fix duplicate unreg_rpi error in port offline flow\n\tf2fs: fix to update dir\u0027s i_pino during cross_rename\n\tclk: qcom: smd: Add missing pnoc clock\n\tclk: qcom: Allow constant ratio freq tables for rcg\n\tclk: clk-gpio: propagate rate change to parent\n\tirqchip/irq-bcm7038-l1: Enable parent IRQ if necessary\n\tirqchip: ingenic: Error out if IRQ domain creation failed\n\tdma-direct: check for overflows on 32 bit DMA addresses\n\tfs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long\n\tiommu/arm-smmu-v3: Don\u0027t display an error when IRQ lines are missing\n\ti2c: stm32f7: fix \u0026 reorder remove \u0026 probe error handling\n\tiomap: fix return value of iomap_dio_bio_actor on 32bit systems\n\tInput: ili210x - handle errors from input_mt_init_slots()\n\tscsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences\n\tscsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)\n\tPCI: rpaphp: Fix up pointer to first drc-info entry\n\tscsi: ufs: fix potential bug which ends in system hang\n\tpowerpc/pseries/cmm: Implement release() function for sysfs device\n\tPCI: rpaphp: Don\u0027t rely on firmware feature to imply drc-info support\n\tPCI: rpaphp: Annotate and correctly byte swap DRC properties\n\tPCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info\n\tpowerpc/security: Fix wrong message when RFI Flush is disable\n\tpowerpc/eeh: differentiate duplicate detection message\n\tpowerpc/book3s/mm: Update Oops message to print the correct translation in use\n\tscsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE\n\tclk: pxa: fix one of the pxa RTC clocks\n\tbcache: at least try to shrink 1 node in bch_mca_scan()\n\tHID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse\n\tdt-bindings: Improve validation build error handling\n\tHID: logitech-hidpp: Silence intermittent get_battery_capacity errors\n\tHID: i2c-hid: fix no irq after reset on raydium 3118\n\tARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening\n\tlibnvdimm/btt: fix variable \u0027rc\u0027 set but not used\n\tHID: Improve Windows Precision Touchpad detection.\n\tHID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device\n\twatchdog: imx7ulp: Fix reboot hang\n\twatchdog: prevent deferral of watchdogd wakeup on RT\n\twatchdog: Fix the race between the release of watchdog_core_data and cdev\n\tpowerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt()\n\tscsi: pm80xx: Fix for SATA device discovery\n\tscsi: ufs: Fix error handing during hibern8 enter\n\tscsi: scsi_debug: num_tgts must be \u003e\u003d 0\n\tscsi: NCR5380: Add disconnect_mask module parameter\n\tscsi: target: core: Release SPC-2 reservations when closing a session\n\tscsi: ufs: Fix up auto hibern8 enablement\n\tscsi: iscsi: Don\u0027t send data to unbound connection\n\tscsi: target: iscsi: Wait for all commands to finish before freeing a session\n\tf2fs: Fix deadlock in f2fs_gc() context during atomic files handling\n\thabanalabs: skip VA block list update in reset flow\n\tgpio/mpc8xxx: fix qoriq GPIO reading\n\tplatform/x86: intel_pmc_core: Fix the SoC naming inconsistency\n\tplatform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver\n\tgpio: mpc8xxx: Don\u0027t overwrite default irq_set_type callback\n\tgpio: lynxpoint: Setup correct IRQ handlers\n\ttools/power/x86/intel-speed-select: Ignore missing config level\n\tDrivers: hv: vmbus: Fix crash handler reset of Hyper-V synic\n\tapparmor: fix unsigned len comparison with less than zero\n\tdrm/amdgpu: Call find_vma under mmap_sem\n\tscripts/kallsyms: fix definitely-lost memory leak\n\tpowerpc: Don\u0027t add -mabi\u003d flags when building with Clang\n\tcifs: Fix use-after-free bug in cifs_reconnect()\n\tum: virtio: Keep reading on -EAGAIN\n\tio_uring: io_allocate_scq_urings() should return a sane state\n\tof: unittest: fix memory leak in attach_node_and_children\n\tcdrom: respect device capabilities during opening action\n\tcifs: move cifsFileInfo_put logic into a work-queue\n\tperf diff: Use llabs() with 64-bit values\n\tperf script: Fix brstackinsn for AUXTRACE\n\tperf regs: Make perf_reg_name() return \"unknown\" instead of NULL\n\ts390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR\n\tmailbox: imx: Clear the right interrupts at shutdown\n\tlibfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h\n\ts390/unwind: filter out unreliable bogus %r14\n\ts390/cpum_sf: Check for SDBT and SDB consistency\n\tocfs2: fix passing zero to \u0027PTR_ERR\u0027 warning\n\tmailbox: imx: Fix Tx doorbell shutdown path\n\ts390: disable preemption when switching to nodat stack with CALL_ON_STACK\n\tselftests: vm: add fragment CONFIG_TEST_VMALLOC\n\tmm/hugetlbfs: fix error handling when setting up mounts\n\tkernel: sysctl: make drop_caches write-only\n\tuserfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK\n\tRevert \"powerpc/vcpu: Assume dedicated processors as non-preempt\"\n\tsctp: fix err handling of stream initialization\n\tmd: make sure desc_nr less than MD_SB_DISKS\n\tRevert \"iwlwifi: assign directly to iwl_trans-\u003ecfg in QuZ detection\"\n\tnetfilter: ebtables: compat: reject all padding in matches/watchers\n\t6pack,mkiss: fix possible deadlock\n\tpowerpc: Fix __clear_user() with KUAP enabled\n\tnet/smc: add fallback check to connect()\n\tnetfilter: bridge: make sure to pull arp header in br_nf_forward_arp()\n\tinetpeer: fix data-race in inet_putpeer / inet_putpeer\n\tnet: add a READ_ONCE() in skb_peek_tail()\n\tnet: icmp: fix data-race in cmp_global_allow()\n\thrtimer: Annotate lockless access to timer-\u003estate\n\ttomoyo: Don\u0027t use nifty names on sockets.\n\tuaccess: disallow \u003e INT_MAX copy sizes\n\tdrm: limit to INT_MAX in create_blob ioctl\n\txfs: fix mount failure crash on invalid iclog memory access\n\tcxgb4/cxgb4vf: fix flow control display for auto negotiation\n\tnet: dsa: bcm_sf2: Fix IP fragment location and behavior\n\tnet/mlxfw: Fix out-of-memory error in mfa2 flash burning\n\tnet: phy: aquantia: add suspend / resume ops for AQR105\n\tnet/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device\n\tnet/sched: add delete_empty() to filters and use it in cls_flower\n\tnet_sched: sch_fq: properly set sk-\u003esk_pacing_status\n\tnet: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs\n\tptp: fix the race between the release of ptp_clock and cdev\n\ttcp: Fix highest_sack and highest_sack_seq\n\tudp: fix integer overflow while computing available space in sk_rcvbuf\n\tbnxt_en: Fix MSIX request logic for RDMA driver.\n\tbnxt_en: Free context memory in the open path if firmware has been reset.\n\tbnxt_en: Return error if FW returns more data than dump length\n\tbnxt_en: Fix bp-\u003efw_health allocation and free logic.\n\tbnxt_en: Remove unnecessary NULL checks for fw_health\n\tbnxt_en: Fix the logic that creates the health reporters.\n\tbnxt_en: Add missing devlink health reporters for VFs.\n\tmlxsw: spectrum_router: Skip loopback RIFs during MAC validation\n\tmlxsw: spectrum: Use dedicated policer for VRRP packets\n\tnet: add bool confirm_neigh parameter for dst_ops.update_pmtu\n\tip6_gre: do not confirm neighbor when do pmtu update\n\tgtp: do not confirm neighbor when do pmtu update\n\tnet/dst: add new function skb_dst_update_pmtu_no_confirm\n\ttunnel: do not confirm neighbor when do pmtu update\n\tvti: do not confirm neighbor when do pmtu update\n\tsit: do not confirm neighbor when do pmtu update\n\tnet/dst: do not confirm neighbor for vxlan and geneve pmtu update\n\tnet: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S\n\tnet: marvell: mvpp2: phylink requires the link interrupt\n\tgtp: fix wrong condition in gtp_genl_dump_pdp()\n\tgtp: avoid zero size hashtable\n\tbonding: fix active-backup transition after link failure\n\ttcp: do not send empty skb from tcp_write_xmit()\n\ttcp/dccp: fix possible race __inet_lookup_established()\n\thv_netvsc: Fix tx_table init in rndis_set_subchannel()\n\tgtp: fix an use-after-free in ipv4_pdp_find()\n\tgtp: do not allow adding duplicate tid and ms_addr pdp context\n\tbnxt: apply computed clamp value for coalece parameter\n\tipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set\n\tnet: phylink: fix interface passed to mac_link_up\n\tnet: ena: fix napi handler misbehavior when the napi budget is zero\n\tvhost/vsock: accept only packets with the right dst_cid\n\tmmc: sdhci-of-esdhc: fix up erratum A-008171 workaround\n\tmmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround\n\tmm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()\n\tLinux 5.4.8\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: I9962505e7207f0004499de4666df6862105e990d\n"
    },
    {
      "commit": "2176441fdd00bdeba970ec5c382723d9d1448b3d",
      "tree": "0cc837f8980537f55eadf2f9e3a3fd0655ed78e4",
      "parents": [
        "ead87f1165cc1ff5fb809ec11f82866f02bca810"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.ibm.com",
        "time": "Sat Nov 30 17:58:01 2019 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat Jan 04 19:18:32 2020 +0100"
      },
      "message": "userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK\n\n[ Upstream commit 3c1c24d91ffd536de0a64688a9df7f49e58fadbc ]\n\nA while ago Andy noticed\n(http://lkml.kernel.org/r/CALCETrWY+5ynDct7eU_nDUqx\u003dokQvjm\u003dY5wJvA4ahBja\u003dCQXGw@mail.gmail.com)\nthat UFFD_FEATURE_EVENT_FORK used by an unprivileged user may have\nsecurity implications.\n\nAs the first step of the solution the following patch limits the availably\nof UFFD_FEATURE_EVENT_FORK only for those having CAP_SYS_PTRACE.\n\nThe usage of CAP_SYS_PTRACE ensures compatibility with CRIU.\n\nYet, if there are other users of non-cooperative userfaultfd that run\nwithout CAP_SYS_PTRACE, they would be broken :(\n\nCurrent implementation of UFFD_FEATURE_EVENT_FORK modifies the file\ndescriptor table from the read() implementation of uffd, which may have\nsecurity implications for unprivileged use of the userfaultfd.\n\nLimit availability of UFFD_FEATURE_EVENT_FORK only for callers that have\nCAP_SYS_PTRACE.\n\nLink: http://lkml.kernel.org/r/1572967777-8812-2-git-send-email-rppt@linux.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Daniel Colascione \u003cdancol@google.com\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Lokesh Gidra \u003clokeshgidra@google.com\u003e\nCc: Nick Kralevich \u003cnnk@google.com\u003e\nCc: Nosh Minwalla \u003cnosh@google.com\u003e\nCc: Pavel Emelyanov \u003covzxemul@gmail.com\u003e\nCc: Tim Murray \u003ctimmurray@google.com\u003e\nCc: Aleksa Sarai \u003ccyphar@cyphar.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n"
    },
    {
      "commit": "94139142d9c65591ac13912eae1d9655ba8aed6f",
      "tree": "0d4e10fadca47f10a1e7d2bf3c4270db9a24194d",
      "parents": [
        "099f0261d93727c97aa0dea2ed22bedf991fe574",
        "972a2bf7dfe39ebf49dd47f68d27c416392e53b1"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Wed Oct 02 17:58:47 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Wed Oct 02 17:58:47 2019 +0200"
      },
      "message": "Merge 5.4-rc1-prelrease into android-mainline\n\nTo make the 5.4-rc1 merge easier, merge at a prerelease point in time\nbefore the final release happens.\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: If613d657fd0abf9910c5bf3435a745f01b89765e\n"
    },
    {
      "commit": "7d0325749a6c77b075424ab9de76bcb73a118430",
      "tree": "7158928c88f34ae5c07645c9a0a5614247882795",
      "parents": [
        "ed8a66b83269c27f7181c95b477da5d33fecfbc4"
      ],
      "author": {
        "name": "Andrey Konovalov",
        "email": "andreyknvl@google.com",
        "time": "Wed Sep 25 16:48:44 2019 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 25 17:51:41 2019 -0700"
      },
      "message": "userfaultfd: untag user pointers\n\nThis patch is a part of a series that extends kernel ABI to allow to pass\ntagged user pointers (with the top byte set to something else other than\n0x00) as syscall arguments.\n\nuserfaultfd code use provided user pointers for vma lookups, which can\nonly by done with untagged pointers.\n\nUntag user pointers in validate_range().\n\nLink: http://lkml.kernel.org/r/cdc59ddd7011012ca2e689bc88c3b65b1ea7e413.1563904656.git.andreyknvl@google.com\nSigned-off-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Vincenzo Frascino \u003cvincenzo.frascino@arm.com\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nReviewed-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Dave Hansen \u003cdave.hansen@intel.com\u003e\nCc: Eric Auger \u003ceric.auger@redhat.com\u003e\nCc: Felix Kuehling \u003cFelix.Kuehling@amd.com\u003e\nCc: Jens Wiklander \u003cjens.wiklander@linaro.org\u003e\nCc: Khalid Aziz \u003ckhalid.aziz@oracle.com\u003e\nCc: Mauro Carvalho Chehab \u003cmchehab+samsung@kernel.org\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ad455d87e5ea947285ee53deec41e4e664a5ef82",
      "tree": "f8e2dfdcf15b4c911397b5a100c3f8e3c56fef47",
      "parents": [
        "a5bd47ef3fa514b7280ed6ce3b9eadf4f7ffdcec",
        "a55aa89aab90fae7c815b0551b07be37db359d76"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon Aug 26 16:45:30 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon Aug 26 16:45:30 2019 +0200"
      },
      "message": "Merge 5.3-rc6 into android-mainline\n\nLinux 5.3-rc6\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\nChange-Id: Id10580d48d56054408b3efe0bd1866d67aba2a3d\n"
    },
    {
      "commit": "46d0b24c5ee10a15dfb25e20642f5a5ed59c5003",
      "tree": "6467a794faee3eac2a2839f70478f3fa22dfdd9c",
      "parents": [
        "7b2b55da1db10a5525460633ae4b6fb0be060c41"
      ],
      "author": {
        "name": "Oleg Nesterov",
        "email": "oleg@redhat.com",
        "time": "Sat Aug 24 17:54:56 2019 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Aug 24 19:48:42 2019 -0700"
      },
      "message": "userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx\n\nuserfaultfd_release() should clear vm_flags/vm_userfaultfd_ctx even if\nmm-\u003ecore_state !\u003d NULL.\n\nOtherwise a page fault can see userfaultfd_missing() \u003d\u003d T and use an\nalready freed userfaultfd_ctx.\n\nLink: http://lkml.kernel.org/r/20190820160237.GB4983@redhat.com\nFixes: 04f5866e41fb (\"coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping\")\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nTested-by: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a4bbf3df04aed187569b419227d2773ac56f8c83",
      "tree": "9ddf3c60cd57ff33af5495913e06d94061349e64",
      "parents": [
        "9bc25811e446b74ec7ec7691148d0fd570468bb0",
        "0ecfebd2b52404ae0c54a878c872bb93363ada36"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon Jul 08 08:24:40 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon Jul 08 08:24:40 2019 +0200"
      },
      "message": "Merge 5.2 into android-common\n\nLinux 5.2\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\n"
    },
    {
      "commit": "cbcfa130a911c613a1d9d921af2eea171c414172",
      "tree": "2521ce85f86e05b2a51ae13882f0504cd300bc27",
      "parents": [
        "b9705d8778e7adc97de38f405f835a2426e14d84"
      ],
      "author": {
        "name": "Eric Biggers",
        "email": "ebiggers@google.com",
        "time": "Thu Jul 04 15:14:39 2019 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jul 05 11:12:07 2019 +0900"
      },
      "message": "fs/userfaultfd.c: disable irqs for fault_pending and event locks\n\nWhen IOCB_CMD_POLL is used on a userfaultfd, aio_poll() disables IRQs\nand takes kioctx::ctx_lock, then userfaultfd_ctx::fd_wqh.lock.\n\nThis may have to wait for userfaultfd_ctx::fd_wqh.lock to be released by\nuserfaultfd_ctx_read(), which in turn can be waiting for\nuserfaultfd_ctx::fault_pending_wqh.lock or\nuserfaultfd_ctx::event_wqh.lock.\n\nBut elsewhere the fault_pending_wqh and event_wqh locks are taken with\nIRQs enabled.  Since the IRQ handler may take kioctx::ctx_lock, lockdep\nreports that a deadlock is possible.\n\nFix it by always disabling IRQs when taking the fault_pending_wqh and\nevent_wqh locks.\n\nCommit ae62c16e105a (\"userfaultfd: disable irqs when taking the\nwaitqueue lock\") didn\u0027t fix this because it only accounted for the\nfd_wqh lock, not the other locks nested inside it.\n\nLink: http://lkml.kernel.org/r/20190627075004.21259-1-ebiggers@kernel.org\nFixes: bfe4037e722e (\"aio: implement IOCB_CMD_POLL\")\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nReported-by: syzbot+fab6de82892b6b9c6191@syzkaller.appspotmail.com\nReported-by: syzbot+53c0b767f7ca0dc0c451@syzkaller.appspotmail.com\nReported-by: syzbot+a3accb352f9c22041cfa@syzkaller.appspotmail.com\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Christoph Hellwig \u003chch@lst.de\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.19+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9a7ed8b83e3ce7f5955995ade118a5c3bbc69ccd",
      "tree": "b23456f513c1fbc84794d9f84acc151896cf72f8",
      "parents": [
        "29cf12fed1031e920aadefb4670397fadc2ac99e",
        "4b972a01a7da614b4796475f933094751a295a2f"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sun Jun 23 07:22:28 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Sun Jun 23 07:22:28 2019 +0200"
      },
      "message": "Merge 5.2-rc6 into android-mainline\n\nLinux 5.2-rc6\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\n"
    },
    {
      "commit": "20c8ccb1975b8d5639789d1025ad6ada38bd6f48",
      "tree": "daafa0a015cf20ce126a1981e7f6f1816e0f83d5",
      "parents": [
        "0c94efabe00ed97415c48361b5fecaa2f2117d57"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Tue Jun 04 10:11:32 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jun 19 17:09:53 2019 +0200"
      },
      "message": "treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 499\n\nBased on 1 normalized pattern(s):\n\n  this work is licensed under the terms of the gnu gpl version 2 see\n  the copying file in the top level directory\n\nextracted by the scancode license scanner the SPDX license identifier\n\n  GPL-2.0-only\n\nhas been chosen to replace the boilerplate/reference in 35 file(s).\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Kate Stewart \u003ckstewart@linuxfoundation.org\u003e\nReviewed-by: Enrico Weigelt \u003cinfo@metux.net\u003e\nReviewed-by: Allison Randal \u003callison@lohutok.net\u003e\nCc: linux-spdx@vger.kernel.org\nLink: https://lkml.kernel.org/r/20190604081206.797835076@linutronix.de\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "1226c72a32a8fecfd77370319d8f9d6ceeafdeac",
      "tree": "96df23a049b12eea8ba6643570f67c8b6ffd9bd6",
      "parents": [
        "e2f91dda876b10262af26caa96374907a3ef27bb",
        "a188339ca5a396acc588e5851ed7e19f66b0ebd9"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon May 20 20:17:24 2019 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@google.com",
        "time": "Mon May 20 20:17:24 2019 +0200"
      },
      "message": "Merge 5.2-rc1 into android-mainline\n\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@google.com\u003e\n"
    },
    {
      "commit": "cefdca0a86be517bc390fc4541e3674b8e7803b0",
      "tree": "f85716c23f5e1356c8e5213162489a04d40b06f9",
      "parents": [
        "f0fd50504a54f5548eb666dc16ddf8394e44e4b7"
      ],
      "author": {
        "name": "Peter Xu",
        "email": "peterx@redhat.com",
        "time": "Mon May 13 17:16:41 2019 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue May 14 09:47:45 2019 -0700"
      },
      "message": "userfaultfd/sysctl: add vm.unprivileged_userfaultfd\n\nUserfaultfd can be misued to make it easier to exploit existing\nuse-after-free (and similar) bugs that might otherwise only make a\nshort window or race condition available.  By using userfaultfd to\nstall a kernel thread, a malicious program can keep some state that it\nwrote, stable for an extended period, which it can then access using an\nexisting exploit.  While it doesn\u0027t cause the exploit itself, and while\nit\u0027s not the only thing that can stall a kernel thread when accessing a\nmemory location, it\u0027s one of the few that never needs privilege.\n\nWe can add a flag, allowing userfaultfd to be restricted, so that in\ngeneral it won\u0027t be useable by arbitrary user programs, but in\nenvironments that require userfaultfd it can be turned back on.\n\nAdd a global sysctl knob \"vm.unprivileged_userfaultfd\" to control\nwhether userfaultfd is allowed by unprivileged users.  When this is\nset to zero, only privileged users (root user, or users with the\nCAP_SYS_PTRACE capability) will be able to use the userfaultfd\nsyscalls.\n\nAndrea said:\n\n: The only difference between the bpf sysctl and the userfaultfd sysctl\n: this way is that the bpf sysctl adds the CAP_SYS_ADMIN capability\n: requirement, while userfaultfd adds the CAP_SYS_PTRACE requirement,\n: because the userfaultfd monitor is more likely to need CAP_SYS_PTRACE\n: already if it\u0027s doing other kind of tracking on processes runtime, in\n: addition of userfaultfd.  In other words both syscalls works only for\n: root, when the two sysctl are opt-in set to 1.\n\n[dgilbert@redhat.com: changelog additions]\n[akpm@linux-foundation.org: documentation tweak, per Mike]\nLink: http://lkml.kernel.org/r/20190319030722.12441-2-peterx@redhat.com\nSigned-off-by: Peter Xu \u003cpeterx@redhat.com\u003e\nSuggested-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSuggested-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Luis Chamberlain \u003cmcgrof@kernel.org\u003e\nCc: Maxime Coquelin \u003cmaxime.coquelin@redhat.com\u003e\nCc: Maya Gokhale \u003cgokhale2@llnl.gov\u003e\nCc: Jerome Glisse \u003cjglisse@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Martin Cracauer \u003ccracauer@cons.org\u003e\nCc: Denis Plotnikov \u003cdplotnikov@virtuozzo.com\u003e\nCc: Marty McFadden \u003cmcfadden8@llnl.gov\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: \"Kirill A . Shutemov\" \u003ckirill@shutemov.name\u003e\nCc: \"Dr . David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "0f2cb7cf80335db55cd3c406134e8def59f16814",
      "tree": "ed8932c2f7a867763a6325989ef2b11b53a1748b",
      "parents": [
        "03bd957ad6c7cf6076584e9fed8ac3894497eb88",
        "37624b58542fb9f2d9a70e6ea006ef8a5f66c30b"
      ],
      "author": {
        "name": "Todd Kjos",
        "email": "tkjos@google.com",
        "time": "Fri May 03 12:22:22 2019 -0700"
      },
      "committer": {
        "name": "Todd Kjos",
        "email": "tkjos@google.com",
        "time": "Fri May 03 12:22:22 2019 -0700"
      },
      "message": "Merge branch \u0027linux-mainline\u0027 into android-mainline-tmp\n\nChange-Id: I4380c68c3474026a42ffa9f95c525f9a563ba7a3\n"
    },
    {
      "commit": "60500a42286de35f00d2a195f2021bcc029f11a1",
      "tree": "53d96deb477969d86077b3db907f3e99202fcef5",
      "parents": [
        "7c6ba364ef8b206ff522adfd52626725035c7db7"
      ],
      "author": {
        "name": "Colin Cross",
        "email": "ccross@android.com",
        "time": "Tue Oct 27 16:42:08 2015 -0700"
      },
      "committer": {
        "name": "Todd Kjos",
        "email": "tkjos@google.com",
        "time": "Fri May 03 10:39:58 2019 -0700"
      },
      "message": "ANDROID: mm: add a field to store names for private anonymous memory\n\nUserspace processes often have multiple allocators that each do\nanonymous mmaps to get memory.  When examining memory usage of\nindividual processes or systems as a whole, it is useful to be\nable to break down the various heaps that were allocated by\neach layer and examine their size, RSS, and physical memory\nusage.\n\nThis patch adds a user pointer to the shared union in\nvm_area_struct that points to a null terminated string inside\nthe user process containing a name for the vma.  vmas that\npoint to the same address will be merged, but vmas that\npoint to equivalent strings at different addresses will\nnot be merged.\n\nUserspace can set the name for a region of memory by calling\nprctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, start, len, (unsigned long)name);\nSetting the name to NULL clears it.\n\nThe names of named anonymous vmas are shown in /proc/pid/maps\nas [anon:\u003cname\u003e] and in /proc/pid/smaps in a new \"Name\" field\nthat is only present for named vmas.  If the userspace pointer\nis no longer valid all or part of the name will be replaced\nwith \"\u003cfault\u003e\".\n\nThe idea to store a userspace pointer to reduce the complexity\nwithin mm (at the expense of the complexity of reading\n/proc/pid/mem) came from Dave Hansen.  This results in no\nruntime overhead in the mm subsystem other than comparing\nthe anon_name pointers when considering vma merging.  The pointer\nis stored in a union with fieds that are only used on file-backed\nmappings, so it does not increase memory usage.\n\nIncludes fix from Jed Davis \u003cjld@mozilla.com\u003e for typo in\nprctl_set_vma_anon_name, which could attempt to set the name\nacross two vmas at the same time due to a typo, which might\ncorrupt the vma list.  Fix it to use tmp instead of end to limit\nthe name setting to a single vma at a time.\n\nBug: 120441514\nChange-Id: I9aa7b6b5ef536cd780599ba4e2fba8ceebe8b59f\nSigned-off-by: Dmitry Shmidt \u003cdimitrysh@google.com\u003e\n[AmitP: Fix get_user_pages_remote() call to align with upstream commit\n        5b56d49fc31d (\"mm: add locked parameter to get_user_pages_remote()\")]\nSigned-off-by: Amit Pundir \u003camit.pundir@linaro.org\u003e\n"
    },
    {
      "commit": "04f5866e41fb70690e28397487d8bd8eea7d712a",
      "tree": "e2058b00a20f67fcdc84495d76cc24b08e4462d6",
      "parents": [
        "dce5b0bdeec61bdbee56121ceb1d014151d5cab1"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Apr 18 17:50:52 2019 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Apr 19 09:46:05 2019 -0700"
      },
      "message": "coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping\n\nThe core dumping code has always run without holding the mmap_sem for\nwriting, despite that is the only way to ensure that the entire vma\nlayout will not change from under it.  Only using some signal\nserialization on the processes belonging to the mm is not nearly enough.\nThis was pointed out earlier.  For example in Hugh\u0027s post from Jul 2017:\n\n  https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils\n\n  \"Not strictly relevant here, but a related note: I was very surprised\n   to discover, only quite recently, how handle_mm_fault() may be called\n   without down_read(mmap_sem) - when core dumping. That seems a\n   misguided optimization to me, which would also be nice to correct\"\n\nIn particular because the growsdown and growsup can move the\nvm_start/vm_end the various loops the core dump does around the vma will\nnot be consistent if page faults can happen concurrently.\n\nPretty much all users calling mmget_not_zero()/get_task_mm() and then\ntaking the mmap_sem had the potential to introduce unexpected side\neffects in the core dumping code.\n\nAdding mmap_sem for writing around the -\u003ecore_dump invocation is a\nviable long term fix, but it requires removing all copy user and page\nfaults and to replace them with get_dump_page() for all binary formats\nwhich is not suitable as a short term fix.\n\nFor the time being this solution manually covers the places that can\nconfuse the core dump either by altering the vma layout or the vma flags\nwhile it runs.  Once -\u003ecore_dump runs under mmap_sem for writing the\nfunction mmget_still_valid() can be dropped.\n\nAllowing mmap_sem protected sections to run in parallel with the\ncoredump provides some minor parallelism advantage to the swapoff code\n(which seems to be safe enough by never mangling any vma field and can\nkeep doing swapins in parallel to the core dumping) and to some other\ncorner case.\n\nIn order to facilitate the backporting I added \"Fixes: 86039bd3b4e6\"\nhowever the side effect of this same race condition in /proc/pid/mem\nshould be reproducible since before 2.6.12-rc2 so I couldn\u0027t add any\nother \"Fixes:\" because there\u0027s no hash beyond the git genesis commit.\n\nBecause find_extend_vma() is the only location outside of the process\ncontext that could modify the \"mm\" structures under mmap_sem for\nreading, by adding the mmget_still_valid() check to it, all other cases\nthat take the mmap_sem for reading don\u0027t need the new check after\nmmget_not_zero()/get_task_mm().  The expand_stack() in page fault\ncontext also doesn\u0027t need the new check, because all tasks under core\ndumping are frozen.\n\nLink: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com\nFixes: 86039bd3b4e6 (\"userfaultfd: add new syscall to provide memory externalization\")\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Jann Horn \u003cjannh@google.com\u003e\nSuggested-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Peter Xu \u003cpeterx@redhat.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReviewed-by: Jann Horn \u003cjannh@google.com\u003e\nAcked-by: Jason Gunthorpe \u003cjgg@mellanox.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "3cfd22be0ad663248fadfc8f6ffa3e255c394552",
      "tree": "80ff16175ad74737c24414f9a714a510d72cf12b",
      "parents": [
        "125b860b251ad226b1384b6db06be37485127f69"
      ],
      "author": {
        "name": "Peter Xu",
        "email": "peterx@redhat.com",
        "time": "Fri Dec 28 00:38:47 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Dec 28 12:11:51 2018 -0800"
      },
      "message": "userfaultfd: clear flag if remap event not enabled\n\nWhen the process being tracked does mremap() without\nUFFD_FEATURE_EVENT_REMAP on the corresponding tracking uffd file handle,\nwe should not generate the remap event, and at the same time we should\nclear all the uffd flags on the new VMA.  Without this patch, we can still\nhave the VM_UFFD_MISSING|VM_UFFD_WP flags on the new VMA even the fault\nhandling process does not even know the existance of the VMA.\n\nLink: http://lkml.kernel.org/r/20181211053409.20317-1-peterx@redhat.com\nSigned-off-by: Peter Xu \u003cpeterx@redhat.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nReviewed-by: William Kucharski \u003cwilliam.kucharski@oracle.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Kirill A. Shutemov \u003ckirill@shutemov.name\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Pravin Shedge \u003cpravin.shedge4linux@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ca880420665dbc8beec3693bee9f5eccb89de4a6",
      "tree": "7255c489175110780706a7eaf04fe8f0f34611b5",
      "parents": [
        "66f71da9dd38af17dc17209cdde7987d4679a699"
      ],
      "author": {
        "name": "Eric Biggers",
        "email": "ebiggers@google.com",
        "time": "Fri Dec 28 00:34:43 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Dec 28 12:11:47 2018 -0800"
      },
      "message": "userfaultfd: convert userfaultfd_ctx::refcount to refcount_t\n\nReference counters should use refcount_t rather than atomic_t, since the\nrefcount_t implementation can prevent overflows, reducing the\nexploitability of reference leak bugs.  userfaultfd_ctx::refcount is a\nreference counter with the usual semantics, so convert it to refcount_t.\n\nNote: I replaced the BUG() on incrementing a 0 refcount with just\nrefcount_inc(), since part of the semantics of refcount_t is that that\nincrementing a 0 refcount is not allowed; with CONFIG_REFCOUNT_FULL,\nrefcount_inc() already checks for it and warns.\n\nLink: http://lkml.kernel.org/r/20181115003916.63381-1-ebiggers@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "792bf4d871dea8b69be2aaabdd320d7c6ed15985",
      "tree": "8cec3755ff6df5f82b12420fb6ad6a4d531ebfd1",
      "parents": [
        "eed9688f8513189295887e5a27ec7f576754b60e",
        "4bbfd7467cfc7d42e18d3008fa6a28ffd56e901a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Dec 26 13:07:19 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Dec 26 13:07:19 2018 -0800"
      },
      "message": "Merge branch \u0027core-rcu-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull RCU updates from Ingo Molnar:\n \"The biggest RCU changes in this cycle were:\n\n   - Convert RCU\u0027s BUG_ON() and similar calls to WARN_ON() and similar.\n\n   - Replace calls of RCU-bh and RCU-sched update-side functions to\n     their vanilla RCU counterparts. This series is a step towards\n     complete removal of the RCU-bh and RCU-sched update-side functions.\n\n     ( Note that some of these conversions are going upstream via their\n       respective maintainers. )\n\n   - Documentation updates, including a number of flavor-consolidation\n     updates from Joel Fernandes.\n\n   - Miscellaneous fixes.\n\n   - Automate generation of the initrd filesystem used for rcutorture\n     testing.\n\n   - Convert spin_is_locked() assertions to instead use lockdep.\n\n     ( Note that some of these conversions are going upstream via their\n       respective maintainers. )\n\n   - SRCU updates, especially including a fix from Dennis Krein for a\n     bag-on-head-class bug.\n\n   - RCU torture-test updates\"\n\n* \u0027core-rcu-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (112 commits)\n  rcutorture: Don\u0027t do busted forward-progress testing\n  rcutorture: Use 100ms buckets for forward-progress callback histograms\n  rcutorture: Recover from OOM during forward-progress tests\n  rcutorture: Print forward-progress test age upon failure\n  rcutorture: Print time since GP end upon forward-progress failure\n  rcutorture: Print histogram of CB invocation at OOM time\n  rcutorture: Print GP age upon forward-progress failure\n  rcu: Print per-CPU callback counts for forward-progress failures\n  rcu: Account for nocb-CPU callback counts in RCU CPU stall warnings\n  rcutorture: Dump grace-period diagnostics upon forward-progress OOM\n  rcutorture: Prepare for asynchronous access to rcu_fwd_startat\n  torture: Remove unnecessary \"ret\" variables\n  rcutorture: Affinity forward-progress test to avoid housekeeping CPUs\n  rcutorture: Break up too-long rcu_torture_fwd_prog() function\n  rcutorture: Remove cbflood facility\n  torture: Bring any extra CPUs online during kernel startup\n  rcutorture: Add call_rcu() flooding forward-progress tests\n  rcutorture/formal: Replace synchronize_sched() with synchronize_rcu()\n  tools/kernel.h: Replace synchronize_sched() with synchronize_rcu()\n  net/decnet: Replace rcu_barrier_bh() with rcu_barrier()\n  ...\n"
    },
    {
      "commit": "01e881f5a1fca4677e82733061868c6d6ea05ca7",
      "tree": "104ce9922663f88b905b14ecacc2c710367b48a9",
      "parents": [
        "61c6de667263184125d5ca75e894fcad632b0dd3"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Fri Dec 14 14:17:17 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Dec 14 15:05:45 2018 -0800"
      },
      "message": "userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered\n\nCalling UFFDIO_UNREGISTER on virtual ranges not yet registered in uffd\ncould trigger an harmless false positive WARN_ON.  Check the vma is\nalready registered before checking VM_MAYWRITE to shut off the false\npositive warning.\n\nLink: http://lkml.kernel.org/r/20181206212028.18726-2-aarcange@redhat.com\nCc: \u003cstable@vger.kernel.org\u003e\nFixes: 29ec90660d68 (\"userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas\")\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: syzbot+06c7092e7d71218a2c16@syzkaller.appspotmail.com\nAcked-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nAcked-by: Peter Xu \u003cpeterx@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "4bbfd7467cfc7d42e18d3008fa6a28ffd56e901a",
      "tree": "3b6d27e740976d0393fd13ae675ae6a0e07812a9",
      "parents": [
        "2595646791c319cadfdbf271563aac97d0843dc7",
        "5ac7cdc29897e5fc3f5e214f3f8c8b03ef8d7029"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Dec 04 07:52:30 2018 +0100"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Dec 04 07:52:30 2018 +0100"
      },
      "message": "Merge branch \u0027for-mingo\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu\n\nPull RCU changes from Paul E. McKenney:\n\n- Convert RCU\u0027s BUG_ON() and similar calls to WARN_ON() and similar.\n\n- Replace calls of RCU-bh and RCU-sched update-side functions\n  to their vanilla RCU counterparts.  This series is a step\n  towards complete removal of the RCU-bh and RCU-sched update-side\n  functions.\n\n  ( Note that some of these conversions are going upstream via their\n    respective maintainers. )\n\n- Documentation updates, including a number of flavor-consolidation\n  updates from Joel Fernandes.\n\n- Miscellaneous fixes.\n\n- Automate generation of the initrd filesystem used for\n  rcutorture testing.\n\n- Convert spin_is_locked() assertions to instead use lockdep.\n\n  ( Note that some of these conversions are going upstream via their\n    respective maintainers. )\n\n- SRCU updates, especially including a fix from Dennis Krein\n  for a bag-on-head-class bug.\n\n- RCU torture-test updates.\n\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "29ec90660d68bbdd69507c1c8b4e33aa299278b1",
      "tree": "8b23230b8554fe963152a3f8cdff152a5b7f72e4",
      "parents": [
        "5b51072e97d587186c2f5390c8c9c1fb7e179505"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Fri Nov 30 14:09:32 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 30 14:56:14 2018 -0800"
      },
      "message": "userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas\n\nAfter the VMA to register the uffd onto is found, check that it has\nVM_MAYWRITE set before allowing registration.  This way we inherit all\ncommon code checks before allowing to fill file holes in shmem and\nhugetlbfs with UFFDIO_COPY.\n\nThe userfaultfd memory model is not applicable for readonly files unless\nit\u0027s a MAP_PRIVATE.\n\nLink: http://lkml.kernel.org/r/20181126173452.26955-4-aarcange@redhat.com\nFixes: ff62a3421044 (\"hugetlb: implement memfd sealing\")\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.ibm.com\u003e\nReviewed-by: Hugh Dickins \u003chughd@google.com\u003e\nReported-by: Jann Horn \u003cjannh@google.com\u003e\nFixes: 4c27fe4c4c84 (\"userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support\")\nCc: \u003cstable@vger.kernel.org\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "456a737896b25e4853bbf3d6ca5a1c8ee4df4ee9",
      "tree": "3927484a6afcb884753131e916e2c6f5160191f7",
      "parents": [
        "97eeebea894283c290ead6694b76f575e7654773"
      ],
      "author": {
        "name": "Lance Roy",
        "email": "ldr709@gmail.com",
        "time": "Thu Oct 04 23:45:44 2018 -0700"
      },
      "committer": {
        "name": "Paul E. McKenney",
        "email": "paulmck@linux.ibm.com",
        "time": "Mon Nov 12 09:06:22 2018 -0800"
      },
      "message": "userfaultfd: Replace spin_is_locked() with lockdep\n\nlockdep_assert_held() is better suited to checking locking requirements,\nsince it only checks if the current thread holds the lock regardless of\nwhether someone else does. This is also a step towards possibly removing\nspin_is_locked().\n\nSigned-off-by: Lance Roy \u003cldr709@gmail.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: \u003clinux-fsdevel@vger.kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.ibm.com\u003e\n"
    },
    {
      "commit": "ae62c16e105a869524afcf8a07ee85c5ae5d0479",
      "tree": "f91def5f8e72340a5ebafa664fe296c965a96b9a",
      "parents": [
        "fa76da461bb0be13c8339d984dcf179151167c8f"
      ],
      "author": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Fri Oct 26 15:02:19 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Oct 26 16:25:18 2018 -0700"
      },
      "message": "userfaultfd: disable irqs when taking the waitqueue lock\n\nuserfaultfd contains howe-grown locking of the waitqueue lock, and does\nnot disable interrupts.  This relies on the fact that no one else takes it\nfrom interrupt context and violates an invariat of the normal waitqueue\nlocking scheme.  With aio poll it is easy to trigger other locks that\ndisable interrupts (or are called from interrupt context).\n\nLink: http://lkml.kernel.org/r/20181018154101.18750-1-hch@lst.de\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.19.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "2b7403035459c75e193c6b04a293e518a4212de0",
      "tree": "d553df6f3c3cac0ae3a3de3a1fcc9f2729d01ea8",
      "parents": [
        "a99237afc12ba697159ca313525dc390737dd52f"
      ],
      "author": {
        "name": "Souptick Joarder",
        "email": "jrdr.linux@gmail.com",
        "time": "Thu Aug 23 17:01:36 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 23 18:48:44 2018 -0700"
      },
      "message": "mm: Change return type int to vm_fault_t for fault handlers\n\nUse new return type vm_fault_t for fault handler.  For now, this is just\ndocumenting that the function returns a VM_FAULT value rather than an\nerrno.  Once all instances are converted, vm_fault_t will become a\ndistinct type.\n\nRef-\u003e commit 1c8f422059ae (\"mm: change return type to vm_fault_t\")\n\nThe aim is to change the return type of finish_fault() and\nhandle_mm_fault() to vm_fault_t type.  As part of that clean up return\ntype of all other recursively called functions have been changed to\nvm_fault_t type.\n\nThe places from where handle_mm_fault() is getting invoked will be\nchange to vm_fault_t type but in a separate patch.\n\nvmf_error() is the newly introduce inline function in 4.17-rc6.\n\n[akpm@linux-foundation.org: don\u0027t shadow outer local `ret\u0027 in __do_huge_pmd_anonymous_page()]\nLink: http://lkml.kernel.org/r/20180604171727.GA20279@jordon-HP-15-Notebook-PC\nSigned-off-by: Souptick Joarder \u003cjrdr.linux@gmail.com\u003e\nReviewed-by: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "c430d1e848ff1240d126e79780f3c26208b8aed9",
      "tree": "aa2c5cd32056e24e075310d950f4385203c7cc87",
      "parents": [
        "ee8ef0a4b167c1f2605bc9b5701c603224673d53"
      ],
      "author": {
        "name": "Matthew Wilcox",
        "email": "mawilcox@microsoft.com",
        "time": "Tue Aug 21 21:56:30 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 22 10:52:47 2018 -0700"
      },
      "message": "userfaultfd: use fault_wqh lock\n\nThe userfaultfd code currently uses the unlocked waitqueue helpers for\nmanaging fault_wqh, but instead of holding the waitqueue lock for this\nwaitqueue around these calls, it the waitqueue lock of\nfault_pending_wq, which is a different waitqueue instance.  Given that\nthe waitqueue is not exposed to the rest of the kernel this actually\nworks ok at the moment, but prevents the userfaultfd locking rules from\nbeing enforced using lockdep.\n\nSwitch to the internally locked waitqueue helpers instead.  This means\nthat the lock inside fault_wqh now nests inside the fault_pending_wqh\nlock, but that\u0027s not a problem since it was entirely unused before.\n\n[hch@lst.de: slight changelog updates]\n[rppt@linux.vnet.ibm.com: spotted changelog spellos]\nLink: http://lkml.kernel.org/r/20171214152344.6880-3-hch@lst.de\nSigned-off-by: Matthew Wilcox \u003cmawilcox@microsoft.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Jason Baron \u003cjbaron@akamai.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "5241d4727479aad77af50b80757c38268bfa4560",
      "tree": "8638c1713966d4cea62912ecd24a374e4baf7ce0",
      "parents": [
        "ddbf369c0a33924f76d092985bd20d9310f43d7f"
      ],
      "author": {
        "name": "Colin Ian King",
        "email": "colin.king@canonical.com",
        "time": "Fri Aug 17 15:50:01 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 17 16:20:32 2018 -0700"
      },
      "message": "fs/userfaultfd.c: remove redundant pointer uwq\n\nPointer uwq is being assigned but is never used hence it is redundant\nand can be removed.\n\nCleans up clang warning:\n  warning: variable \u0027uwq\u0027 set but not used [-Wunused-but-set-variable]\n\nLink: http://lkml.kernel.org/r/20180717090802.18357-1-colin.king@canonical.com\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "31e810aa1033a7db50a2746cd34a2432237f6420",
      "tree": "54907b7acfdd32910f2ea58912a4b78bbaabaad5",
      "parents": [
        "eec3636ad198d4ac61e574cb122cb67e9bef5492"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Thu Aug 02 15:36:09 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 02 16:03:40 2018 -0700"
      },
      "message": "userfaultfd: remove uffd flags from vma-\u003evm_flags if UFFD_EVENT_FORK fails\n\nThe fix in commit 0cbb4b4f4c44 (\"userfaultfd: clear the\nvma-\u003evm_userfaultfd_ctx if UFFD_EVENT_FORK fails\") cleared the\nvma-\u003evm_userfaultfd_ctx but kept userfaultfd flags in vma-\u003evm_flags\nthat were copied from the parent process VMA.\n\nAs the result, there is an inconsistency between the values of\nvma-\u003evm_userfaultfd_ctx.ctx and vma-\u003evm_flags which triggers BUG_ON\nin userfaultfd_release().\n\nClearing the uffd flags from vma-\u003evm_flags in case of UFFD_EVENT_FORK\nfailure resolves the issue.\n\nLink: http://lkml.kernel.org/r/1532931975-25473-1-git-send-email-rppt@linux.vnet.ibm.com\nFixes: 0cbb4b4f4c44 (\"userfaultfd: clear the vma-\u003evm_userfaultfd_ctx if UFFD_EVENT_FORK fails\")\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nReported-by: syzbot+121be635a7a35ddb7dcb@syzkaller.appspotmail.com\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Eric Biggers \u003cebiggers3@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "1e2c043628c7736dd56536d16c0ce009bc834ae7",
      "tree": "e511865feee12b1d6ba326588fb7aa36ada14951",
      "parents": [
        "410da1e12ffed61129d61df5b7adce4d08c7f17c"
      ],
      "author": {
        "name": "Janosch Frank",
        "email": "frankja@linux.ibm.com",
        "time": "Tue Jul 03 17:02:39 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jul 03 17:32:18 2018 -0700"
      },
      "message": "userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access\n\nUse huge_ptep_get() to translate huge ptes to normal ptes so we can\ncheck them with the huge_pte_* functions.  Otherwise some architectures\nwill check the wrong values and will not wait for userspace to bring in\nthe memory.\n\nLink: http://lkml.kernel.org/r/20180626132421.78084-1-frankja@linux.ibm.com\nFixes: 369cd2121be4 (\"userfaultfd: hugetlbfs: userfaultfd_huge_must_wait for hugepmd ranges\")\nSigned-off-by: Janosch Frank \u003cfrankja@linux.ibm.com\u003e\nReviewed-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nReviewed-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "df2cc96e77011cf7989208b206da9817e0321028",
      "tree": "5831fc1b33713f8073c5661a36890f7822a4f484",
      "parents": [
        "be09102b4190561b67e3809b07a7fd29c9774152"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Thu Jun 07 17:09:25 2018 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 07 17:34:38 2018 -0700"
      },
      "message": "userfaultfd: prevent non-cooperative events vs mcopy_atomic races\n\nIf a process monitored with userfaultfd changes it\u0027s memory mappings or\nforks() at the same time as uffd monitor fills the process memory with\nUFFDIO_COPY, the actual creation of page table entries and copying of\nthe data in mcopy_atomic may happen either before of after the memory\nmapping modifications and there is no way for the uffd monitor to\nmaintain consistent view of the process memory layout.\n\nFor instance, let\u0027s consider fork() running in parallel with\nuserfaultfd_copy():\n\nprocess        \t\t         |\tuffd monitor\n---------------------------------+------------------------------\nfork()        \t\t         | userfaultfd_copy()\n...        \t\t         | ...\n    dup_mmap()        \t         |     down_read(mmap_sem)\n    down_write(mmap_sem)         |     /* create PTEs, copy data */\n        dup_uffd()               |     up_read(mmap_sem)\n        copy_page_range()        |\n        up_write(mmap_sem)       |\n        dup_uffd_complete()      |\n            /* notify monitor */ |\n\nIf the userfaultfd_copy() takes the mmap_sem first, the new page(s) will\nbe present by the time copy_page_range() is called and they will appear\nin the child\u0027s memory mappings.  However, if the fork() is the first to\ntake the mmap_sem, the new pages won\u0027t be mapped in the child\u0027s address\nspace.\n\nIf the pages are not present and child tries to access them, the monitor\nwill get page fault notification and everything is fine.  However, if\nthe pages *are present*, the child can access them without uffd\nnoticing.  And if we copy them into child it\u0027ll see the wrong data.\nSince we are talking about background copy, we\u0027d need to decide whether\nthe pages should be copied or not regardless #PF notifications.\n\nSince userfaultfd monitor has no way to determine what was the order,\nlet\u0027s disallow userfaultfd_copy in parallel with the non-cooperative\nevents.  In such case we return -EAGAIN and the uffd monitor can\nunderstand that userfaultfd_copy() clashed with a non-cooperative event\nand take an appropriate action.\n\nLink: http://lkml.kernel.org/r/1527061324-19949-1-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nAcked-by: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Andrei Vagin \u003cavagin@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a9a08845e9acbd224e4ee466f5c1275ed50054e8",
      "tree": "415d6e6a82e001c65e6b161539411f54ba5fe8ce",
      "parents": [
        "ee5daa1361fceb6f482c005bcc9ba8d01b92ea5c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Feb 11 14:34:03 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Feb 11 14:34:03 2018 -0800"
      },
      "message": "vfs: do bulk POLL* -\u003e EPOLL* replacement\n\nThis is the mindless scripted replacement of kernel use of POLL*\nvariables as described by Al, done by this script:\n\n    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do\n        L\u003d`git grep -l -w POLL$V | grep -v \u0027^t\u0027 | grep -v /um/ | grep -v \u0027^sa\u0027 | grep -v \u0027/poll.h$\u0027|grep -v \u0027^D\u0027`\n        for f in $L; do sed -i \"-es/^\\([^\\\"]*\\)\\(\\\u003cPOLL$V\\\u003e\\)/\\\\1E\\\\2/\" $f; done\n    done\n\nwith de-mangling cleanups yet to come.\n\nNOTE! On almost all architectures, the EPOLL* constants have the same\nvalues as the POLL* constants do.  But they keyword here is \"almost\".\nFor various bad reasons they aren\u0027t the same, and epoll() doesn\u0027t\nactually work quite correctly in some cases due to this on Sparc et al.\n\nThe next patch from Al will sort out the final differences, and we\nshould be all done.\n\nScripted-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "284cd241a18ee6d999296f8ff3104eb6d2fc898f",
      "tree": "001b843c3d63357e0a6a7dbb95192bd5feba116d",
      "parents": [
        "c5c63835e5713b09fc974241db47956362a63efa"
      ],
      "author": {
        "name": "Eric Biggers",
        "email": "ebiggers@google.com",
        "time": "Wed Jan 31 16:19:48 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jan 31 17:18:39 2018 -0800"
      },
      "message": "userfaultfd: convert to use anon_inode_getfd()\n\nNothing actually calls userfaultfd_file_create() besides the\nuserfaultfd() system call itself.  So simplify things by folding it into\nthe system call and using anon_inode_getfd() instead of\nanon_inode_getfile().  Do the same in resolve_userfault_fork() as well.\n\nThis removes over 50 lines with no change in functionality.\n\nLink: http://lkml.kernel.org/r/20171229212403.22800-1-ebiggers3@gmail.com\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a365ac09d334389bc69841c9d153f03fa2442f1c",
      "tree": "54c35ebe10a2de98640f59723c3a2f1db9af1bfd",
      "parents": [
        "9bebc09fcf4fb25e36cf86af764c038b92f64057"
      ],
      "author": {
        "name": "Huang Ying",
        "email": "ying.huang@intel.com",
        "time": "Wed Jan 31 16:17:32 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jan 31 17:18:37 2018 -0800"
      },
      "message": "mm, userfaultfd, THP: avoid waiting when PMD under THP migration\n\nIf THP migration is enabled, for a VMA handled by userfaultfd, consider\nthe following situation,\n\n  do_page_fault()\n    __do_huge_pmd_anonymous_page()\n     handle_userfault()\n       userfault_msg()\n         /* a huge page is allocated and mapped at fault address */\n         /* the huge page is under migration, leaves migration entry\n            in page table */\n       userfaultfd_must_wait()\n         /* return true because !pmd_present() */\n       /* may wait in loop until fatal signal */\n\nThat is, it may be possible for userfaultfd_must_wait() encounters a PMD\nentry which is !pmd_none() \u0026\u0026 !pmd_present().  In the current\nimplementation, we will wait for such PMD entries, which may cause\nunnecessary waiting, and potential soft lockup.\n\nThis is fixed via avoiding to wait when !pmd_none() \u0026\u0026 !pmd_present(),\nonly wait when pmd_none().\n\nThis may be not a problem in practice, because userfaultfd_must_wait()\nis always called with mm-\u003emmap_sem read-locked.  mremap() will\nwrite-lock mm-\u003emmap_sem.  And UFFDIO_COPY doesn\u0027t support to copy THP\nmapping.  But the change introduced still makes the code more correct,\nand makes the PMD and PTE code more consistent.\n\nLink: http://lkml.kernel.org/r/20171207011752.3292-1-ying.huang@intel.com\nSigned-off-by: \"Huang, Ying\" \u003cying.huang@intel.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.UK\u003e\nCc: Zi Yan \u003czi.yan@cs.rutgers.edu\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "168fe32a072a4b8dc81a3aebf0e5e588d38e2955",
      "tree": "297f0f6192256785979f5ebfb92797f81754548d",
      "parents": [
        "13ddd1667e7f01071cdf120132238ffca004a88e",
        "c71d227fc4133f949dae620ed5e3a250b43f2415"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jan 30 17:58:07 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jan 30 17:58:07 2018 -0800"
      },
      "message": "Merge branch \u0027misc.poll\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull poll annotations from Al Viro:\n \"This introduces a __bitwise type for POLL### bitmap, and propagates\n  the annotations through the tree. Most of that stuff is as simple as\n  \u0027make -\u003epoll() instances return __poll_t and do the same to local\n  variables used to hold the future return value\u0027.\n\n  Some of the obvious brainos found in process are fixed (e.g. POLLIN\n  misspelled as POLL_IN). At that point the amount of sparse warnings is\n  low and most of them are for genuine bugs - e.g. -\u003epoll() instance\n  deciding to return -EINVAL instead of a bitmap. I hadn\u0027t touched those\n  in this series - it\u0027s large enough as it is.\n\n  Another problem it has caught was eventpoll() ABI mess; select.c and\n  eventpoll.c assumed that corresponding POLL### and EPOLL### were\n  equal. That\u0027s true for some, but not all of them - EPOLL### are\n  arch-independent, but POLL### are not.\n\n  The last commit in this series separates userland POLL### values from\n  the (now arch-independent) kernel-side ones, converting between them\n  in the few places where they are copied to/from userland. AFAICS, this\n  is the least disruptive fix preserving poll(2) ABI and making epoll()\n  work on all architectures.\n\n  As it is, it\u0027s simply broken on sparc - try to give it EPOLLWRNORM and\n  it will trigger only on what would\u0027ve triggered EPOLLWRBAND on other\n  architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered\n  at all on sparc. With this patch they should work consistently on all\n  architectures\"\n\n* \u0027misc.poll\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits)\n  make kernel-side POLL... arch-independent\n  eventpoll: no need to mask the result of epi_item_poll() again\n  eventpoll: constify struct epoll_event pointers\n  debugging printk in sg_poll() uses %x to print POLL... bitmap\n  annotate poll(2) guts\n  9p: untangle -\u003epoll() mess\n  -\u003esi_band gets POLL... bitmap stored into a user-visible long field\n  ring_buffer_poll_wait() return value used as return value of -\u003epoll()\n  the rest of drivers/*: annotate -\u003epoll() instances\n  media: annotate -\u003epoll() instances\n  fs: annotate -\u003epoll() instances\n  ipc, kernel, mm: annotate -\u003epoll() instances\n  net: annotate -\u003epoll() instances\n  apparmor: annotate -\u003epoll() instances\n  tomoyo: annotate -\u003epoll() instances\n  sound: annotate -\u003epoll() instances\n  acpi: annotate -\u003epoll() instances\n  crypto: annotate -\u003epoll() instances\n  block: annotate -\u003epoll() instances\n  x86: annotate -\u003epoll() instances\n  ...\n"
    },
    {
      "commit": "0cbb4b4f4c44f54af268969b18d8deda63aded59",
      "tree": "e4195e9d5425397f557117077d6306eadf94e350",
      "parents": [
        "d09cfbbfa0f761a97687828b5afb27b56cbf2e19"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Jan 04 16:18:09 2018 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jan 04 16:45:09 2018 -0800"
      },
      "message": "userfaultfd: clear the vma-\u003evm_userfaultfd_ctx if UFFD_EVENT_FORK fails\n\nThe previous fix in commit 384632e67e08 (\"userfaultfd: non-cooperative:\nfix fork use after free\") corrected the refcounting in case of\nUFFD_EVENT_FORK failure for the fork userfault paths.\n\nThat still didn\u0027t clear the vma-\u003evm_userfaultfd_ctx of the vmas that\nwere set to point to the aborted new uffd ctx earlier in\ndup_userfaultfd.\n\nLink: http://lkml.kernel.org/r/20171223002505.593-2-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Eric Biggers \u003cebiggers3@gmail.com\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "076ccb76e1a6cf0aa5371132efdd502a11e806f1",
      "tree": "6917e5c6896f75226fe97e09a236c502fe0637f5",
      "parents": [
        "9dd957485d7d896ec18d8e2f9dd410efe71eca34"
      ],
      "author": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Jul 03 01:02:18 2017 -0400"
      },
      "committer": {
        "name": "Al Viro",
        "email": "viro@zeniv.linux.org.uk",
        "time": "Mon Nov 27 16:20:05 2017 -0500"
      },
      "message": "fs: annotate -\u003epoll() instances\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n"
    },
    {
      "commit": "00bb31fa44acf9591018810ff9d5ab375779c1cc",
      "tree": "2c66edaefa2b2eab70cb7c440c55b547e36749ff",
      "parents": [
        "85ccc8fa81af74c3c9133cf243fb75f65d02a59a"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Nov 15 17:36:56 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Nov 15 18:21:05 2017 -0800"
      },
      "message": "userfaultfd: use mmgrab instead of open-coded increment of mm_count\n\nLink: http://lkml.kernel.org/r/1508132478-7738-1-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr . David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "6aa7de059173a986114ac43b8f50b297a86f09a8",
      "tree": "77666afe795e022914ca26433d61686c694dc4fd",
      "parents": [
        "b03a0fe0c5e4b46dcd400d27395b124499554a71"
      ],
      "author": {
        "name": "Mark Rutland",
        "email": "mark.rutland@arm.com",
        "time": "Mon Oct 23 14:07:29 2017 -0700"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Wed Oct 25 11:01:08 2017 +0200"
      },
      "message": "locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE()\n\nPlease do not apply this to mainline directly, instead please re-run the\ncoccinelle script shown below and apply its output.\n\nFor several reasons, it is desirable to use {READ,WRITE}_ONCE() in\npreference to ACCESS_ONCE(), and new code is expected to use one of the\nformer. So far, there\u0027s been no reason to change most existing uses of\nACCESS_ONCE(), as these aren\u0027t harmful, and changing them results in\nchurn.\n\nHowever, for some features, the read/write distinction is critical to\ncorrect operation. To distinguish these cases, separate read/write\naccessors must be used. This patch migrates (most) remaining\nACCESS_ONCE() instances to {READ,WRITE}_ONCE(), using the following\ncoccinelle script:\n\n----\n// Convert trivial ACCESS_ONCE() uses to equivalent READ_ONCE() and\n// WRITE_ONCE()\n\n// $ make coccicheck COCCI\u003d/home/mark/once.cocci SPFLAGS\u003d\"--include-headers\" MODE\u003dpatch\n\nvirtual patch\n\n@ depends on patch @\nexpression E1, E2;\n@@\n\n- ACCESS_ONCE(E1) \u003d E2\n+ WRITE_ONCE(E1, E2)\n\n@ depends on patch @\nexpression E;\n@@\n\n- ACCESS_ONCE(E)\n+ READ_ONCE(E)\n----\n\nSigned-off-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: davem@davemloft.net\nCc: linux-arch@vger.kernel.org\nCc: mpe@ellerman.id.au\nCc: shuah@kernel.org\nCc: snitzer@redhat.com\nCc: thor.thayer@linux.intel.com\nCc: tj@kernel.org\nCc: viro@zeniv.linux.org.uk\nCc: will.deacon@arm.com\nLink: http://lkml.kernel.org/r/1508792849-3115-19-git-send-email-paulmck@linux.vnet.ibm.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "384632e67e0829deb8015ee6ad916b180049d252",
      "tree": "24dbfe0561ac449ff84af9a6ca598b29f7d95bd4",
      "parents": [
        "7d790d2da386a52cfebcf0c898ba927bece9d4ab"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Tue Oct 03 16:15:38 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Oct 03 17:54:25 2017 -0700"
      },
      "message": "userfaultfd: non-cooperative: fix fork use after free\n\nWhen reading the event from the uffd, we put it on a temporary\nfork_event list to detect if we can still access it after releasing and\nretaking the event_wqh.lock.\n\nIf fork aborts and removes the event from the fork_event all is fine as\nlong as we\u0027re still in the userfault read context and fork_event head is\nstill alive.\n\nWe\u0027ve to put the event allocated in the fork kernel stack, back from\nfork_event list-head to the event_wqh head, before returning from\nuserfaultfd_ctx_read, because the fork_event head lifetime is limited to\nthe userfaultfd_ctx_read stack lifetime.\n\nForgetting to move the event back to its event_wqh place then results in\n__remove_wait_queue(\u0026ctx-\u003eevent_wqh, \u0026ewq-\u003ewq); in\nuserfaultfd_event_wait_completion to remove it from a head that has been\nalready freed from the reader stack.\n\nThis could only happen if resolve_userfault_fork failed (for example if\nthere are no file descriptors available to allocate the fork uffd).  If\nit succeeded it was put back correctly.\n\nFurthermore, after find_userfault_evt receives a fork event, the forked\nuserfault context in fork_nctx and uwq-\u003emsg.arg.reserved.reserved1 can\nbe released by the fork thread as soon as the event_wqh.lock is\nreleased.  Taking a reference on the fork_nctx before dropping the lock\nprevents an use after free in resolve_userfault_fork().\n\nIf the fork side aborted and it already released everything, we still\ntry to succeed resolve_userfault_fork(), if possible.\n\nFixes: 893e26e61d04eac9 (\"userfaultfd: non-cooperative: Add fork() event\")\nLink: http://lkml.kernel.org/r/20170920180413.26713-1-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nTested-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "656710a60e3693911bee3a355d2f2bbae3faba33",
      "tree": "dd55fb4c43f3cf65c50d0795a001370429b4d6e0",
      "parents": [
        "98c70baad4067cf3bfb90c26b3b01cb3eab621e2"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Fri Sep 08 16:12:42 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Sep 08 18:26:47 2017 -0700"
      },
      "message": "userfaultfd: non-cooperative: closing the uffd without triggering SIGBUS\n\nThis is an enhancement to avoid a non cooperative userfaultfd manager\nhaving to unregister all regions before it can close the uffd after all\nuserfaultfd activity completed.\n\nThe UFFDIO_UNREGISTER would serialize against the handle_userfault by\ntaking the mmap_sem for writing, but we can simply repeat the page fault\nif we detect the uffd was closed and so the regular page fault paths\nshould takeover.\n\nLink: http://lkml.kernel.org/r/20170823181227.19926-1-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a36985d31a65d5c0559fb582719e32eaf0ccec3b",
      "tree": "422c04b7bd357e1f1f23ff4576c139ca272b8546",
      "parents": [
        "9d4ac934829ac58c5109c49e6dfe677300e5e652"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Sep 06 16:23:59 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 06 17:27:29 2017 -0700"
      },
      "message": "userfaultfd: provide pid in userfault msg - add feat union\n\nNo ABI change, but this will make it more explicit to software that ptid\nis only available if requested by passing UFFD_FEATURE_THREAD_ID to\nUFFDIO_API.  The fact it\u0027s a union will also self document it shouldn\u0027t\nbe taken for granted there\u0027s a tpid there.\n\nLink: http://lkml.kernel.org/r/20170802165145.22628-7-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Alexey Perevalov \u003ca.perevalov@samsung.com\u003e\nCc: Maxime Coquelin \u003cmaxime.coquelin@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9d4ac934829ac58c5109c49e6dfe677300e5e652",
      "tree": "95d3de228e2d3f34ef777b7674f27adcf075c84a",
      "parents": [
        "2376dd7ceddae67432db055ff3f2b7f4122a919d"
      ],
      "author": {
        "name": "Alexey Perevalov",
        "email": "a.perevalov@samsung.com",
        "time": "Wed Sep 06 16:23:56 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 06 17:27:29 2017 -0700"
      },
      "message": "userfaultfd: provide pid in userfault msg\n\nIt could be useful for calculating downtime during postcopy live\nmigration per vCPU.  Side observer or application itself will be\ninformed about proper task\u0027s sleep during userfaultfd processing.\n\nProcess\u0027s thread id is being provided when user requeste it by setting\nUFFD_FEATURE_THREAD_ID bit into uffdio_api.features.\n\nLink: http://lkml.kernel.org/r/20170802165145.22628-6-aarcange@redhat.com\nSigned-off-by: Alexey Perevalov \u003ca.perevalov@samsung.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Maxime Coquelin \u003cmaxime.coquelin@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "2d6d6f5a09a96cc1fec7ed992b825e05f64cb50e",
      "tree": "0410e47be4df76c2e71da34aa32a92b7a39d4378",
      "parents": [
        "c41f012ade0b95b0a6e25c7150673e0554736165"
      ],
      "author": {
        "name": "Prakash Sangappa",
        "email": "prakash.sangappa@oracle.com",
        "time": "Wed Sep 06 16:23:39 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 06 17:27:29 2017 -0700"
      },
      "message": "mm: userfaultfd: add feature to request for a signal delivery\n\nIn some cases, userfaultfd mechanism should just deliver a SIGBUS signal\nto the faulting process, instead of the page-fault event.  Dealing with\npage-fault event using a monitor thread can be an overhead in these\ncases.  For example applications like the database could use the\nsignaling mechanism for robustness purpose.\n\nDatabase uses hugetlbfs for performance reason.  Files on hugetlbfs\nfilesystem are created and huge pages allocated using fallocate() API.\nPages are deallocated/freed using fallocate() hole punching support.\nThese files are mmapped and accessed by many processes as shared memory.\nThe database keeps track of which offsets in the hugetlbfs file have\npages allocated.\n\nAny access to mapped address over holes in the file, which can occur due\nto bugs in the application, is considered invalid and expect the process\nto simply receive a SIGBUS.  However, currently when a hole in the file\nis accessed via the mapped address, kernel/mm attempts to automatically\nallocate a page at page fault time, resulting in implicitly filling the\nhole in the file.  This may not be the desired behavior for applications\nlike the database that want to explicitly manage page allocations of\nhugetlbfs files.\n\nUsing userfaultfd mechanism with this support to get a signal, database\napplication can prevent pages from being allocated implicitly when\nprocesses access mapped address over holes in the file.\n\nThis patch adds UFFD_FEATURE_SIGBUS feature to userfaultfd mechnism to\nrequest for a SIGBUS signal.\n\nSee following for previous discussion about the database requirement\nleading to this proposal as suggested by Andrea.\n\nhttp://www.spinics.net/lists/linux-mm/msg129224.html\n\nLink: http://lkml.kernel.org/r/1501552446-748335-2-git-send-email-prakash.sangappa@oracle.com\nSigned-off-by: Prakash Sangappa \u003cprakash.sangappa@oracle.com\u003e\nReviewed-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ce53e8e6f2cb02d69f0a1d7954e10d3231bc75f5",
      "tree": "cffa940f27e189853b3afd76c49f977eb30d6a93",
      "parents": [
        "8fb44e5403ca86e33411dfa12dd298ed5ab1c3f7"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Sep 06 16:23:12 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Sep 06 17:27:28 2017 -0700"
      },
      "message": "userfaultfd: report UFFDIO_ZEROPAGE as available for shmem VMAs\n\nNow when shmem VMAs can be filled with zero page via userfaultfd we can\nreport that UFFDIO_ZEROPAGE is available for those VMAs\n\nLink: http://lkml.kernel.org/r/1497939652-16528-7-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "040cca3ab2f6f8b8d26e0e4965abea2b9aa14818",
      "tree": "25709ba52ee06fccf4bfbfbf2897bb8cf86da828",
      "parents": [
        "ef0758dd0fd70b98b889af26e27f003656952db8",
        "b2dbdf2ca1d2803e9cdc46a94554c4a39ffb235a"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Fri Aug 11 13:51:59 2017 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Fri Aug 11 13:51:59 2017 +0200"
      },
      "message": "Merge branch \u0027linus\u0027 into locking/core, to resolve conflicts\n\n Conflicts:\n\tinclude/linux/mm_types.h\n\tmm/huge_memory.c\n\nI removed the smp_mb__before_spinlock() like the following commit does:\n\n  8b1b436dd1cc (\"mm, locking: Rework {set,clear,mm}_tlb_flush_pending()\")\n\nand fixed up the affected commits.\n\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "e86b298bebf7e799e4b7232e9135799f1947552e",
      "tree": "ef1d29b5737ebbe5bdcf966bcd69a152e634a0b8",
      "parents": [
        "f357e345eef7863da037e0243f2d3df4ba6df986"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Thu Aug 10 15:24:32 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 10 15:54:07 2017 -0700"
      },
      "message": "userfaultfd: replace ENOSPC with ESRCH in case mm has gone during copy/zeropage\n\nWhen the process exit races with outstanding mcopy_atomic, it would be\nbetter to return ESRCH error.  When such race occurs the process and\nit\u0027s mm are going away and returning \"no such process\" to the uffd\nmonitor seems better fit than ENOSPC.\n\nLink: http://lkml.kernel.org/r/1502111545-32305-1-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSuggested-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a9668cd6ee288c4838bc668880ac085be551cac2",
      "tree": "5a4b71cef5d9f8acf8f2c67c4c518146b1c49a51",
      "parents": [
        "d89e588ca4081615216cc25f2489b0281ac0bfe9"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Wed Jun 07 17:51:27 2017 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Aug 10 12:29:03 2017 +0200"
      },
      "message": "locking: Remove smp_mb__before_spinlock()\n\nNow that there are no users of smp_mb__before_spinlock() left, remove\nit entirely.\n\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "5a18b64e3f02125be1c0ef777501ae38aafe2a24",
      "tree": "88de1eff4972ac8c6acd682682e497f7a29f7eda",
      "parents": [
        "ade9f91b32b964e83d294f4973d50083b08ef6fc"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Aug 02 13:32:24 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 02 17:16:13 2017 -0700"
      },
      "message": "userfaultfd: non-cooperative: flush event_wqh at release time\n\nThere may still be threads waiting on event_wqh at the time the\nuserfault file descriptor is closed.  Flush the events wait-queue to\nprevent waiting threads from hanging.\n\nLink: http://lkml.kernel.org/r/1501398127-30419-1-git-send-email-rppt@linux.vnet.ibm.com\nFixes: 9cd75c3cd4c3d (\"userfaultfd: non-cooperative: add ability to report\nnon-PF events from uffd descriptor\")\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9d95aa4bada24be35bb94827a55e1d6e243d866e",
      "tree": "89fc20ba88a75c6da517d88d1f7c9450ac0002e9",
      "parents": [
        "167d0f258fedbfc859ad4105b1ea236818d41bdd"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Aug 02 13:32:15 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 02 17:16:12 2017 -0700"
      },
      "message": "userfaultfd_zeropage: return -ENOSPC in case mm has gone\n\nIn the non-cooperative userfaultfd case, the process exit may race with\noutstanding mcopy_atomic called by the uffd monitor.  Returning -ENOSPC\ninstead of -EINVAL when mm is already gone will allow uffd monitor to\ndistinguish this case from other error conditions.\n\nUnfortunately I overlooked userfaultfd_zeropage when updating\nuserfaultd_copy().\n\nLink: http://lkml.kernel.org/r/1501136819-21857-1-git-send-email-rppt@linux.vnet.ibm.com\nFixes: 96333187ab162 (\"userfaultfd_copy: return -ENOSPC in case mm has gone\")\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "7868a2087ec13ec4a5df0c5e00999863be132ba8",
      "tree": "ae49686ff18e3e90cb644c22a4fb92d0f8bd0e2a",
      "parents": [
        "d63206ee32b6e64b0e12d46e5d6004afd9913713"
      ],
      "author": {
        "name": "Punit Agrawal",
        "email": "punit.agrawal@arm.com",
        "time": "Thu Jul 06 15:39:42 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jul 06 16:24:34 2017 -0700"
      },
      "message": "mm/hugetlb: add size parameter to huge_pte_offset()\n\nA poisoned or migrated hugepage is stored as a swap entry in the page\ntables.  On architectures that support hugepages consisting of\ncontiguous page table entries (such as on arm64) this leads to ambiguity\nin determining the page table entry to return in huge_pte_offset() when\na poisoned entry is encountered.\n\nLet\u0027s remove the ambiguity by adding a size parameter to convey\nadditional information about the requested address.  Also fixup the\ndefinition/usage of huge_pte_offset() throughout the tree.\n\nLink: http://lkml.kernel.org/r/20170522133604.11392-4-punit.agrawal@arm.com\nSigned-off-by: Punit Agrawal \u003cpunit.agrawal@arm.com\u003e\nAcked-by: Steve Capper \u003csteve.capper@arm.com\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Tony Luck \u003ctony.luck@intel.com\u003e\nCc: Fenghua Yu \u003cfenghua.yu@intel.com\u003e\nCc: James Hogan \u003cjames.hogan@imgtec.com\u003e (odd fixer:METAG ARCHITECTURE)\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e (supporter:MIPS)\nCc: \"James E.J. Bottomley\" \u003cjejb@parisc-linux.org\u003e\nCc: Helge Deller \u003cdeller@gmx.de\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nCc: Yoshinori Sato \u003cysato@users.sourceforge.jp\u003e\nCc: Rich Felker \u003cdalias@libc.org\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Chris Metcalf \u003ccmetcalf@mellanox.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: \"Aneesh Kumar K.V\" \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "f93ae36462091eca8c8d70ced64b97056a8ecbd6",
      "tree": "628e94206b84a04df21c1080a8575809588d84a5",
      "parents": [
        "57ecbd3831ee3ad43914d5c9dddbff7ce30e3d42"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Thu Jul 06 15:38:35 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jul 06 16:24:33 2017 -0700"
      },
      "message": "fs/userfaultfd.c: drop dead code\n\nCalculation of start end end in __wake_userfault function are not used\nand can be removed.\n\nLink: http://lkml.kernel.org/r/1494930917-3134-1-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "2055da97389a605c8a00d163d40903afbe413921",
      "tree": "6aec7243076aab2d4d239f03e34598752ce1512a",
      "parents": [
        "5822a454d6d22297c5fcd66264120587b2ec21cd"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Jun 20 12:06:46 2017 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Jun 20 12:19:14 2017 +0200"
      },
      "message": "sched/wait: Disambiguate wq_entry-\u003etask_list and wq_head-\u003etask_list naming\n\nSo I\u0027ve noticed a number of instances where it was not obvious from the\ncode whether -\u003etask_list was for a wait-queue head or a wait-queue entry.\n\nFurthermore, there\u0027s a number of wait-queue users where the lists are\nnot for \u0027tasks\u0027 but other entities (poll tables, etc.), in which case\nthe \u0027task_list\u0027 name is actively confusing.\n\nTo clear this all up, name the wait-queue head and entry list structure\nfields unambiguously:\n\n\tstruct wait_queue_head::task_list\t\u003d\u003e ::head\n\tstruct wait_queue_entry::task_list\t\u003d\u003e ::entry\n\nFor example, this code:\n\n\trqw-\u003ewait.task_list.next !\u003d \u0026wait-\u003etask_list\n\n... is was pretty unclear (to me) what it\u0027s doing, while now it\u0027s written this way:\n\n\trqw-\u003ewait.head.next !\u003d \u0026wait-\u003eentry\n\n... which makes it pretty clear that we are iterating a list until we see the head.\n\nOther examples are:\n\n\tlist_for_each_entry_safe(pos, next, \u0026x-\u003etask_list, task_list) {\n\tlist_for_each_entry(wq, \u0026fence-\u003ewait.task_list, task_list) {\n\n... where it\u0027s unclear (to me) what we are iterating, and during review it\u0027s\nhard to tell whether it\u0027s trying to walk a wait-queue entry (which would be\na bug), while now it\u0027s written as:\n\n\tlist_for_each_entry_safe(pos, next, \u0026x-\u003ehead, entry) {\n\tlist_for_each_entry(wq, \u0026fence-\u003ewait.head, entry) {\n\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "ac6424b981bce1c4bc55675c6ce11bfe1bbfa64f",
      "tree": "a9312337219777a9d3fb65d4673bbc6b5eeacd9c",
      "parents": [
        "9705596d08ac87c18aee32cc97f2783b7d14624e"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Jun 20 12:06:13 2017 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Tue Jun 20 12:18:27 2017 +0200"
      },
      "message": "sched/wait: Rename wait_queue_t \u003d\u003e wait_queue_entry_t\n\nRename:\n\n\twait_queue_t\t\t\u003d\u003e\twait_queue_entry_t\n\n\u0027wait_queue_t\u0027 was always a slight misnomer: its name implies that it\u0027s a \"queue\",\nbut in reality it\u0027s a queue *entry*. The \u0027real\u0027 queue is the wait queue head,\nwhich had to carry the name.\n\nStart sorting this out by renaming it to \u0027wait_queue_entry_t\u0027.\n\nThis also allows the real structure name \u0027struct __wait_queue\u0027 to\nlose its double underscore and become \u0027struct wait_queue_entry\u0027,\nwhich is the more canonical nomenclature for such data types.\n\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "64c2b20301f62c697352c8028c569b1b2bdd8e82",
      "tree": "435b7139eca1e06238e50aca345a904d0f19ccd5",
      "parents": [
        "3c226c637b69104f6b9f1c6ec5b08d7b741b3229"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Fri Jun 16 14:02:37 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Jun 17 06:37:05 2017 +0900"
      },
      "message": "userfaultfd: shmem: handle coredumping in handle_userfault()\n\nAnon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to\n__get_user_pages().\n\nshmem as opposed has no special FOLL_DUMP handling there so\nhandle_mm_fault() is invoked without mmap_sem and ends up calling\nhandle_userfault() that isn\u0027t expecting to be invoked without mmap_sem\nheld.\n\nThis makes handle_userfault() fail immediately if invoked through\nshmem_vm_ops-\u003efault during coredumping and solves the problem.\n\nThe side effect is a BUG_ON with no lock held triggered by the\ncoredumping process which exits.  Only 4.11 is affected, pre-4.11 anon\nmemory holes are skipped in __get_user_pages by checking FOLL_DUMP\nexplicitly against empty pagetables (mm/gup.c:no_page_table()).\n\nIt\u0027s zero cost as we already had a check for current-\u003eflags to prevent\nfutex to trigger userfaults during exit (PF_EXITING).\n\nLink: http://lkml.kernel.org/r/20170615214838.27429-1-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.11+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "045098e944959d4cbd56bbf33e2f26045863b7ca",
      "tree": "8495ab4992f0a50304649c67016b2b965b515db6",
      "parents": [
        "d75450ff40df0199bf13dfb19f435519ff947138"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Fri Apr 07 16:04:42 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Apr 08 00:47:48 2017 -0700"
      },
      "message": "userfaultfd: report actual registered features in fdinfo\n\nfdinfo for userfault file descriptor reports UFFD_API_FEATURES.  Up\nuntil recently, the UFFD_API_FEATURES was defined as 0, therefore\ncorresponding field in fdinfo always contained zero.  Now, with\nintroduction of several additional features, UFFD_API_FEATURES is not\nlonger 0 and it seems better to report actual features requested for the\nuserfaultfd object described by the fdinfo.\n\nFirst, the applications that were using userfault will still see zero at\nthe features field in fdinfo.  Next, reporting actual features rather\nthan available features, gives clear indication of what userfault\nfeatures are used by an application.\n\nLink: http://lkml.kernel.org/r/1491140181-22121-1-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "baeedc7158da5b0f489d04125ba6adfba532a6f7",
      "tree": "1f42b5cd4a961ed10673578a28602dd13d09ab99",
      "parents": [
        "8fe3ccaed080a7804bc459c42e0419253973be92",
        "90eceff1a375f6ffa78caf8654e787c0a8a591ef"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 10 08:59:07 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 10 08:59:07 2017 -0800"
      },
      "message": "Merge branch \u0027prep-for-5level\u0027\n\nMerge 5-level page table prep from Kirill Shutemov:\n \"Here\u0027s relatively low-risk part of 5-level paging patchset. Merging it\n  now will make x86 5-level paging enabling in v4.12 easier.\n\n  The first patch is actually x86-specific: detect 5-level paging\n  support. It boils down to single define.\n\n  The rest of patchset converts Linux MMU abstraction from 4- to 5-level\n  paging.\n\n  Enabling of new abstraction in most cases requires adding single line\n  of code in arch-specific code. The rest is taken care by asm-generic/.\n\n  Changes to mm/ code are mostly mechanical: add support for new page\n  table level -- p4d_t -- where we deal with pud_t now.\n\n  v2:\n   - fix build on microblaze (Michal);\n   - comment for __ARCH_HAS_5LEVEL_HACK in kasan_populate_zero_shadow();\n   - acks from Michal\"\n\n* emailed patches from Kirill A Shutemov \u003ckirill.shutemov@linux.intel.com\u003e:\n  mm: introduce __p4d_alloc()\n  mm: convert generic code to 5-level paging\n  asm-generic: introduce \u003casm-generic/pgtable-nop4d.h\u003e\n  arch, mm: convert all architectures to use 5level-fixup.h\n  asm-generic: introduce __ARCH_USE_5LEVEL_HACK\n  asm-generic: introduce 5level-fixup.h\n  x86/cpufeature: Add 5-level paging detection\n"
    },
    {
      "commit": "2378cd6181edd94748d699448823609977283b11",
      "tree": "bfa11d39ae423a09e10516e097dc2b1a0596384a",
      "parents": [
        "c0d0e351285161a515396b7b1ee53ec9ffd97e3c"
      ],
      "author": {
        "name": "David Hildenbrand",
        "email": "david@redhat.com",
        "time": "Thu Mar 09 16:17:40 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:10 2017 -0800"
      },
      "message": "userfaultfd: remove wrong comment from userfaultfd_ctx_get()\n\nIt\u0027s a void function, so there is no return value;\n\nLink: http://lkml.kernel.org/r/20170309150817.7510-1-david@redhat.com\nSigned-off-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "70ccb92fdd90b35bb6f9200093d4ffd6cb38156b",
      "tree": "1a010b4c126bf64c0a740f648b96050d4b122d68",
      "parents": [
        "7eb76d457fd758d396bc2e65cb0ace5aae614149"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Mar 09 16:17:11 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:10 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: userfaultfd_remove revalidate vma in MADV_DONTNEED\n\nuserfaultfd_remove() has to be execute before zapping the pagetables or\nUFFDIO_COPY could keep filling pages after zap_page_range returned,\nwhich would result in non zero data after a MADV_DONTNEED.\n\nHowever userfaultfd_remove() may have to release the mmap_sem.  This was\nhandled correctly in MADV_REMOVE, but MADV_DONTNEED accessed a\npotentially stale vma (the very vma passed to zap_page_range(vma, ...)).\n\nThe fix consists in revalidating the vma in case userfaultfd_remove()\nhad to release the mmap_sem.\n\nThis also optimizes away an unnecessary down_read/up_read in the\nMADV_REMOVE case if UFFD_EVENT_FORK had to be delivered.\n\nIt all remains zero runtime cost in case CONFIG_USERFAULTFD\u003dn as\nuserfaultfd_remove() will be defined as \"true\" at build time.\n\nLink: http://lkml.kernel.org/r/20170302173738.18994-3-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "7eb76d457fd758d396bc2e65cb0ace5aae614149",
      "tree": "65cef25c2ccabe3574891256e13292939270bdce",
      "parents": [
        "bfc7228b9a9647e1c353e50b40297a2929801759"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Thu Mar 09 16:17:09 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:10 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: fix fork fctx-\u003enew memleak\n\nWe have a memleak in the -\u003enew ctx if the uffd of the parent is closed\nbefore the fork event is read, nothing frees the new context.\n\nLink: http://lkml.kernel.org/r/20170302173738.18994-2-aarcange@redhat.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "8c9e7bb7a41f2bbd54b2caefb274fb3de239819f",
      "tree": "e7ebed49b9c69b07a09654c8298747eedb97781c",
      "parents": [
        "9a69a829f9b656c2a220d65a94ecf7b5887c5da1"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Mar 09 16:16:54 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:09 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: release all ctx in dup_userfaultfd_complete\n\nDon\u0027t stop running dup_fctx() even if userfaultfd_event_wait_completion\nfails as it has to run userfaultfd_ctx_put on all ctx to pair against\nthe userfaultfd_ctx_get that was run on all fctx-\u003eorig in\ndup_userfaultfd.\n\nLink: http://lkml.kernel.org/r/20170224181957.19736-4-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9a69a829f9b656c2a220d65a94ecf7b5887c5da1",
      "tree": "dee2ed7716c4d6ce06f1e6762c6eb5f002b91f23",
      "parents": [
        "dd0db88d8094a6d9d4d1fc5fcd56ab619f54ccf8"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Mar 09 16:16:52 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:09 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: robustness check\n\nSimilar to the handle_userfault() case, also make sure to never attempt\nto send any event past the PF_EXITING point of no return.\n\nThis is purely a robustness check.\n\nLink: http://lkml.kernel.org/r/20170224181957.19736-3-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "dd0db88d8094a6d9d4d1fc5fcd56ab619f54ccf8",
      "tree": "9ee42e28b5d63801e4c61f2ba2582a7b3e5a512a",
      "parents": [
        "b2e593e271b0760ebc8999e5f9dd068ae2b9d30a"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Mar 09 16:16:49 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:09 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: rollback userfaultfd_exit\n\nPatch series \"userfaultfd non-cooperative further update for 4.11 merge\nwindow\".\n\nUnfortunately I noticed one relevant bug in userfaultfd_exit while doing\nmore testing.  I\u0027ve been doing testing before and this was also tested\nby kbuild bot and exercised by the selftest, but this bug never\nreproduced before.\n\nI dropped userfaultfd_exit as result.  I dropped it because of\nimplementation difficulty in receiving signals in __mmput and because I\nthink -ENOSPC as result from the background UFFDIO_COPY should be enough\nalready.\n\nBefore I decided to remove userfaultfd_exit, I noticed userfaultfd_exit\nwasn\u0027t exercised by the selftest and when I tried to exercise it, after\nmoving it to a more correct place in __mmput where it would make more\nsense and where the vma list is stable, it resulted in the\nevent_wait_completion in D state.  So then I added the second patch to\nbe sure even if we call userfaultfd_event_wait_completion too late\nduring task exit(), we won\u0027t risk to generate tasks in D state.  The\nsame check exists in handle_userfault() for the same reason, except it\nmakes a difference there, while here is just a robustness check and it\u0027s\nrun under WARN_ON_ONCE.\n\nWhile looking at the userfaultfd_event_wait_completion() function I\nlooked back at its callers too while at it and I think it\u0027s not ok to\nstop executing dup_fctx on the fcs list because we relay on\nuserfaultfd_event_wait_completion to execute\nuserfaultfd_ctx_put(fctx-\u003eorig) which is paired against\nuserfaultfd_ctx_get(fctx-\u003eorig) in dup_userfault just before\nlist_add(fcs).  This change only takes care of fctx-\u003eorig but this area\nalso needs further review looking for similar problems in fctx-\u003enew.\n\nThe only patch that is urgent is the first because it\u0027s an use after\nfree during a SMP race condition that affects all processes if\nCONFIG_USERFAULTFD\u003dy.  Very hard to reproduce though and probably\nimpossible without SLUB poisoning enabled.\n\nThis patch (of 3):\n\nI once reproduced this oops with the userfaultfd selftest, it\u0027s not\neasily reproducible and it requires SLUB poisoning to reproduce.\n\n    general protection fault: 0000 [#1] SMP\n    Modules linked in:\n    CPU: 2 PID: 18421 Comm: userfaultfd Tainted: G               ------------ T 3.10.0+ #15\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.1-0-g8891697-prebuilt.qemu-project.org 04/01/2014\n    task: ffff8801f83b9440 ti: ffff8801f833c000 task.ti: ffff8801f833c000\n    RIP: 0010:[\u003cffffffff81451299\u003e]  [\u003cffffffff81451299\u003e] userfaultfd_exit+0x29/0xa0\n    RSP: 0018:ffff8801f833fe80  EFLAGS: 00010202\n    RAX: ffff8801f833ffd8 RBX: 6b6b6b6b6b6b6b6b RCX: ffff8801f83b9440\n    RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800baf18600\n    RBP: ffff8801f833fee8 R08: 0000000000000000 R09: 0000000000000001\n    R10: 0000000000000000 R11: ffffffff8127ceb3 R12: 0000000000000000\n    R13: ffff8800baf186b0 R14: ffff8801f83b99f8 R15: 00007faed746c700\n    FS:  0000000000000000(0000) GS:ffff88023fc80000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n    CR2: 00007faf0966f028 CR3: 0000000001bc6000 CR4: 00000000000006e0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n    Call Trace:\n      do_exit+0x297/0xd10\n      SyS_exit+0x17/0x20\n      tracesys+0xdd/0xe2\n    Code: 00 00 66 66 66 66 90 55 48 89 e5 41 54 53 48 83 ec 58 48 8b 1f 48 85 db 75 11 eb 73 66 0f 1f 44 00 00 48 8b 5b 10 48 85 db 74 64 \u003c4c\u003e 8b a3 b8 00 00 00 4d 85 e4 74 eb 41 f6 84 24 2c 01 00 00 80\n    RIP  [\u003cffffffff81451299\u003e] userfaultfd_exit+0x29/0xa0\n     RSP \u003cffff8801f833fe80\u003e\n    ---[ end trace 9fecd6dcb442846a ]---\n\nIn the debugger I located the \"mm\" pointer in the stack and walking\nmm-\u003emmap-\u003evm_next through the end shows the vma-\u003evm_next list is fully\nconsistent and it is null terminated list as expected.  So this has to\nbe an SMP race condition where userfaultfd_exit was running while the\nvma list was being modified by another CPU.\n\nWhen userfaultfd_exit() run one of the -\u003evm_next pointers pointed to\nSLAB_POISON (RBX is the vma pointer and is 0x6b6b..).\n\nThe reason is that it\u0027s not running in __mmput but while there are still\nother threads running and it\u0027s not holding the mmap_sem (it can\u0027t as it\nhas to wait the even to be received by the manager).  So this is an use\nafter free that was happening for all processes.\n\nOne more implementation problem aside from the race condition:\nuserfaultfd_exit has really to check a flag in mm-\u003eflags before walking\nthe vma or it\u0027s going to slowdown the exit() path for regular tasks.\n\nOne more implementation problem: at that point signals can\u0027t be\ndelivered so it would also create a task in D state if the manager\ndoesn\u0027t read the event.\n\nThe major design issue: it overall looks superfluous as the manager can\ncheck for -ENOSPC in the background transfer:\n\n\tif (mmget_not_zero(ctx-\u003emm)) {\n[..]\n\t} else {\n\t\treturn -ENOSPC;\n\t}\n\nIt\u0027s safer to roll it back and re-introduce it later if at all.\n\n[rppt@linux.vnet.ibm.com: documentation fixup after removal of UFFD_EVENT_EXIT]\n  Link: http://lkml.kernel.org/r/1488345437-4364-1-git-send-email-rppt@linux.vnet.ibm.com\nLink: http://lkml.kernel.org/r/20170224181957.19736-2-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "6bbc4a4144b1a69743022ac68dfaf6e7d993abb9",
      "tree": "6a9eaa82d3bb88a8de32ee18320559491fea8780",
      "parents": [
        "ea6200e84182989a3cce9687cf79a23ac44ec4db"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Thu Mar 09 16:16:28 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 17:01:09 2017 -0800"
      },
      "message": "userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE\n\n__do_fault assumes vmf-\u003epage has been initialized and is valid if\nVM_FAULT_NOPAGE is not returned by vma-\u003evm_ops-\u003efault(vma, vmf).\n\nhandle_userfault() in turn should return VM_FAULT_NOPAGE if it doesn\u0027t\nreturn VM_FAULT_SIGBUS or VM_FAULT_RETRY (the other two possibilities).\n\nThis VM_FAULT_NOPAGE case is only invoked when signal are pending and it\ndidn\u0027t matter for anonymous memory before.  It only started to matter\nsince shmem was introduced.  hugetlbfs also takes a different path and\ndoesn\u0027t exercise __do_fault.\n\nLink: http://lkml.kernel.org/r/20170228154201.GH5816@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill@shutemov.name\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "c2febafc67734a62196c1b9dfba926412d4077ba",
      "tree": "a61b7cd503e4c6d2fbb58f0cb53662ffd60b4c14",
      "parents": [
        "048456dcf2c56ad6f6248e2899dda92fb6a613f6"
      ],
      "author": {
        "name": "Kirill A. Shutemov",
        "email": "kirill.shutemov@linux.intel.com",
        "time": "Thu Mar 09 17:24:07 2017 +0300"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 09 11:48:47 2017 -0800"
      },
      "message": "mm: convert generic code to 5-level paging\n\nConvert all non-architecture-specific code to 5-level paging.\n\nIt\u0027s mostly mechanical adding handling one more page table level in\nplaces where we deal with pud_t.\n\nSigned-off-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "174cd4b1e5fbd0d74c68cf3a74f5bd4923485512",
      "tree": "103e34df3da7bd1cdca65c0db1a19fff74830eaa",
      "parents": [
        "b12fb7f46af7d548503d75be59f493f958c6d1b3"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Feb 02 19:15:33 2017 +0100"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Mar 02 08:42:32 2017 +0100"
      },
      "message": "sched/headers: Prepare to move signal wakeup \u0026 sigpending methods from \u003clinux/sched.h\u003e into \u003clinux/sched/signal.h\u003e\n\nFix up affected files that include this signal functionality via sched.h.\n\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "6e84f31522f931027bf695752087ece278c10d3f",
      "tree": "77c09a0bb2878e9725539f310f43dd38137c5d97",
      "parents": [
        "4eb5aaa3af8a54e5e9bac90e2b42bbab1f1ee5a3"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Wed Feb 08 18:51:29 2017 +0100"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Mar 02 08:42:28 2017 +0100"
      },
      "message": "sched/headers: Prepare for new header dependencies before moving code to \u003clinux/sched/mm.h\u003e\n\nWe are going to split \u003clinux/sched/mm.h\u003e out of \u003clinux/sched.h\u003e, which\nwill have to be picked up from other headers and a couple of .c files.\n\nCreate a trivial placeholder \u003clinux/sched/mm.h\u003e file that just\nmaps to \u003clinux/sched.h\u003e to make this patch obviously correct and\nbisectable.\n\nThe APIs that are going to be moved first are:\n\n   mm_alloc()\n   __mmdrop()\n   mmdrop()\n   mmdrop_async_fn()\n   mmdrop_async()\n   mmget_not_zero()\n   mmput()\n   mmput_async()\n   get_task_mm()\n   mm_access()\n   mm_release()\n\nInclude the new header in the files that are going to need it.\n\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "f1f1007644ffc8051a4c11427d58b1967ae7b75a",
      "tree": "e7e590cb1baa494b963d81b967a3f98d3c56f33e",
      "parents": [
        "522b837c672eba9e9fb69f9f52bced0256dc6697"
      ],
      "author": {
        "name": "Vegard Nossum",
        "email": "vegard.nossum@oracle.com",
        "time": "Mon Feb 27 14:30:07 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Feb 27 18:43:48 2017 -0800"
      },
      "message": "mm: add new mmgrab() helper\n\nApart from adding the helper function itself, the rest of the kernel is\nconverted mechanically using:\n\n  git grep -l \u0027atomic_inc.*mm_count\u0027 | xargs sed -i \u0027s/atomic_inc(\u0026\\(.*\\)-\u003emm_count);/mmgrab\\(\\1\\);/\u0027\n  git grep -l \u0027atomic_inc.*mm_count\u0027 | xargs sed -i \u0027s/atomic_inc(\u0026\\(.*\\)\\.mm_count);/mmgrab\\(\\\u0026\\1\\);/\u0027\n\nThis is needed for a later patch that hooks into the helper, but might\nbe a worthwhile cleanup on its own.\n\n(Michal Hocko provided most of the kerneldoc comment.)\n\nLink: http://lkml.kernel.org/r/20161218123229.22952-1-vegard.nossum@oracle.com\nSigned-off-by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9332ef9dbd172d4ab0a0141df7cb21c696a5ce96",
      "tree": "f358b4a02c534b4144379ace4e99f9429cf4dd68",
      "parents": [
        "c6efb58db4e76ab1322b5e869d4f9eb9ce30bd40"
      ],
      "author": {
        "name": "Masahiro Yamada",
        "email": "yamada.masahiro@socionext.com",
        "time": "Mon Feb 27 14:28:47 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Feb 27 18:43:46 2017 -0800"
      },
      "message": "scripts/spelling.txt: add \"an user\" pattern and fix typo instances\n\nFix typos and add the following to the scripts/spelling.txt:\n\n  an user||a user\n  an userspace||a userspace\n\nI also added \"userspace\" to the list since it is a common word in Linux.\nI found some instances for \"an userfaultfd\", but I did not add it to the\nlist.  I felt it is endless to find words that start with \"user\" such as\n\"userland\" etc., so must draw a line somewhere.\n\nLink: http://lkml.kernel.org/r/1481573103-11329-4-git-send-email-yamada.masahiro@socionext.com\nSigned-off-by: Masahiro Yamada \u003cyamada.masahiro@socionext.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "96333187ab16215888f2bce01985ca5a823da8ba",
      "tree": "7eb8866b6d2ab89b0bf058c3963089095049e893",
      "parents": [
        "27d02568f529e908399514dfbee8ee43bdfd5299"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Fri Feb 24 14:58:31 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Feb 24 17:46:55 2017 -0800"
      },
      "message": "userfaultfd_copy: return -ENOSPC in case mm has gone\n\nIn the non-cooperative userfaultfd case, the process exit may race with\noutstanding mcopy_atomic called by the uffd monitor.  Returning -ENOSPC\ninstead of -EINVAL when mm is already gone will allow uffd monitor to\ndistinguish this case from other error conditions.\n\nLink: http://lkml.kernel.org/r/1485542673-24387-6-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ca49ca7114553587736fe78319e22f073b631380",
      "tree": "ef56409db78f5d218c2aca6b7d49901658a6edaa",
      "parents": [
        "897ab3e0c49e24b62e2d54d165c7afec6bbca65b"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Fri Feb 24 14:58:25 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Feb 24 17:46:55 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: add event for exit() notification\n\nAllow userfaultfd monitor track termination of the processes that have\nmemory backed by the uffd.\n\n[rppt@linux.vnet.ibm.com: add comment]\n  Link: http://lkml.kernel.org/r/20170202135448.GB19804@rapoport-lnxLink: http://lkml.kernel.org/r/1485542673-24387-4-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "897ab3e0c49e24b62e2d54d165c7afec6bbca65b",
      "tree": "5fa7e09864d6c959cef33849f6cb10ed04e459e4",
      "parents": [
        "846b1a0f1db065a8479159dd8fecddb1ebf30547"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Fri Feb 24 14:58:22 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Feb 24 17:46:55 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: add event for memory unmaps\n\nWhen a non-cooperative userfaultfd monitor copies pages in the\nbackground, it may encounter regions that were already unmapped.\nAddition of UFFD_EVENT_UNMAP allows the uffd monitor to track precisely\nchanges in the virtual memory layout.\n\nSince there might be different uffd contexts for the affected VMAs, we\nfirst should create a temporary representation for the unmap event for\neach uffd context and then notify them one by one to the appropriate\nuserfault file descriptors.\n\nThe event notification occurs after the mmap_sem has been released.\n\n[arnd@arndb.de: fix nommu build]\n  Link: http://lkml.kernel.org/r/20170203165141.3665284-1-arnd@arndb.de\n[mhocko@suse.com: fix nommu build]\n  Link: http://lkml.kernel.org/r/20170202091503.GA22823@dhcp22.suse.cz\nLink: http://lkml.kernel.org/r/1485542673-24387-3-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "d811914d87576c562e849c00d9f9beff45038801",
      "tree": "7f31dbf8e5febb2396b7428d3c821792e5ce9787",
      "parents": [
        "0262d9c845ec349edf93f69688a5129c36cc2232"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Fri Feb 24 14:56:02 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Feb 24 17:46:54 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: rename *EVENT_MADVDONTNEED to *EVENT_REMOVE\n\nPatch series \"userfaultfd: non-cooperative: add madvise() event for\nMADV_REMOVE request\".\n\nThese patches add notification of madvise(MADV_REMOVE) event to\nnon-cooperative userfaultfd monitor.\n\nThe first pacth renames EVENT_MADVDONTNEED to EVENT_REMOVE along with\nrelevant functions and structures.  Using _REMOVE instead of\n_MADVDONTNEED describes the event semantics more clearly and I hope it\u0027s\nnot too late for such change in the ABI.\n\nThis patch (of 3):\n\nThe UFFD_EVENT_MADVDONTNEED purpose is to notify uffd monitor about\nremoval of certain range from address space tracked by userfaultfd.\nHence, UFFD_EVENT_REMOVE seems to better reflect the operation\nsemantics.  Respectively, \u0027madv_dn\u0027 field of uffd_msg is renamed to\n\u0027remove\u0027 and the madvise_userfault_dontneed callback is renamed to\nuserfaultfd_remove.\n\nLink: http://lkml.kernel.org/r/1484814154-1557-2-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "cac673292b9b39493bb0ff526b96c83ace6fdcd0",
      "tree": "7d8dbcd6cabcdf35cc2866b672c65be98cc1e5be",
      "parents": [
        "cfda05267f7bd02b5ae5ac6a37fbbdf3b9c41b57"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Feb 22 15:43:40 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: shmem: allow registration of shared memory ranges\n\nExpand the userfaultfd_register/unregister routines to allow shared\nmemory VMAs.\n\nCurrently, there is no UFFDIO_ZEROPAGE and write-protection support for\nshared memory VMAs, which is reflected in ioctl methods supported by\nuffdio_register.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-34-aarcange@redhat.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ba6907db6de17cf90c4fc67f3eb1d1d37dd0b7ac",
      "tree": "3276c0440ef2e4ba611fc5b235d0567a3b0e1fb4",
      "parents": [
        "163e11bc4f6ebbfcfdf751c108bd212a26e492ee"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Feb 22 15:43:22 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: introduce vma_can_userfault\n\nCheck whether a VMA can be used with userfault in more compact way\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-28-aarcange@redhat.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "369cd2121be440543280b91056de187f625d0dbb",
      "tree": "800cc640df4ee6e627f61e277d27b3d90936e0a5",
      "parents": [
        "9903bd7b73ef0dec429e951009b36643eb0fe239"
      ],
      "author": {
        "name": "Mike Kravetz",
        "email": "mike.kravetz@oracle.com",
        "time": "Wed Feb 22 15:43:10 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: hugetlbfs: userfaultfd_huge_must_wait for hugepmd ranges\n\nAdd routine userfaultfd_huge_must_wait which has the same functionality\nas the existing userfaultfd_must_wait routine.  Only difference is that\nnew routine must handle page table structure for hugepmd vmas.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-24-aarcange@redhat.com\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "cab350afcbc9c8a744e0d164d1c26560568f770b",
      "tree": "57eb4021a19e2cd735454a85de03f271ebcb826d",
      "parents": [
        "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45"
      ],
      "author": {
        "name": "Mike Kravetz",
        "email": "mike.kravetz@oracle.com",
        "time": "Wed Feb 22 15:43:04 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: hugetlbfs: allow registration of ranges containing huge pages\n\nExpand the userfaultfd_register/unregister routines to allow VM_HUGETLB\nvmas.  huge page alignment checking is performed after a VM_HUGETLB vma\nis encountered.\n\nAlso, since there is no UFFDIO_ZEROPAGE support for huge pages do not\nreturn that as a valid ioctl method for huge page ranges.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-22-aarcange@redhat.com\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "09fa5296a40d01e014b4851def20b975feb98fd5",
      "tree": "4b937777549f85e69134d5a1af48b849f174ddb0",
      "parents": [
        "0594f58dbd954f7747553c041d7cbbf9b6ef1947"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:46 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: wake userfaults after UFFDIO_UNREGISTER\n\nUserfaults may still happen after the userfaultfd monitor thread\nreceived a UFFD_EVENT_MADVDONTNEED until UFFDIO_UNREGISTER is run.\n\nWake any pending userfault within UFFDIO_UNREGISTER protected by the\nmmap_sem for writing, so they will not be reported to userland leading\nto UFFDIO_COPY returning -EINVAL (as the range was already unregistered)\nand they will not hang permanently either.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-16-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "05ce77249d5068b057082d24ec22d3824f4816ac",
      "tree": "818c65b8517abe7dcfd655b590d4c587dad098fe",
      "parents": [
        "90794bf19dc19691a16b71bcd75c04094d9e392d"
      ],
      "author": {
        "name": "Pavel Emelyanov",
        "email": "xemul@parallels.com",
        "time": "Wed Feb 22 15:42:40 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: add madvise() event for MADV_DONTNEED request\n\nIf the page is punched out of the address space the uffd reader should\nknow this and zeromap the respective area in case of the #PF event.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-14-aarcange@redhat.com\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "90794bf19dc19691a16b71bcd75c04094d9e392d",
      "tree": "96c80c3f2d4b0aa5b72ab5965269e7050fec4185",
      "parents": [
        "72f87654c69690ff4721bd9b4a39983f971de9a5"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:37 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: optimize mremap_userfaultfd_complete()\n\nOptimize the mremap_userfaultfd_complete() interface to pass only the\nvm_userfaultfd_ctx pointer through the stack as a microoptimization.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-13-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nAcked-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "72f87654c69690ff4721bd9b4a39983f971de9a5",
      "tree": "0e607734e047d2dc7379b186c5c8c57e9276fd8a",
      "parents": [
        "d3aadc8ed4cb447981ecf34f9af71cddc6cf907d"
      ],
      "author": {
        "name": "Pavel Emelyanov",
        "email": "xemul@parallels.com",
        "time": "Wed Feb 22 15:42:34 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: add mremap() event\n\nThe event denotes that an area [start:end] moves to different location.\nLength change isn\u0027t reported as \"new\" addresses, if they appear on the\nuffd reader side they will not contain any data and the latter can just\nzeromap them.\n\nWaiting for the event ACK is also done outside of mmap sem, as for fork\nevent.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-12-aarcange@redhat.com\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "d3aadc8ed4cb447981ecf34f9af71cddc6cf907d",
      "tree": "1833efa2cd4ec49c81e3a35ca3e046c48c1a549f",
      "parents": [
        "893e26e61d04eac974ded0c11e1647b335c8cb7b"
      ],
      "author": {
        "name": "Mike Rapoport",
        "email": "rppt@linux.vnet.ibm.com",
        "time": "Wed Feb 22 15:42:30 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: dup_userfaultfd: use mm_count instead of mm_users\n\nSince commit d2005e3f41d4 (\"userfaultfd: don\u0027t pin the user memory in\nuserfaultfd_file_create()\") userfaultfd uses mm_count rather than\nmm_users to pin mm_struct.\n\nMake dup_userfaultfd consistent with this behaviour\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-11-aarcange@redhat.com\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "893e26e61d04eac974ded0c11e1647b335c8cb7b",
      "tree": "d75bbbd621a08130e8794dffcedc71f4a6ff50cc",
      "parents": [
        "656031445d5a855e1c13b291dedae32579d0f3f2"
      ],
      "author": {
        "name": "Pavel Emelyanov",
        "email": "xemul@parallels.com",
        "time": "Wed Feb 22 15:42:27 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: Add fork() event\n\nWhen the mm with uffd-ed vmas fork()-s the respective vmas notify their\nuffds with the event which contains a descriptor with new uffd.  This\nnew descriptor can then be used to get events from the child and\npopulate its mm with data.  Note, that there can be different uffd-s\ncontrolling different vmas within one mm, so first we should collect all\nthose uffds (and ctx-s) in a list and then notify them all one by one\nbut only once per fork().\n\nThe context is created at fork() time but the descriptor, file struct\nand anon inode object is created at event read time.  So some trickery\nis added to the userfaultfd_ctx_read() to handle the ctx queues\u0027 locking\nvs file creation.\n\nAnother thing worth noticing is that the task that fork()-s waits for\nthe uffd event to get processed WITHOUT the mmap sem.\n\n[aarcange@redhat.com: build warning fix]\n  Link: http://lkml.kernel.org/r/20161216144821.5183-10-aarcange@redhat.com\nLink: http://lkml.kernel.org/r/20161216144821.5183-9-aarcange@redhat.com\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "656031445d5a855e1c13b291dedae32579d0f3f2",
      "tree": "cc6ed3acc6f8af0717589b6515616f9c12868cb1",
      "parents": [
        "9cd75c3cd4c3d06aa0c4ed8ef5327d811a8b6cff"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:24 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: report all available features to userland\n\nThis will allow userland to probe all features available in the kernel.\nIt will however only enable the requested features in the open userfaultfd\ncontext.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-8-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "9cd75c3cd4c3d06aa0c4ed8ef5327d811a8b6cff",
      "tree": "d1a58d5498d477fe285205b6b06587a820b76559",
      "parents": [
        "6dcc27fd39437f77057322cf314cc545bf0e4863"
      ],
      "author": {
        "name": "Pavel Emelyanov",
        "email": "xemul@parallels.com",
        "time": "Wed Feb 22 15:42:21 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor\n\nThe custom events are queued in ctx-\u003eevent_wqh not to disturb the\nfast-path-ed PF queue-wait-wakeup functions.\n\nThe events to be generated (other than PF-s) are requested in UFFD_API\nioctl with the uffd_api.features bits. Those, known by the kernel, are\nthen turned on and reported back to the user-space.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-7-aarcange@redhat.com\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "6dcc27fd39437f77057322cf314cc545bf0e4863",
      "tree": "227b15190c3c227f459530468d390bfb20432819",
      "parents": [
        "a94720bf821dd63e72176da5f423ba7935dde67d"
      ],
      "author": {
        "name": "Pavel Emelyanov",
        "email": "xemul@parallels.com",
        "time": "Wed Feb 22 15:42:18 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: non-cooperative: Split the find_userfault() routine\n\nI will need one to lookup for userfaultfd_wait_queue-s in different\nwait queue\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-6-aarcange@redhat.com\nSigned-off-by: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a94720bf821dd63e72176da5f423ba7935dde67d",
      "tree": "cf518943eefeb9ce2ae619930897c4ef9fb4fae4",
      "parents": [
        "8474901a33d8a27958bfa99e78736863abd67874"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:15 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: use vma_is_anonymous\n\nCleanup the vma-\u003evm_ops usage.\n\nSide note: it would be more robust if vma_is_anonymous() would also\ncheck that vm_flags hasn\u0027t VM_PFNMAP set.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-5-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "8474901a33d8a27958bfa99e78736863abd67874",
      "tree": "9163a3aafeff6d7854ed7b567af7633eece19eea",
      "parents": [
        "a4605a61d642fe9b9de050d356432ecac82cc701"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:12 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: convert BUG() to WARN_ON_ONCE()\n\nAvoid BUG_ON()s and only WARN instead.  This is just a cleanup, it can\u0027t\nmake any runtime difference.  This BUG_ON has never triggered and cannot\ntrigger.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-4-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a4605a61d642fe9b9de050d356432ecac82cc701",
      "tree": "749bbdcdb13c6089c8c7418eef94f8b2a88f88f0",
      "parents": [
        "e067eba5871c6922539dc1728699c14e6b22590f"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Wed Feb 22 15:42:09 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Feb 22 16:41:28 2017 -0800"
      },
      "message": "userfaultfd: correct comment about UFFD_FEATURE_PAGEFAULT_FLAG_WP\n\nMinor comment correction.\n\nLink: http://lkml.kernel.org/r/20161216144821.5183-3-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "15a77c6fe494f4b1757d30cd137fe66ab06a38c3",
      "tree": "7f94e57b840b851fbf707deda5c860ab8a285a18",
      "parents": [
        "de182cc8e882f74af2a112e09f148ce646937232"
      ],
      "author": {
        "name": "Andrea Arcangeli",
        "email": "aarcange@redhat.com",
        "time": "Tue Jan 24 15:17:59 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jan 24 16:26:14 2017 -0800"
      },
      "message": "userfaultfd: fix SIGBUS resulting from false rwsem wakeups\n\nWith \u003e\u003d32 CPUs the userfaultfd selftest triggered a graceful but\nunexpected SIGBUS because VM_FAULT_RETRY was returned by\nhandle_userfault() despite the UFFDIO_COPY wasn\u0027t completed.\n\nThis seems caused by rwsem waking the thread blocked in\nhandle_userfault() and we can\u0027t run up_read() before the wait_event\nsequence is complete.\n\nKeeping the wait_even sequence identical to the first one, would require\nrunning userfaultfd_must_wait() again to know if the loop should be\nrepeated, and it would also require retaking the rwsem and revalidating\nthe whole vma status.\n\nIt seems simpler to wait the targeted wakeup so that if false wakeups\nmaterialize we still wait for our specific wakeup event, unless of\ncourse there are signals or the uffd was released.\n\nDebug code collecting the stack trace of the wakeup showed this:\n\n  $ ./userfaultfd 100 99999\n  nr_pages: 25600, nr_pages_per_cpu: 800\n  bounces: 99998, mode: racing ver poll, userfaults: 32 35 90 232 30 138 69 82 34 30 139 40 40 31 20 19 43 13 15 28 27 38 21 43 56 22 1 17 31 8 4 2\n  bounces: 99997, mode: rnd ver poll, Bus error (core dumped)\n\n    save_stack_trace+0x2b/0x50\n    try_to_wake_up+0x2a6/0x580\n    wake_up_q+0x32/0x70\n    rwsem_wake+0xe0/0x120\n    call_rwsem_wake+0x1b/0x30\n    up_write+0x3b/0x40\n    vm_mmap_pgoff+0x9c/0xc0\n    SyS_mmap_pgoff+0x1a9/0x240\n    SyS_mmap+0x22/0x30\n    entry_SYSCALL_64_fastpath+0x1f/0xbd\n    0xffffffffffffffff\n    FAULT_FLAG_ALLOW_RETRY missing 70\n  CPU: 24 PID: 1054 Comm: userfaultfd Tainted: G        W       4.8.0+ #30\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014\n  Call Trace:\n    dump_stack+0xb8/0x112\n    handle_userfault+0x572/0x650\n    handle_mm_fault+0x12cb/0x1520\n    __do_page_fault+0x175/0x500\n    trace_do_page_fault+0x61/0x270\n    do_async_page_fault+0x19/0x90\n    async_page_fault+0x25/0x30\n\nThis always happens when the main userfault selftest thread is running\nclone() while glibc runs either mprotect or mmap (both taking mmap_sem\ndown_write()) to allocate the thread stack of the background threads,\nwhile locking/userfault threads already run at full throttle and are\nsusceptible to false wakeups that may cause handle_userfault() to return\nbefore than expected (which results in graceful SIGBUS at the next\nattempt).\n\nThis was reproduced only with \u003e\u003d32 CPUs because the loop to start the\nthread where clone() is too quick with fewer CPUs, while with 32 CPUs\nthere\u0027s already significant activity on ~32 locking and userfault\nthreads when the last background threads are started with clone().\n\nThis \u003e\u003d32 CPUs SMP race condition is likely reproducible only with the\nselftest because of the much heavier userfault load it generates if\ncompared to real apps.\n\nWe\u0027ll have to allow \"one more\" VM_FAULT_RETRY for the WP support and a\npatch floating around that provides it also hidden this problem but in\nreality only is successfully at hiding the problem.\n\nFalse wakeups could still happen again the second time\nhandle_userfault() is invoked, even if it\u0027s a so rare race condition\nthat getting false wakeups twice in a row is impossible to reproduce.\nThis full fix is needed for correctness, the only alternative would be\nto allow VM_FAULT_RETRY to be returned infinitely.  With this fix the WP\nsupport can stick to a strict \"one more\" VM_FAULT_RETRY logic (no need\nof returning it infinite times to avoid the SIGBUS).\n\nLink: http://lkml.kernel.org/r/20170111005535.13832-2-aarcange@redhat.com\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nReported-by: Shubham Kumar Sharma \u003cshubham.kumar.sharma@oracle.com\u003e\nTested-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nAcked-by: Hillf Danton \u003chillf.zj@alibaba-inc.com\u003e\nCc: Michael Rapoport \u003cRAPOPORT@il.ibm.com\u003e\nCc: \"Dr. David Alan Gilbert\" \u003cdgilbert@redhat.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "82b0f8c39a3869b6fd2a10e180a862248736ec6f",
      "tree": "cc10f381647ad18a17b05020783991ed32ae4590",
      "parents": [
        "8b7457ef9a9eb46cd1675d40d8e1fd3c47a38395"
      ],
      "author": {
        "name": "Jan Kara",
        "email": "jack@suse.cz",
        "time": "Wed Dec 14 15:06:58 2016 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Dec 14 16:04:09 2016 -0800"
      },
      "message": "mm: join struct fault_env and vm_fault\n\nCurrently we have two different structures for passing fault information\naround - struct vm_fault and struct fault_env.  DAX will need more\ninformation in struct vm_fault to handle its faults so the content of\nthat structure would become event closer to fault_env.  Furthermore it\nwould need to generate struct fault_env to be able to call some of the\ngeneric functions.  So at this point I don\u0027t think there\u0027s much use in\nkeeping these two structures separate.  Just embed into struct vm_fault\nall that is needed to use it for both purposes.\n\nLink: http://lkml.kernel.org/r/1479460644-25076-2-git-send-email-jack@suse.cz\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Ross Zwisler \u003cross.zwisler@linux.intel.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "bae473a423f65e480db83c85b5e92254f6dfcb28",
      "tree": "9e09cd8cbcafdcc1a27298700f69f8f86f929392",
      "parents": [
        "dcddffd41d3f1d3bdcc1dce3f1cd142779b6d4c1"
      ],
      "author": {
        "name": "Kirill A. Shutemov",
        "email": "kirill.shutemov@linux.intel.com",
        "time": "Tue Jul 26 15:25:20 2016 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jul 26 16:19:19 2016 -0700"
      },
      "message": "mm: introduce fault_env\n\nThe idea borrowed from Peter\u0027s patch from patchset on speculative page\nfaults[1]:\n\nInstead of passing around the endless list of function arguments,\nreplace the lot with a single structure so we can change context without\nendless function signature changes.\n\nThe changes are mostly mechanical with exception of faultaround code:\nfilemap_map_pages() got reworked a bit.\n\nThis patch is preparation for the next one.\n\n[1] http://lkml.kernel.org/r/20141020222841.302891540@infradead.org\n\nLink: http://lkml.kernel.org/r/1466021202-61880-9-git-send-email-kirill.shutemov@linux.intel.com\nSigned-off-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    }
  ],
  "next": "d2005e3f41d4f9299e2df6a967c8beb5086967a9"
}