--- /dev/null
+From f5d435fe1786060ffd9ec336063376b09d705e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2024 08:50:03 -0700
+Subject: apparmor: fix policy_unpack_test on big endian systems
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 98c0cc48e27e9d269a3e4db2acd72b486c88ec77 ]
+
+policy_unpack_test fails on big endian systems because data byte order
+is expected to be little endian but is generated in host byte order.
+This results in test failures such as:
+
+ # policy_unpack_test_unpack_array_with_null_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:150
+ Expected array_size == (u16)16, but
+ array_size == 4096 (0x1000)
+ (u16)16 == 16 (0x10)
+ # policy_unpack_test_unpack_array_with_null_name: pass:0 fail:1 skip:0 total:1
+ not ok 3 policy_unpack_test_unpack_array_with_null_name
+ # policy_unpack_test_unpack_array_with_name: EXPECTATION FAILED at security/apparmor/policy_unpack_test.c:164
+ Expected array_size == (u16)16, but
+ array_size == 4096 (0x1000)
+ (u16)16 == 16 (0x10)
+ # policy_unpack_test_unpack_array_with_name: pass:0 fail:1 skip:0 total:1
+
+Add the missing endianness conversions when generating test data.
+
+Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack")
+Cc: Brendan Higgins <brendanhiggins@google.com>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack_test.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c
+index 5c9bde25e56df..2b8003eb4f463 100644
+--- a/security/apparmor/policy_unpack_test.c
++++ b/security/apparmor/policy_unpack_test.c
+@@ -80,14 +80,14 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
+ *(buf + 1) = strlen(TEST_U32_NAME) + 1;
+ strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;
+- *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;
++ *((__le32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = cpu_to_le32(TEST_U32_DATA);
+
+ buf = e->start + TEST_NAMED_U64_BUF_OFFSET;
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_U64_NAME) + 1;
+ strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;
+- *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;
++ *((__le64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = cpu_to_le64(TEST_U64_DATA);
+
+ buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;
+ *buf = AA_NAME;
+@@ -103,7 +103,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
+ *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;
+ strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;
+- *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;
++ *((__le16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = cpu_to_le16(TEST_ARRAY_SIZE);
+
+ return e;
+ }
+--
+2.43.0
+
--- /dev/null
+From 1ae73bb96d6bacfeb3dbdbc2225757125bfccf69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 13:31:11 +0200
+Subject: ARM: dts: omap3-n900: correct the accelerometer orientation
+
+From: Sicelo A. Mhlongo <absicsz@gmail.com>
+
+[ Upstream commit 5062d9c0cbbc202e495e9b20f147f64ef5cc2897 ]
+
+Negate the values reported for the accelerometer z-axis in order to
+match Documentation/devicetree/bindings/iio/mount-matrix.txt.
+
+Fixes: 14a213dcb004 ("ARM: dts: n900: use iio driver for accelerometer")
+
+Signed-off-by: Sicelo A. Mhlongo <absicsz@gmail.com>
+Reviewed-By: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20240722113137.3240847-1-absicsz@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/omap3-n900.dts b/arch/arm/boot/dts/ti/omap/omap3-n900.dts
+index 07c5b963af78a..4bde3342bb959 100644
+--- a/arch/arm/boot/dts/ti/omap/omap3-n900.dts
++++ b/arch/arm/boot/dts/ti/omap/omap3-n900.dts
+@@ -781,7 +781,7 @@
+
+ mount-matrix = "-1", "0", "0",
+ "0", "1", "0",
+- "0", "0", "1";
++ "0", "0", "-1";
+ };
+
+ cam1: camera@3e {
+--
+2.43.0
+
--- /dev/null
+From 1a235795507b2ad9d522bf8b68726779817cca79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2024 14:58:48 +0200
+Subject: arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
+
+From: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+
+[ Upstream commit cd0c6872aab4d2c556a5e953e6926a1b4485e543 ]
+
+DRAM starts at 0x80000000.
+
+Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board")
+Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi
+index 9d2328c185c90..fe951f86a96bd 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352.dtsi
+@@ -19,7 +19,7 @@
+ linux,cma {
+ compatible = "shared-dma-pool";
+ reusable;
+- alloc-ranges = <0 0x60000000 0 0x40000000>;
++ alloc-ranges = <0 0x80000000 0 0x40000000>;
+ size = <0 0x10000000>;
+ linux,cma-default;
+ };
+--
+2.43.0
+
--- /dev/null
+From 7dcd5e296bc1e4a357cc86d34f0caf79a140cde4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2024 14:58:52 +0200
+Subject: arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo
+
+From: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+
+[ Upstream commit 5f0a894bfa3c26ce61deda4c52b12e8ec84d876a ]
+
+Fix typo in assignment of SD-Card cd-gpios.
+
+Fixes: c982ecfa7992 ("arm64: dts: freescale: add initial device tree for MBa93xxLA SBC board")
+Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts
+index eb3f4cfb69863..ad77a96c5617b 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-tqma9352-mba93xxla.dts
+@@ -438,7 +438,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2_hs>, <&pinctrl_usdhc2_gpio>;
+ pinctrl-1 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>;
+ pinctrl-2 = <&pinctrl_usdhc2_uhs>, <&pinctrl_usdhc2_gpio>;
+- cd-gpios = <&gpio3 00 GPIO_ACTIVE_LOW>;
++ cd-gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
+ vmmc-supply = <®_usdhc2_vmmc>;
+ bus-width = <4>;
+ no-sdio;
+--
+2.43.0
+
--- /dev/null
+From 5ac4763129c94dfcd01a14843079ec78f19800d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jul 2024 12:20:17 -0500
+Subject: arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 4e69cd835a2d5c3915838491f59a68ee697a87d0 ]
+
+The L/R clock needs to be controlled by the SAI3 instead of the
+CODEC to properly achieve stereo sound. Doing this allows removes
+the need for unnecessary clock manipulation to try to get the
+CODEC's clock in sync with the SAI3 clock, since the CODEC can cope
+with a wide variety of clock inputs.
+
+Fixes: 161af16c18f3 ("arm64: dts: imx8mp-beacon-kit: Fix audio_pll2 clock")
+Fixes: 69e2f37a6ddc ("arm64: dts: imx8mp-beacon-kit: Enable WM8962 Audio CODEC")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts
+index e5d3901f29136..e1f59bdcae497 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-beacon-kit.dts
+@@ -211,13 +211,12 @@
+
+ simple-audio-card,cpu {
+ sound-dai = <&sai3>;
++ frame-master;
++ bitclock-master;
+ };
+
+ simple-audio-card,codec {
+ sound-dai = <&wm8962>;
+- clocks = <&clk IMX8MP_CLK_IPP_DO_CLKO1>;
+- frame-master;
+- bitclock-master;
+ };
+ };
+ };
+@@ -499,10 +498,9 @@
+ &sai3 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_sai3>;
+- assigned-clocks = <&clk IMX8MP_CLK_SAI3>,
+- <&clk IMX8MP_AUDIO_PLL2> ;
+- assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL2_OUT>;
+- assigned-clock-rates = <12288000>, <361267200>;
++ assigned-clocks = <&clk IMX8MP_CLK_SAI3>;
++ assigned-clock-parents = <&clk IMX8MP_AUDIO_PLL1_OUT>;
++ assigned-clock-rates = <12288000>;
+ fsl,sai-mclk-direction-output;
+ status = "okay";
+ };
+--
+2.43.0
+
--- /dev/null
+From 8d18bac23f34ea3c7f9baaa60ec3df6546ba158c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2024 08:17:22 -0500
+Subject: arm64: dts: imx93: update default value for snps,clk-csr
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit 109f256285dd6a5f8c3bd0d80d39b2ccd4fe314e ]
+
+For the i.MX93 SoC, the default clock rate for the IP of STMMAC EQOS is
+312.5 MHz. According to the following mapping table from the i.MX93
+reference manual, this clock rate corresponds to a CSR value of 6.
+
+ 0000: CSR clock = 60-100 MHz; MDC clock = CSR clock/42
+ 0001: CSR clock = 100-150 MHz; MDC clock = CSR clock/62
+ 0010: CSR clock = 20-35 MHz; MDC clock = CSR clock/16
+ 0011: CSR clock = 35-60 MHz; MDC clock = CSR clock/26
+ 0100: CSR clock = 150-250 MHz; MDC clock = CSR clock/102
+ 0101: CSR clock = 250-300 MHz; MDC clock = CSR clock/124
+ 0110: CSR clock = 300-500 MHz; MDC clock = CSR clock/204
+ 0111: CSR clock = 500-800 MHz; MDC clock = CSR clock/324
+
+Fixes: f2d03ba997cb ("arm64: dts: imx93: reorder device nodes")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi
+index 4a3f42355cb8f..a0993022c102d 100644
+--- a/arch/arm64/boot/dts/freescale/imx93.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi
+@@ -1105,7 +1105,7 @@
+ <&clk IMX93_CLK_SYS_PLL_PFD0_DIV2>;
+ assigned-clock-rates = <100000000>, <250000000>;
+ intf_mode = <&wakeupmix_gpr 0x28>;
+- snps,clk-csr = <0>;
++ snps,clk-csr = <6>;
+ nvmem-cells = <ð_mac2>;
+ nvmem-cell-names = "mac-address";
+ status = "disabled";
+--
+2.43.0
+
--- /dev/null
+From 511f79557fa244e0e90a2231f945a75ed0ba6d1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2024 15:31:51 +0530
+Subject: arm64: dts: qcom: ipq5332: Fix interrupt trigger type for usb
+
+From: Varadarajan Narayanan <quic_varada@quicinc.com>
+
+[ Upstream commit 60a76f7826b88ebf7697a56fdcd9596b23c2b616 ]
+
+Trigger type is incorrectly specified as IRQ_TYPE_EDGE_BOTH
+instead of IRQ_TYPE_LEVEL_HIGH. This trigger type is not
+supported for SPIs and results in probe failure with -EINVAL.
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Fixes: 927173bf8a0e ("arm64: dts: qcom: Add missing interrupts for qcs404/ipq5332")
+Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
+Link: https://lore.kernel.org/r/20240723100151.402300-3-quic_varada@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq5332.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq5332.dtsi b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
+index 770d9c2fb4562..e3064568f0221 100644
+--- a/arch/arm64/boot/dts/qcom/ipq5332.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
+@@ -321,8 +321,8 @@
+ reg = <0x08af8800 0x400>;
+
+ interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 53 IRQ_TYPE_EDGE_BOTH>,
+- <GIC_SPI 52 IRQ_TYPE_EDGE_BOTH>;
++ <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "pwr_event",
+ "dp_hs_phy_irq",
+ "dm_hs_phy_irq";
+--
+2.43.0
+
--- /dev/null
+From 9a301f8eaec5c5e63c92576101051e1ac34e1897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 14:47:44 +0100
+Subject: firmware: microchip: fix incorrect error report of
+ programming:timeout on success
+
+From: Steve Wilkins <steve.wilkins@raymarine.com>
+
+[ Upstream commit 591940e22e287fb64ac07be275e343d860cb72d6 ]
+
+After successfully programming the SPI flash with an MFPS auto update
+image, the error sysfs attribute reports programming:timeout.
+This is caused by an incorrect check on the return value from
+wait_for_completion_timeout() in mpfs_auto_update_poll_complete().
+
+Fixes: ec5b0f1193ad ("firmware: microchip: add PolarFire SoC Auto Update support")
+Signed-off-by: Steve Wilkins <steve.wilkins@raymarine.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/microchip/mpfs-auto-update.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/microchip/mpfs-auto-update.c b/drivers/firmware/microchip/mpfs-auto-update.c
+index 835a19a7a3a09..4a95fbbf4733e 100644
+--- a/drivers/firmware/microchip/mpfs-auto-update.c
++++ b/drivers/firmware/microchip/mpfs-auto-update.c
+@@ -153,7 +153,7 @@ static enum fw_upload_err mpfs_auto_update_poll_complete(struct fw_upload *fw_up
+ */
+ ret = wait_for_completion_timeout(&priv->programming_complete,
+ msecs_to_jiffies(AUTO_UPDATE_TIMEOUT_MS));
+- if (ret)
++ if (!ret)
+ return FW_UPLOAD_ERR_TIMEOUT;
+
+ return FW_UPLOAD_ERR_NONE;
+--
+2.43.0
+
--- /dev/null
+From c732ca9198e217d54084b5305f40d5674dfab5cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 09:06:28 +1000
+Subject: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party
+ lease
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 40927f3d0972bf86357a32a5749be71a551241b6 ]
+
+It is not safe to dereference fl->c.flc_owner without first confirming
+fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict()
+tests fl_lmops but largely ignores the result and assumes that flc_owner
+is an nfs4_delegation anyway. This is wrong.
+
+With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave
+as it did before the change mentioned below. This is the same as the
+current code, but without any reference to a possible delegation.
+
+Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 07f2496850c4c..a366fb1c1b9b4 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -8859,7 +8859,15 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry,
+ */
+ if (type == F_RDLCK)
+ break;
+- goto break_lease;
++
++ nfsd_stats_wdeleg_getattr_inc(nn);
++ spin_unlock(&ctx->flc_lock);
++
++ status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));
++ if (status != nfserr_jukebox ||
++ !nfsd_wait_for_delegreturn(rqstp, inode))
++ return status;
++ return 0;
+ }
+ if (type == F_WRLCK) {
+ struct nfs4_delegation *dp = fl->c.flc_owner;
+@@ -8868,7 +8876,6 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry,
+ spin_unlock(&ctx->flc_lock);
+ return 0;
+ }
+-break_lease:
+ nfsd_stats_wdeleg_getattr_inc(nn);
+ dp = fl->c.flc_owner;
+ refcount_inc(&dp->dl_stid.sc_count);
+--
+2.43.0
+
--- /dev/null
+From 8df1c65efb4acad084a6e48f75bdfc0042b4019d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 00:51:42 +0200
+Subject: scsi: aacraid: Fix double-free on probe failure
+
+From: Ben Hutchings <benh@debian.org>
+
+[ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ]
+
+aac_probe_one() calls hardware-specific init functions through the
+aac_driver_ident::init pointer, all of which eventually call down to
+aac_init_adapter().
+
+If aac_init_adapter() fails after allocating memory for aac_dev::queues,
+it frees the memory but does not clear that member.
+
+After the hardware-specific init function returns an error,
+aac_probe_one() goes down an error path that frees the memory pointed to
+by aac_dev::queues, resulting.in a double-free.
+
+Reported-by: Michael Gordon <m.gordon.zelenoborsky@gmail.com>
+Link: https://bugs.debian.org/1075855
+Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support")
+Signed-off-by: Ben Hutchings <benh@debian.org>
+Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aacraid/comminit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
+index bd99c5492b7d4..0f64b02443037 100644
+--- a/drivers/scsi/aacraid/comminit.c
++++ b/drivers/scsi/aacraid/comminit.c
+@@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
+
+ if (aac_comm_init(dev)<0){
+ kfree(dev->queues);
++ dev->queues = NULL;
+ return NULL;
+ }
+ /*
+@@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
+ */
+ if (aac_fib_setup(dev) < 0) {
+ kfree(dev->queues);
++ dev->queues = NULL;
+ return NULL;
+ }
+
+--
+2.43.0
+
usb-cdnsp-fix-incorrect-index-in-cdnsp_get_hw_deq-function.patch
usb-cdnsp-fix-for-link-trb-with-tc.patch
usb-typec-ucsi-move-unregister-out-of-atomic-section.patch
+arm64-dts-qcom-ipq5332-fix-interrupt-trigger-type-fo.patch
+arm-dts-omap3-n900-correct-the-accelerometer-orienta.patch
+arm64-dts-imx8mp-beacon-kit-fix-stereo-audio-on-wm89.patch
+arm64-dts-imx93-update-default-value-for-snps-clk-cs.patch
+arm64-dts-freescale-imx93-tqma9352-fix-cma-alloc-ran.patch
+arm64-dts-freescale-imx93-tqma9352-mba93xxla-fix-typ.patch
+firmware-microchip-fix-incorrect-error-report-of-pro.patch
+scsi-aacraid-fix-double-free-on-probe-failure.patch
+apparmor-fix-policy_unpack_test-on-big-endian-system.patch
+nfsd-fix-nfsd4_deleg_getattr_conflict-in-presence-of.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
