Merge tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2024-12-01

* tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common: (552 commits)
  UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  ANDROID: add file for recording allowed ABI breaks
  Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
  Revert "spi: fix use-after-free of the add_lock mutex"
  ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER
  BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics
  UPSTREAM: x86/percpu: Clean up percpu_add_op()
  UPSTREAM: x86/percpu: Clean up percpu_from_op()
  UPSTREAM: x86/percpu: Clean up percpu_to_op()
  UPSTREAM: x86/percpu: Introduce size abstraction macros
  BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output
  BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze
  FROMGIT: binder: allow freeze notification for dead nodes
  FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
  FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
  BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work()
  FROMGIT: binder: fix OOB in binder_add_freeze_work()
  FROMGIT: binder: fix node UAF in binder_add_freeze_work()
  Linux 5.4.286
  mm: avoid leaving partial pfn mappings around in error case
  ...

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.txt
	arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.yaml
	drivers/clk/qcom/clk-rpmh.c
	drivers/usb/dwc3/core.c
	fs/erofs/decompressor.c
	net/qrtr/qrtr.c

Change-Id: Iae3a7502b304d7be66da795411c4f330eef8b693
This commit is contained in:
Michael Bestas 2024-12-16 01:08:23 +02:00
commit 0262d4e51f
No known key found for this signature in database
GPG key ID: CC95044519BE6669
480 changed files with 4407 additions and 2292 deletions

View file

@ -2085,7 +2085,6 @@ struct cache_args {
sector_t cache_sectors;
struct dm_dev *origin_dev;
sector_t origin_sectors;
uint32_t block_size;
@ -2167,6 +2166,7 @@ static int parse_cache_dev(struct cache_args *ca, struct dm_arg_set *as,
static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as,
char **error)
{
sector_t origin_sectors;
int r;
if (!at_least_one_arg(as, error))
@ -2179,8 +2179,8 @@ static int parse_origin_dev(struct cache_args *ca, struct dm_arg_set *as,
return r;
}
ca->origin_sectors = get_dev_size(ca->origin_dev);
if (ca->ti->len > ca->origin_sectors) {
origin_sectors = get_dev_size(ca->origin_dev);
if (ca->ti->len > origin_sectors) {
*error = "Device size larger than cached device";
return -EINVAL;
}
@ -2506,7 +2506,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
ca->metadata_dev = ca->origin_dev = ca->cache_dev = NULL;
origin_blocks = cache->origin_sectors = ca->origin_sectors;
origin_blocks = cache->origin_sectors = ti->len;
origin_blocks = block_div(origin_blocks, ca->block_size);
cache->origin_blocks = to_oblock(origin_blocks);
@ -2999,19 +2999,19 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache)
static bool can_resize(struct cache *cache, dm_cblock_t new_size)
{
if (from_cblock(new_size) > from_cblock(cache->cache_size)) {
if (cache->sized) {
DMERR("%s: unable to extend cache due to missing cache table reload",
cache_device_name(cache));
return false;
}
DMERR("%s: unable to extend cache due to missing cache table reload",
cache_device_name(cache));
return false;
}
/*
* We can't drop a dirty block when shrinking the cache.
*/
while (from_cblock(new_size) < from_cblock(cache->cache_size)) {
new_size = to_cblock(from_cblock(new_size) + 1);
if (is_dirty(cache, new_size)) {
if (cache->loaded_mappings) {
new_size = to_cblock(find_next_bit(cache->dirty_bitset,
from_cblock(cache->cache_size),
from_cblock(new_size)));
if (new_size != cache->cache_size) {
DMERR("%s: unable to shrink cache; cache block %llu is dirty",
cache_device_name(cache),
(unsigned long long) from_cblock(new_size));
@ -3047,20 +3047,15 @@ static int cache_preresume(struct dm_target *ti)
/*
* Check to see if the cache has resized.
*/
if (!cache->sized) {
r = resize_cache_dev(cache, csize);
if (r)
return r;
cache->sized = true;
} else if (csize != cache->cache_size) {
if (!cache->sized || csize != cache->cache_size) {
if (!can_resize(cache, csize))
return -EINVAL;
r = resize_cache_dev(cache, csize);
if (r)
return r;
cache->sized = true;
}
if (!cache->loaded_mappings) {

View file

@ -84,8 +84,8 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
}
uc->physical_start = start;
uc->unstripe_offset = uc->unstripe * uc->chunk_size;
uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size;
uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size;
uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size;
uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0;
tmp_len = ti->len;

View file

@ -3069,7 +3069,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
sector_t sect;
int must_sync;
int any_working;
int need_recover = 0;
struct raid10_info *mirror = &conf->mirrors[i];
struct md_rdev *mrdev, *mreplace;
@ -3077,14 +3076,13 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
mrdev = rcu_dereference(mirror->rdev);
mreplace = rcu_dereference(mirror->replacement);
if (mrdev != NULL &&
!test_bit(Faulty, &mrdev->flags) &&
!test_bit(In_sync, &mrdev->flags))
need_recover = 1;
if (mrdev && (test_bit(Faulty, &mrdev->flags) ||
test_bit(In_sync, &mrdev->flags)))
mrdev = NULL;
if (mreplace && test_bit(Faulty, &mreplace->flags))
mreplace = NULL;
if (!need_recover && !mreplace) {
if (!mrdev && !mreplace) {
rcu_read_unlock();
continue;
}
@ -3118,7 +3116,8 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
rcu_read_unlock();
continue;
}
atomic_inc(&mrdev->nr_pending);
if (mrdev)
atomic_inc(&mrdev->nr_pending);
if (mreplace)
atomic_inc(&mreplace->nr_pending);
rcu_read_unlock();
@ -3205,7 +3204,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
r10_bio->devs[1].devnum = i;
r10_bio->devs[1].addr = to_addr;
if (need_recover) {
if (mrdev) {
bio = r10_bio->devs[1].bio;
bio->bi_next = biolist;
biolist = bio;
@ -3250,7 +3249,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
for (k = 0; k < conf->copies; k++)
if (r10_bio->devs[k].devnum == i)
break;
if (!test_bit(In_sync,
if (mrdev && !test_bit(In_sync,
&mrdev->flags)
&& !rdev_set_badblocks(
mrdev,
@ -3276,12 +3275,14 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
if (rb2)
atomic_dec(&rb2->remaining);
r10_bio = rb2;
rdev_dec_pending(mrdev, mddev);
if (mrdev)
rdev_dec_pending(mrdev, mddev);
if (mreplace)
rdev_dec_pending(mreplace, mddev);
break;
}
rdev_dec_pending(mrdev, mddev);
if (mrdev)
rdev_dec_pending(mrdev, mddev);
if (mreplace)
rdev_dec_pending(mreplace, mddev);
if (r10_bio->devs[0].bio->bi_opf & MD_FAILFAST) {