This is the 5.4.240 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQtPbUACgkQONu9yGCS
 aT462xAAhgh6J/KB4thj31ULLDPkX3zEuTLKIBlLK617NkKHF9k0XA6oAo9A2Fyy
 t/MfXJvjmmL0kxsWqmoir0ZrPMifgdAK5hoxjXfvjWYtlYi3k0CXqXlg4YQ9Xalp
 VU3O0RRli3KQxKK3u1PhnMMui7+l3pMELza3pUvyhCxRJx3K9loXkbrFZqdOvXEV
 QuZ0ugKaxEwWnwStqIzIAUw+jt/13TwPrVQC6cBjkeOOItw2kNw1SPzrjptfHahG
 M8fApzAKEgZPa49gDw95hZLawt4Acf5suITLgktBtzniFbj8c5A7jaYMFnaKVv3/
 1zUhDu6VYZ5UfLzwYoLnmZ08vWVCTi8r28MJ/f1UdkPlhH9T6blos5RdGB9+4Al8
 17KmOPSXLjzs36cSJFaj521earJSrcwvhsc/sc0ENk0U3CO1d0JkqZKClD2QRt82
 z4yOlkd8j7SbpMgLdwwKbn0PqlK9YddCH7vXNCeMu9thA+Zjy7Z1zCWzENrh8btt
 EcQls3VfHSue9avVhkb5THlhEjY8Pe4/x061YWCYqzamIg5/9xjmYTE8mJdXQVxs
 zr2wgDikAfXHM440/yQgCiAYLT+gB7ewef+ubbhWVwMDviu8vTWlPAiLqnR7TUAp
 CHvypmojDa6iLVnLGvPmIZTkChGCj0x3u7b5VDBJmlt/DLi8amw=
 =Y+Jp
 -----END PGP SIGNATURE-----

Merge 5.4.240 into android11-5.4-lts

Changes in 5.4.240
	net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
	power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
	iavf: fix inverted Rx hash condition leading to disabled hash
	iavf: fix non-tunneled IPv6 UDP packet type and hashing
	intel/igbvf: free irq on the error path in igbvf_request_msix()
	igbvf: Regard vf reset nack as success
	i2c: imx-lpi2c: check only for enabled interrupt flags
	scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
	net: usb: smsc95xx: Limit packet length to skb->len
	qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
	xirc2ps_cs: Fix use after free bug in xirc2ps_detach
	net: qcom/emac: Fix use after free bug in emac_remove due to race condition
	net/ps3_gelic_net: Fix RX sk_buff length
	net/ps3_gelic_net: Use dma_mapping_error
	keys: Do not cache key in task struct if key is requested from kernel thread
	bpf: Adjust insufficient default bpf_jit_limit
	net/mlx5: Read the TC mapping of all priorities on ETS query
	atm: idt77252: fix kmemleak when rmmod idt77252
	erspan: do not use skb_mac_header() in ndo_start_xmit()
	net/sonic: use dma_mapping_error() for error check
	nvme-tcp: fix nvme_tcp_term_pdu to match spec
	hvc/xen: prevent concurrent accesses to the shared ring
	net: mdio: thunder: Add missing fwnode_handle_put()
	Bluetooth: btqcomsmd: Fix command timeout after setting BD address
	Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
	platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
	hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
	scsi: qla2xxx: Perform lockless command completion in abort path
	uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
	thunderbolt: Use const qualifier for `ring_interrupt_index`
	riscv: Bump COMMAND_LINE_SIZE value to 1024
	ca8210: fix mac_len negative array access
	m68k: Only force 030 bus error if PC not in exception table
	selftests/bpf: check that modifier resolves after pointer
	scsi: target: iscsi: Fix an error message in iscsi_check_key()
	scsi: ufs: core: Add soft dependency on governor_simpleondemand
	scsi: lpfc: Avoid usage of list iterator variable after loop
	net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
	net: usb: qmi_wwan: add Telit 0x1080 composition
	sh: sanitize the flags on sigreturn
	cifs: empty interface list when server doesn't support query interfaces
	scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
	usb: gadget: u_audio: don't let userspace block driver unbind
	fsverity: Remove WQ_UNBOUND from fsverity read workqueue
	igb: revert rtnl_lock() that causes deadlock
	dm thin: fix deadlock when swapping to thin device
	usb: cdns3: Fix issue with using incorrect PCI device function
	usb: chipdea: core: fix return -EINVAL if request role is the same with current role
	usb: chipidea: core: fix possible concurrent when switch role
	wifi: mac80211: fix qos on mesh interfaces
	nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
	i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
	dm stats: check for and propagate alloc_percpu failure
	dm crypt: add cond_resched() to dmcrypt_write()
	sched/fair: sanitize vruntime of entity being placed
	sched/fair: Sanitize vruntime of entity being migrated
	tun: avoid double free in tun_free_netdev
	ocfs2: fix data corruption after failed write
	fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
	bus: imx-weim: fix branch condition evaluates to a garbage value
	md: avoid signed overflow in slot_store()
	ALSA: asihpi: check pao in control_message()
	ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
	fbdev: tgafb: Fix potential divide by zero
	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
	fbdev: nvidia: Fix potential divide by zero
	fbdev: intelfb: Fix potential divide by zero
	fbdev: lxfb: Fix potential divide by zero
	fbdev: au1200fb: Fix potential divide by zero
	ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
	dma-mapping: drop the dev argument to arch_sync_dma_for_*
	mips: bmips: BCM6358: disable RAC flush for TP1
	mtd: rawnand: meson: invalidate cache on polling ECC bit
	scsi: megaraid_sas: Fix crash after a double completion
	ptp_qoriq: fix memory leak in probe()
	regulator: fix spelling mistake "Cant" -> "Can't"
	regulator: Handle deferred clk
	net/net_failover: fix txq exceeding warning
	can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
	s390/vfio-ap: fix memory leak in vfio_ap device driver
	i40e: fix registers dump after run ethtool adapter self test
	bnxt_en: Fix typo in PCI id to device description string mapping
	net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
	net: mvneta: make tx buffer array agnostic
	pinctrl: ocelot: Fix alt mode for ocelot
	Input: alps - fix compatibility with -funsigned-char
	Input: focaltech - use explicitly signed char type
	cifs: prevent infinite recursion in CIFSGetDFSRefer()
	cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
	Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
	xen/netback: don't do grant copy across page boundary
	pinctrl: at91-pio4: fix domain name assignment
	NFSv4: Fix hangs when recovering open state after a server reboot
	ALSA: hda/conexant: Partial revert of a quirk for Lenovo
	ALSA: usb-audio: Fix regression on detection of Roland VS-100
	drm/etnaviv: fix reference leak when mmaping imported buffer
	s390/uaccess: add missing earlyclobber annotations to __clear_user()
	btrfs: scan device in non-exclusive mode
	ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
	net_sched: add __rcu annotation to netdev->qdisc
	net: sched: fix race condition in qdisc_graft()
	firmware: arm_scmi: Fix device node validation for mailbox transport
	gfs2: Always check inode size of inline inodes
	Linux 5.4.240

Change-Id: Ibe603c6cdf434feacfd91e87ba359dc544223a21
Signed-off-by: Greg Kroah-Hartman <[email protected]>

drivers/tty/hvc/hvc_xen.c

@@ -43,6 +43,7 @@ struct xencons_info {
 	int irq;
 	int vtermno;
 	grant_ref_t gntref;
+	spinlock_t ring_lock;
 };
 
 static LIST_HEAD(xenconsoles);
@@ -89,12 +90,15 @@ static int __write_console(struct xencons_info *xencons,
 	XENCONS_RING_IDX cons, prod;
 	struct xencons_interface *intf = xencons->intf;
 	int sent = 0;
+	unsigned long flags;
 
+	spin_lock_irqsave(&xencons->ring_lock, flags);
 	cons = intf->out_cons;
 	prod = intf->out_prod;
 	mb();			/* update queue values before going on */
 
 	if ((prod - cons) > sizeof(intf->out)) {
+		spin_unlock_irqrestore(&xencons->ring_lock, flags);
 		pr_err_once("xencons: Illegal ring page indices");
 		return -EINVAL;
 	}
@@ -104,6 +108,7 @@ static int __write_console(struct xencons_info *xencons,
 
 	wmb();			/* write ring before updating pointer */
 	intf->out_prod = prod;
+	spin_unlock_irqrestore(&xencons->ring_lock, flags);
 
 	if (sent)
 		notify_daemon(xencons);
@@ -146,16 +151,19 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
 	int recv = 0;
 	struct xencons_info *xencons = vtermno_to_xencons(vtermno);
 	unsigned int eoiflag = 0;
+	unsigned long flags;
 
 	if (xencons == NULL)
 		return -EINVAL;
 	intf = xencons->intf;
 
+	spin_lock_irqsave(&xencons->ring_lock, flags);
 	cons = intf->in_cons;
 	prod = intf->in_prod;
 	mb();			/* get pointers before reading ring */
 
 	if ((prod - cons) > sizeof(intf->in)) {
+		spin_unlock_irqrestore(&xencons->ring_lock, flags);
 		pr_err_once("xencons: Illegal ring page indices");
 		return -EINVAL;
 	}
@@ -179,10 +187,13 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
 		xencons->out_cons = intf->out_cons;
 		xencons->out_cons_same = 0;
 	}
+	if (!recv && xencons->out_cons_same++ > 1) {
+		eoiflag = XEN_EOI_FLAG_SPURIOUS;
+	}
+	spin_unlock_irqrestore(&xencons->ring_lock, flags);
+
 	if (recv) {
 		notify_daemon(xencons);
-	} else if (xencons->out_cons_same++ > 1) {
-		eoiflag = XEN_EOI_FLAG_SPURIOUS;
 	}
 
 	xen_irq_lateeoi(xencons->irq, eoiflag);
@@ -239,6 +250,7 @@ static int xen_hvm_console_init(void)
 		info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
 		if (!info)
 			return -ENOMEM;
+		spin_lock_init(&info->ring_lock);
 	} else if (info->intf != NULL) {
 		/* already configured */
 		return 0;
@@ -275,6 +287,7 @@ err:
 
 static int xencons_info_pv_init(struct xencons_info *info, int vtermno)
 {
+	spin_lock_init(&info->ring_lock);
 	info->evtchn = xen_start_info->console.domU.evtchn;
 	/* GFN == MFN for PV guest */
 	info->intf = gfn_to_virt(xen_start_info->console.domU.mfn);
@@ -325,6 +338,7 @@ static int xen_initial_domain_console_init(void)
 		info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
 		if (!info)
 			return -ENOMEM;
+		spin_lock_init(&info->ring_lock);
 	}
 
 	info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
@@ -482,6 +496,7 @@ static int xencons_probe(struct xenbus_device *dev,
 	info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
 	if (!info)
 		return -ENOMEM;
+	spin_lock_init(&info->ring_lock);
 	dev_set_drvdata(&dev->dev, info);
 	info->xbdev = dev;
 	info->vtermno = xenbus_devid_to_vtermno(devid);