This is the 5.4.302 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkwI4sACgkQONu9yGCS
 aT46Mg//f9a0IiDkO2ybqt7JAStVCkQ5MM2CgPjlgHGyns6hWyxUES5twrVrTO0v
 mdYmeXLztyFSArUHMnoWcUK1O4IVUVK32SX3eEMFy81ojX+LpYm/m5TZg3tU1rvq
 jaTE0i6ihmwG48ciB63i28TxQfhY8QuVJTEV400Ro+ILY2hs1l6c6DYf9i0S/v4g
 gKDQpzuwR0AnGNFI+D6D6D0D8jbLVcBYnAndyvDrLYTIILczf7nJ66ZePYTBvlg3
 rIiIMjG0BX0V2ctPmez3mz0BDTpnZY4pwIwIG8K/bX4UZrgOKJPSZWh1SzbASaGN
 vTJQwRs9nGHvM/kK9CUUsi1+hhaAl7UmQEiRJ06BkXlR7chFCcL/fI/VEQjf12wL
 dyw6/RR/rXPxLbLxCYk+9C9ANTE/ByirLKSeJkNT/yoeiCSpaFuKxtoYkNslBK/B
 i0/Qweez0IzJuVUtUp/2/PrkNKyCaEbbqhDerbnLhU/0lcnT0fkFlFoLLLNzxNdt
 hj6RRJrcpoQB+Qrkf0+5Sxx6W1feP5clZJ2nRSL+rtUNEzCWk7HVh4GprCyvDn6i
 xjINN9Yh40suJkuKaE0+IrPF1tcL3/128OaT3e0VlL57wK5M4YmJTwrb7g4mlR2/
 31Z4bL1IFYju9WYPW2fWHrdrZUH4h22vLcpW6Q/VFdG0wTC6wVc=
 =Wt2i
 -----END PGP SIGNATURE-----

Merge 5.4.302 into android11-5.4-lts

Changes in 5.4.302
	net/sched: sch_qfq: Fix null-deref in agg_dequeue
	x86/bugs: Fix reporting of LFENCE retpoline
	btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
	net: usb: asix_devices: Check return value of usbnet_get_endpoints
	fbdev: atyfb: Check if pll_ops->init_pll failed
	ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
	fbdev: bitblit: bound-check glyph index in bit_putcs*
	fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
	fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
	ASoC: qdsp6: q6asm: do not sleep while atomic
	wifi: ath10k: Fix memory leak on unsupported WMI command
	usbnet: Prevents free active kevent
	drm/etnaviv: fix flush sequence logic
	regmap: slimbus: fix bus_context pointer in regmap init calls
	net: phy: dp83867: Disable EEE support as not implemented
	wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
	x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
	net: ravb: Enforce descriptor type ordering
	devcoredump: Fix circular locking dependency with devcd->mutex.
	can: gs_usb: increase max interface to U8_MAX
	serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
	serial: 8250_dw: Use devm_add_action_or_reset()
	serial: 8250_dw: handle reset control deassert error
	usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
	soc: qcom: smem: Fix endian-unaware access of num_entries
	spi: loopback-test: Don't use %pK through printk
	bpf: Don't use %pK through printk
	mmc: host: renesas_sdhi: Fix the actual clock
	memstick: Add timeout to prevent indefinite waiting
	ACPI: video: force native for Lenovo 82K8
	selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
	cpufreq/longhaul: handle NULL policy in longhaul_exit
	arc: Fix __fls() const-foldability via __builtin_clzl()
	irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
	mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
	ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
	tee: allow a driver to allocate a tee_device without a pool
	video: backlight: lp855x_bl: Set correct EPROM start for LP8556
	clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
	uprobe: Do not emulate/sstep original instruction when ip is changed
	hwmon: (dell-smm) Add support for Dell OptiPlex 7040
	tools/cpupower: Fix incorrect size in cpuidle_state_disable()
	tools/power x86_energy_perf_policy: Enhance HWP enable
	tools/power x86_energy_perf_policy: Prefer driver HWP limits
	mfd: stmpe: Remove IRQ domain upon removal
	mfd: stmpe-i2c: Add missing MODULE_LICENSE
	mfd: madera: Work around false-positive -Wininitialized warning
	drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
	PCI: Disable MSI on RDC PCI to PCIe bridges
	selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
	selftests/net: Ensure assert() triggers in psock_tpacket.c
	drm/amdkfd: return -ENOTTY for unsupported IOCTLs
	media: pci: ivtv: Don't create fake v4l2_fh
	x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
	powerpc/eeh: Use result of error_detected() in uevent
	bridge: Redirect to backup port when port is administratively down
	net: ipv6: fix field-spanning memcpy warning in AH output
	media: imon: make send_packet() more robust
	iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
	usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
	char: misc: Does not request module for miscdevice with dynamic minor
	net: When removing nexthops, don't call synchronize_net if it is not necessary
	net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
	PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
	rds: Fix endianness annotation for RDS_MPATH_HASH
	extcon: adc-jack: Fix wakeup source leaks on device unbind
	drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
	media: fix uninitialized symbol warnings
	mips: lantiq: danube: add missing properties to cpu node
	mips: lantiq: danube: add missing device_type in pci node
	mips: lantiq: xway: sysctrl: rename stp clock
	scsi: pm8001: Use int instead of u32 to store error codes
	dmaengine: sh: setup_xref error handling
	dmaengine: mv_xor: match alloc_wc and free_wc
	dmaengine: dw-edma: Set status for callback_result
	net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
	ALSA: usb-audio: apply quirk for MOONDROP Quark2
	net: call cond_resched() less often in __release_sock()
	usb: gadget: f_hid: Fix zero length packet transfer
	phy: cadence: cdns-dphy: Enable lower resolutions in dphy
	net: sh_eth: Disable WoL if system can not suspend
	media: redrat3: use int type to store negative error codes
	selftests: Disable dad for ipv6 in fcnal-test.sh
	selftests: Replace sleep with slowwait
	net/cls_cgroup: Fix task_get_classid() during qdisc run
	selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
	scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
	scsi: lpfc: Define size of debugfs entry for xri rebalancing
	allow finish_no_open(file, ERR_PTR(-E...))
	usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
	usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
	ipv6: np->rxpmtu race annotation
	jfs: Verify inode mode when loading from disk
	jfs: fix uninitialized waitqueue in transaction manager
	net: intel: fm10k: Fix parameter idx set but not used
	sparc/module: Add R_SPARC_UA64 relocation handling
	remoteproc: qcom: q6v5: Avoid handling handover twice
	NFSv4: handle ERR_GRACE on delegation recalls
	NFSv4.1: fix mount hang after CREATE_SESSION failure
	nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
	net: macb: avoid dealing with endianness in macb_set_hwaddr()
	Bluetooth: SCO: Fix UAF on sco_conn_free
	Bluetooth: bcsp: receive data only if registered
	page_pool: Clamp pool size to max 16K pages
	orangefs: fix xattr related buffer overflow...
	ACPICA: Update dsmethod.c to get rid of unused variable warning
	fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
	9p: fix /sys/fs/9p/caches overwriting itself
	9p: sysfs_init: don't hardcode error to ENOMEM
	ACPI: property: Return present device nodes only on fwnode interface
	fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
	ceph: add checking of wait_for_completion_killable() return value
	net: vlan: sync VLAN features with lower device
	net: dsa/b53: change b53_force_port_config() pause argument
	net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
	net: dsa: b53: fix resetting speed and pause on forced link
	net: dsa: b53: fix enabling ip multicast
	net: dsa: b53: stop reading ARL entries if search is done
	sctp: Hold RCU read lock while iterating over address list
	sctp: Prevent TOCTOU out-of-bounds write
	net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
	tracing: Fix memory leaks in create_field_var()
	extcon: adc-jack: Cleanup wakeup source only if it was enabled
	compiler_types: Move unused static inline functions warning to W=2
	NFS4: Fix state renewals missing after boot
	HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
	ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
	net: fec: correct rx_bytes statistic for the case SHIFT16 is set
	Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
	Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
	Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
	Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
	sctp: get netns from asoc and ep base
	sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
	tipc: simplify the finalize work queue
	tipc: Fix use-after-free in tipc_mon_reinit_self().
	net: mdio: fix resource leak in mdiobus_register_device()
	wifi: mac80211: skip rate verification for not captured PSDUs
	net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
	net/mlx5e: Fix maxrate wraparound in threshold between units
	net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
	net_sched: remove need_resched() from qdisc_run()
	net_sched: limit try_bulk_dequeue_skb() batches
	Bluetooth: L2CAP: export l2cap_chan_hold for modules
	regulator: fixed: use dev_err_probe for register
	regulator: fixed: fix GPIO descriptor leak on register failure
	ASoC: cs4271: Fix regulator leak on probe failure
	drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
	ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
	mm/ksm: fix flag-dropping behavior in ksm_madvise
	gcov: add support for GCC 15
	strparser: Fix signed/unsigned mismatch bug
	ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
	spi: Try to get ACPI GPIO IRQ earlier
	EDAC/altera: Handle OCRAM ECC enable after warm reset
	EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
	isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
	HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
	be2net: pass wrb_params in case of OS2BMC
	Input: cros_ec_keyb - fix an invalid memory access
	scsi: sg: Do not sleep in atomic context
	scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
	MIPS: Malta: Fix !EVA SOC-it PCI MMIO
	mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
	net: openvswitch: remove never-working support for setting nsh fields
	s390/ctcm: Fix double-kfree
	vsock: Ignore signal/timeout on connect() if already established
	kconfig/mconf: Initialize the default locale at startup
	kconfig/nconf: Initialize the default locale at startup
	mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
	ALSA: usb-audio: fix uac2 clock source at terminal parser
	net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
	uio_hv_generic: Set event for all channels on the device
	net: qede: Initialize qede_ll_ops with designated initializer
	net: netpoll: fix incorrect refcount handling causing incorrect cleanup
	pmdomain: arm: scmi: Fix genpd leak on provider registration failure
	pmdomain: imx: Fix reference count leak in imx_gpc_remove
	fs/proc: fix uaf in proc_readdir_de()
	ata: libata-scsi: Fix system suspend for a security locked drive
	usb: deprecate the third argument of usb_maxpacket()
	Input: remove third argument of usb_maxpacket()
	Input: pegasus-notetaker - fix potential out-of-bounds access
	Linux 5.4.302

Change-Id: I7291d845c3cfde8a154957356156fadcc4b96b80
Signed-off-by: Greg Kroah-Hartman <[email protected]>

drivers/usb/gadget/function/f_fs.c

@@ -2012,7 +2012,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 	ep = func->eps;
 	epfile = ffs->epfiles;
 	count = ffs->eps_count;
-	while(count--) {
+	if (!epfile) {
+		ret = -ENOMEM;
+		goto done;
+	}
+
+	while (count--) {
 		ep->ep->driver_data = ep;
 
 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
@@ -2036,6 +2041,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 	}
 
 	wake_up_interruptible(&ffs->wait);
+done:
 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
 
 	return ret;

drivers/usb/gadget/function/f_hid.c

@@ -496,7 +496,7 @@ try_again:
 	}
 
 	req->status   = 0;
-	req->zero     = 0;
+	req->zero     = 1;
 	req->length   = count;
 	req->complete = f_hidg_req_complete;
 	req->context  = hidg;
@@ -767,7 +767,7 @@ stall:
 	return -EOPNOTSUPP;
 
 respond:
-	req->zero = 0;
+	req->zero = 1;
 	req->length = length;
 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
 	if (status < 0)

drivers/usb/gadget/function/f_ncm.c

@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
 
 	ncm_opts->bound = true;
 
+	ncm_string_defs[1].s = ncm->ethaddr;
+
 	us = usb_gstrings_attach(cdev, ncm_strings,
 				 ARRAY_SIZE(ncm_string_defs));
 	if (IS_ERR(us)) {
@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
 		mutex_unlock(&opts->lock);
 		return ERR_PTR(-EINVAL);
 	}
-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
 
 	spin_lock_init(&ncm->lock);
 	ncm_reset_values(ncm);

drivers/usb/host/xhci-plat.c

@@ -222,6 +222,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 	}
 
 	pm_runtime_set_active(&pdev->dev);
+	pm_runtime_use_autosuspend(&pdev->dev);
 	pm_runtime_enable(&pdev->dev);
 	pm_runtime_get_noresume(&pdev->dev);
 

drivers/usb/mon/mon_bin.c

@@ -68,18 +68,20 @@
  * The magic limit was calculated so that it allows the monitoring
  * application to pick data once in two ticks. This way, another application,
  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
- * enormous overhead built into the bus protocol, so we need about 1000 KB.
+ *
+ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
+ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
+ * buffer size is set to 64 MiB to accommodate this.
  *
  * This is still too much for most cases, where we just snoop a few
  * descriptor fetches for enumeration. So, the default is a "reasonable"
- * amount for systems with HZ=250 and incomplete bus saturation.
+ * amount for typical, low-throughput use cases.
  *
  * XXX What about multi-megabyte URBs which take minutes to transfer?
  */
-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
+#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
+#define BUFF_DFL      CHUNK_ALIGN(300*1024)
+#define BUFF_MIN        CHUNK_ALIGN(8*1024)
 
 /*
  * The per-event API header (2 per URB).