mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-05 19:31:57 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Michael Bestas
|
2eb0f824a1 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.0
* sm8350/lineage-20: (841 commits)
UPSTREAM: fs: prevent out-of-bounds array speculation when closing a file descriptor
UPSTREAM: file: let pick_file() tell caller it's done
BACKPORT: rcu-tasks: Add a grace-period start time for throttling and debug
BACKPORT: maccess: rename probe_user_{read,write} to copy_{from,to}_user_nofault
BACKPORT: powerpc: use probe_user_read() and probe_user_write()
BACKPORT: maccess: rename probe_kernel_address to get_kernel_nofault
BACKPORT: tracing/kprobes: handle mixed kernel/userspace probes better
BACKPORT: maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
UPSTREAM: maccess: unexport probe_kernel_write()
UPSTREAM: maccess: return -ERANGE when probe_kernel_read() fails
UPSTREAM: maccess: allow architectures to provide kernel probing directly
BACKPORT: maccess: remove strncpy_from_unsafe
UPSTREAM: bpf:bpf_seq_printf(): handle potentially unsafe format string better
UPSTREAM: bpf: Use strncpy_from_unsafe_strict() in bpf_seq_printf() helper
UPSTREAM: bpf: handle the compat string in bpf_trace_copy_string better
UPSTREAM: bpf: factor out a bpf_trace_copy_string helper
BACKPORT: maccess: always use strict semantics for probe_kernel_read
UPSTREAM: maccess: unify the probe kernel arch hooks
UPSTREAM: maccess: remove probe_read_common and probe_write_common
UPSTREAM: maccess: remove duplicate kerneldoc comments
...
Change-Id: I22cf7d6fb34826727904effb4f012b0ef459149d
|
||
Christoph Hellwig
|
2fbd504840 |
BACKPORT: maccess: rename probe_kernel_address to get_kernel_nofault
Better describe what this helper does, and match the naming of copy_from_kernel_nofault. Also switch the argument order around, so that it acts and looks like get_user(). Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Change-Id: Ia3e47b1cbf80a23b85dc408b3d90db770a27a3dd |
||
|
Michael Bestas
|
ad91405468 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.0
* sm8350/lineage-20: tcp: Fix compiler error due to type confusion fixup! net: usb: rtl8150: Fix frame padding Linux 5.4.302 Input: pegasus-notetaker - fix potential out-of-bounds access Input: remove third argument of usb_maxpacket() usb: deprecate the third argument of usb_maxpacket() ata: libata-scsi: Fix system suspend for a security locked drive fs/proc: fix uaf in proc_readdir_de() pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: arm: scmi: Fix genpd leak on provider registration failure net: netpoll: fix incorrect refcount handling causing incorrect cleanup net: qede: Initialize qede_ll_ops with designated initializer uio_hv_generic: Set event for all channels on the device net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error ALSA: usb-audio: fix uac2 clock source at terminal parser mm/page_alloc: fix hash table order logging in alloc_large_system_hash() kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup vsock: Ignore signal/timeout on connect() if already established s390/ctcm: Fix double-kfree ... Conflicts: drivers/usb/gadget/configfs.c Change-Id: I23044bb8ce42b6bd65eb30d909c4dba15ae3f915 |
||
basamaryan
|
9181ada660 |
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: Linux 5.4.302 Input: pegasus-notetaker - fix potential out-of-bounds access Input: remove third argument of usb_maxpacket() usb: deprecate the third argument of usb_maxpacket() ata: libata-scsi: Fix system suspend for a security locked drive fs/proc: fix uaf in proc_readdir_de() pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: arm: scmi: Fix genpd leak on provider registration failure net: netpoll: fix incorrect refcount handling causing incorrect cleanup net: qede: Initialize qede_ll_ops with designated initializer uio_hv_generic: Set event for all channels on the device net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error ALSA: usb-audio: fix uac2 clock source at terminal parser mm/page_alloc: fix hash table order logging in alloc_large_system_hash() kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup vsock: Ignore signal/timeout on connect() if already established s390/ctcm: Fix double-kfree net: openvswitch: remove never-working support for setting nsh fields mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() MIPS: Malta: Fix !EVA SOC-it PCI MMIO scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() scsi: sg: Do not sleep in atomic context Input: cros_ec_keyb - fix an invalid memory access be2net: pass wrb_params in case of OS2BMC HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection EDAC/altera: Handle OCRAM ECC enable after warm reset spi: Try to get ACPI GPIO IRQ earlier ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe strparser: Fix signed/unsigned mismatch bug gcov: add support for GCC 15 mm/ksm: fix flag-dropping behavior in ksm_madvise ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE ASoC: cs4271: Fix regulator leak on probe failure regulator: fixed: fix GPIO descriptor leak on register failure regulator: fixed: use dev_err_probe for register Bluetooth: L2CAP: export l2cap_chan_hold for modules net_sched: limit try_bulk_dequeue_skb() batches net_sched: remove need_resched() from qdisc_run() net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net/mlx5e: Fix maxrate wraparound in threshold between units net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak wifi: mac80211: skip rate verification for not captured PSDUs net: mdio: fix resource leak in mdiobus_register_device() tipc: Fix use-after-free in tipc_mon_reinit_self(). tipc: simplify the finalize work queue sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto sctp: get netns from asoc and ep base Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF net: fec: correct rx_bytes statistic for the case SHIFT16 is set ASoC: max98090/91: fixed max98091 ALSA widget powering up/down HID: quirks: avoid Cooler Master MM712 dongle wakeup bug NFS4: Fix state renewals missing after boot compiler_types: Move unused static inline functions warning to W=2 extcon: adc-jack: Cleanup wakeup source only if it was enabled tracing: Fix memory leaks in create_field_var() net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup sctp: Prevent TOCTOU out-of-bounds write sctp: Hold RCU read lock while iterating over address list net: dsa: b53: stop reading ARL entries if search is done net: dsa: b53: fix enabling ip multicast net: dsa: b53: fix resetting speed and pause on forced link net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 net: dsa/b53: change b53_force_port_config() pause argument net: vlan: sync VLAN features with lower device ceph: add checking of wait_for_completion_killable() return value fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds ACPI: property: Return present device nodes only on fwnode interface 9p: sysfs_init: don't hardcode error to ENOMEM 9p: fix /sys/fs/9p/caches overwriting itself fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink ACPICA: Update dsmethod.c to get rid of unused variable warning orangefs: fix xattr related buffer overflow... page_pool: Clamp pool size to max 16K pages Bluetooth: bcsp: receive data only if registered Bluetooth: SCO: Fix UAF on sco_conn_free net: macb: avoid dealing with endianness in macb_set_hwaddr() nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing NFSv4.1: fix mount hang after CREATE_SESSION failure NFSv4: handle ERR_GRACE on delegation recalls remoteproc: qcom: q6v5: Avoid handling handover twice sparc/module: Add R_SPARC_UA64 relocation handling net: intel: fm10k: Fix parameter idx set but not used jfs: fix uninitialized waitqueue in transaction manager jfs: Verify inode mode when loading from disk ipv6: np->rxpmtu race annotation usb: xhci: plat: Facilitate using autosuspend for xhci plat devices usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs allow finish_no_open(file, ERR_PTR(-E...)) scsi: lpfc: Define size of debugfs entry for xri rebalancing scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency net/cls_cgroup: Fix task_get_classid() during qdisc run selftests: Replace sleep with slowwait selftests: Disable dad for ipv6 in fcnal-test.sh media: redrat3: use int type to store negative error codes net: sh_eth: Disable WoL if system can not suspend phy: cadence: cdns-dphy: Enable lower resolutions in dphy usb: gadget: f_hid: Fix zero length packet transfer net: call cond_resched() less often in __release_sock() ALSA: usb-audio: apply quirk for MOONDROP Quark2 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms dmaengine: dw-edma: Set status for callback_result dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: sh: setup_xref error handling scsi: pm8001: Use int instead of u32 to store error codes mips: lantiq: xway: sysctrl: rename stp clock mips: lantiq: danube: add missing device_type in pci node mips: lantiq: danube: add missing properties to cpu node media: fix uninitialized symbol warnings drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption extcon: adc-jack: Fix wakeup source leaks on device unbind rds: Fix endianness annotation for RDS_MPATH_HASH PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. net: When removing nexthops, don't call synchronize_net if it is not necessary char: misc: Does not request module for miscdevice with dynamic minor usb: gadget: f_ncm: Fix MAC assignment NCM ethernet iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register media: imon: make send_packet() more robust net: ipv6: fix field-spanning memcpy warning in AH output bridge: Redirect to backup port when port is administratively down powerpc/eeh: Use result of error_detected() in uevent x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall media: pci: ivtv: Don't create fake v4l2_fh drm/amdkfd: return -ENOTTY for unsupported IOCTLs selftests/net: Ensure assert() triggers in psock_tpacket.c selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 PCI: Disable MSI on RDC PCI to PCIe bridges drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() mfd: madera: Work around false-positive -Wininitialized warning mfd: stmpe-i2c: Add missing MODULE_LICENSE mfd: stmpe: Remove IRQ domain upon removal tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: Enhance HWP enable tools/cpupower: Fix incorrect size in cpuidle_state_disable() hwmon: (dell-smm) Add support for Dell OptiPlex 7040 uprobe: Do not emulate/sstep original instruction when ip is changed clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel video: backlight: lp855x_bl: Set correct EPROM start for LP8556 tee: allow a driver to allocate a tee_device without a pool ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment arc: Fix __fls() const-foldability via __builtin_clzl() cpufreq/longhaul: handle NULL policy in longhaul_exit selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 ACPI: video: force native for Lenovo 82K8 memstick: Add timeout to prevent indefinite waiting mmc: host: renesas_sdhi: Fix the actual clock bpf: Don't use %pK through printk spi: loopback-test: Don't use %pK through printk soc: qcom: smem: Fix endian-unaware access of num_entries usb: gadget: f_fs: Fix epfile null pointer access after ep enable. serial: 8250_dw: handle reset control deassert error serial: 8250_dw: Use devm_add_action_or_reset() serial: 8250_dw: Use devm_clk_get_optional() to get the input clock can: gs_usb: increase max interface to U8_MAX devcoredump: Fix circular locking dependency with devcd->mutex. net: ravb: Enforce descriptor type ordering x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode net: phy: dp83867: Disable EEE support as not implemented regmap: slimbus: fix bus_context pointer in regmap init calls drm/etnaviv: fix flush sequence logic usbnet: Prevents free active kevent wifi: ath10k: Fix memory leak on unsupported WMI command ASoC: qdsp6: q6asm: do not sleep while atomic fbdev: valkyriefb: Fix reference count leak in valkyriefb_init fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: bitblit: bound-check glyph index in bit_putcs* ACPI: video: Fix use-after-free in acpi_video_switch_brightness() fbdev: atyfb: Check if pll_ops->init_pll failed net: usb: asix_devices: Check return value of usbnet_get_endpoints btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() x86/bugs: Fix reporting of LFENCE retpoline net/sched: sch_qfq: Fix null-deref in agg_dequeue Conflicts: drivers/mmc/host/sdhci-msm.c drivers/usb/host/xhci-plat.c Change-Id: I30739fea8840ace3825ea8955598d9efa687bb27 |
||
|
Michael Bestas
|
350c4ccfe1 |
Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-12-01 CVE-2025-48623 CVE-2025-48624 CVE-2025-48637 CVE-2025-48638 CVE-2024-35970 CVE-2025-38236 CVE-2025-38349 CVE-2025-48610 CVE-2025-38500 * tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common: UPSTREAM: crypto: essiv - Check ssize for decryption and in-place encryption ANDROID: GKI: fix up build break where timer_delete_sync() was used Revert "net: rtnetlink: remove redundant assignment to variable err" Revert "net: rtnetlink: add msg kind names" Revert "net: rtnetlink: add helper to extract msg type's kind" Revert "net: rtnetlink: use BIT for flag values" Revert "net: netlink: add NLM_F_BULK delete request modifier" Revert "net: rtnetlink: add bulk delete support flag" Revert "net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg" Revert "net: add ndo_fdb_del_bulk" Revert "net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del" Revert "rtnetlink: Allow deleting FDB entries in user namespace" Linux 5.4.301 net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg media: s5p-mfc: remove an unused/uninitialized variable NFSD: Fix last write offset handling in layoutcommit NFSD: Minor cleanup in layoutcommit processing padata: Reset next CPU when reorder sequence wraps around KEYS: trusted_tpm1: Compare HMAC values in constant time NFSD: Define a proc_layoutcommit for the FlexFiles layout type vfs: Don't leak disconnected dentries on umount jbd2: ensure that all ongoing I/O complete before freeing blocks ext4: detect invalid INLINE_DATA + EXTENTS flag combination drm/amdgpu: use atomic functions with memory barriers for vm fault info ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() spi: cadence-quadspi: Flush posted register writes before DAC access spi: cadence-quadspi: Flush posted register writes before INDAC access memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe memory: samsung: exynos-srom: Correct alignment arm64: errata: Apply workarounds for Neoverse-V3AE arm64: cputype: Add Neoverse-V3AE definitions comedi: fix divide-by-zero in comedi_buf_munge() binder: remove "invalid inc weak" check xhci: dbc: enable back DbC in resume if it was enabled before suspend usb/core/quirks: Add Huawei ME906S to wakeup quirk USB: serial: option: add Telit FN920C04 ECM compositions USB: serial: option: add Quectel RG255C USB: serial: option: add UNISOC UIS7720 net: ravb: Ensure memory write completes before ringing TX doorbell net: usb: rtl8150: Fix frame padding ocfs2: clear extent cache after moving/defragmenting extents MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering Revert "cpuidle: menu: Avoid discarding useful information" net: bonding: fix possible peer notify event loss or dup issue sctp: avoid NULL dereference when chunk data buffer is missing arm64, mm: avoid always making PTE dirty in pte_mkwrite() net: enetc: correct the value of ENETC_RXB_TRUESIZE rtnetlink: Allow deleting FDB entries in user namespace net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del net: add ndo_fdb_del_bulk net: rtnetlink: add bulk delete support flag net: netlink: add NLM_F_BULK delete request modifier net: rtnetlink: use BIT for flag values net: rtnetlink: add helper to extract msg type's kind net: rtnetlink: add msg kind names net: rtnetlink: remove redundant assignment to variable err m68k: bitops: Fix find_*_bit() signatures hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() dlm: check for defined force value in dlm_lockspace_release hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() hfs: validate record offset in hfsplus_bmap_alloc hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() hfs: make proper initalization of struct hfs_find_data hfs: clear offset and space out of valid records in b-tree node exec: Fix incorrect type for ret hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings sched/fair: Fix pelt lost idle time detection sched/balancing: Rename newidle_balance() => sched_balance_newidle() sched/fair: Trivial correction of the newidle_balance() comment sched: Make newidle_balance() static again tls: don't rely on tx_work during send() tls: always set record_type in tls_process_cmsg tg3: prevent use of uninitialized remote_adv and local_adv variables tcp: fix tcp_tso_should_defer() vs large RTT amd-xgbe: Avoid spurious link down messages during interface toggle net/ip6_tunnel: Prevent perpetual tunnel growth net: dlink: handle dma_map_single() failure properly net: dl2k: switch from 'pci_' to 'dma_' API media: pci: ivtv: Add missing check after DMA map media: pci/ivtv: switch from 'pci_' to 'dma_' API xen/events: Update virq_to_irq on migration media: lirc: Fix error handling in lirc_register() media: rc: Directly use ida_free() drm/exynos: exynos7_drm_decon: remove ctx->suspended btrfs: avoid potential out-of-bounds in btrfs_encode_fh() pwm: berlin: Fix wrong register in suspend/resume media: cx18: Add missing check after DMA map xen/events: Cleanup find_virq() return codes cramfs: Verify inode mode when loading from disk fs: Add 'initramfs_options' to set initramfs mount options pid: Add a judgment for ns null in pid_nr_ns minixfs: Verify inode mode when loading from disk tracing: Fix race condition in kprobe initialization causing NULL pointer dereference dm: fix NULL pointer dereference in __dm_suspend() mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value Squashfs: reject negative file sizes in squashfs_read_inode() Squashfs: add additional inode sanity checking media: mc: Clear minor number before put device mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() fs: udf: fix OOB read in lengthAllocDescs handling KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O net/9p: fix double req put in p9_fd_cancelled ext4: guard against EA inode refcount underflow in xattr update ext4: correctly handle queries for metadata mappings ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() nfsd: nfserr_jukebox in nlm_fopen should lead to a retry x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) x86/umip: Check that the instruction opcode is at least two bytes PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit PCI/AER: Fix missing uevent on recovery when a reset is requested PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV rseq/selftests: Use weak symbol reference, not definition, to link with glibc rtc: interface: Fix long-standing race when setting alarm rtc: interface: Ensure alarm irq is enabled when UIE is enabled mmc: core: SPI mode remove cmd7 mtd: rawnand: fsmc: Default to autodetect buswidth sparc: fix error handling in scan_one_device() sparc64: fix hugetlb for sun4u sctp: Fix MAC comparison to be constant-time scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() parisc: don't reference obsolete termio struct for TC* constants lib/genalloc: fix device leak in of_gen_pool_get() iio: frequency: adf4350: Fix prescaler usage. iio: dac: ad5421: use int type to store negative error codes iio: dac: ad5360: use int type to store negative error codes crypto: atmel - Fix dma_unmap_sg() direction cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() drm/nouveau: fix bad ret code in nouveau_bo_move_prep media: i2c: mt9v111: fix incorrect type for ret firmware: meson_sm: fix device leak at probe xen/manage: Fix suspend error path arm64: dts: qcom: msm8916: Add missing MDSS reset ACPI: debug: fix signedness issues in read/write helpers ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single tpm, tpm_tis: Claim locality before writing interrupt registers crypto: essiv - Check ssize for decryption and in-place encryption mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call tools build: Align warning options with perf net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() drm/vmwgfx: Fix Use-after-free in validation net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() scsi: mvsas: Fix use-after-free bugs in mvs_work_queue scsi: mvsas: Use sas_task_find_rq() for tagging scsi: mvsas: Delete mvs_tag_init() scsi: libsas: Add sas_task_find_rq() clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() perf session: Fix handling when buffer exceeds 2 GiB rtc: x1205: Fix Xicor X1205 vendor prefix perf util: Fix compression checks returning -1 as bool iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE clocksource/drivers/clps711x: Fix resource leaks in error paths pinctrl: check the return value of pinmux_ops::get_function_name() Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak mm: hugetlb: avoid soft lockup when mprotect to large memory area uio_hv_generic: Let userspace take care of interrupt mask Squashfs: fix uninit-value in squashfs_get_parent Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable nfp: fix RSS hash key size when RSS is not supported drivers/base/node: fix double free in register_one_node() ocfs2: fix double free in user_cluster_connect() net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast RDMA/siw: Always report immediate post SQ errors usb: vhci-hcd: Prevent suspending virtually attached devices scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() ipvs: Defer ip_vs_ftp unregister during netns cleanup NFSv4.1: fix backchannel max_resp_sz verification check remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice sparc: fix accurate exception reporting in copy_{from,to}_user for M7 sparc: fix accurate exception reporting in copy_to_user for Niagara 4 sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC IB/sa: Fix sa_local_svc_timeout_ms read race RDMA/core: Resolve MAC of next-hop device without ARP support wifi: mt76: fix potential memory leak in mt76_wmac_probe() drivers/base/node: handle error properly in register_one_node() watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog netfilter: ipset: Remove unused htable_bits in macro ahash_region iio: consumers: Fix offset handling in iio_convert_raw_to_processed() ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping pps: fix warning in pps_register_cdev when register device fail misc: genwqe: Fix incorrect cmd field being reported in error usb: gadget: configfs: Correctly set use_os_string at bind usb: phy: twl6030: Fix incorrect type for ret tcp: fix __tcp_close() to only send RST when required PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation wifi: mwifiex: send world regulatory domain to driver ALSA: lx_core: use int type to store negative error codes media: rj54n1cb0c: Fix memleak in rj54n1_probe() scsi: myrs: Fix dma_alloc_coherent() error check scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod serial: max310x: Add error checking in probe() usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup drm/radeon/r600_cs: clean up of dead code in r600_cs i2c: designware: Add disabling clocks when probe fails i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD bpf: Explicitly check accesses to bpf_sock_addr selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported pwm: tiehrpwm: Fix corner case in clock divisor calculation block: use int to store blk_stack_limits() return value blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx pinctrl: meson-gxl: add missing i2c_d pinmux soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS ACPI: processor: idle: Fix memory leak when register cpuidle device failed regmap: Remove superfluous check for !config in __regmap_init() x86/vdso: Fix output operand size of RDPID perf: arm_spe: Prevent overflow in PERF_IDX2OFF() driver core/PM: Set power.no_callbacks along with power.no_pm staging: axis-fifo: flush RX FIFO on read errors staging: axis-fifo: fix maximum TX packet length check perf subcmd: avoid crash in exclude_cmds when excludes is empty dm-integrity: limit MAX_TAG_SIZE to 255 wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 USB: serial: option: add SIMCom 8230C compositions media: rc: fix races with imon_disconnect() media: imon: grab lock earlier in imon_ir_change_protocol() media: imon: reorganize serialization media: rc: Add support for another iMON 0xffdc device media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: tuner: xc5000: Fix use-after-free in xc5000_release media: tunner: xc5000: Refactor firmware load udp: Fix memory accounting leak. media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove scsi: target: target_core_configfs: Add length check to avoid buffer overflow Conflicts: drivers/soc/qcom/rpmh-rsc.c kernel/sched/fair.c Change-Id: I58ab24a3db8be4c698c41fd47daeb1f1fb7884ee |
||
Greg Kroah-Hartman
|
ca00e0f525 |
This is the 5.4.302 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkwI4sACgkQONu9yGCS aT46Mg//f9a0IiDkO2ybqt7JAStVCkQ5MM2CgPjlgHGyns6hWyxUES5twrVrTO0v mdYmeXLztyFSArUHMnoWcUK1O4IVUVK32SX3eEMFy81ojX+LpYm/m5TZg3tU1rvq jaTE0i6ihmwG48ciB63i28TxQfhY8QuVJTEV400Ro+ILY2hs1l6c6DYf9i0S/v4g gKDQpzuwR0AnGNFI+D6D6D0D8jbLVcBYnAndyvDrLYTIILczf7nJ66ZePYTBvlg3 rIiIMjG0BX0V2ctPmez3mz0BDTpnZY4pwIwIG8K/bX4UZrgOKJPSZWh1SzbASaGN vTJQwRs9nGHvM/kK9CUUsi1+hhaAl7UmQEiRJ06BkXlR7chFCcL/fI/VEQjf12wL dyw6/RR/rXPxLbLxCYk+9C9ANTE/ByirLKSeJkNT/yoeiCSpaFuKxtoYkNslBK/B i0/Qweez0IzJuVUtUp/2/PrkNKyCaEbbqhDerbnLhU/0lcnT0fkFlFoLLLNzxNdt hj6RRJrcpoQB+Qrkf0+5Sxx6W1feP5clZJ2nRSL+rtUNEzCWk7HVh4GprCyvDn6i xjINN9Yh40suJkuKaE0+IrPF1tcL3/128OaT3e0VlL57wK5M4YmJTwrb7g4mlR2/ 31Z4bL1IFYju9WYPW2fWHrdrZUH4h22vLcpW6Q/VFdG0wTC6wVc= =Wt2i -----END PGP SIGNATURE----- Merge 5.4.302 into android11-5.4-lts Changes in 5.4.302 net/sched: sch_qfq: Fix null-deref in agg_dequeue x86/bugs: Fix reporting of LFENCE retpoline btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() net: usb: asix_devices: Check return value of usbnet_get_endpoints fbdev: atyfb: Check if pll_ops->init_pll failed ACPI: video: Fix use-after-free in acpi_video_switch_brightness() fbdev: bitblit: bound-check glyph index in bit_putcs* fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: valkyriefb: Fix reference count leak in valkyriefb_init ASoC: qdsp6: q6asm: do not sleep while atomic wifi: ath10k: Fix memory leak on unsupported WMI command usbnet: Prevents free active kevent drm/etnaviv: fix flush sequence logic regmap: slimbus: fix bus_context pointer in regmap init calls net: phy: dp83867: Disable EEE support as not implemented wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID net: ravb: Enforce descriptor type ordering devcoredump: Fix circular locking dependency with devcd->mutex. can: gs_usb: increase max interface to U8_MAX serial: 8250_dw: Use devm_clk_get_optional() to get the input clock serial: 8250_dw: Use devm_add_action_or_reset() serial: 8250_dw: handle reset control deassert error usb: gadget: f_fs: Fix epfile null pointer access after ep enable. soc: qcom: smem: Fix endian-unaware access of num_entries spi: loopback-test: Don't use %pK through printk bpf: Don't use %pK through printk mmc: host: renesas_sdhi: Fix the actual clock memstick: Add timeout to prevent indefinite waiting ACPI: video: force native for Lenovo 82K8 selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 cpufreq/longhaul: handle NULL policy in longhaul_exit arc: Fix __fls() const-foldability via __builtin_clzl() irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() tee: allow a driver to allocate a tee_device without a pool video: backlight: lp855x_bl: Set correct EPROM start for LP8556 clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel uprobe: Do not emulate/sstep original instruction when ip is changed hwmon: (dell-smm) Add support for Dell OptiPlex 7040 tools/cpupower: Fix incorrect size in cpuidle_state_disable() tools/power x86_energy_perf_policy: Enhance HWP enable tools/power x86_energy_perf_policy: Prefer driver HWP limits mfd: stmpe: Remove IRQ domain upon removal mfd: stmpe-i2c: Add missing MODULE_LICENSE mfd: madera: Work around false-positive -Wininitialized warning drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() PCI: Disable MSI on RDC PCI to PCIe bridges selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 selftests/net: Ensure assert() triggers in psock_tpacket.c drm/amdkfd: return -ENOTTY for unsupported IOCTLs media: pci: ivtv: Don't create fake v4l2_fh x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall powerpc/eeh: Use result of error_detected() in uevent bridge: Redirect to backup port when port is administratively down net: ipv6: fix field-spanning memcpy warning in AH output media: imon: make send_packet() more robust iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register usb: gadget: f_ncm: Fix MAC assignment NCM ethernet char: misc: Does not request module for miscdevice with dynamic minor net: When removing nexthops, don't call synchronize_net if it is not necessary net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call rds: Fix endianness annotation for RDS_MPATH_HASH extcon: adc-jack: Fix wakeup source leaks on device unbind drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption media: fix uninitialized symbol warnings mips: lantiq: danube: add missing properties to cpu node mips: lantiq: danube: add missing device_type in pci node mips: lantiq: xway: sysctrl: rename stp clock scsi: pm8001: Use int instead of u32 to store error codes dmaengine: sh: setup_xref error handling dmaengine: mv_xor: match alloc_wc and free_wc dmaengine: dw-edma: Set status for callback_result net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms ALSA: usb-audio: apply quirk for MOONDROP Quark2 net: call cond_resched() less often in __release_sock() usb: gadget: f_hid: Fix zero length packet transfer phy: cadence: cdns-dphy: Enable lower resolutions in dphy net: sh_eth: Disable WoL if system can not suspend media: redrat3: use int type to store negative error codes selftests: Disable dad for ipv6 in fcnal-test.sh selftests: Replace sleep with slowwait net/cls_cgroup: Fix task_get_classid() during qdisc run selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET scsi: lpfc: Define size of debugfs entry for xri rebalancing allow finish_no_open(file, ERR_PTR(-E...)) usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs usb: xhci: plat: Facilitate using autosuspend for xhci plat devices ipv6: np->rxpmtu race annotation jfs: Verify inode mode when loading from disk jfs: fix uninitialized waitqueue in transaction manager net: intel: fm10k: Fix parameter idx set but not used sparc/module: Add R_SPARC_UA64 relocation handling remoteproc: qcom: q6v5: Avoid handling handover twice NFSv4: handle ERR_GRACE on delegation recalls NFSv4.1: fix mount hang after CREATE_SESSION failure nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing net: macb: avoid dealing with endianness in macb_set_hwaddr() Bluetooth: SCO: Fix UAF on sco_conn_free Bluetooth: bcsp: receive data only if registered page_pool: Clamp pool size to max 16K pages orangefs: fix xattr related buffer overflow... ACPICA: Update dsmethod.c to get rid of unused variable warning fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink 9p: fix /sys/fs/9p/caches overwriting itself 9p: sysfs_init: don't hardcode error to ENOMEM ACPI: property: Return present device nodes only on fwnode interface fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds ceph: add checking of wait_for_completion_killable() return value net: vlan: sync VLAN features with lower device net: dsa/b53: change b53_force_port_config() pause argument net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 net: dsa: b53: fix resetting speed and pause on forced link net: dsa: b53: fix enabling ip multicast net: dsa: b53: stop reading ARL entries if search is done sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup tracing: Fix memory leaks in create_field_var() extcon: adc-jack: Cleanup wakeup source only if it was enabled compiler_types: Move unused static inline functions warning to W=2 NFS4: Fix state renewals missing after boot HID: quirks: avoid Cooler Master MM712 dongle wakeup bug ASoC: max98090/91: fixed max98091 ALSA widget powering up/down net: fec: correct rx_bytes statistic for the case SHIFT16 is set Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions sctp: get netns from asoc and ep base sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto tipc: simplify the finalize work queue tipc: Fix use-after-free in tipc_mon_reinit_self(). net: mdio: fix resource leak in mdiobus_register_device() wifi: mac80211: skip rate verification for not captured PSDUs net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak net/mlx5e: Fix maxrate wraparound in threshold between units net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps net_sched: remove need_resched() from qdisc_run() net_sched: limit try_bulk_dequeue_skb() batches Bluetooth: L2CAP: export l2cap_chan_hold for modules regulator: fixed: use dev_err_probe for register regulator: fixed: fix GPIO descriptor leak on register failure ASoC: cs4271: Fix regulator leak on probe failure drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd mm/ksm: fix flag-dropping behavior in ksm_madvise gcov: add support for GCC 15 strparser: Fix signed/unsigned mismatch bug ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe spi: Try to get ACPI GPIO IRQ earlier EDAC/altera: Handle OCRAM ECC enable after warm reset EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 be2net: pass wrb_params in case of OS2BMC Input: cros_ec_keyb - fix an invalid memory access scsi: sg: Do not sleep in atomic context scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() MIPS: Malta: Fix !EVA SOC-it PCI MMIO mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() net: openvswitch: remove never-working support for setting nsh fields s390/ctcm: Fix double-kfree vsock: Ignore signal/timeout on connect() if already established kconfig/mconf: Initialize the default locale at startup kconfig/nconf: Initialize the default locale at startup mm/page_alloc: fix hash table order logging in alloc_large_system_hash() ALSA: usb-audio: fix uac2 clock source at terminal parser net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error uio_hv_generic: Set event for all channels on the device net: qede: Initialize qede_ll_ops with designated initializer net: netpoll: fix incorrect refcount handling causing incorrect cleanup pmdomain: arm: scmi: Fix genpd leak on provider registration failure pmdomain: imx: Fix reference count leak in imx_gpc_remove fs/proc: fix uaf in proc_readdir_de() ata: libata-scsi: Fix system suspend for a security locked drive usb: deprecate the third argument of usb_maxpacket() Input: remove third argument of usb_maxpacket() Input: pegasus-notetaker - fix potential out-of-bounds access Linux 5.4.302 Change-Id: I7291d845c3cfde8a154957356156fadcc4b96b80 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Miaoqian Lin
|
e45dfc5368 |
pmdomain: imx: Fix reference count leak in imx_gpc_remove
[ Upstream commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 ]
of_get_child_by_name() returns a node pointer with refcount incremented, we
should use of_node_put() on it when not needed anymore. Add the missing
of_node_put() to avoid refcount leak.
Fixes:
|
||
Nishanth Menon
|
af6b10a13f |
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
[ Upstream commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5 ]
Make knav_dma_open_channel consistently return NULL on error instead
of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h
returns NULL when the driver is disabled, but the driver
implementation does not even return NULL or ERR_PTR on failure,
causing inconsistency in the users. This results in a crash in
netcp_free_navigator_resources as followed (trimmed):
Unhandled fault: alignment exception (0x221) at 0xfffffff2
[fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000
Internal error: : 221 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE
Hardware name: Keystone
PC is at knav_dma_close_channel+0x30/0x19c
LR is at netcp_free_navigator_resources+0x2c/0x28c
[... TRIM...]
Call trace:
knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c
netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c
netcp_ndo_open from __dev_open+0x114/0x29c
__dev_open from __dev_change_flags+0x190/0x208
__dev_change_flags from netif_change_flags+0x1c/0x58
netif_change_flags from dev_change_flags+0x38/0xa0
dev_change_flags from ip_auto_config+0x2c4/0x11f0
ip_auto_config from do_one_initcall+0x58/0x200
do_one_initcall from kernel_init_freeable+0x1cc/0x238
kernel_init_freeable from kernel_init+0x1c/0x12c
kernel_init from ret_from_fork+0x14/0x38
[... TRIM...]
Standardize the error handling by making the function return NULL on
all error conditions. The API is used in just the netcp_core.c so the
impact is limited.
Note, this change, in effect reverts commit
|
||
Jens Reidel
|
9ff6994c80 |
soc: qcom: smem: Fix endian-unaware access of num_entries
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ] Add a missing le32_to_cpu when accessing num_entries, which is always a little endian integer. Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian. Signed-off-by: Jens Reidel <adrian@mainlining.org> Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Michael Bestas
|
e2d3707e62 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.0
* sm8350/lineage-20: UPSTREAM: soc: qcom: mdt_loader: Deal with zero e_shentsize msm: mhi_dev: Avoid BME check while sending ready FROMGIT: media: venus: hfi: add a check to handle OOB in sfr region FROMGIT: media: venus: hfi: add check to handle incorrect queue size FROMGIT: media: venus: hfi_parser: refactor hfi packet parsing logic FROMGIT: media: venus: hfi_parser: add check to avoid out of bound access defconfig: Enable RTL8152 ETH-USB driver msm: Add Kconfig for RTL8152 driver defconfig: Disable upstream RTL8152 ETH-USB driver qseecom: Remove virtual address print Change-Id: Icb29cc481bb2405b2a803fc4ccc089e73b06ccc4 |
||
|
Michael Bestas
|
92d61f8f0f |
Merge tag 'LA.UM.9.14.r1-26500-LAHAINA.QSSI16.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina
LA.UM.9.14.r1-26500-LAHAINA.QSSI16.0 * tag 'LA.UM.9.14.r1-26500-LAHAINA.QSSI16.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4: msm: mhi_dev: Avoid BME check while sending ready FROMGIT: media: venus: hfi: add a check to handle OOB in sfr region FROMGIT: media: venus: hfi: add check to handle incorrect queue size FROMGIT: media: venus: hfi_parser: refactor hfi packet parsing logic FROMGIT: media: venus: hfi_parser: add check to avoid out of bound access defconfig: Enable RTL8152 ETH-USB driver msm: Add Kconfig for RTL8152 driver defconfig: Disable upstream RTL8152 ETH-USB driver qseecom: Remove virtual address print Conflicts: arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.yaml arch/arm64/boot/dts/vendor/bindings/vendor-prefixes.yaml drivers/clk/qcom/clk-rpmh.c drivers/rpmsg/qcom_glink_native.c drivers/soc/qcom/smcinvoke.c drivers/soc/qcom/socinfo.c drivers/usb/dwc3/core.c fs/userfaultfd.c mm/madvise.c Change-Id: I76d04fb5422490ff302dad1460426db1b573f4c9 |
||
|
Greg Kroah-Hartman
|
f6520a7c91 |
This is the 5.4.301 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkCD9kACgkQONu9yGCS
aT756BAAwEcL3lKO/0QKjMUrvgv7FRoRm9TH9Usq7Nswmiax6YKI3oPgZKfZZL6u
yLGSnYqV8f+Jo8kALMJAybu+Oc3Z8WbBZJG/dvlAkvR7iN19ZCuKa2NwWmh8BTGd
5ZP4/nyXlNlg0/IIZ8xJa3067U895y9IhgMDmSvOZoUFGFecqUmJNBoj8bHgJaPL
/MENYb7D0CcKWbgCwzsqN0EEm9UKb7xgtaaC52sfZD+GHUPF/RLq9QNyUGtyL0m8
y20HG6zXmBiVP+zdtYpTaaEP6OSNOCmiOweSZOFafnatd2XO1hRdnAoEk7+t2Lj+
Xa5GowVUuglmBd8bPbeY8cwVihMxr81DxMns+OpQJTiDD8Q6Whcxbaqwv+tVe7z4
cVDh1xlKG4U2rsDTeiGhbZVNb6gqqy3LnVFqImQE+dcZqlwC0pbqwO2lLdHMa8NF
f+l1U3ab0k9qYx8HQegYDTufW5Eb0Rki/3YyHk8o3alOYd2Oc3r16lw9rpSw2Nq3
Rku+VMSy6z8uvmIP7Ywobla6j73SGFrDc61F0nsU1x+Gd/dMIgkn36dfxciBCgPa
/AmkK1Psx04s7dIPMowx/nXy5Jk8J4k3JlVMeBnMCuFVUNCNp3qzq5WXdeL1G5f5
GFPJPblaZrfKQNSSlpUAmstl8v5t8aJcjxobmHn28fVliFAJdDI=
=XPvH
-----END PGP SIGNATURE-----
Merge 5.4.301 into android11-5.4-lts
Changes in 5.4.301
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
udp: Fix memory accounting leak.
media: tunner: xc5000: Refactor firmware load
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
media: rc: Add support for another iMON 0xffdc device
media: imon: reorganize serialization
media: imon: grab lock earlier in imon_ir_change_protocol()
media: rc: fix races with imon_disconnect()
USB: serial: option: add SIMCom 8230C compositions
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
dm-integrity: limit MAX_TAG_SIZE to 255
perf subcmd: avoid crash in exclude_cmds when excludes is empty
staging: axis-fifo: fix maximum TX packet length check
staging: axis-fifo: flush RX FIFO on read errors
driver core/PM: Set power.no_callbacks along with power.no_pm
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
x86/vdso: Fix output operand size of RDPID
regmap: Remove superfluous check for !config in __regmap_init()
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
pinctrl: meson-gxl: add missing i2c_d pinmux
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
block: use int to store blk_stack_limits() return value
pwm: tiehrpwm: Fix corner case in clock divisor calculation
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
bpf: Explicitly check accesses to bpf_sock_addr
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
i2c: designware: Add disabling clocks when probe fails
drm/radeon/r600_cs: clean up of dead code in r600_cs
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
serial: max310x: Add error checking in probe()
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
scsi: myrs: Fix dma_alloc_coherent() error check
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
ALSA: lx_core: use int type to store negative error codes
wifi: mwifiex: send world regulatory domain to driver
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
tcp: fix __tcp_close() to only send RST when required
usb: phy: twl6030: Fix incorrect type for ret
usb: gadget: configfs: Correctly set use_os_string at bind
misc: genwqe: Fix incorrect cmd field being reported in error
pps: fix warning in pps_register_cdev when register device fail
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
netfilter: ipset: Remove unused htable_bits in macro ahash_region
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
drivers/base/node: handle error properly in register_one_node()
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
RDMA/core: Resolve MAC of next-hop device without ARP support
IB/sa: Fix sa_local_svc_timeout_ms read race
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
NFSv4.1: fix backchannel max_resp_sz verification check
ipvs: Defer ip_vs_ftp unregister during netns cleanup
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
usb: vhci-hcd: Prevent suspending virtually attached devices
RDMA/siw: Always report immediate post SQ errors
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
ocfs2: fix double free in user_cluster_connect()
drivers/base/node: fix double free in register_one_node()
nfp: fix RSS hash key size when RSS is not supported
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Squashfs: fix uninit-value in squashfs_get_parent
uio_hv_generic: Let userspace take care of interrupt mask
mm: hugetlb: avoid soft lockup when mprotect to large memory area
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
pinctrl: check the return value of pinmux_ops::get_function_name()
clocksource/drivers/clps711x: Fix resource leaks in error paths
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
perf util: Fix compression checks returning -1 as bool
rtc: x1205: Fix Xicor X1205 vendor prefix
perf session: Fix handling when buffer exceeds 2 GiB
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
scsi: libsas: Add sas_task_find_rq()
scsi: mvsas: Delete mvs_tag_init()
scsi: mvsas: Use sas_task_find_rq() for tagging
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
drm/vmwgfx: Fix Use-after-free in validation
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
tools build: Align warning options with perf
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
crypto: essiv - Check ssize for decryption and in-place encryption
tpm, tpm_tis: Claim locality before writing interrupt registers
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
ACPI: debug: fix signedness issues in read/write helpers
arm64: dts: qcom: msm8916: Add missing MDSS reset
xen/manage: Fix suspend error path
firmware: meson_sm: fix device leak at probe
media: i2c: mt9v111: fix incorrect type for ret
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
crypto: atmel - Fix dma_unmap_sg() direction
iio: dac: ad5360: use int type to store negative error codes
iio: dac: ad5421: use int type to store negative error codes
iio: frequency: adf4350: Fix prescaler usage.
lib/genalloc: fix device leak in of_gen_pool_get()
parisc: don't reference obsolete termio struct for TC* constants
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
sctp: Fix MAC comparison to be constant-time
sparc64: fix hugetlb for sun4u
sparc: fix error handling in scan_one_device()
mtd: rawnand: fsmc: Default to autodetect buswidth
mmc: core: SPI mode remove cmd7
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
rtc: interface: Fix long-standing race when setting alarm
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
PCI/AER: Fix missing uevent on recovery when a reset is requested
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
x86/umip: Check that the instruction opcode is at least two bytes
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
ext4: correctly handle queries for metadata mappings
ext4: guard against EA inode refcount underflow in xattr update
net/9p: fix double req put in p9_fd_cancelled
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
fs: udf: fix OOB read in lengthAllocDescs handling
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
media: mc: Clear minor number before put device
Squashfs: add additional inode sanity checking
Squashfs: reject negative file sizes in squashfs_read_inode()
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
dm: fix NULL pointer dereference in __dm_suspend()
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
minixfs: Verify inode mode when loading from disk
pid: Add a judgment for ns null in pid_nr_ns
fs: Add 'initramfs_options' to set initramfs mount options
cramfs: Verify inode mode when loading from disk
xen/events: Cleanup find_virq() return codes
media: cx18: Add missing check after DMA map
pwm: berlin: Fix wrong register in suspend/resume
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
drm/exynos: exynos7_drm_decon: remove ctx->suspended
media: rc: Directly use ida_free()
media: lirc: Fix error handling in lirc_register()
xen/events: Update virq_to_irq on migration
media: pci/ivtv: switch from 'pci_' to 'dma_' API
media: pci: ivtv: Add missing check after DMA map
net: dl2k: switch from 'pci_' to 'dma_' API
net: dlink: handle dma_map_single() failure properly
net/ip6_tunnel: Prevent perpetual tunnel growth
amd-xgbe: Avoid spurious link down messages during interface toggle
tcp: fix tcp_tso_should_defer() vs large RTT
tg3: prevent use of uninitialized remote_adv and local_adv variables
tls: always set record_type in tls_process_cmsg
tls: don't rely on tx_work during send()
sched: Make newidle_balance() static again
sched/fair: Trivial correction of the newidle_balance() comment
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
sched/fair: Fix pelt lost idle time detection
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
exec: Fix incorrect type for ret
hfs: clear offset and space out of valid records in b-tree node
hfs: make proper initalization of struct hfs_find_data
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
dlm: check for defined force value in dlm_lockspace_release
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
m68k: bitops: Fix find_*_bit() signatures
net: rtnetlink: remove redundant assignment to variable err
net: rtnetlink: add msg kind names
net: rtnetlink: add helper to extract msg type's kind
net: rtnetlink: use BIT for flag values
net: netlink: add NLM_F_BULK delete request modifier
net: rtnetlink: add bulk delete support flag
net: add ndo_fdb_del_bulk
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
rtnetlink: Allow deleting FDB entries in user namespace
net: enetc: correct the value of ENETC_RXB_TRUESIZE
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
sctp: avoid NULL dereference when chunk data buffer is missing
net: bonding: fix possible peer notify event loss or dup issue
Revert "cpuidle: menu: Avoid discarding useful information"
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
ocfs2: clear extent cache after moving/defragmenting extents
net: usb: rtl8150: Fix frame padding
net: ravb: Ensure memory write completes before ringing TX doorbell
USB: serial: option: add UNISOC UIS7720
USB: serial: option: add Quectel RG255C
USB: serial: option: add Telit FN920C04 ECM compositions
usb/core/quirks: Add Huawei ME906S to wakeup quirk
xhci: dbc: enable back DbC in resume if it was enabled before suspend
binder: remove "invalid inc weak" check
comedi: fix divide-by-zero in comedi_buf_munge()
arm64: cputype: Add Neoverse-V3AE definitions
arm64: errata: Apply workarounds for Neoverse-V3AE
memory: samsung: exynos-srom: Correct alignment
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
spi: cadence-quadspi: Flush posted register writes before INDAC access
spi: cadence-quadspi: Flush posted register writes before DAC access
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
drm/amdgpu: use atomic functions with memory barriers for vm fault info
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
jbd2: ensure that all ongoing I/O complete before freeing blocks
vfs: Don't leak disconnected dentries on umount
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
KEYS: trusted_tpm1: Compare HMAC values in constant time
padata: Reset next CPU when reorder sequence wraps around
NFSD: Minor cleanup in layoutcommit processing
NFSD: Fix last write offset handling in layoutcommit
media: s5p-mfc: remove an unused/uninitialized variable
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
Linux 5.4.301
Change-Id: Ie2685625a0f630cb01ac8d8c9ddcd68c64ea6ed7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Sneh Mankad
|
cdf96ac33a |
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
transaction completes. Previously this bit was only cleared when
a wake TCS was borrowed as an AMC TCS but not for dedicated
AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
power modes can generate a false completion IRQ.
Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
bit upon receiving a completion IRQ.
Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Michael Bestas
|
cd41689b70 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20: ANDROID: fix wakeup reason findings Revert "genirq: Provide new interfaces for affinity hints" Revert "i40e: Use irq_update_affinity_hint()" Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path" Linux 5.4.300 mm/hugetlb: fix folio is still mapped when deleted i40e: add mask to apply valid bits for itr_idx i40e: fix validation of VF state in get resources i40e: fix idx validation in config queues msg i40e: add validation for ring_len param i40e: increase max descriptors for XL710 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() fbcon: Fix OOB access in font allocation fbcon: fix integer overflow in fbcon_do_set_font i40e: add max boundary check for VF filters i40e: fix input validation logic for action_meta i40e: fix idx validation in i40e_validate_queue_map drm/gma500: Fix null dereference in hdmi teardown can: peak_usb: fix shift-out-of-bounds issue can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow ... Change-Id: I35c2bd8174f8de67fbe46fb7fba584ee769722fa |
||
|
Michael Bestas
|
b4aa467048 |
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: Revert "genirq: Provide new interfaces for affinity hints" Revert "i40e: Use irq_update_affinity_hint()" Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path" Linux 5.4.300 mm/hugetlb: fix folio is still mapped when deleted i40e: add mask to apply valid bits for itr_idx i40e: fix validation of VF state in get resources i40e: fix idx validation in config queues msg i40e: add validation for ring_len param i40e: increase max descriptors for XL710 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() fbcon: Fix OOB access in font allocation fbcon: fix integer overflow in fbcon_do_set_font i40e: add max boundary check for VF filters i40e: fix input validation logic for action_meta i40e: fix idx validation in i40e_validate_queue_map drm/gma500: Fix null dereference in hdmi teardown can: peak_usb: fix shift-out-of-bounds issue can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: rcar_can: rcar_can_resume(): fix s2ram with PSCI IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions usb: core: Add 0x prefix to quirks debug output ALSA: usb-audio: Fix build with CONFIG_INPUT=n ALSA: usb-audio: Convert comma to semicolon ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks ALSA: usb-audio: Simplify NULL comparison in mixer_quirks ALSA: usb-audio: Avoid multiple assignments in mixer_quirks ALSA: usb-audio: Fix block comments in mixer_quirks KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer net: rfkill: gpio: add DT support serial: sc16is7xx: fix bug in flow control levels init USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels usb: gadget: dummy_hcd: remove usage of list iterator past the loop body ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message ASoC: wm8974: Correct PLL rate rounding ASoC: wm8940: Correct typo in control name rds: ib: Increment i_fastreg_wrs before bailing out mmc: mvsdio: Fix dma_unmap_sg() nents value power: supply: bq27xxx: restrict no-battery detection to bq27000 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* cnic: Fix use-after-free bugs in cnic_delete_task net: liquidio: fix overflow in octeon_init_instr_queue() Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). i40e: remove redundant memory barrier when cleaning Tx descs net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure cgroup: split cgroup_destroy_wq into 3 workqueues pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch wifi: mac80211: fix incorrect type for ret ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory soc: qcom: mdt_loader: Deal with zero e_shentsize phy: ti-pipe3: fix device leak at unbind dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees dmaengine: ti: edma: Fix memory allocation size for queue_priority_map can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path i40e: Use irq_update_affinity_hint() genirq: Provide new interfaces for affinity hints genirq: Export affinity setter for modules genirq/affinity: Add irq_update_affinity_desc() igb: fix link test skipping when interface is admin down net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions USB: serial: option: add Telit Cinterion FN990A w/audio compositions tty: hvc_console: Call hvc_kick in hvc_write unconditionally mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing mtd: nand: raw: atmel: Fix comment in timings preparation mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer mm/khugepaged: fix the address passed to notifier on testing young fuse: prevent overflow in copy_file_range return value fuse: check if copy_file_range() returns larger than requested size mtd: rawnand: stm32_fmc2: fix ECC overwrite ocfs2: fix recursive semaphore deadlock in fiemap call EDAC/altera: Delete an inappropriate dma_free_coherent() call tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. NFSv4: Don't clear capabilities that won't be reset net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. usb: hub: Fix flushing of delayed work used for post resume purposes Change-Id: I9cbae559320c1ca8d46d8443b8ce47f1c9a50f4b |
||
|
Michael Bestas
|
b31d93f6d6 |
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-10-01 * tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common: UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY Linux 5.4.299 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() cifs: fix integer overflow in match_server() spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort spi: spi-fsl-lpspi: Set correct chip-select polarity bit spi: spi-fsl-lpspi: Fix transmissions when using CONT pcmcia: Add error handling for add_interval() in do_validate_mem() ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model randstruct: gcc-plugin: Fix attribute addition randstruct: gcc-plugin: Remove bogus void member vmxnet3: update MTU after device quiesce net: dsa: microchip: linearize skb for tail-tagging switches net: dsa: microchip: update tag_ksz masks for KSZ9477 family dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup gpio: pca953x: fix IRQ storm on system wake up iio: light: opt3001: fix deadlock due to concurrent flag access iio: chemical: pms7003: use aligned_s64 for timestamp KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer cpufreq/sched: Explicitly synchronize limits_changed flag handling mm/slub: avoid accessing metadata when pointer is invalid in object_err() scsi: lpfc: Fix buffer free/clear order in deferred receive path mm/khugepaged: fix ->anon_vma race e1000e: fix heap overflow in e1000_set_eeprom batman-adv: fix OOB read/write in network-coding decode drm/amdgpu: drop hw access in non-DC audio fini wifi: mwifiex: Initialize the chan_stats array to zero pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() ALSA: usb-audio: Add mute TLV for playback volumes on some devices ppp: fix memory leak in pad_compress_skb net: atm: fix memory leak in atm_register_sysfs when device_register fail ax25: properly unshare skbs in ax25_kiss_rcv() ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() net: thunder_bgx: decrement cleanup index before use net: thunder_bgx: add a missing of_node_put wifi: libertas: cap SSID len in lbs_associate() wifi: cw1200: cap SSID length in cw1200_do_join() net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets i40e: Fix potential invalid access when MAC list is empty icmp: fix icmp_ndo_send address translation for reply direction mISDN: Fix memory leak in dsp_hwec_enable() xirc2ps_cs: fix register access when enabling FullDuplex Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() netfilter: conntrack: helper: Replace -EEXIST by -EBUSY wifi: cfg80211: fix use-after-free in cmp_bss() powerpc: boot: Remove leading zero in label in udelay() Linux 5.4.298 Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Revert "drm/amdgpu: fix incorrect vm flags to map bo" HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: wacom: Add a new Art Pen 2 HID: asus: fix UAF via HID_CLAIMED_INPUT validation KVM: x86: use array_index_nospec with indices that come from guest efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare sctp: initialize more fields in sctp_v6_from_sk() net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net/mlx5e: Set local Xoff after FW update net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Update and set Xon/Xoff upon MTU set net: dlink: fix multicast stats being counted incorrectly atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). net/atm: remove the atmdev_ops {get, set}sockopt methods Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced powerpc/kvm: Fix ifdef to remove build warning net: ipv4: fix regression in local-broadcast routes vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() scsi: core: sysfs: Correct sysfs attributes access rights ftrace: Fix potential warning in trace_printk_seq during ftrace_dump pinctrl: STMFX: add missing HAS_IOMEM dependency Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports" Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()" Linux 5.4.297 alloc_fdtable(): change calling conventions. s390/hypfs: Enable limited access during lockdown s390/hypfs: Avoid unnecessary ioctl registration in debugfs ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add ALSA: usb-audio: Fix size validation in convert_chmap_v3() scsi: qla4xxx: Prevent a potential error pointer dereference usb: xhci: Fix slot_id resource race conflict nfs: fix UAF in direct writes NFS: Fix up commit deadlocks cifs: Fix UAF in cifs_demultiplex_thread() Bluetooth: fix use-after-free in device_for_each_child() act_mirred: use the backlog for nested calls to mirred ingress net/sched: act_mirred: better wording on protection against excessive stack growth net/sched: act_mirred: refactor the handle of xmit selftests: forwarding: tc_actions.sh: add matchall mirror test net: sched: don't expose action qstats to skb_tc_reinsert() net: sched: extract qstats update code into functions net: sched: extract bstats update code into function net: sched: extract common action counters update code into function mm: perform the mapping_map_writable() check after call_mmap() mm: update memfd seal write check to include F_SEAL_WRITE mm: drop the assumption that VM_SHARED always implies writable codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent btrfs: populate otime when logging an inode item media: venus: hfi: explicitly release IRQ during teardown f2fs: fix to avoid out-of-boundary access in dnode page media: venus: protect against spurious interrupts during probe media: qcom: camss: cleanup media device allocated resource on error path media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS pwm: mediatek: Fix duty and period setting pwm: mediatek: Handle hardware enable and clock enable separately pwm: mediatek: Implement .apply() callback media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() media: v4l2-ctrls: always copy the controls on completion ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig soc: qcom: mdt_loader: Ensure we don't read past the ELF header rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 usb: musb: omap2430: fix device leak at unbind NFS: Fix the setting of capabilities when automounting a new filesystem NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() NFSv4: Fix nfs4_bitmap_copy_adjust() usb: typec: fusb302: cache PD RX state cdc-acm: fix race between initial clearing halt and open USB: cdc-acm: do not log successful probe on later errors mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() x86/fpu: Delay instruction pointer fixup until after warning mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov tracing: Add down_write(trace_event_sem) when adding trace event usb: hub: Don't try to recover devices lost during warm reset. usb: hub: avoid warm port reset during USB3 disconnect x86/mce/amd: Add default names for MCA banks and blocks iio: hid-sensor-prox: Fix incorrect OFFSET calculation f2fs: fix to do sanity check on ino and xnid mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() drm/sched: Remove optimization that causes hang when killing dependent jobs ice: Fix a null pointer dereference in ice_copy_and_init_pkg() net: usbnet: Fix the wrong netif_carrier_on() call net: usbnet: Avoid potential RCU stall on LINK_CHANGE event PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large comedi: Fix initialization of data for instructions that write to subdevice kbuild: Add KBUILD_CPPFLAGS to as-option invocation kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS kbuild: Add CLANG_FLAGS to as-instr mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation kbuild: Update assembler calls to use proper flags and language target ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS usb: dwc3: Ignore late xferNotReady event to prevent halt timeout USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles usb: storage: realtek_cr: Use correct byte order for bcs->Residue USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive iio: proximity: isl29501: fix buffered read on big-endian systems ftrace: Also allocate and copy hash for reading of filter files fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() use uniform permission checks for all mount propagation changes move_mount: allow to add a mount into an existing group fs/buffer: fix use-after-free when call bh_read() helper drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 squashfs: fix memory leak in squashfs_fill_super memstick: Fix deadlock by moving removing flag earlier media: venus: Add a check for packet size after reading from shared memory media: ov2659: Fix memory leaks in ov2659_probe() media: usbtv: Lock resolution while streaming media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() media: gspca: Add bounds checking to firmware parser soc/tegra: pmc: Ensure power-domains are in a known state jbd2: prevent softlockup in jbd2_log_do_checkpoint() PCI: endpoint: Fix configfs group removal on driver teardown PCI: endpoint: Fix configfs group list head handling mtd: rawnand: fsmc: Add missing check after DMA map pwm: imx-tpm: Reset counter if CMOD is 0 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() zynq_fpga: use sgtable-based scatterlist wrappers ata: libata-scsi: Fix ata_to_sense_error() status handling ext4: fix reserved gdt blocks handling in fsmap ext4: fix fsmap end of range reporting with bigalloc ext4: check fast symlink for ea_inode correctly Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" vt: defkeymap: Map keycodes above 127 to K_HOLE vt: keyboard: Don't process Unicode characters in K_OFF mode usb: dwc3: meson-g12a: fix device leaks at unbind usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() m68k: Fix lost column on framebuffer debug console cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() serial: 8250: fix panic due to PSLVERR media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() parisc: Makefile: fix a typo in palo.conf btrfs: fix log tree replay failure due to file with 0 links and extents thunderbolt: Fix copy+paste error in match_service_id() comedi: fix race between polling and detaching misc: rtsx: usb: Ensure mmc child device is active when card is present drm/amdgpu: fix incorrect vm flags to map bo scsi: lpfc: Remove redundant assignment to avoid memory leak rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe pNFS: Fix uninited ptr deref in block/scsi layout pNFS: Handle RPC size limit for layoutcommits pNFS: Fix disk addr range check in block/scsi layout pNFS: Fix stripe mapping in block/scsi layout net: phy: smsc: add proper reset flags for LAN8710A ipmi: Fix strcpy source and destination the same kconfig: lxdialog: fix 'space' to (de)select options kconfig: gconf: fix potential memory leak in renderer_edited() kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() ipmi: Use dev_warn_ratelimited() for incorrect message warnings scsi: aacraid: Stop using PCI_IRQ_AFFINITY scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans kconfig: nconf: Ensure null termination where strncpy is used kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c i3c: don't fail if GETHDRCAP is unsupported PCI: pnv_php: Work around switches with broken presence detection i3c: add missing include to internal header media: uvcvideo: Fix bandwidth issue for Alcor camera media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() media: usb: hdpvr: disable zero-length read messages media: tc358743: Increase FIFO trigger level to 374 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt media: tc358743: Check I2C succeeded during probe pinctrl: stm32: Manage irq affinity settings scsi: mpt3sas: Correctly handle ATA device errors scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() MIPS: Don't crash in stack_top() for tasks without ABI or vDSO jfs: upper bound check of tree index in dbAllocAG jfs: Regular file corruption check jfs: truncate good inode pages when hard link is 0 scsi: bfa: Double-free fix MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} watchdog: dw_wdt: Fix default timeout fs/orangefs: use snprintf() instead of sprintf() scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr cifs: Fix calling CIFSFindFirst() for root path without msearch vhost: fail early when __vhost_add_used() fails net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 uapi: in6: restore visibility of most IPv6 socket options net: ncsi: Fix buffer overflow in fetching version id net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs wifi: iwlegacy: Check rate_idx range after addition netmem: fix skb_frag_address_safe with unreadable skbs wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() net: fec: allow disable coalescing (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer s390/stp: Remove udelay from stp_sync_clock() wifi: iwlwifi: mvm: fix scan request validation net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() net: ipv4: fix incorrect MTU in broadcast routes wifi: cfg80211: Fix interface type validation rcu: Protect ->defer_qs_iw_pending from data race net: ag71xx: Add missing check after DMA map et131x: Add missing check after DMA map be2net: Use correct byte order and format string for TCP seq and ack_seq s390/time: Use monotonic clock in get_cycles() wifi: cfg80211: reject HTC bit for management frames ktest.pl: Prevent recursion of default variable options ASoC: codecs: rt5640: Retry DEVICE_ID verification ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() usb: core: usb_submit_urb: downgrade type check ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path ACPI: processor: fix acpi_object initialization PM: sleep: console: Fix the black screen issue thermal: sysfs: Return ENODATA instead of EAGAIN for reads PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() selftests: tracing: Use mutex_unlock for testing glob filter ARM: tegra: Use I/O memcpy to write to IRAM gpio: tps65912: check the return value of regmap_update_bits() ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed ARM: rockchip: fix kernel hang during smp initialization cpufreq: Exit governor when failed to start old governor usb: xhci: Avoid showing errors during surprise removal usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command usb: xhci: Avoid showing warnings for dying controller selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t usb: xhci: print xhci->xhc_state when queue_command failed securityfs: don't pin dentries twice, once is enough... hfs: fix not erasing deleted b-tree node issue drbd: add missing kref_get in handle_write_conflicts udf: Verify partition map count arm64: Handle KCOV __init vs inline mismatches hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() hfs: fix slab-out-of-bounds in hfs_bnode_read() sctp: linearize cloned gso packets in sctp_rcv netfilter: ctnetlink: fix refcount leak on table dump udp: also consider secpath when evaluating ipsec use for checksumming ACPI: processor: perflib: Move problematic pr->performance check ACPI: processor: perflib: Fix initial _PPC limit application Documentation: ACPI: Fix parent device references fs: Prevent file descriptor table allocations exceeding INT_MAX sunvdc: Balance device refcount in vdc_port_mpgroup_check NFSD: detect mismatch of file handle and delegation stateid in OPEN op net: dpaa: fix device leak when querying time stamp info net: gianfar: fix device leak when querying time stamp info netlink: avoid infinite retry looping in netlink_unicast() ALSA: usb-audio: Validate UAC3 cluster segment descriptors ALSA: usb-audio: Validate UAC3 power domain descriptors, too io_uring: don't use int for ABI usb: gadget : fix use-after-free in composite_dev_cleanup() MIPS: mm: tlb-r4k: Uniquify TLB entries on init USB: serial: option: add Foxconn T99W709 vsock: Do not allow binding to VMADDR_PORT_ANY net/packet: fix a race in packet_set_ring() and packet_notifier() perf/core: Prevent VMA split of buffer mappings perf/core: Exit early on perf_mmap() fail perf/core: Don't leak AUX buffer refcount on allocation failure pptp: fix pptp_xmit() error path smb: client: let recv_done() cleanup before notifying the callers. benet: fix BUG when creating VFs net: drop UFO packets in udp_rcv_segment() ipv6: reject malicious packets in ipv6_gso_segment() pptp: ensure minimal skb length in pptp_xmit() netpoll: prevent hanging NAPI when netcons gets enabled NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() pci/hotplug/pnv-php: Wrap warnings in macro pci/hotplug/pnv-php: Improve error msg on power state change failure usb: chipidea: udc: fix sleeping function called from invalid context f2fs: fix to avoid out-of-boundary access in devs.path f2fs: fix to avoid panic in f2fs_evict_inode f2fs: fix to avoid UAF in f2fs_sync_inode_meta() rtc: pcf8563: fix incorrect maximum clock rate handling rtc: hym8563: fix incorrect maximum clock rate handling rtc: ds1307: fix incorrect maximum clock rate handling module: Restore the moduleparam prefix length check bpf: Check flow_dissector ctx accesses are aligned mtd: rawnand: atmel: set pmecc data setup time mtd: rawnand: atmel: Fix dma_mapping_error() address jfs: fix metapage reference count leak in dbAllocCtl fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref crypto: qat - fix seq_file position update in adf_ring_next() dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap fs/orangefs: Allow 2 more characters in do_c_string() soundwire: stream: restore params when prepare ports fail crypto: img-hash - Fix dma_unmap_sg() nents value hwrng: mtk - handle devm_pm_runtime_enable errors watchdog: ziirave_wdt: check record length in ziirave_firm_verify() scsi: isci: Fix dma_unmap_sg() nents value scsi: mvsas: Fix dma_unmap_sg() nents value scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value clk: sunxi-ng: v3s: Fix de clock definition perf tests bp_account: Fix leaked file descriptor crypto: ccp - Fix crash when rebind ccp device for ccp.ko pinctrl: sunxi: Fix memory leak on krealloc failure power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set clk: davinci: Add NULL check in davinci_lpsc_clk_register() mtd: fix possible integer overflow in erase_xfer() crypto: marvell/cesa - Fix engine load inaccuracy PCI: rockchip-host: Fix "Unexpected Completion" log message vrf: Drop existing dst reference in vrf_ip6_input_dst selftests: rtnetlink.sh: remove esp4_offload after test netfilter: xt_nfacct: don't assume acct name is null-terminated can: kvaser_usb: Assign netdev.dev_port based on device channel index can: kvaser_pciefd: Store device channel index wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" mwl8k: Add missing check after DMA map wifi: rtl8xxxu: Fix RX skb size for aggregation disabled net/sched: Restrict conditions for adding duplicating netems to qdisc tree arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX netfilter: nf_tables: adjust lockdep assertions handling drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value m68k: Don't unregister boot console needlessly tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range iwlwifi: Add missing check for alloc_ordered_workqueue wifi: iwlwifi: Fix memory leak in iwl_mvm_init() wifi: rtl818x: Kill URBs before clearing tx status queue caif: reduce stack size, again bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls staging: nvec: Fix incorrect null termination of battery manufacturer samples: mei: Fix building on musl libc cpufreq: Init policy->rwsem before it may be possibly used ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface usb: early: xhci-dbc: Fix early_ioremap leak Revert "vmci: Prevent the dispatching of uninitialized payloads" pps: fix poll support vmci: Prevent the dispatching of uninitialized payloads staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() ARM: dts: vfxxx: Correctly use two tuples for timer address ASoC: ops: dynamically allocate struct snd_ctl_elem_value hfsplus: remove mutex_lock check in hfsplus_free_extents ASoC: Intel: fix SND_SOC_SOF dependencies ethernet: intel: fix building with large NR_CPUS usb: phy: mxs: disconnect line when USB charger is attached usb: chipidea: add USB PHY event usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use usb: chipidea: udc: protect usb interrupt enable usb: chipidea: udc: add new API ci_hdrc_gadget_connect ALSA: hda: Add missing NVIDIA HDA codec IDs comedi: comedi_test: Fix possible deletion of uninitialized timers nilfs2: reject invalid file types when reading inodes i2c: qup: jump out of the loop in case of timeout net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net: appletalk: Fix use-after-free in AARP proxy probe net: appletalk: fix kerneldoc warnings RDMA/core: Rate limit GID cache warning messages regulator: core: fix NULL dereference on unbind due to stale coupling data usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm usb: hub: fix detection of high tier USB3 devices behind suspended hubs net_sched: sch_sfq: reject invalid perturb period net_sched: sch_sfq: move the limit validation net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: don't allow 1 packet limit net_sched: sch_sfq: handle bigger packets net_sched: sch_sfq: annotate data-races around q->perturb_period power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync power: supply: bq24190_charger: Fix runtime PM imbalance on error xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS virtio-net: ensure the received length does not exceed allocated size ASoC: fsl_sai: Force a software reset when starting in consumer mode usb: dwc3: qcom: Don't leave BCR asserted usb: musb: fix gadget state on disconnect net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout Bluetooth: SMP: If an unallowed command is received consider it a failure Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() usb: net: sierra: check for no status endpoint net/sched: sch_qfq: Fix race condition on qfq_aggregate net: emaclite: Fix missing pointer increment in aligned_read() comedi: Fix use of uninitialized data in insn_rw_emulate_bits() comedi: Fix some signed shift left operations comedi: das6402: Fix bit shift out of bounds comedi: das16m1: Fix bit shift out of bounds comedi: aio_iiro_16: Fix bit shift out of bounds comedi: pcl812: Fix bit shift out of bounds iio: adc: stm32-adc: Fix race in installing chained IRQ handler iio: adc: max1363: Reorder mode_list[] entries iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order mmc: sdhci_am654: Workaround for Errata i2312 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models mmc: bcm2835: Fix dma_unmap_sg() nents value memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() isofs: Verify inode mode when loading from disk dmaengine: nbpfaxi: Fix memory corruption in probe() af_packet: fix soft lockup issue caused by tpacket_snd() af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() HID: core: do not bypass hid_hw_raw_request HID: core: ensure __hid_request reserves the report ID as the first byte HID: core: ensure the allocated report buffer can contain the reserved report ID pch_uart: Fix dma_sync_sg_for_device() nents value Input: xpad - set correct controller type for Acer NGR200 i2c: stm32: fix the device used for the DMA map usb: gadget: configfs: Fix OOB read on empty string write USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI USB: serial: option: add Foxconn T99W640 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition Conflicts: drivers/soc/qcom/mdt_loader.c drivers/usb/dwc3/dwc3-qcom.c drivers/usb/host/xhci-plat.c mm/slub.c mm/zsmalloc.c Change-Id: I83183b507249a323eba0ecec4c7b4b04d76cc7f6 |
||
|
Greg Kroah-Hartman
|
901ffda291 |
This is the 5.4.300 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjeY04ACgkQONu9yGCS aT7jARAAtuC4ENHOhlmT+k8n2jrrNZ5RPHsFipG61AFMkXlTVDxF+ysmlR4Z7i7h fcVDqAfLBehA9rBHya/4A1WPsc5plXGLSy8Xl9C7243RnQRITBE6Y36ZB4MT5Lhy fWMmcE2X9YratNZ4X6pREueQgmtddNusEwB+ZJeYsa3byeLPB0yx9PhZUiitTpvI pLdp6hGtPAAOT8O0wuUhbHZ0khbeCiEmrMXbP44DVjjgAfcdMid+6/x76fgMJZ++ gT8UkkCN2dqMJnT4LgazVBjrCxfbXrU+YNgTkU1O2k3ZINYdYWXZ1Aw2uRIDYwhE NUAbmqZkcafinjhw2/DVp/Rys2zCSsYf9VaZR5BVd+qHNAFnRiw2mOKiynxN/+bT pr3gzw6/SD/faYGMtoFmFcv8COZGx9Az9f2LJmfUoi+ieV9sxQ6xW4c0xDW0ZsQD wp/PBcvKGy6A9WHqT1oQ1lHUrCUY4kZ3/ymPGy1xuyIoB3ILtXAa19LgFB1wMMo6 iPLBlXa+7GsluvYTYzFkJ7wA4BKgtvLONJ/ARyhG2jDpxHdMgikgdimiwmjaZyej uGoOm7Qmt5FPHt2dMlCj8DG120NuXwCgc4+tA/Y9iBVWrHZZsh0myCiO2TImnKwT pHrPWd4Rva8bgZClEFhulreW3evnWrVW3B6a4PJVMRb2csVdCjo= =FesN -----END PGP SIGNATURE----- Merge 5.4.300 into android11-5.4-lts Changes in 5.4.300 usb: hub: Fix flushing of delayed work used for post resume purposes net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. NFSv4: Don't clear capabilities that won't be reset tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. EDAC/altera: Delete an inappropriate dma_free_coherent() call ocfs2: fix recursive semaphore deadlock in fiemap call mtd: rawnand: stm32_fmc2: fix ECC overwrite fuse: check if copy_file_range() returns larger than requested size fuse: prevent overflow in copy_file_range return value mm/khugepaged: fix the address passed to notifier on testing young mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer mtd: nand: raw: atmel: Fix comment in timings preparation mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing tty: hvc_console: Call hvc_kick in hvc_write unconditionally USB: serial: option: add Telit Cinterion FN990A w/audio compositions USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() igb: fix link test skipping when interface is admin down genirq/affinity: Add irq_update_affinity_desc() genirq: Export affinity setter for modules genirq: Provide new interfaces for affinity hints i40e: Use irq_update_affinity_hint() i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails dmaengine: ti: edma: Fix memory allocation size for queue_priority_map dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees phy: ti-pipe3: fix device leak at unbind soc: qcom: mdt_loader: Deal with zero e_shentsize mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported wifi: mac80211: fix incorrect type for ret pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch cgroup: split cgroup_destroy_wq into 3 workqueues net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure i40e: remove redundant memory barrier when cleaning Tx descs tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" net: liquidio: fix overflow in octeon_init_instr_queue() cnic: Fix use-after-free bugs in cnic_delete_task nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery power: supply: bq27xxx: restrict no-battery detection to bq27000 mmc: mvsdio: Fix dma_unmap_sg() nents value rds: ib: Increment i_fastreg_wrs before bailing out ASoC: wm8940: Correct typo in control name ASoC: wm8974: Correct PLL rate rounding ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message usb: gadget: dummy_hcd: remove usage of list iterator past the loop body USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels serial: sc16is7xx: fix bug in flow control levels init net: rfkill: gpio: add DT support net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active ALSA: usb-audio: Fix block comments in mixer_quirks ALSA: usb-audio: Avoid multiple assignments in mixer_quirks ALSA: usb-audio: Simplify NULL comparison in mixer_quirks ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 ALSA: usb-audio: Convert comma to semicolon ALSA: usb-audio: Fix build with CONFIG_INPUT=n usb: core: Add 0x prefix to quirks debug output IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions can: rcar_can: rcar_can_resume(): fix s2ram with PSCI can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: peak_usb: fix shift-out-of-bounds issue drm/gma500: Fix null dereference in hdmi teardown i40e: fix idx validation in i40e_validate_queue_map i40e: fix input validation logic for action_meta i40e: add max boundary check for VF filters fbcon: fix integer overflow in fbcon_do_set_font fbcon: Fix OOB access in font allocation mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() i40e: increase max descriptors for XL710 i40e: add validation for ring_len param i40e: fix idx validation in config queues msg i40e: fix validation of VF state in get resources i40e: add mask to apply valid bits for itr_idx mm/hugetlb: fix folio is still mapped when deleted Linux 5.4.300 Change-Id: I24b202860574c8b633ccc93f52ac4330e4ae51bf Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Bjorn Andersson
|
64faf7d643 |
soc: qcom: mdt_loader: Deal with zero e_shentsize
commit 25daf9af0ac1bf12490b723b5efaf8dcc85980bc upstream.
Firmware that doesn't provide section headers leave both e_shentsize and
e_shnum 0, which obvious isn't compatible with the newly introduced
stricter checks.
Make the section-related checks conditional on either of these values
being non-zero.
Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header")
Reported-by: Val Packett <val@packett.cool>
Closes: https://lore.kernel.org/all/ece307c3-7d65-440f-babd-88cf9705b908@packett.cool/
Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
Closes: https://lore.kernel.org/all/aec9cd03-6fc2-4dc8-b937-8b7cf7bf4128@linaro.org/
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Fixes: 9f35ab0e53cc ("soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()")
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250730-mdt-loader-shentsize-zero-v1-1-04f43186229c@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Cc: Yongqin Liu <yongqin.liu@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
0f7dff11a8 |
This is the 5.4.297 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmiwZfcACgkQONu9yGCS
aT54xQ/7Bakgl/fkNhIOFy8BZtf4GX4drYUsyMFXzYKhmY+rsB41MuhgXEXnt29s
JGG9evsj2MzyL5sxR244F3W/zoH+KEELCLvY93/z6Tt++9r9XNVvX8cWsHKIx9iV
mcVrI0/IvQPnPpgeZoHSwakk86DzyB5Ck6ITCurTndVNx49wcqonqxdxDB79ChjB
GE3XPrSodkPDQFs3ESYa2STRFmOCxm3YmD06rUfOA8WWxHfCPSB+uNZwBHuD5wla
jS5Od20zdAvY+sex179zCSknJB4HBq8rKizIkMxeo84tivBodNbIb8Kf2Hy889ii
5pqIsF0jRmhV/ADO94OfBIcDB5+xoMkCUnqcSH3vsmaenfU7r93Godsl4Shii0z+
Wiw58LEZ/Ki1ZJEfgTvJw0A5sPF0F+06ySVcocUW1z4E8GuT/RKgjJA0BSu82fto
5T8GTJ2nrT1eZbAOiau0MU5jK72PPlFk2uEWD/kW6VYfelmfjGF/SYNy/JSGpivh
dOQkW5V1ZLKyVzVYXyqYFvnZTxDNYCm9qGgYOL6Wkr2Q6XM7QiSKhhGMEBWMpSXP
0xuhZ332a/xrLXdXRR0s04CWPXe5Nb1R2XvJ7EC3JMx/TQHSWGqrbDD+4LBgZWmQ
I6uSNV4IGaqQ83xx2ekSxa5HmbAhPhVvtY/0NhQzyKm7pFAY3WU=
=o4wf
-----END PGP SIGNATURE-----
Merge 5.4.297 into android11-5.4-lts
Changes in 5.4.297
USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
USB: serial: option: add Foxconn T99W640
USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
usb: gadget: configfs: Fix OOB read on empty string write
i2c: stm32: fix the device used for the DMA map
Input: xpad - set correct controller type for Acer NGR200
pch_uart: Fix dma_sync_sg_for_device() nents value
HID: core: ensure the allocated report buffer can contain the reserved report ID
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: do not bypass hid_hw_raw_request
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
af_packet: fix soft lockup issue caused by tpacket_snd()
dmaengine: nbpfaxi: Fix memory corruption in probe()
isofs: Verify inode mode when loading from disk
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
mmc: bcm2835: Fix dma_unmap_sg() nents value
mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
mmc: sdhci_am654: Workaround for Errata i2312
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
iio: adc: max1363: Reorder mode_list[] entries
iio: adc: stm32-adc: Fix race in installing chained IRQ handler
comedi: pcl812: Fix bit shift out of bounds
comedi: aio_iiro_16: Fix bit shift out of bounds
comedi: das16m1: Fix bit shift out of bounds
comedi: das6402: Fix bit shift out of bounds
comedi: Fix some signed shift left operations
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
net: emaclite: Fix missing pointer increment in aligned_read()
net/sched: sch_qfq: Fix race condition on qfq_aggregate
usb: net: sierra: check for no status endpoint
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
Bluetooth: SMP: If an unallowed command is received consider it a failure
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
usb: musb: fix gadget state on disconnect
usb: dwc3: qcom: Don't leave BCR asserted
ASoC: fsl_sai: Force a software reset when starting in consumer mode
virtio-net: ensure the received length does not exceed allocated size
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
power: supply: bq24190_charger: Fix runtime PM imbalance on error
power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
net_sched: sch_sfq: annotate data-races around q->perturb_period
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: don't allow 1 packet limit
net_sched: sch_sfq: use a temporary work area for validating configuration
net_sched: sch_sfq: move the limit validation
net_sched: sch_sfq: reject invalid perturb period
usb: hub: fix detection of high tier USB3 devices behind suspended hubs
usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
regulator: core: fix NULL dereference on unbind due to stale coupling data
RDMA/core: Rate limit GID cache warning messages
net: appletalk: fix kerneldoc warnings
net: appletalk: Fix use-after-free in AARP proxy probe
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
i2c: qup: jump out of the loop in case of timeout
nilfs2: reject invalid file types when reading inodes
comedi: comedi_test: Fix possible deletion of uninitialized timers
ALSA: hda: Add missing NVIDIA HDA codec IDs
usb: chipidea: udc: add new API ci_hdrc_gadget_connect
usb: chipidea: udc: protect usb interrupt enable
usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
usb: chipidea: add USB PHY event
usb: phy: mxs: disconnect line when USB charger is attached
ethernet: intel: fix building with large NR_CPUS
ASoC: Intel: fix SND_SOC_SOF dependencies
hfsplus: remove mutex_lock check in hfsplus_free_extents
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
ARM: dts: vfxxx: Correctly use two tuples for timer address
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
vmci: Prevent the dispatching of uninitialized payloads
pps: fix poll support
Revert "vmci: Prevent the dispatching of uninitialized payloads"
usb: early: xhci-dbc: Fix early_ioremap leak
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
cpufreq: Init policy->rwsem before it may be possibly used
samples: mei: Fix building on musl libc
staging: nvec: Fix incorrect null termination of battery manufacturer
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
caif: reduce stack size, again
wifi: rtl818x: Kill URBs before clearing tx status queue
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
iwlwifi: Add missing check for alloc_ordered_workqueue
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
m68k: Don't unregister boot console needlessly
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
netfilter: nf_tables: adjust lockdep assertions handling
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
mwl8k: Add missing check after DMA map
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
can: kvaser_pciefd: Store device channel index
can: kvaser_usb: Assign netdev.dev_port based on device channel index
netfilter: xt_nfacct: don't assume acct name is null-terminated
selftests: rtnetlink.sh: remove esp4_offload after test
vrf: Drop existing dst reference in vrf_ip6_input_dst
PCI: rockchip-host: Fix "Unexpected Completion" log message
crypto: marvell/cesa - Fix engine load inaccuracy
mtd: fix possible integer overflow in erase_xfer()
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
pinctrl: sunxi: Fix memory leak on krealloc failure
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
perf tests bp_account: Fix leaked file descriptor
clk: sunxi-ng: v3s: Fix de clock definition
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
scsi: mvsas: Fix dma_unmap_sg() nents value
scsi: isci: Fix dma_unmap_sg() nents value
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
hwrng: mtk - handle devm_pm_runtime_enable errors
crypto: img-hash - Fix dma_unmap_sg() nents value
soundwire: stream: restore params when prepare ports fail
fs/orangefs: Allow 2 more characters in do_c_string()
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
dmaengine: nbpfaxi: Add missing check after DMA map
crypto: qat - fix seq_file position update in adf_ring_next()
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
jfs: fix metapage reference count leak in dbAllocCtl
mtd: rawnand: atmel: Fix dma_mapping_error() address
mtd: rawnand: atmel: set pmecc data setup time
bpf: Check flow_dissector ctx accesses are aligned
module: Restore the moduleparam prefix length check
rtc: ds1307: fix incorrect maximum clock rate handling
rtc: hym8563: fix incorrect maximum clock rate handling
rtc: pcf8563: fix incorrect maximum clock rate handling
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
f2fs: fix to avoid panic in f2fs_evict_inode
f2fs: fix to avoid out-of-boundary access in devs.path
usb: chipidea: udc: fix sleeping function called from invalid context
pci/hotplug/pnv-php: Improve error msg on power state change failure
pci/hotplug/pnv-php: Wrap warnings in macro
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
netpoll: prevent hanging NAPI when netcons gets enabled
pptp: ensure minimal skb length in pptp_xmit()
ipv6: reject malicious packets in ipv6_gso_segment()
net: drop UFO packets in udp_rcv_segment()
benet: fix BUG when creating VFs
smb: client: let recv_done() cleanup before notifying the callers.
pptp: fix pptp_xmit() error path
perf/core: Don't leak AUX buffer refcount on allocation failure
perf/core: Exit early on perf_mmap() fail
perf/core: Prevent VMA split of buffer mappings
net/packet: fix a race in packet_set_ring() and packet_notifier()
vsock: Do not allow binding to VMADDR_PORT_ANY
USB: serial: option: add Foxconn T99W709
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
usb: gadget : fix use-after-free in composite_dev_cleanup()
io_uring: don't use int for ABI
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
netlink: avoid infinite retry looping in netlink_unicast()
net: gianfar: fix device leak when querying time stamp info
net: dpaa: fix device leak when querying time stamp info
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
sunvdc: Balance device refcount in vdc_port_mpgroup_check
fs: Prevent file descriptor table allocations exceeding INT_MAX
Documentation: ACPI: Fix parent device references
ACPI: processor: perflib: Fix initial _PPC limit application
ACPI: processor: perflib: Move problematic pr->performance check
udp: also consider secpath when evaluating ipsec use for checksumming
netfilter: ctnetlink: fix refcount leak on table dump
sctp: linearize cloned gso packets in sctp_rcv
hfs: fix slab-out-of-bounds in hfs_bnode_read()
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
arm64: Handle KCOV __init vs inline mismatches
udf: Verify partition map count
drbd: add missing kref_get in handle_write_conflicts
hfs: fix not erasing deleted b-tree node issue
securityfs: don't pin dentries twice, once is enough...
usb: xhci: print xhci->xhc_state when queue_command failed
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
usb: xhci: Avoid showing warnings for dying controller
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
usb: xhci: Avoid showing errors during surprise removal
cpufreq: Exit governor when failed to start old governor
ARM: rockchip: fix kernel hang during smp initialization
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
gpio: tps65912: check the return value of regmap_update_bits()
ARM: tegra: Use I/O memcpy to write to IRAM
selftests: tracing: Use mutex_unlock for testing glob filter
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
PM: sleep: console: Fix the black screen issue
ACPI: processor: fix acpi_object initialization
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
usb: core: usb_submit_urb: downgrade type check
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
ASoC: codecs: rt5640: Retry DEVICE_ID verification
ktest.pl: Prevent recursion of default variable options
wifi: cfg80211: reject HTC bit for management frames
s390/time: Use monotonic clock in get_cycles()
be2net: Use correct byte order and format string for TCP seq and ack_seq
et131x: Add missing check after DMA map
net: ag71xx: Add missing check after DMA map
rcu: Protect ->defer_qs_iw_pending from data race
wifi: cfg80211: Fix interface type validation
net: ipv4: fix incorrect MTU in broadcast routes
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
wifi: iwlwifi: mvm: fix scan request validation
s390/stp: Remove udelay from stp_sync_clock()
(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
net: fec: allow disable coalescing
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
netmem: fix skb_frag_address_safe with unreadable skbs
wifi: iwlegacy: Check rate_idx range after addition
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
net: ncsi: Fix buffer overflow in fetching version id
uapi: in6: restore visibility of most IPv6 socket options
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
vhost: fail early when __vhost_add_used() fails
cifs: Fix calling CIFSFindFirst() for root path without msearch
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
fs/orangefs: use snprintf() instead of sprintf()
watchdog: dw_wdt: Fix default timeout
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
scsi: bfa: Double-free fix
jfs: truncate good inode pages when hard link is 0
jfs: Regular file corruption check
jfs: upper bound check of tree index in dbAllocAG
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
scsi: mpt3sas: Correctly handle ATA device errors
pinctrl: stm32: Manage irq affinity settings
media: tc358743: Check I2C succeeded during probe
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
media: tc358743: Increase FIFO trigger level to 374
media: usb: hdpvr: disable zero-length read messages
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
media: uvcvideo: Fix bandwidth issue for Alcor camera
i3c: add missing include to internal header
PCI: pnv_php: Work around switches with broken presence detection
i3c: don't fail if GETHDRCAP is unsupported
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
kconfig: nconf: Ensure null termination where strncpy is used
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
kconfig: gconf: fix potential memory leak in renderer_edited()
kconfig: lxdialog: fix 'space' to (de)select options
ipmi: Fix strcpy source and destination the same
net: phy: smsc: add proper reset flags for LAN8710A
pNFS: Fix stripe mapping in block/scsi layout
pNFS: Fix disk addr range check in block/scsi layout
pNFS: Handle RPC size limit for layoutcommits
pNFS: Fix uninited ptr deref in block/scsi layout
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
scsi: lpfc: Remove redundant assignment to avoid memory leak
drm/amdgpu: fix incorrect vm flags to map bo
misc: rtsx: usb: Ensure mmc child device is active when card is present
comedi: fix race between polling and detaching
thunderbolt: Fix copy+paste error in match_service_id()
btrfs: fix log tree replay failure due to file with 0 links and extents
parisc: Makefile: fix a typo in palo.conf
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
media: uvcvideo: Do not mark valid metadata as invalid
serial: 8250: fix panic due to PSLVERR
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
m68k: Fix lost column on framebuffer debug console
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
usb: gadget: udc: renesas_usb3: fix device leak at unbind
usb: dwc3: meson-g12a: fix device leaks at unbind
vt: keyboard: Don't process Unicode characters in K_OFF mode
vt: defkeymap: Map keycodes above 127 to K_HOLE
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
ext4: check fast symlink for ea_inode correctly
ext4: fix fsmap end of range reporting with bigalloc
ext4: fix reserved gdt blocks handling in fsmap
ata: libata-scsi: Fix ata_to_sense_error() status handling
zynq_fpga: use sgtable-based scatterlist wrappers
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
pwm: imx-tpm: Reset counter if CMOD is 0
mtd: rawnand: fsmc: Add missing check after DMA map
PCI: endpoint: Fix configfs group list head handling
PCI: endpoint: Fix configfs group removal on driver teardown
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
soc/tegra: pmc: Ensure power-domains are in a known state
media: gspca: Add bounds checking to firmware parser
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
media: usbtv: Lock resolution while streaming
media: ov2659: Fix memory leaks in ov2659_probe()
media: venus: Add a check for packet size after reading from shared memory
memstick: Fix deadlock by moving removing flag earlier
squashfs: fix memory leak in squashfs_fill_super
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
fs/buffer: fix use-after-free when call bh_read() helper
move_mount: allow to add a mount into an existing group
use uniform permission checks for all mount propagation changes
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
ftrace: Also allocate and copy hash for reading of filter files
iio: proximity: isl29501: fix buffered read on big-endian systems
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
kbuild: Update assembler calls to use proper flags and language target
mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
kbuild: Add CLANG_FLAGS to as-instr
kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
kbuild: Add KBUILD_CPPFLAGS to as-option invocation
comedi: Fix initialization of data for instructions that write to subdevice
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
net: usbnet: Fix the wrong netif_carrier_on() call
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
drm/sched: Remove optimization that causes hang when killing dependent jobs
mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
f2fs: fix to do sanity check on ino and xnid
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
x86/mce/amd: Add default names for MCA banks and blocks
usb: hub: avoid warm port reset during USB3 disconnect
usb: hub: Don't try to recover devices lost during warm reset.
tracing: Add down_write(trace_event_sem) when adding trace event
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
x86/fpu: Delay instruction pointer fixup until after warning
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
USB: cdc-acm: do not log successful probe on later errors
cdc-acm: fix race between initial clearing halt and open
usb: typec: fusb302: cache PD RX state
NFSv4: Fix nfs4_bitmap_copy_adjust()
NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
NFS: Fix the setting of capabilities when automounting a new filesystem
usb: musb: omap2430: fix device leak at unbind
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
media: v4l2-ctrls: always copy the controls on completion
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
pwm: mediatek: Implement .apply() callback
pwm: mediatek: Handle hardware enable and clock enable separately
pwm: mediatek: Fix duty and period setting
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
media: qcom: camss: cleanup media device allocated resource on error path
media: venus: protect against spurious interrupts during probe
f2fs: fix to avoid out-of-boundary access in dnode page
media: venus: hfi: explicitly release IRQ during teardown
btrfs: populate otime when logging an inode item
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
mm: drop the assumption that VM_SHARED always implies writable
mm: update memfd seal write check to include F_SEAL_WRITE
mm: perform the mapping_map_writable() check after call_mmap()
net: sched: extract common action counters update code into function
net: sched: extract bstats update code into function
net: sched: extract qstats update code into functions
net: sched: don't expose action qstats to skb_tc_reinsert()
selftests: forwarding: tc_actions.sh: add matchall mirror test
net/sched: act_mirred: refactor the handle of xmit
net/sched: act_mirred: better wording on protection against excessive stack growth
act_mirred: use the backlog for nested calls to mirred ingress
Bluetooth: fix use-after-free in device_for_each_child()
cifs: Fix UAF in cifs_demultiplex_thread()
NFS: Fix up commit deadlocks
nfs: fix UAF in direct writes
usb: xhci: Fix slot_id resource race conflict
scsi: qla4xxx: Prevent a potential error pointer dereference
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
s390/hypfs: Enable limited access during lockdown
alloc_fdtable(): change calling conventions.
Linux 5.4.297
Change-Id: I31d1928fd98d4aebd14d5e4753dffcf88dd4c03b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Michael Bestas
|
ee69f5d73d |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20: ANDROID: bpf: do not fail to load if log is full ANDROID: fix kernelci compressed kernel linking ANDROID: GKI: Update symbol list for Zebra UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() Linux 5.4.295 scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() perf: Fix sample vs do_exit() s390/pci: Fix __pcilg_mio_inuser() inline assembly rtc: test: Fix invalid format specifier. jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() mm/huge_memory: fix dereferencing invalid pmd migration entry rtc: Make rtc_time64_to_tm() support dates before 1970 rtc: Improve performance of rtc_time64_to_tm(). Add tests. xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms ARM: dts: am335x-bone-common: Increase MDIO reset deassert time ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board net: atm: fix /proc/net/atm/lec handling ... Change-Id: Ibdde607f7a4ae5a74994603f513e7f94a9eb04ad |
||
|
Michael Bestas
|
2b9e22c70c |
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-08-01 * tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common: ANDROID: bpf: do not fail to load if log is full ANDROID: fix kernelci compressed kernel linking ANDROID: GKI: Update symbol list for Zebra UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() Linux 5.4.295 scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() perf: Fix sample vs do_exit() s390/pci: Fix __pcilg_mio_inuser() inline assembly rtc: test: Fix invalid format specifier. jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() mm/huge_memory: fix dereferencing invalid pmd migration entry rtc: Make rtc_time64_to_tm() support dates before 1970 rtc: Improve performance of rtc_time64_to_tm(). Add tests. xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms ARM: dts: am335x-bone-common: Increase MDIO reset deassert time ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board net: atm: fix /proc/net/atm/lec handling net: atm: add lec_mutex calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior atm: atmtcp: Free invalid length skb in atmtcp_c_send(). mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). wifi: carl9170: do not ping device which has failed to load firmware aoe: clean device rq_list in aoedev_downdev() hwmon: (occ) fix unaligned accesses drm/nouveau/bl: increase buffer size to avoid truncate warning erofs: remove unused trace event erofs_destroy_inode ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged ALSA: hda/intel: Add Thinkpad E15 to PM deny list Input: sparcspkr - avoid unannotated fall-through HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() atm: Revert atm_account_tx() if copy_from_iter_full() fails. selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len scsi: s390: zfcp: Ensure synchronous unit_add scsi: storvsc: Increase the timeouts to storvsc_timeout jffs2: check jffs2_prealloc_raw_node_refs() result in few other places jffs2: check that raw node were preallocated before writing summary drivers/rapidio/rio_cm.c: prevent possible heap overwrite Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery platform/x86: dell_rbu: Stop overwriting data buffer platform: Add Surface platform directory Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" tee: Prevent size calculation wraparound on 32-bit kernels ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value watchdog: da9052_wdt: respect TWDMIN i40e: fix MMIO write access to an invalid page in i40e_clear_hw sock: Correct error checking condition for (assign|release)_proto_idx() scsi: lpfc: Use memcpy() for BIOS version vxlan: Do not treat dst cache initialization errors as fatal clk: rockchip: rk3036: mark ddrphy as critical wifi: mac80211: do not offer a mesh path if forwarding is disabled net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows tcp: always seek for minimal rtt in tcp_rcv_rtt_update() net: dlink: add synchronization for stats update sctp: Do not wake readers in __sctp_write_space() emulex/benet: correct command version selection in be_cmd_get_stats() i2c: designware: Invoke runtime suspend on quick slave re-registration net: macb: Check return value of dma_set_mask_and_coherent() cpufreq: Force sync policy boost with global boost on sysfs update nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() media: tc358743: ignore video while HPD is low drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB jfs: Fix null-ptr-deref in jfs_ioc_trim drm/amdgpu/gfx9: fix CSIB handling drm/amdgpu/gfx8: fix CSIB handling jfs: fix array-index-out-of-bounds read in add_missing_indices drm/amdgpu/gfx7: fix CSIB handling drm/amdgpu/gfx10: fix CSIB handling drm/msm/a6xx: Increase HFI response timeout drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition drm/msm/hdmi: add runtime PM calls to DDC transfer function drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() sunrpc: update nextcheck time when adding new cache entries drm/amdgpu/gfx6: fix CSIB handling ACPI: battery: negate current when discharging PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() power: supply: bq27xxx: Retrieve again when busy ACPICA: fix acpi parse and parseext cache leaks ACPICA: Avoid sequence overread in call to strncmp() ACPICA: fix acpi operand cache leak in dswstate.c iio: adc: ad7606_spi: fix reg write value mask PCI: Fix lock symmetry in pci_slot_unlock() PCI: Add ACS quirk for Loongson PCIe uio_hv_generic: Use correct size for interrupt and monitor pages regulator: max14577: Add error check for max14577_read_reg() mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS staging: iio: ad5933: Correct settling cycles encoding per datasheet net: ch9200: fix uninitialised access during mii_nway_restart ftrace: Fix UAF when lookup kallsym after ftrace disabled dm-mirror: fix a tiny race condition mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk mm: fix ratelimit_pages update error in dirty_ratio_handler() ipc: fix to protect IPCS lookups using RCU parisc: fix building with gcc-15 vgacon: Add check for vc_origin address range in vgacon_scroll() fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var EDAC/altera: Use correct write width with the INTTEST register NFC: nci: uart: Set tty->disc_data only in success path f2fs: prevent kernel warning due to negative i_nlink from corrupted image Input: ims-pcu - check record size in ims_pcu_flash_firmware() ext4: fix calculation of credits for extent tree modification ext4: inline: fix len overflow in ext4_prepare_inline_data bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() media: v4l2-dev: fix error handling in __video_register_device() media: gspca: Add error handling for stv06xx_read_sensor() wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() gfs2: move msleep to sleepable context configfs: Do not override creating attribute file failure in populate_attrs() net: usb: aqc111: debug info before sanitation calipso: unlock rcu before returning -EAFNOSUPPORT xen/arm: call uaccess_ttbr0_enable for dm_op hypercall usb: Flush altsetting 0 endpoints before reinitializating them after reset. fs/filesystems: Fix potential unsigned integer underflow in fs_name() net/mdiobus: Fix potential out-of-bounds read/write access drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option x86/boot/compressed: prefer cc-option for CFLAGS additions net: mdio: C22 is now optional, EOPNOTSUPP if not provided net_sched: tbf: fix a race in tbf_change() net_sched: red: fix a race in __red_change() net_sched: prio: fix a race in prio_tune() net/mlx5: Fix return value when searching for existing flow group net/mlx5: Wait for inactive autogroups i40e: retry VFLR handling if there is ongoing VF reset i40e: return false from i40e_reset_vf if reset is in progress net_sched: sch_sfq: fix a potential crash on gso_skb handling scsi: iscsi: Fix incorrect error path labels for flashnode operations NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes NFSD: Fix ia_size underflow Input: synaptics-rmi - fix crash with unsupported versions of F34 Input: synaptics-rmi4 - convert to use sysfs_emit() APIs pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() do_change_type(): refuse to operate on unmounted/not ours mounts PM: sleep: Fix power.is_suspended cleanup for direct-complete devices ice: create new Tx scheduler nodes for new queues only Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION net/mlx4_en: Prevent potential integer overflow calculating Hz vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() serial: Fix potential null-ptr-deref in mlb_usio_probe() usb: renesas_usbhs: Reorder clock handling and power management in probe rtc: Fix offset calculation for .start_secs < 0 rtc: sh: assign correct interrupts with DT perf record: Fix incorrect --user-regs comments perf tests switch-tracking: Fix timestamp comparison mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 perf ui browser hists: Set actions->thread before calling do_zoom_thread() fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() soc: aspeed: lpc: Fix impossible judgment condition arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device bus: fsl-mc: fix double-free on mc_dev nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() nilfs2: add pointer check for nilfs_direct_propagate() Squashfs: check return result of sb_min_blocksize ARM: dts: at91: at91sam9263: fix NAND chip selects ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select f2fs: fix to correct check conditions in f2fs_cross_rename f2fs: use d_inode(dentry) cleanup dentry->d_inode calipso: Don't call calipso functions for AF_INET sk. net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy net: usb: aqc111: fix error handling of usbnet read calls netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy wifi: ath9k_htc: Abort software beacon handling if disabled bpf: Fix WARN() in get_bpf_raw_tp_regs pinctrl: at91: Fix possible out-of-boundary access ktls, sockmap: Fix missing uncharge operation netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it f2fs: clean up w/ fscrypt_is_bounce_page() RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h wifi: rtw88: do not ignore hardware read error during DPK net: ncsi: Fix GCPS 64-bit member variables f2fs: fix to do sanity check on sbi->total_valid_block_count drm/tegra: rgb: Fix the unbound reference count drm/vkms: Adjust vkms_state->active_planes allocation type drm: rcar-du: Fix memory leak in rcar_du_vsps_init() selftests/seccomp: fix syscall_restart test for arm compat firmware: psci: Fix refcount leak in psci_dt_init m68k: mac: Fix macintosh_config for Mac II drm/vmwgfx: Add seqno waiter for sync_files spi: sh-msiof: Fix maximum DMA transfer size ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() EDAC/skx_common: Fix general protection fault crypto: marvell/cesa - Avoid empty transfer descriptor crypto: marvell/cesa - Handle zero-length skcipher requests x86/cpu: Sanitize CPUID(0x80000000) output perf/core: Fix broken throttling when max_samples_per_tick=1 gfs2: gfs2_create_inode error handling fix netfilter: nft_socket: fix sk refcount leaks thunderbolt: Do not double dequeue a configuration request usb: usbtmc: Fix timeout value in get_stb usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE pinctrl: armada-37xx: set GPIO output value before setting direction pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 tracing: Fix compilation warning on arm32 BACKPORT: binder: Create safe versions of binder log files UPSTREAM: binder: Refactor binder_node print synchronization Revert "coredump: hand a pidfd to the usermode coredump helper" Linux 5.4.294 xen/swiotlb: relax alignment requirements platform/x86: thinkpad_acpi: Ignore battery threshold change event notification platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys spi: spi-sun4i: fix early activation um: let 'make clean' properly clean underlying SUBARCH as well platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS nfs: don't share pNFS DS connections between net namespaces HID: quirks: Add ADATA XPG alpha wireless mouse support coredump: hand a pidfd to the usermode coredump helper fork: use pidfd_prepare() pid: add pidfd_prepare() pidfd: check pid has attached task in fdinfo coredump: fix error handling for replace_fd() net_sched: hfsc: Address reentrant enqueue adding class to eltree twice smb: client: Reset all search buffer pointers when releasing buffer smb: client: Fix use-after-free in cifs_fill_dirent drm/i915/gvt: fix unterminated-string-initialization warning netfilter: nf_tables: do not defer rule destruction via call_rcu netfilter: nf_tables: wait for rcu grace period on net_device removal netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx kbuild: Disable -Wdefault-const-init-unsafe spi: spi-fsl-dspi: restrict register range for regmap access mm/page_alloc.c: avoid infinite retries caused by cpuset race memcg: always call cond_resched() after fn() drm/edid: fixed the bug that hdr metadata was not reset llc: fix data loss when reading from a socket in llc_ui_recvmsg() ALSA: pcm: Fix race of buffer access at PCM OSS layer can: bcm: add missing rcu read protection for procfs content can: bcm: add locking for bcm_op runtime updates crypto: algif_hash - fix double free in hash_accept sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() net: dwmac-sun8i: Use parsed internal PHY address instead of 1 bridge: netfilter: Fix forwarding of fragmented packets xfrm: Sanitize marks before insert __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock xenbus: Allow PVH dom0 a non-local xenstore btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref nvmet-tcp: don't restore null sk_state_change ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 pinctrl: meson: define the pull up/down resistor value as 60 kOhm drm: Add valid clones check drm/atomic: clarify the rules around drm_atomic_state->allow_modeset regulator: ad5398: Add device tree support wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate bpftool: Fix readlink usage in get_fd_type HID: usbkbd: Fix the bit shift number for LED_KANA scsi: st: Restore some drive settings after reset scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine rcu: fix header guard for rcu_all_qs() rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y vxlan: Annotate FDB data races hwmon: (xgene-hwmon) use appropriate type for the latency value ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). net/mlx5e: reduce rep rxq depth to 256 for ECPF net/mlx5e: set the tx_queue_len for pfifo_fast net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB phy: core: don't require set_mode() callback for phy_get_mode() to work net/mlx4_core: Avoid impossible mlx4_db_alloc() order value smack: recognize ipv4 CIPSO w/o categories pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map ASoC: ops: Enforce platform maximum on initial value net/mlx5: Apply rate-limiting to high temperature warning net/mlx5: Modify LSB bitmask in temperature event to include only the first bit ACPI: HED: Always initialize before evged PCI: Fix old_size lower bound in calculate_iosize() too EDAC/ie31200: work around false positive build warning net: pktgen: fix access outside of user given buffer in pktgen_thread_write() wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU scsi: mpt3sas: Send a diag reset if target reset fails MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core MIPS: Use arch specific syscall name match function cpuidle: menu: Avoid discarding useful information x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() bonding: report duplicate MAC address in all situations net: xgene-v2: remove incorrect ACPI_PTR annotation drm/amdkfd: KFD release_work possible circular locking net/mlx5: Avoid report two health errors on same syndrome fpga: altera-cvp: Increase credit timeout drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence hwmon: (gpio-fan) Add missing mutex locks x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 net: pktgen: fix mpls maximum labels list parsing pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" media: cx231xx: set device_caps for 417 orangefs: Do not truncate file size dm cache: prevent BUG_ON by blocking retries on failed device resumes media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 ieee802154: ca8210: Use proper setters and getters for bitwise types rtc: ds1307: stop disabling alarms on probe powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 mmc: sdhci: Disable SD card clock before changing parameters netfilter: conntrack: Bound nf_conntrack sysctl writes posix-timers: Add cond_resched() to posix_timer_add() search loop xen: Add support for XenServer 6.1 platform device dm: restrict dm device size to 2^63-512 bytes kbuild: fix argument parsing in scripts/config scsi: st: ERASE does not change tape location scsi: st: Tighten the page format heuristics with MODE SELECT ext4: reorder capability check last um: Update min_low_pfn to match changes in uml_reserved um: Store full CSGSFS and SS register from mcontext btrfs: send: return -ENAMETOOLONG when attempting a path that is too long btrfs: avoid linker error in btrfs_find_create_tree_block() i2c: pxa: fix call balance of i2c->clk handling routines mmc: host: Wait for Vdd to settle on card power off libnvdimm/labels: Fix divide error in nd_label_data_init() pNFS/flexfiles: Report ENETDOWN as a connection error tools/build: Don't pass test log files to linker dql: Fix dql->limit value when reset. SUNRPC: rpc_clnt_set_transport() must not change the autobind setting NFSv4: Treat ENETUNREACH errors as fatal for state recovery fbdev: core: tileblit: Implement missing margin clearing for tileblit fbdev: fsl-diu-fb: add missing device_remove_file() mailbox: use error ret code of of_parse_phandle_with_args() kconfig: merge_config: use an empty file as initfile cgroup: Fix compilation issue due to cgroup_mutex not being exported dma-mapping: avoid potential unused data compilation warning scsi: target: iscsi: Fix timeout on deleted connection openvswitch: Fix unsafe attribute parsing in output_userspace() Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 Input: synaptics - enable SMBus for HP Elitebook 850 G1 clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() phy: renesas: rcar-gen3-usb2: Set timing registers only once phy: Fix error handling in tegra_xusb_port_init ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() ACPI: PPTT: Fix processor subtable walk dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" NFSv4/pnfs: Reset the layout state after a layoutreturn NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() ALSA: sh: SND_AICA should depend on SH_DMA_API net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING spi: loopback-test: Do not split 1024-byte hexdumps nfs: handle failure of nfs_get_lock_context in unlock path RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug iio: chemical: sps30: use aligned_s64 for timestamp iio: adc: ad7768-1: Fix insufficient alignment of timestamp. staging: axis-fifo: Correct handling of tx_fifo_depth for size validation staging: axis-fifo: avoid parsing ignored device tree properties staging: axis-fifo: Remove hardware resets for user errors staging: axis-fifo: replace spinlock with mutex platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection do_umount(): add missing barrier before refcount checks in sync case nvme: unblock ctrl state transition for firmware update MIPS: Fix MAX_REG_OFFSET iio: adc: dln2: Use aligned_s64 for timestamp types: Complement the aligned types with signed 64-bit one usb: usbtmc: Fix erroneous generic_read ioctl return usb: usbtmc: Fix erroneous wait_srq ioctl return usb: usbtmc: Fix erroneous get_stb ioctl error returns USB: usbtmc: use interruptible sleep in usbtmc_read usb: typec: ucsi: displayport: Fix NULL pointer access usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition ocfs2: stop quota recovery before disabling quotas ocfs2: implement handshaking with ocfs2 recovery thread ocfs2: switch osb->disable_recovery to enum module: ensure that kobject_put() is safe for module type kobjects xenbus: Use kref to track req lifetime usb: uhci-platform: Make the clock really optional iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo iio: adis16201: Correct inclinometer channel resolution iio: adc: ad7606: fix serial register access staging: iio: adc: ad7816: Correct conditional logic for store mode Input: synaptics - enable InterTouch on Dell Precision M3800 Input: synaptics - enable InterTouch on Dynabook Portege X30L-G Input: synaptics - enable InterTouch on Dynabook Portege X30-D net: dsa: b53: fix learning on VLAN unaware bridges netfilter: ipset: fix region locking in hash types sch_htb: make htb_deactivate() idempotent scsi: target: Fix WRITE_SAME No Data Buffer crash dm: fix copying after src array boundaries iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid arm64: dts: rockchip: fix iface clock-name on px30 iommus usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling usb: chipidea: ci_hdrc_imx: use dev_err_probe() usb: chipidea: imx: refine the error handling for hsic usb: chipidea: imx: change hsic power regulator as optional irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() irqchip/gic-v2m: Mark a few functions __init irqchip/gic-v2m: Add const to of_device_id sch_htb: make htb_qlen_notify() idempotent of: module: add buffer overflow check in of_modalias() PCI: imx6: Skip controller_id generation logic for i.MX7D net: fec: ERR007885 Workaround for conventional TX net: lan743x: Fix memleak issue when GSO enabled lan743x: fix endianness when accessing descriptors lan743x: remove redundant initialization of variable current_head_index nvme-tcp: fix premature queue removal and I/O failover net: dlink: Correct endianness handling of led_mode net_sched: qfq: Fix double list add in class with netem as child qdisc net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc net_sched: drr: Fix double list add in class with netem as child qdisc net/mlx5: E-Switch, Initialize MAC Address for Default GID tracing: Fix oob write in trace_seq_to_buffer() dm: always update the array size in realloc_argv on success dm-integrity: fix a warning on invalid table line wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload parisc: Fix double SIGFPE crash i2c: imx-lpi2c: Fix clock count when probe defers EDAC/altera: Set DDR and SDMMC interrupt mask before registration EDAC/altera: Test the correct error reg offset Conflicts: Makefile drivers/platform/Kconfig drivers/platform/Makefile include/linux/pid.h Change-Id: Iab0fd96a23cfe218e945cbf71eef0e87dce204db |
||
|
Bjorn Andersson
|
1096eb63ec |
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
[ Upstream commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef ]
When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.
Fixes:
|
||
Jon Hunter
|
31f339e3c6 |
soc/tegra: pmc: Ensure power-domains are in a known state
commit b6bcbce3359619d05bf387d4f5cc3af63668dbaa upstream.
After commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on
until late_initcall_sync") was applied, the Tegra210 Jetson TX1 board
failed to boot. Looking into this issue, before this commit was applied,
if any of the Tegra power-domains were in 'on' state when the kernel
booted, they were being turned off by the genpd core before any driver
had chance to request them. This was purely by luck and a consequence of
the power-domains being turned off earlier during boot. After this
commit was applied, any power-domains in the 'on' state are kept on for
longer during boot and therefore, may never transitioned to the off
state before they are requested/used. The hang on the Tegra210 Jetson
TX1 is caused because devices in some power-domains are accessed without
the power-domain being turned off and on, indicating that the
power-domain is not in a completely on state.
>From reviewing the Tegra PMC driver code, if a power-domain is in the
'on' state there is no guarantee that all the necessary clocks
associated with the power-domain are on and even if they are they would
not have been requested via the clock framework and so could be turned
off later. Some power-domains also have a 'clamping' register that needs
to be configured as well. In short, if a power-domain is already 'on' it
is difficult to know if it has been configured correctly. Given that the
power-domains happened to be switched off during boot previously, to
ensure that they are in a good known state on boot, fix this by
switching off any power-domains that are on initially when registering
the power-domains with the genpd framework.
Note that commit
|
||
Andrew Jeffery
|
62e51f51d9 |
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
commit 56448e78a6bb4e1a8528a0e2efe94eff0400c247 upstream.
Mitigate e.g. the following:
# echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind
...
[ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write
[ 120.373866] [00000004] *pgd=00000000
[ 120.377910] Internal error: Oops: 805 [#1] SMP ARM
[ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE
...
[ 120.679543] Call trace:
[ 120.679559] misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac
[ 120.692462] aspeed_lpc_snoop_remove from platform_remove+0x28/0x38
[ 120.700996] platform_remove from device_release_driver_internal+0x188/0x200
...
Fixes:
|
||
|
Andrew Jeffery
|
e4e4798204 |
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
commit 8481d59be606d2338dbfe14b04cdbd1a3402c150 upstream.
Free the kfifo after unregistering the miscdev in
aspeed_lpc_disable_snoop() as the kfifo is initialised before the
miscdev in aspeed_lpc_enable_snoop().
Fixes:
|
||
|
Greg Kroah-Hartman
|
978aeb58ff |
This is the 5.4.295 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmhebGEACgkQONu9yGCS
aT67mBAAqkBCrkNSqHHQpsl/YybmfDgGonfHeLkNOYp4G44Axp/oytb1bAEhg65A
oqfTSF67Hr3xjBVEvFMHMnuFO1+xHxkKIy3LUr9o9gjS+6+rEn7U5cYkaHYPNef5
hN/tPUwf90d2ivpAsTueUu4PegJUJTaux0VqW6PsECKJ/fRF2sdAW7NpGps4zwaw
+gnxZ7fhWnMLDeSH4d6HAFsVB10AH4sC/WzVMGlXpiS7V8vzM7QjAj3S7NWkOjaX
fUWmKLecRT6388V+PBH6tr7vwsbFAv83gKVENgFMPKnsfPLTKd3d81TJvWqbU5Dn
Y+KxG1NWmIUkhlMeqDld51JJCP2JpLxSchqHvJ2TiFJs3gRdkYeQxiDfXHzRsZ+v
8beqQufcmQFxOyUkWQLGlMR9ACva1IA7hQ4HdTqygDqcQjKcvIYGcy+29PpTBVjj
+BNs6F8ttK6jQ19IqwhP2AeIObq/DQCtn0xRaOkfAwyODhi2nD7F191ZtmrRwAq7
ax+hXzNIWkLhvsuG+YLuNXczYbOGKZ56mg8XI+3DQ0KNRUieznsgeXXsjkGbzivn
uDPWkRtqO48RnZHzlLUzT0Zv7pNCWXscnHEa1LfQ7Effj3G0C74TJWLDRcfSgf0i
+cdXwJhnHc1ztExtmuNvfk7SHEFRNhjB8Zmdd8weK6SUzH0knPE=
=jzgM
-----END PGP SIGNATURE-----
Merge 5.4.295 into android11-5.4-lts
Changes in 5.4.295
tracing: Fix compilation warning on arm32
pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
pinctrl: armada-37xx: set GPIO output value before setting direction
usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
usb: usbtmc: Fix timeout value in get_stb
thunderbolt: Do not double dequeue a configuration request
netfilter: nft_socket: fix sk refcount leaks
gfs2: gfs2_create_inode error handling fix
perf/core: Fix broken throttling when max_samples_per_tick=1
x86/cpu: Sanitize CPUID(0x80000000) output
crypto: marvell/cesa - Handle zero-length skcipher requests
crypto: marvell/cesa - Avoid empty transfer descriptor
EDAC/skx_common: Fix general protection fault
PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
spi: sh-msiof: Fix maximum DMA transfer size
drm/vmwgfx: Add seqno waiter for sync_files
m68k: mac: Fix macintosh_config for Mac II
firmware: psci: Fix refcount leak in psci_dt_init
selftests/seccomp: fix syscall_restart test for arm compat
drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
drm/vkms: Adjust vkms_state->active_planes allocation type
drm/tegra: rgb: Fix the unbound reference count
f2fs: fix to do sanity check on sbi->total_valid_block_count
net: ncsi: Fix GCPS 64-bit member variables
wifi: rtw88: do not ignore hardware read error during DPK
RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
f2fs: clean up w/ fscrypt_is_bounce_page()
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
ktls, sockmap: Fix missing uncharge operation
pinctrl: at91: Fix possible out-of-boundary access
bpf: Fix WARN() in get_bpf_raw_tp_regs
wifi: ath9k_htc: Abort software beacon handling if disabled
netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
net: usb: aqc111: fix error handling of usbnet read calls
net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
calipso: Don't call calipso functions for AF_INET sk.
f2fs: use d_inode(dentry) cleanup dentry->d_inode
f2fs: fix to correct check conditions in f2fs_cross_rename
ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
ARM: dts: at91: at91sam9263: fix NAND chip selects
Squashfs: check return result of sb_min_blocksize
nilfs2: add pointer check for nilfs_direct_propagate()
nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
bus: fsl-mc: fix double-free on mc_dev
ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
soc: aspeed: lpc: Fix impossible judgment condition
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
perf ui browser hists: Set actions->thread before calling do_zoom_thread()
perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
perf tests switch-tracking: Fix timestamp comparison
perf record: Fix incorrect --user-regs comments
rtc: sh: assign correct interrupts with DT
rtc: Fix offset calculation for .start_secs < 0
usb: renesas_usbhs: Reorder clock handling and power management in probe
serial: Fix potential null-ptr-deref in mlb_usio_probe()
vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
net/mlx4_en: Prevent potential integer overflow calculating Hz
Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
ice: create new Tx scheduler nodes for new queues only
PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
do_change_type(): refuse to operate on unmounted/not ours mounts
pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
Input: synaptics-rmi - fix crash with unsupported versions of F34
NFSD: Fix ia_size underflow
NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
scsi: iscsi: Fix incorrect error path labels for flashnode operations
net_sched: sch_sfq: fix a potential crash on gso_skb handling
i40e: return false from i40e_reset_vf if reset is in progress
i40e: retry VFLR handling if there is ongoing VF reset
net/mlx5: Wait for inactive autogroups
net/mlx5: Fix return value when searching for existing flow group
net_sched: prio: fix a race in prio_tune()
net_sched: red: fix a race in __red_change()
net_sched: tbf: fix a race in tbf_change()
net: mdio: C22 is now optional, EOPNOTSUPP if not provided
x86/boot/compressed: prefer cc-option for CFLAGS additions
MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
net/mdiobus: Fix potential out-of-bounds read/write access
fs/filesystems: Fix potential unsigned integer underflow in fs_name()
usb: Flush altsetting 0 endpoints before reinitializating them after reset.
xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
calipso: unlock rcu before returning -EAFNOSUPPORT
net: usb: aqc111: debug info before sanitation
configfs: Do not override creating attribute file failure in populate_attrs()
gfs2: move msleep to sleepable context
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: gspca: Add error handling for stv06xx_read_sensor()
media: v4l2-dev: fix error handling in __video_register_device()
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
NFC: nci: uart: Set tty->disc_data only in success path
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
ipc: fix to protect IPCS lookups using RCU
mm: fix ratelimit_pages update error in dirty_ratio_handler()
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
dm-mirror: fix a tiny race condition
ftrace: Fix UAF when lookup kallsym after ftrace disabled
net: ch9200: fix uninitialised access during mii_nway_restart
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
regulator: max14577: Add error check for max14577_read_reg()
uio_hv_generic: Use correct size for interrupt and monitor pages
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ACPICA: Avoid sequence overread in call to strncmp()
ACPICA: fix acpi parse and parseext cache leaks
power: supply: bq27xxx: Retrieve again when busy
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
ACPI: battery: negate current when discharging
drm/amdgpu/gfx6: fix CSIB handling
sunrpc: update nextcheck time when adding new cache entries
drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
drm/msm/hdmi: add runtime PM calls to DDC transfer function
media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
drm/msm/a6xx: Increase HFI response timeout
drm/amdgpu/gfx10: fix CSIB handling
drm/amdgpu/gfx7: fix CSIB handling
jfs: fix array-index-out-of-bounds read in add_missing_indices
drm/amdgpu/gfx8: fix CSIB handling
drm/amdgpu/gfx9: fix CSIB handling
jfs: Fix null-ptr-deref in jfs_ioc_trim
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
media: tc358743: ignore video while HPD is low
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
cpufreq: Force sync policy boost with global boost on sysfs update
net: macb: Check return value of dma_set_mask_and_coherent()
i2c: designware: Invoke runtime suspend on quick slave re-registration
emulex/benet: correct command version selection in be_cmd_get_stats()
sctp: Do not wake readers in __sctp_write_space()
net: dlink: add synchronization for stats update
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
vxlan: Do not treat dst cache initialization errors as fatal
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
platform: Add Surface platform directory
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
Input: sparcspkr - avoid unannotated fall-through
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
erofs: remove unused trace event erofs_destroy_inode
drm/nouveau/bl: increase buffer size to avoid truncate warning
hwmon: (occ) fix unaligned accesses
aoe: clean device rq_list in aoedev_downdev()
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
rtc: Make rtc_time64_to_tm() support dates before 1970
mm/huge_memory: fix dereferencing invalid pmd migration entry
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
rtc: test: Fix invalid format specifier.
s390/pci: Fix __pcilg_mio_inuser() inline assembly
perf: Fix sample vs do_exit()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
Linux 5.4.295
Change-Id: I44ee88afdff6b4865efac55635f7529a2d9715e8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Henry Martin
|
2beee9cf83 |
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
[ Upstream commit f1706e0e1a74b095cbc60375b9b1e6205f5f4c98 ] devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: |
||
Su Hui
|
c07c8b4e33 |
soc: aspeed: lpc: Fix impossible judgment condition
[ Upstream commit d9f0a97e859bdcef51f9c187b1eb712eb13fd3ff ]
smatch error：
drivers/soc/aspeed/aspeed-lpc-snoop.c:169
aspeed_lpc_snoop_config_irq() warn: platform_get_irq() does not return zero
platform_get_irq() return non-zero IRQ number or negative error code,
change '!lpc_snoop->irq' to 'lpc_snoop->irq < 0' to fix this.
Fixes:
|
||
|
Michael Bestas
|
66b9cabfb9 |
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20: ANDROID: Fix compilation error with huge_pmd_share() BACKPORT: mm/gup: Remove enfornced COW mechanism UPSTREAM: mm/userfaultfd: selftests: fix memory corruption with thp enabled UPSTREAM: mm/shmem: use page_mapping() to detect page cache for uffd continue UPSTREAM: mm/userfaultfd: fix memory corruption due to writeprotect UPSTREAM: mm: hugetlb: add missing cache flushing in hugetlb_unshare_all_pmds() BACKPORT: userfaultfd: wp: declare _UFFDIO_WRITEPROTECT conditionally BACKPORT: mm, mempolicy: fix up gup usage in lookup_node UPSTREAM: mm/mempolicy: Allow lookup_node() to handle fatal signal UPSTREAM: mm/gup: Let __get_user_pages_locked() return -EINTR for fatal signal UPSTREAM: mm/gup: fix fixup_user_fault() on multiple retries UPSTREAM: mm/gup: Mark lock taken only after a successful retake UPSTREAM: mm/userfaultfd: honor FAULT_FLAG_KILLABLE in fault path UPSTREAM: mm/gup: allow to react to fatal signals UPSTREAM: mm/gup: allow VM_FAULT_RETRY for multiple times UPSTREAM: mm: allow VM_FAULT_RETRY for multiple times UPSTREAM: mm: introduce FAULT_FLAG_INTERRUPTIBLE UPSTREAM: mm: introduce FAULT_FLAG_DEFAULT UPSTREAM: userfaultfd: don't retake mmap_sem to emulate NOPAGE UPSTREAM: mm: return faster for non-fatal signals in user mode faults ... Change-Id: I9d715b94bd5e1daaf1c3857facb03166aeba69e5 |
||
|
Michael Bestas
|
bbcf9da13a |
Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-05-01 * tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common: UPSTREAM: net_sched: Prevent creation of classes with TC_H_ROOT Linux 5.4.292 jfs: add index corruption check to DT_GETPAGE() jfs: fix slab-out-of-bounds read in ea_get() tracing: Fix use-after-free in print_graph_function_flags during tracer switching mmc: sdhci-pxav3: set NEED_RSP_BUSY capability ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs x86/tsc: Always save/restore TSC sched_clock() on suspend/resume ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() can: flexcan: only change CAN state when link up in system PM arcnet: Add NULL check in com20020pci_probe() net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS vsock: avoid timeout during connect() if the socket is closing net_sched: skbprio: Remove overly strict queue assertions netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets ntb: intel: Fix using link status DB's ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans spufs: fix a leak in spufs_create_context() spufs: fix a leak on spufs_new_file() failure hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} can: statistics: use atomic access in hot path locking/semaphore: Use wake_q to wake up processes outside lock critical section sched/deadline: Use online cpus for validating runtime affs: don't write overlarge OFS data block size fields affs: generate OFS sequence numbers starting at 1 wifi: iwlwifi: fw: allocate chained SG tables for dump sched/smt: Always inline sched_smt_active() octeontx2-af: Fix mbox INTR handler when num VFs > 64 ring-buffer: Fix bytes_dropped calculation issue objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() fs/procfs: fix the comment above proc_pid_wchan() perf python: Check if there is space to copy all the event perf python: Decrement the refcount of just created event on failure perf python: Fixup description of sample.id event member ocfs2: validate l_tree_depth to avoid out-of-bounds access kexec: initialize ELF lowest address to ULONG_MAX perf units: Fix insufficient array space iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio coresight: catu: Fix number of pages while using 64k pages isofs: fix KMSAN uninit-value bug in do_isofs_readdir() x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment mfd: sm501: Switch to BIT() to mitigate integer overflows RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow power: supply: max77693: Fix wrong conversion of charge input threshold value x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 clk: amlogic: g12a: fix mmc A peripheral clock clk: amlogic: gxbb: drop non existing 32k clock parent clk: amlogic: g12b: fix cluster A parent data IB/mad: Check available slots before posting receive WRs clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent pinctrl: renesas: rza2: Fix missing of_node_put() call lib: 842: Improve error handling in sw842_compress() bpf: Use preempt_count() directly in bpf_send_signal_common() clk: amlogic: gxbb: drop incorrect flag on 32k clock fbdev: sm501fb: Add some geometry checks. mdacon: rework dependency list fbdev: au1100fb: Move a variable assignment behind a null pointer check PCI: pciehp: Don't enable HPIE when resuming in poll mode PCI: Remove stray put_device() in pci_register_host_bridge() PCI/portdrv: Only disable pciehp interrupts early when needed PCI/ASPM: Fix link state exit during switch upstream function removal drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member ALSA: hda/realtek: Always honor no_shutup_pins perf/ring_buffer: Allow the EPOLLRDNORM flag for poll lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() PM: sleep: Fix handling devices with direct_complete set on errors thermal: int340x: Add NULL check for adev EDAC/ie31200: Fix the error path order of ie31200_init() EDAC/ie31200: Fix the DIMM size mask for several SoCs EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer selinux: Chain up tool resolving errors in install_policy.sh x86/platform: Only allow CONFIG_EISA for 32-bit x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() x86/mm/pat: cpa-test: fix length for CPA_ARRAY test serial: 8250_dma: terminate correct DMA in tx_dma_flush() memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove net: usb: usbnet: restore usb%d name exception for local mac addresses net: usb: qmi_wwan: add Telit Cinterion FE990B composition net: usb: qmi_wwan: add Telit Cinterion FN990B composition tty: serial: 8250: Add some more device IDs counter: stm32-lptimer-cnt: fix error handling when enabling netfilter: socket: Lookup orig tuple for IPv6 SNAT ARM: Remove address checking for MMUless devices ARM: 9351/1: fault: Add "cut here" line for prefetch aborts ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed() atm: Fix NULL pointer dereference HID: hid-plantronics: Add mic mute mapping and generalize quirks ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() batman-adv: Ignore own maximum aggregation size during RX ARM: shmobile: smp: Enforce shmobile_smp_* alignment mmc: atmel-mci: Add missing clk_disable_unprepare() drm/v3d: Don't run jobs that have errors flagged in its fence i2c: omap: fix IRQ storms net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES net: atm: fix use after free in lec_send() ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create(). ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). Bluetooth: Fix error code in chan_alloc_skb_cb() RDMA/hns: Fix wrong value of max_sge_rd RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path xfrm_output: Force software GSO only in tunnel mode firmware: imx-scu: fix OF node leak in .probe() i2c: sis630: Fix an error handling path in sis630_probe() i2c: ali15x3: Fix an error handling path in ali15x3_probe() i2c: ali1535: Fix an error handling path in ali1535_probe() ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe() drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data() qlcnic: fix memory leak issues in qlcnic_sriov_common.c drm/amd/display: Assign normalized_pix_clk when color depth = 14 drm/atomic: Filter out redundant DPMS calls x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes USB: serial: option: match on interface class for Telit FN990B USB: serial: option: fix Telit Cinterion FE990A name USB: serial: option: add Telit Cinterion FE990B compositions USB: serial: ftdi_sio: add support for Altera USB Blaster 3 block: fix 'kmem_cache of name 'bio-108' already exists' drm/nouveau: Do not override forced connector status x86/irq: Define trace events conditionally fuse: don't truncate cached, mutated symlink nvme: only allow entering LIVE from CONNECTING state sctp: Fix undefined behavior in left shift operation nvmet-rdma: recheck queue state is LIVE in state lock in recv done ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime() s390/cio: Fix CHPID "configure" attribute caching HID: ignore non-functional sensor in HP 5MP Camera HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell ACPI: resource: IRQ override for Eluktronics MECH-17 scsi: qla1280: Fix kernel oops when debug level > 2 iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() powercap: call put_device() on an error path in powercap_register_control_type() hrtimers: Mark is_migration_base() with __always_inline nvme-fc: go straight to connecting state when initializing net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices netfilter: nft_exthdr: fix offset with ipv4_find_option() net_sched: Prevent creation of classes with TC_H_ROOT ipvs: prevent integer overflow in do_ip_vs_get_ctl() netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() drivers/hv: Replace binary semaphore with mutex netpoll: hold rcu read lock in __netpoll_send_skb() netpoll: netpoll_send_skb() returns transmit status netpoll: move netpoll_send_skb() out of line netpoll: remove dev argument from netpoll_send_skb_on_dev() netpoll: Fix use correct return type for ndo_start_xmit() pinctrl: bcm281xx: Fix incorrect regmap max_registers value sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy" Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy" sched/isolation: Prevent boot crash when the boot CPU is nohz_full clockevents/drivers/i8253: Fix stop sequence for timer 0 vlan: fix memory leak in vlan_newlink() Revert "tasklet: Introduce new initialization API" Revert "net: usb: rtl8150: use new tasklet API" Revert "net: usb: rtl8150: enable basic endpoint checking" Revert "usb: xhci: Add timeout argument in address_device USB HCD callback" Revert "usb: xhci: Fix NULL pointer dereference on certain command aborts" Linux 5.4.291 eeprom: digsy_mtc: Make GPIO lookup table match the device slimbus: messaging: Free transaction ID in delayed interrupt scenario intel_th: pci: Add Panther Lake-P/U support intel_th: pci: Add Panther Lake-H support intel_th: pci: Add Arrow Lake support Squashfs: check the inode number is not the invalid value of zero xhci: pci: Fix indentation in the PCI device ID definitions usb: gadget: Check bmAttributes only if configuration is valid usb: gadget: Fix setting self-powered state on suspend usb: gadget: Set self-powered based on MaxPower and bmAttributes usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality usb: typec: ucsi: increase timeout for PPM reset operations usb: atm: cxacru: fix a flaw in existing endpoint checks usb: renesas_usbhs: Flush the notify_hotplug_work usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader usb: renesas_usbhs: Use devm_usb_get_phy() usb: renesas_usbhs: Call clk_put() Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" gpio: rcar: Fix missing of_node_put() call net: ipv6: fix missing dst ref drop in ila lwtunnel net: ipv6: fix dst ref loop in ila lwtunnel net-timestamp: support TCP GSO case for a few missing flags vlan: enforce underlying device type ppp: Fix KMSAN uninit-value warning with bpf be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink drm/sched: Fix preprocessor guard hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() llc: do not use skb_get() before dev_queue_xmit() hwmon: (ad7314) Validate leading zero bits and return error hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table hwmon: (pmbus) Initialise page count in pmbus_identify() caif_virtio: fix wrong pointer check in cfv_probe() net: gso: fix ownership in __udp_gso_segment HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() HID: google: fix unused variable warning under !CONFIG_ACPI wifi: iwlwifi: limit printed string from FW file mm/page_alloc: fix uninitialized variable rapidio: fix an API misues when rio_add_net() fails rapidio: add check for rio_add_net() in rio_scan_alloc_net() wifi: nl80211: reject cooked mode if it is set along with other flags wifi: cfg80211: regulatory: improve invalid hints checking x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 x86/cpu: Validate CPUID leaf 0x2 EDX output x86/cacheinfo: Validate CPUID leaf 0x2 EDX output platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M ALSA: hda/realtek: update ALC222 depop optimize ALSA: hda: intel: Add Dell ALC3271 to power_save denylist HID: appleir: Fix potential NULL dereference at raw event handle Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" drm/amdgpu: disable BAR resize on Dell G5 SE drm/amdgpu: Check extended configuration space register when system uses large bar drm/amdgpu: skip BAR resizing if the bios already did it acct: perform last write from workqueue kernel/acct.c: use dedicated helper to access rlimit values kernel/acct.c: use #elif instead of #end and #elif drop_monitor: fix incorrect initialization order pfifo_tail_enqueue: Drop new packet when sch->limit == 0 sched/core: Prevent rescheduling when interrupts are disabled phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk phy: tegra: xusb: reset VBUS & ID OVERRIDE usbnet: gl620a: fix endpoint checking in genelink_bind() perf/core: Fix low freq setting via IOC_PERIOD ftrace: Avoid potential division by zero in function_stat_show() x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination. ipvs: Always clear ipvs_property flag in skb_scrub_packet() ASoC: es8328: fix route from DAC to output net: cadence: macb: Synchronize stats calculations net: loopback: Avoid sending IP packets without an Ethernet header sunrpc: suppress warnings for unused procfs functions batman-adv: Drop unmanaged ELP metric worker batman-adv: Ignore neighbor throughput metrics in error case acct: block access to kernel internal filesystems ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() tee: optee: Fix supplicant wait loop power: supply: da9150-fg: fix potential overflow flow_dissector: Fix port range key handling in BPF conversion flow_dissector: Fix handling of mixed port and port-range keys net: extract port range fields from fl_flow_key geneve: Suppress list corruption splat in geneve_destroy_tunnels(). gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). geneve: Fix use-after-free in geneve_find_dev(). powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC ALSA: hda/realtek: Fixup ALC225 depop procedure ALSA: hda/realtek - Add type for ALC287 powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline powerpc/64s/mm: Move __real_pte stubs into hash-4k.h USB: gadget: f_midi: f_midi_complete to call queue_work usb/gadget: f_midi: Replace tasklet with work usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API usb: dwc3: Fix timeout issue during controller enter/exit from halt state usb: dwc3: Increase DWC3 controller halt timeout memcg: fix soft lockup in the OOM process mm: update mark_victim tracepoints fields crypto: testmgr - some more fixes to RSA test vectors crypto: testmgr - populate RSA CRT parameters in RSA test vectors crypto: testmgr - fix version number of RSA tests crypto: testmgr - Fix wrong test case of RSA crypto: testmgr - fix wrong key length for pkcs1pad driver core: bus: Fix double free in driver API bus_register() scsi: storvsc: Set correct data length for sending SCSI command without payload vlan: move dev_put into vlan_dev_uninit vlan: introduce vlan_dev_free_egress_priority ima: Fix use-after-free on a dentry's dname.name pps: Fix a use-after-free btrfs: avoid monopolizing a core when activating a swap file Revert "btrfs: avoid monopolizing a core when activating a swap file" x86/i8253: Disable PIT timer 0 when not in use parport_pc: add support for ASIX AX99100 serial: 8250_pci: add support for ASIX AX99100 can: ems_pci: move ASIX AX99100 ids to pci_ids.h nilfs2: protect access to buffers with no active references nilfs2: do not force clear folio if buffer is referenced nilfs2: do not output warnings when clearing dirty buffers alpha: replace hardcoded stack offsets with autogenerated ones ndisc: extend RCU protection in ndisc_send_skb() openvswitch: use RCU protection in ovs_vport_cmd_fill_info() arp: use RCU protection in arp_xmit() neighbour: use RCU protection in __neigh_notify() neighbour: delete redundant judgment statements ndisc: use RCU protection in ndisc_alloc_skb() ipv6: use RCU protection in ip6_default_advmss() ipv4: use RCU protection in inet_select_addr() ipv4: use RCU protection in rt_is_expired() net: add dev_net_rcu() helper net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() regmap-irq: Add missing kfree() partitions: mac: fix handling of bogus partition table gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock alpha: align stack for page fault and user unaligned trap handlers serial: 8250: Fix fifo underflow on flush alpha: make stack 16-byte aligned (most cases) can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero can: c_can: fix unbalanced runtime PM disable in error path USB: serial: option: drop MeiG Smart defines USB: serial: option: fix Telit Cinterion FN990A name USB: serial: option: add Telit Cinterion FN990B compositions USB: serial: option: add MeiG Smart SLM828 usb: cdc-acm: Fix handling of oversized fragments usb: cdc-acm: Check control transfer buffer size before access USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk USB: hub: Ignore non-compliant devices with too many configs or interfaces usb: gadget: f_midi: fix MIDI Streaming descriptor lengths USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI usb: dwc2: gadget: remove of_node reference upon udc_stop usb: gadget: udc: renesas_usb3: Fix compiler warning usb: roles: set switch registered flag early on batman-adv: fix panic during interface removal ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V orangefs: fix a oob in orangefs_debug_write Grab mm lock before grabbing pt lock vfio/pci: Enable iowrite64 and ioread64 for vfio pci media: cxd2841er: fix 64-bit division on gcc-9 x86/xen: allow larger contiguous memory regions in PV guests xen: remove a confusing comment on auto-translated guest I/O gpio: bcm-kona: Add missing newline to dev_err format string gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array team: better TEAM_OPTION_TYPE_STRING validation vrf: use RCU protection in l3mdev_l3_out() ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() HID: multitouch: Add NULL check in mt_input_configured ocfs2: check dir i_size in ocfs2_find_entry MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static ptp: Ensure info->enable callback is always set net/ncsi: wait for the last response to Deselect Package before configuring channel misc: fastrpc: Fix registered buffer page address mtd: onenand: Fix uninitialized retlen in do_otp_read() NFC: nci: Add bounds checking in nci_hci_create_pipe() nilfs2: fix possible int overflows in nilfs_fiemap() ocfs2: handle a symlink read error correctly ocfs2: fix incorrect CPU endianness conversion causing mount failure vfio/platform: check the bounds of read/write syscalls nvmem: core: improve range check for nvmem_cell_write() crypto: qce - unregister previously registered algos in error path crypto: qce - fix goto jump in error path media: uvcvideo: Remove redundant NULL assignment media: uvcvideo: Fix event flags in uvc_ctrl_send_events media: ov5640: fix get_light_freq on auto soc: qcom: smem_state: fix missing of_node_put in error path kbuild: Move -Wenum-enum-conversion to W=2 powerpc/pseries/eeh: Fix get PE state translation serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use serial: sh-sci: Drop __initdata macro for port_cfg soc: qcom: socinfo: Avoid out of bounds read of serial number usb: gadget: f_tcm: Don't prepare BOT write request twice usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint usb: gadget: f_tcm: Decrement command ref count on cleanup usb: gadget: f_tcm: Translate error to sense wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() HID: hid-sensor-hub: don't use stale platform-data on remove of: reserved-memory: Fix using wrong number of cells to get property 'alignment' of: Fix of_find_node_opts_by_path() handling of alias+path+options of: Correct child specifier used as input of the 2nd nexus node perf bench: Fix undefined behavior in cmpworker() clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate clk: qcom: clk-alpha-pll: fix alpha mode configuration Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc drm/komeda: Add check for komeda_get_layer_fourcc_list() KVM: s390: vsie: fix some corner-cases when grabbing vsie pages KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma binfmt_flat: Fix integer overflow bug on 32 bit systems m68k: vga: Fix I/O defines s390/futex: Fix FUTEX_OP_ANDN implementation leds: lp8860: Write full EEPROM, not only half of it cpufreq: s3c64xx: Fix compilation warning tun: revert fix group permission check netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() net: rose: lock the socket in rose_bind() udp: gso: do not drop small packets when PMTU reduces tg3: Disable tg3 PCIe AER on system reboot gpu: drm_dp_cec: fix broken CEC adapter properties check firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry nvme: handle connectivity loss in nvme_set_queue_count usb: xhci: Fix NULL pointer dereference on certain command aborts usb: xhci: Add timeout argument in address_device USB HCD callback net: usb: rtl8150: enable basic endpoint checking net: usb: rtl8150: use new tasklet API tasklet: Introduce new initialization API kbuild: userprogs: use correct lld when linking through clang sched: sch_cake: add bounds checks to host bulk flow fairness counts media: uvcvideo: Remove dangling pointers media: uvcvideo: Only save async fh if success nilfs2: handle errors that nilfs_prepare_chunk() may return nilfs2: eliminate staggered calls to kunmap in nilfs_rename nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link spi-mxs: Fix chipselect glitch x86/mm: Don't disable PCID when INVLPG has been fixed by microcode APEI: GHES: Have GHES honor the panic= setting HID: Wacom: Add PCI Wacom device support mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id tomoyo: don't emit warning in tomoyo_write_control() wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() mmc: core: Respect quirk_max_rate for non-UHS SDIO card tun: fix group permission check printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX x86/amd_nb: Restrict init function to AMD-based systems sched: Don't try to catch up excess steal time. btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling btrfs: fix use-after-free when attempting to join an aborted transaction btrfs: output the reason for open_ctree() failure usb: gadget: f_tcm: Don't free command immediately media: uvcvideo: Fix double free in error path HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE drivers/card_reader/rtsx_usb: Restore interrupt based detection ktest.pl: Check kernelrelease return in get_version NFSD: Reset cb_seq_status after NFS4ERR_DELAY hexagon: Fix unbalanced spinlock in die() hexagon: fix using plain integer as NULL pointer warning in cmpxchg genksyms: fix memory leak when the same symbol is read from *.symref file genksyms: fix memory leak when the same symbol is added from source net: sh_eth: Fix missing rtnl lock in suspend/resume path vsock: Allow retrying on connect() failure perf trace: Fix runtime error of index out of bounds net: davicom: fix UAF in dm9000_drv_remove net: rose: fix timer races against user threads PM: hibernate: Add error handling for syscore_suspend() ipmr: do not call mr_mfc_uses_dev() for unres entries net: fec: implement TSO descriptor cleanup ubifs: skip dumping tnc tree when zroot is null rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read dmaengine: ti: edma: fix OF node reference leaks in edma_driver module: Extend the preempt disabled section in dereference_symbol_descriptor(). ocfs2: mark dquot as inactive if failed to start trans while releasing dquot scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() media: uvcvideo: Propagate buf->error to userspace media: camif-core: Add check for clk_enable() media: mipi-csis: Add check for clk_enable() PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() media: lmedm04: Handle errors for lme2510_int_read media: lmedm04: Use GFP_KERNEL for URB allocation/submission. media: rc: iguanair: handle timeouts fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() ARM: dts: mediatek: mt7623: fix IR nodename arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property rdma/cxgb4: Prevent potential integer overflow on 32bit RDMA/mlx4: Avoid false error about access to uninitialized gids array bpf: Send signals asynchronously if !preemptible perf report: Fix misleading help message about --demangle perf top: Don't complain about lack of vmlinux when not resolving some kernel samples padata: fix sysfs store callback check ktest.pl: Remove unused declarations in run_bisect_test function perf header: Fix one memory leakage in process_bpf_prog_info() perf header: Fix one memory leakage in process_bpf_btf() ASoC: sun4i-spdif: Add clock multiplier settings tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind net: sched: Disallow replacing of child qdisc from one parent to another net/mlxfw: Drop hard coded max FW flash image size net: let net.core.dev_weight always be non-zero clk: analogbits: Fix incorrect calculation of vco rate delta selftests: harness: fix printing of mismatch values in __EXPECT() selftests/harness: Display signed values correctly wifi: wlcore: fix unbalanced pm_runtime calls regulator: of: Implement the unwind path of of_regulator_match() team: prevent adding a device which is already a team device lower cpupower: fix TSC MHz calculation wifi: rtlwifi: pci: wait for firmware loading before releasing memory wifi: rtlwifi: fix memory leaks and invalid access at probe error path wifi: rtlwifi: remove unused check_buddy_priv wifi: rtlwifi: remove unused dualmac control leftovers wifi: rtlwifi: remove unused timer and related code rtlwifi: replace usage of found with dedicated list iterator variable dt-bindings: mmc: controller: clarify the address-cells description wifi: rtlwifi: usb: fix workqueue leak when probe fails wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg wifi: rtlwifi: do not complete firmware loading needlessly ipmi: ipmb: Add check devm_kasprintf() returned value drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table drm/etnaviv: Fix page property being used for non writecombine buffers partitions: ldm: remove the initial kernel-doc notation nbd: don't allow reconnect after disconnect afs: Fix directory format encoding struct overflow: Allow mixed type arguments overflow: Correct check_shl_overflow() comment overflow: Add __must_check attribute to check_*() helpers udf: Fix use of check_add_overflow() with mixed type arguments perf cs-etm: Add missing variable in cs_etm__process_queues() Conflicts: Documentation/devicetree/bindings/mmc/mmc-controller.yaml Documentation/devicetree/bindings~HEAD drivers/clk/qcom/clk-alpha-pll.c drivers/soc/qcom/socinfo.c drivers/usb/dwc3/gadget.c mm/oom_kill.c scripts/Makefile.extrawarn Change-Id: I599df88164649e325b40d25cb1a8e64e5fd27cf0 |
||
kamasali Satyanarayan
|
f2c008f940 |
Merge android11-5.4.289(4c8fb32) into msm-5.4
* remotes/origin/tmp-4c8fb32:
ANDROID: GKI: add Trimble symbol list
UPSTREAM: selinux: ignore unknown extended permissions
ANDROID: ABI: Update allowed list for galaxy
Revert "netfilter: Replace zero-length array with flexible-array member"
Revert "tracing: Constify string literal data member in struct trace_event_call"
Revert "skb_expand_head() adjust skb->truesize incorrectly"
Linux 5.4.289
ftrace: use preempt_enable/disable notrace macros to avoid double fault
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
drm: adv7511: Drop dsi single lane support
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
sky2: Add device ID 11ab:4373 for Marvell 88E8075
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
RDMA/uverbs: Prevent integer overflow issue
modpost: fix the missed iteration for the max bit in do_input()
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
ARC: build: Try to guess GCC variant of cross compiler
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
net: usb: qmi_wwan: add Telit FE910C04 compositions
bpf: fix potential error return
sound: usb: format: don't warn that raw DSD is unsupported
wifi: mac80211: wake the queues in case of failure in resume
ila: serialize calls to nf_register_net_hooks()
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
af_packet: fix vlan_get_tci() vs MSG_PEEK
ALSA: usb-audio: US16x08: Initialize array before use
net: llc: reset skb->transport_header
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
netfilter: Replace zero-length array with flexible-array member
netrom: check buffer length before accessing it
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
drm: bridge: adv7511: Enable SPDIF DAI
RDMA/bnxt_re: Fix max_qp_wrs reported
RDMA/bnxt_re: Fix reporting hw_ver in query_device
RDMA/bnxt_re: Add check for path mtu in modify_qp
RDMA/mlx5: Enforce same type port association for multiport RoCE
net/mlx5: Make API mlx5_core_is_ecpf accept const pointer
IB/mlx5: Introduce and use mlx5_core_is_vf()
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
selinux: ignore unknown extended permissions
ipv6: prevent possible UAF in ip6_xmit()
skb_expand_head() adjust skb->truesize incorrectly
btrfs: avoid monopolizing a core when activating a swap file
tracing: Constify string literal data member in struct trace_event_call
bpf: fix recursive lock when verdict program return SK_PASS
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: use skb_expand_head in ip6_xmit
ipv6: use skb_expand_head in ip6_finish_output2
skbuff: introduce skb_expand_head()
MIPS: Probe toolchain support of -msym32
epoll: Add synchronous wakeup support for ep_poll_callback
virtio-blk: don't keep queue frozen during system suspend
scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
regmap: Use correct format specifier for logging range errors
scsi: megaraid_sas: Fix for a potential deadlock
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
mtd: rawnand: fix double free in atmel_pmecc_create_user()
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
dmaengine: mv_xor: fix child node refcount handling in early exit
phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
phy: core: Fix that API devm_phy_put() fails to release the phy
phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
phy: core: Fix an OF node refcount leakage in _of_phy_get()
mtd: diskonchip: Cast an operand to prevent potential overflow
nfsd: restore callback functionality for NFSv4.0
bpf: Check negative offsets in __bpf_skb_min_len()
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
of: Fix error path in of_parse_phandle_with_args_map()
udmabuf: also check for F_SEAL_FUTURE_WRITE
nilfs2: prevent use of deleted inode
of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
NFS/pnfs: Fix a live lock between recalled layouts and layoutget
btrfs: tree-checker: reject inline extent items with 0 ref count
zram: refuse to use zero sized block device as backing device
sh: clk: Fix clk_enable() to return 0 on NULL clk
USB: serial: option: add Telit FE910C04 rmnet compositions
USB: serial: option: add MediaTek T7XX compositions
USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
USB: serial: option: add MeiG Smart SLM770A
USB: serial: option: add TCL IK512 MBIM & ECM
efivarfs: Fix error on non-existent file
i2c: riic: Always round-up when calculating bus period
chelsio/chtls: prevent potential integer overflow on 32bit
mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
netfilter: ipset: Fix for recursive locking warning
net: ethernet: bgmac-platform: fix an OF node reference leak
net: hinic: Fix cleanup in create_rxqs/txqs()
ionic: use ee->offset when returning sprom data
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
erofs: fix incorrect symlink detection in fast symlink
erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
drm/i915: Fix memory leak by correcting cache object name in error handler
i2c: pnx: Fix timeout in wait functions
PCI: Add ACS quirk for Broadcom BCM5760X NIC
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
PCI/AER: Disable AER service on suspend
usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
net: sched: fix ordering of qlen adjustment
UPSTREAM: ALSA: usb-audio: Fix a DMA to stack memory bug
Linux 5.4.288
ALSA: usb-audio: Fix a DMA to stack memory bug
xen/netfront: fix crash when removing device
tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe()
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
blk-iocost: fix weight updates of inner active iocgs
blk-iocost: clamp inuse and skip noops in __propagate_weights()
ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
net/sched: netem: account for backlog updates from child qdisc
qca_spi: Make driver probing reliable
qca_spi: Fix clock speed for multiple QCA7000
ACPI: resource: Fix memory resource type union access
net: lapb: increase LAPB_HEADER_LEN
tipc: fix NULL deref in cleanup_bearer()
batman-adv: Do not let TT changes list grows indefinitely
batman-adv: Remove uninitialized data in full table TT response
batman-adv: Do not send uninitialized TT changes
bpf, sockmap: Fix update element with same
xfs: don't drop errno values when we fail to ficlone the entire range
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
usb: ehci-hcd: fix call balance of clocks handling routines
usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
usb: host: max3421-hcd: Correctly abort a USB request.
UPSTREAM: ALSA: usb-audio: Fix out of bounds reads when finding clock sources
UPSTREAM: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Revert "cgroup: Make operations on the cgroup root_list RCU safe"
Revert "cgroup: Move rcu_head up near the top of cgroup_root"
Linux 5.4.287
bpf, xdp: Update devmap comments to reflect napi/rcu usage
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
PCI: rockchip-ep: Fix address translation unit programming
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
modpost: Add .irqentry.text to OTHER_SECTIONS
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
jffs2: Fix rtime decompressor
jffs2: Prevent rtime decompress memory corruption
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
perf/x86/intel/pt: Fix buffer full but size is 0 case
Revert "unicode: Don't special case ignorable code points"
bpf: fix OOB devmap writes when deleting elements
xdp: Simplify devmap cleanup
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
powerpc/prom_init: Fixup missing powermac #size-cells
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
PCI: Add ACS quirk for Wangxun FF5xxx NICs
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
nvdimm: rectify the illogical code within nd_dax_probe()
pinctrl: qcom-pmic-gpio: add support for PM8937
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
scsi: st: Don't modify unknown block number in MTIOCGET
leds: class: Protect brightness_show() with led_cdev->led_access mutex
tracing: Use atomic64_inc_return() in trace_clock_counter()
netpoll: Use rcu_access_pointer() in __netpoll_setup
net/neighbor: clear error in case strict check is not set
rocker: fix link status detection in rocker_carrier_init()
ASoC: hdmi-codec: reorder channel allocation list
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
drm/amdgpu: set the right AMDGPU sg segment limitation
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: fix shift-out-of-bounds in dbSplit
jfs: array-index-out-of-bounds fix in dtReadFirst
wifi: ath5k: add PCI ID for Arcadyan devices
wifi: ath5k: add PCI ID for SX76X
net: inet6: do not leave a dangling sk pointer in inet6_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: af_can: do not leave a dangling sk pointer in can_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
af_packet: avoid erroring out after sock_init_data() in packet_create()
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
net: ethernet: fs_enet: Use %pa to format resource_size_t
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
samples/bpf: Fix a resource leak
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
drm/mcde: Enable module autoloading
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
s390/cpum_sf: Handle CPU hotplug remove during sampling
mmc: core: Further prevent card detect during shutdown
regmap: detach regmap from dev on regmap_exit
dma-buf: fix dma_fence_array_signaled v4
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Fix NVMe and NPIV connect issue
ocfs2: update seq_file index in ocfs2_dlm_seq_next
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
HID: wacom: fix when get product name maybe null pointer
bpf: Fix exact match conditions in trie_get_next_key()
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
ocfs2: free inode when ocfs2_get_init_inode() fails
spi: mpc52xx: Add cancel_work_sync before module remove
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
gpio: grgpio: Add NULL check in grgpio_probe
gpio: grgpio: use a helper variable to store the address of ofdev->dev
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
x86/asm: Reorder early variables
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
xen/xenbus: fix locking
xenbus/backend: Protect xenbus callback with lock
xenbus/backend: Add memory pressure handler callback
xen/xenbus: reference count registered modules
netfilter: nft_set_hash: skip duplicated elements pending gc run
netfilter: ipset: Hold module reference while requesting a module
igb: Fix potential invalid memory access in igb_init_module()
net/qed: allow old cards not supporting "num_images" to work
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
tipc: add new AEAD key structure for user API
tipc: enable creating a "preliminary" node
tipc: add reference counter to bearer
dccp: Fix memory leak in dccp_feat_change_recv
net/ipv6: release expired exception dst cached in socket
can: j1939: j1939_session_new(): fix skb reference counting
net/sched: tbf: correct backlog statistic for GSO packets
netfilter: x_tables: fix LED ID check in led_tg_check()
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
drm/etnaviv: flush shader L1 cache after user commandstream
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
nfsd: make sure exp active before svc_export_show
dm thin: Add missing destroy_work_on_stack()
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
util_macros.h: fix/rework find_closest() macros
ad7780: fix division by zero in ad7780_write_raw()
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
ftrace: Fix regression with module command in stack_trace_filter
ovl: Filter invalid inodes with missing lookup function
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
media: ts2020: fix null-ptr-deref in ts2020_probe()
media: i2c: tc358743: Fix crash in the probe error path when using polling
btrfs: ref-verify: fix use-after-free after invalid ref action
quota: flush quota_release_work upon quota writeback
ASoC: fsl_micfil: fix the naming style for mask definition
sh: intc: Fix use-after-free bug in register_intc_controller()
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
SUNRPC: correct error code comment in xs_tcp_setup_socket()
modpost: remove incorrect code in do_eisa_entry()
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
9p/xen: fix release of IRQ
9p/xen: fix init sequence
block: return unsigned int from bdev_io_min
jffs2: fix use of uninitialized variable
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: Correct the total block count by deducting journal reservation
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
rtc: abx80x: Fix WDT bit position of the status register
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
um: Always dump trace for specified task in show_stack
um: Clean up stacktrace dump
um: add show_stack_loglvl()
um/sysrq: remove needless variable sp
um: Fix the return value of elf_core_copy_task_fpregs
um: Fix potential integer overflow during physmem setup
rpmsg: glink: Propagate TX failures in intentless mode as well
SUNRPC: make sure cache entry active before cache_show
NFSD: Prevent a potential integer overflow
lib: string_helpers: silence snprintf() output truncation warning
usb: dwc3: gadget: Fix checking for number of TRBs left
ALSA: hda/realtek: Apply quirk for Medion E15433
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Update ALC225 depop procedure
media: wl128x: Fix atomicity violation in fmc_send_cmd()
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
um: vector: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: net: Do not use drvdata in release
um: ubd: Do not use drvdata in release
ubi: wl: Put source PEB into correct list if trying locking LEB failed
spi: Fix acpi deferred irq probe
netfilter: ipset: add missing range check in bitmap_ip_uadt
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
comedi: Flush partial mappings in error case
PCI: Fix use-after-free of slot->bus on hot remove
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
jfs: xattr: check invalid xattr size more strictly
ext4: fix FS_IOC_GETFSMAP handling
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
cgroup: Move rcu_head up near the top of cgroup_root
cgroup: Make operations on the cgroup root_list RCU safe
usb: ehci-spear: fix call balance of sehci clk handling routines
apparmor: fix 'Do simple duplicate message elimination'
staging: greybus: uart: clean up TIOCGSERIAL
misc: apds990x: Fix missing pm_runtime_disable()
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
USB: chaoskey: fail open after removal
usb: yurex: make waiting on yurex_write interruptible
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
ipmr: fix tables suspicious RCU usage
ipmr: convert /proc handlers to rcu_read_lock()
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
power: supply: core: Remove might_sleep() from power_supply_put()
vfio/pci: Properly hide first-in-list PCIe extended capability
NFSD: Fix nfsd4_shutdown_copy()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Add TX_DATA_CONT command while sending
perf trace: Avoid garbage when not printing a syscall's arguments
perf trace: Do not lose last events in a race
m68k: coldfire/device.c: only build FEC when HW macros are defined
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
PCI: cpqphp: Fix PCIBIOS_* return value confusion
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
perf probe: Correct demangled symbols in C++ program
perf cs-etm: Don't flush when packet_queue fills up
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
dt-bindings: clock: axi-clkgen: include AXI clk
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
fbdev/sh7760fb: Alloc DMA memory from hardware device
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: fusion: Remove unused variable 'rc'
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
mfd: rt5033: Fix missing regmap_del_irq_chip()
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mtd: rawnand: atmel: Fix possible memory leak
cpufreq: loongson2: Unregister platform_driver on failure
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
mfd: da9052-spi: Change read-mask to write-mask
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
powerpc/vdso: Flag VDSO64 entry points as functions
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
ALSA: 6fire: Release resources at card release
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
net: rfkill: gpio: Add check for clk_enable()
selftests: net: really check for bg process completion
bpf, sockmap: Fix sk_msg_reset_curr
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Several fixes to bpf_msg_push_data
drm/etnaviv: hold GPU lock across perfmon sampling
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: dump: fix sparse warnings
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/panfrost: Remove unused id_mask from struct panfrost_model
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
bpf: Fix the xdp_adjust_tail sample prog issue
ASoC: fsl_micfil: fix regmap_write_bits usage
ASoC: fsl_micfil: use GENMASK to define register bit fields
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
ASoC: fsl_micfil: Drop unnecessary register read
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
drm/omap: Fix locking in omap_gem_new_dmabuf()
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
regmap: irq: Set lockdep class for hierarchical IRQ domains
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
tpm: fix signed/unsigned bug when checking event logs
efi/tpm: Pass correct address to memblock_reserve
mmc: mmc_spi: drop buggy snprintf()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
time: Fix references to _msecs_to_jiffies() handling of values
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
EDAC/fsl_ddr: Fix bad bit shift operations
EDAC/bluefield: Fix potential integer overflow
firmware: google: Unregister driver_info on failure
firmware: google: Unregister driver_info on failure and exit in gsmi
hfsplus: don't query the device logical block size multiple times
s390/syscalls: Avoid creation of arch/arch/ directory
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
m68k: mvme147: Reinstate early console
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Fix SCSI controller IRQ numbers
nvme-pci: fix freeing of the HMB descriptor table
initramfs: avoid filename buffer overrun
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
x86/xen/pvh: Annotate indirect branch as safe
nvme: fix metadata handling in nvme-passthrough
NFSD: Force all NFSv4.2 COPY requests to be synchronous
cifs: Fix buffer overflow when parsing NFS reparse points
ipmr: Fix access to mfc_cache_list without lock held
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
regulator: rk808: Add apply_bit for BUCK3 on RK809
soc: qcom: Add check devm_kasprintf() returned value
net: usb: qmi_wwan: add Quectel RG650V
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
mac80211: fix user-power when emulating chanctx
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
kbuild: Use uname for LINUX_COMPILE_HOST detection
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
ocfs2: uncache inode which has failed entering the group
net/mlx5e: kTLS, Fix incorrect page refcounting
net/mlx5: fs, lock FTE when checking if active
netlink: terminate outstanding dump on socket close
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
ANDROID: add file for recording allowed ABI breaks
Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
Revert "spi: fix use-after-free of the add_lock mutex"
ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER
BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics
UPSTREAM: x86/percpu: Clean up percpu_add_op()
UPSTREAM: x86/percpu: Clean up percpu_from_op()
UPSTREAM: x86/percpu: Clean up percpu_to_op()
UPSTREAM: x86/percpu: Introduce size abstraction macros
BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output
BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze
FROMGIT: binder: allow freeze notification for dead nodes
FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work()
FROMGIT: binder: fix OOB in binder_add_freeze_work()
FROMGIT: binder: fix node UAF in binder_add_freeze_work()
Linux 5.4.286
mm: avoid leaving partial pfn mappings around in error case
9p: fix slab cache name creation for real
mm: add remap_pfn_range_notrack
mm/memory.c: make remap_pfn_range() reject unaligned addr
mm: fix ambiguous comments for better code readability
mm: clarify a confusing comment for remap_pfn_range()
md/raid10: improve code of mrdev in raid10_sync_request
net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
fs: Fix uninitialized value issue in from_kuid and from_kgid
powerpc/powernv: Free name on error in opal_event_init()
sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
bpf: use kvzmalloc to allocate BPF verifier environment
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
9p: Avoid creating multiple slab caches with the same name
ALSA: usb-audio: Add endianness annotations
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
ftrace: Fix possible use-after-free issue in ftrace_location()
NFSD: Fix NFSv4's PUTPUBFH operation
ALSA: usb-audio: Add quirks for Dell WD19 dock
ALSA: usb-audio: Support jack detection on Dell dock
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
irqchip/gic-v3: Force propagation of the active state with a read-back
USB: serial: option: add Quectel RG650V
USB: serial: option: add Fibocom FG132 0x0112 composition
USB: serial: qcserial: add support for Sierra Wireless EM86xx
USB: serial: io_edgeport: fix use after free in debug printk
usb: musb: sunxi: Fix accessing an released usb phy
fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
net: bridge: xmit: make sure we have at least eth header len bytes
spi: fix use-after-free of the add_lock mutex
spi: Fix deadlock when adding SPI controllers on SPI buses
mtd: rawnand: protect access to rawnand devices while in suspend
btrfs: reinitialize delayed ref list after deleting it from the list
nfs: Fix KMSAN warning in decode_getfattr_attrs()
dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
dm cache: fix potential out-of-bounds access on the first resume
dm cache: optimize dirty bit checking with find_next_bit when resizing
dm cache: fix out-of-bounds access to the dirty bitset when resizing
dm cache: correct the number of origin blocks to match the target length
drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
pwm: imx-tpm: Use correct MODULO value for EPWM mode
media: v4l2-tpg: prevent the risk of a division by zero
media: cx24116: prevent overflows on SNR calculus
media: s5p-jpeg: prevent buffer overflows
ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
media: adv7604: prevent underflow condition when reporting colorspace
media: dvb_frontend: don't play tricks with underflow values
media: dvbdev: prevent the risk of out of memory access
media: stb0899_algo: initialize cfr before using it
net: hns3: fix kernel crash when uninstalling driver
can: c_can: fix {rx,tx}_errors statistics
sctp: properly validate chunk size in sctp_sf_ootb()
net: enetc: set MAC address to the VF net_device
enetc: simplify the return expression of enetc_vf_set_mac_addr()
security/keys: fix slab-out-of-bounds in key_task_permission
HID: core: zero-initialize the report buffer
ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
ARM: dts: rockchip: Fix the spi controller on rk3036
ARM: dts: rockchip: drop grf reference from rk3036 hdmi
ARM: dts: rockchip: fix rk3036 acodec node
arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
ANDROID: GKI: Enable SERIAL_8250_DW
UPSTREAM: USB: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
Revert "genetlink: hold RCU in genlmsg_mcast()"
Revert "arm64: probes: Fix uprobes for big-endian kernels"
Revert "arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning"
Revert "inet: inet_defrag: prevent sk release while still in use"
Linux 5.4.285
mm: krealloc: Fix MTE false alarm in __do_krealloc
mac80211: always have ieee80211_sta_restart()
vt: prevent kernel-infoleak in con_font_get()
Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"
mm: shmem: fix data-race in shmem_getattr()
nilfs2: fix kernel bug due to missing clearing of checked flag
ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
riscv: Remove unused GENERATING_ASM_OFFSETS
nilfs2: fix potential deadlock with newly created symlinks
staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
wifi: iwlegacy: Clear stale interrupts before resuming device
wifi: ath10k: Fix memory leak in management tx
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
Revert "driver core: Fix uevent_show() vs driver detach race"
xhci: Fix Link TRB DMA in command ring stopped completion event
usb: phy: Fix API devm_usb_put_phy() can not release the phy
usbip: tools: Fix detach_port() invalid port error path
misc: sgi-gru: Don't disable preemption in GRU driver
net: amd: mvme147: Fix probe banner message
firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
drivers/misc: ti-st: Remove unneeded variable in st_tty_open
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
net: support ip generic csum processing in skb_csum_hwoffload_help
bpf: Fix out-of-bounds write in trie_get_next_key()
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
gtp: allow -1 to be specified as file description from userspace
gtp: simplify error handling code in 'gtp_encap_enable()'
dt-bindings: gpu: Convert Samsung Image Rotator to dt-schema
ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
mac80211: Add support to trigger sta disconnect on hardware restart
mac80211: do drv_reconfig_complete() before restarting all
wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
cgroup: Fix potential overflow issue when checking max_depth
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
selinux: improve error checking in sel_write_load()
hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
nilfs2: fix kernel bug due to missing clearing of buffer delay flag
ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
drm/amd: Guard against bad data for ATIF ACPI method
ALSA: hda/realtek: Update default depop procedure
ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
r8169: avoid unsolicited interrupts
net: sched: fix use-after-free in taprio_change()
net: usb: usbnet: fix name regression
be2net: fix potential memory leak in be_xmit()
net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
tracing: Consider the NULL character when validating the event length
jfs: Fix sanity check in dbMount
udf: fix uninit-value use in udf_get_fileshortad
drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
KVM: s390: gaccess: Check if guest address is in memslot
KVM: s390: gaccess: Cleanup access to guest pages
KVM: s390: gaccess: Refactor access address range check
KVM: s390: gaccess: Refactor gpa and length calculation
arm64: probes: Fix uprobes for big-endian kernels
arm64:uprobe fix the uprobe SWBP_INSN in big-endian
Bluetooth: bnep: fix wild-memory-access in proto_unregister
usb: typec: altmode should keep reference to parent
smb: client: fix OOBs when building SMB2_IOCTL request
genetlink: hold RCU in genlmsg_mcast()
net: systemport: fix potential memory leak in bcm_sysport_xmit()
net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
macsec: don't increment counters for an unrelated SA
drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
RDMA/bnxt_re: Return more meaningful error
ipv4: give an IPv4 dev to blackhole_netdev
RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
mac80211: Fix NULL ptr deref for injected rate info
erofs: fix lz4 inplace decompression
nilfs2: propagate directory read errors from nilfs_find_entry()
x86/apic: Always explicitly disarm TSC-deadline timer
x86/resctrl: Annotate get_mem_config() functions as __init
parport: Proper fix for array out-of-bounds access
USB: serial: option: add Telit FN920C04 MBIM compositions
USB: serial: option: add support for Quectel EG916Q-GL
xhci: Fix incorrect stream context type macro
Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
Bluetooth: Remove debugfs directory on module init failure
iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
iio: light: opt3001: add missing full-scale range value
iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()
iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
drm/vmwgfx: Handle surface check failure correctly
blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
KVM: s390: Change virtual to physical address access in diag 0x258 handler
s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
wifi: mac80211: fix potential key use-after-free
mm/swapfile: skip HugeTLB pages for unuse_vma
fat: fix uninitialized variable
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
tracing/kprobes: Fix symbol counting logic by looking at modules as well
tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
arm64: probes: Fix simulate_ldr*_literal()
arm64: probes: Remove broken LDR (literal) uprobe support
posix-clock: Fix missing timespec64 check in pc_clock_settime()
nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
net: Fix an unsafe loop on the list
hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
usb: xhci: Fix problem with xhci resume from suspend
usb: dwc3: core: Stop processing of pending events if controller is halted
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
HID: plantronics: Workaround for an unexcepted opposite volume key
CDC-NCM: avoid overflow in sanity checking
resource: fix region_intersects() vs add_memory_driver_managed()
lockdep: fix deadlock issue between lockdep and rcu
locking/lockdep: Avoid potential access of invalid memory in lock_class
locking/lockdep: Rework lockdep_lock
locking/lockdep: Fix bad recursion pattern
slip: make slhc_remember() more robust against malicious packets
ppp: fix ppp_async_encode() illegal access
sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
net: annotate lockless accesses to sk->sk_max_ack_backlog
net: annotate lockless accesses to sk->sk_ack_backlog
net: ibm: emac: mal: fix wrong goto
net/sched: accept TCA_STAB only for root qdisc
igb: Do not bring the device up after non-fatal error
gpio: aspeed: Use devm_clk api to manage clock source
gpio: aspeed: Add the flush write to ensure the write complete.
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
netfilter: br_netfilter: fix panic with metadata_dst skb
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
tcp: fix to allow timestamp undo if no retransmits were sent
SUNRPC: Fix integer overflow in decode_rc_list()
ice: fix VLAN replay after reset
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
fbdev: sisfb: Fix strbuf array overflow
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
tools/iio: Add memory allocation failure check for trigger_name
virtio_pmem: Check device status before requesting flush
usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
usb: chipidea: udc: enable suspend interrupt after usb reset
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
i2c: i801: Use a different adapter-name for IDF adapters
PCI: Add ACS quirk for Qualcomm SA8775P
clk: bcm: bcm53573: fix OF node leak in init
ktest.pl: Avoid false positives with grub2 skip regex
s390/cpum_sf: Remove WARN_ON_ONCE statements
ext4: nested locking for xattr inode
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
s390/facility: Disable compile time optimization for decompressor code
bpf: Check percpu map value size first
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
virtio_console: fix misc probe bugs
tracing: Have saved_cmdlines arrays all in one allocation
drm/crtc: fix uninitialized variable use even harder
tracing: Remove precision vsnprintf() check from print event
net: ethernet: cortina: Drop TSO support
unicode: Don't special case ignorable code points
ext4: fix inode tree inconsistency caused by ENOMEM
ACPI: battery: Fix possible crash when unregistering a battery hook
ACPI: battery: Simplify battery hook locking
r8169: add tally counter fields added with RTL8125
r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
clk: qcom: clk-rpmh: Fix overflow in BCM vote
clk: qcom: rpmh: Simplify clk_rpmh_bcm_send_cmd()
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
nfsd: use ktime_get_seconds() for timestamps
uprobes: fix kernel info leak via "[uprobes]" vma
arm64: errata: Expand speculative SSBS workaround once more
arm64: cputype: Add Neoverse-N3 definitions
arm64: Add Cortex-715 CPU part definition
i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
i2c: qcom-geni: Grow a dev pointer to simplify code
i2c: qcom-geni: Let firmware specify irq trigger flags
gpio: davinci: fix lazy disable
btrfs: wait for fixup workers before stopping cleaner kthread during umount
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
Input: adp5589-keys - fix adp5589_gpio_get_value()
rtc: at91sam9: fix OF node leak in probe() error path
tomoyo: fallback to realpath if symlink's pathname does not exist
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
media: venus: fix use after free bug in venus_remove due to race condition
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
media: sun4i_csi: Implement link validate for sun4i_csi subdev
clk: rockchip: fix error for unknown clocks
aoe: fix the potential use-after-free problem in more places
riscv: define ILLEGAL_POINTER_VALUE for 64bit
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
ocfs2: fix null-ptr-deref when journal load failed.
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
ocfs2: cancel dqi_sync_work before freeing oinfo
ocfs2: reserve space for inline xattr before attaching reflink tree
ocfs2: fix uninit-value in ocfs2_get_block()
ocfs2: fix the la space leak when unmounting an ocfs2 volume
mm: krealloc: consider spare memory for __GFP_ZERO
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
drm: omapdrm: Add missing check for alloc_ordered_workqueue
of/irq: Support #msi-cells=<0> in of_msi_get_domain
parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
parisc: Fix 64-bit userspace syscall path
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
ext4: fix double brelse() the buffer of the extents path
ext4: aovid use-after-free in ext4_ext_insert_extent()
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
ext4: no need to continue when the number of entries is 1
ALSA: core: add isascii() check to card ID generator
drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
parisc: Fix itlb miss handler for 64-bit programs
perf/core: Fix small negative period being ignored
spi: bcm63xx: Fix module autoloading
firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
selftests: vDSO: fix vDSO symbols lookup for powerpc64
selftests: breakpoints: use remaining time to check if suspend succeed
spi: s3c64xx: fix timeout counters in flush_fifo
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
ext4: ext4_search_dir should return a proper error
of/irq: Refer to actual buffer size in of_irq_parse_one()
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
scsi: aacraid: Rearrange order of struct aac_srb_unit
drm/printer: Allow NULL data in devcoredump printer
drm/amd/display: Initialize get_bytes_per_element's default to 1
drm/amd/display: Fix index out of bounds in degamma hardware format translation
drm/amd/display: Check stream before comparing them
jfs: Fix uninit-value access of new_ea in ea_buffer
jfs: check if leafidx greater than num leaves per dmap tree
jfs: Fix uaf in dbFreeBits
jfs: UBSAN: shift-out-of-bounds in dbFindBits
ata: sata_sil: Rename sil_blacklist to sil_quirks
power: reset: brcmstb: Do not go into infinite loop if reset fails
fbdev: pxafb: Fix possible use after free in pxafb_task()
x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
ALSA: hdsp: Break infinite MIDI input flush loop
ALSA: asihpi: Fix potential OOB array access
signal: Replace BUG_ON()s
nfp: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
proc: add config & param to block forcing mem writes
ACPICA: iasl: handle empty connection_node
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
net: mvpp2: Increase size of queue_name buffer
tipc: guard against string buffer overrun
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
ACPI: EC: Do not release locks during operation region accesses
wifi: rtw88: select WANT_DEV_COREDUMP
net: sched: consistently use rcu_replace_pointer() in taprio_change()
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
net: hisilicon: hns_mdio: fix OF node leak in probe()
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
net: hisilicon: hip04: fix OF node leak in probe()
ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
f2fs: Require FMODE_WRITE for atomic write ioctls
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
ALSA: hda/realtek: Fix the push button function for the ALC257
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
net: add more sanity checks to qdisc_pkt_len_init()
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
net: ethernet: lantiq_etop: fix memory disclosure
Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
Bluetooth: btmrvl_sdio: Refactor irq wakeup
netfilter: nf_tables: prevent nf_skb_duplicated corruption
net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
net/mlx5: Added cond_resched() to crdump collection
ieee802154: Fix build error
drivers: net: Fix Kconfig indentation, continued
Minor fixes to the CAIF Transport drivers Kconfig file
ceph: remove the incorrect Fw reference check when dirtying pages
mailbox: bcm2835: Fix timeout during suspend mode
mailbox: rockchip: fix a typo in module autoloading
usb: yurex: Fix inconsistent locking bug in yurex_read()
i2c: isch: Add missed 'else'
i2c: aspeed: Update the stop sw state when the bus recovery occurs
mm: only enforce minimum stack gap size if it's sensible
pps: add an error check in parport_attach
pps: remove usage of the deprecated ida_simple_xx() API
USB: misc: yurex: fix race between read and write
usb: yurex: Replace snprintf() with the safer scnprintf() variant
soc: versatile: realview: fix soc_dev leak during device remove
soc: versatile: realview: fix memory leak during device remove
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
ASoC: meson: axg-card: fix 'use-after-free'
ASoC: meson: axg: extract sound card utils
nfs: fix memory leak in error path of nfs4_do_reclaim
fs: Fix file_set_fowner LSM hook inconsistencies
vfs: fix race between evice_inodes() and find_inode()&iput()
hwrng: mtk - Use devm_pm_runtime_enable
f2fs: avoid potential int overflow in sanity_check_area_boundary()
f2fs: prevent possible int overflow in dir_block_index()
debugobjects: Fix conditions in fill_pool()
wifi: rtw88: 8822c: Fix reported RX band width
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
ACPI: sysfs: validate return type of _STR method
drbd: Add NULL check for net_conf to prevent dereference in state validation
drbd: Fix atomicity violation in drbd_uuid_set_bm()
tty: rp2: Fix reset with non forgiving PCIe host bridges
firmware_loader: Block path traversal
USB: class: CDC-ACM: fix race between get_serial and set_serial
USB: misc: cypress_cy7c63: check for short transfer
USB: appledisplay: close race between probe and completion handler
drm/amd/display: Round calculated vtotal
soc: versatile: integrator: fix OF node leak in probe() error path
Remove *.orig pattern from .gitignore
crypto: aead,cipher - zeroize key buffer after use
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
net: qrtr: Update packets cloning when broadcasting
tcp: check skb is non-NULL in tcp_rto_delta_us()
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
coresight: tmc: sg: Do not leak sg_table
iio: adc: ad7606: fix standby gpio state to match the documentation
iio: adc: ad7606: fix oversampling gpio array
f2fs: reduce expensive checkpoint trigger frequency
f2fs: remove unneeded check condition in __f2fs_setxattr()
f2fs: fix to update i_ctime in __f2fs_setxattr()
f2fs: fix typo
f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
nfsd: return -EINVAL when namelen is 0
nfsd: call cache_put if xdr_reserve_space returns NULL
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
RDMA/cxgb4: Added NULL check for lookup_atid
riscv: Fix fp alignment bug in perf_callchain_user()
RDMA/hns: Optimize hem allocation performance
watchdog: imx_sc_wdt: Don't disable WDT in suspend
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
clk: ti: dra7-atl: Fix leak of of_nodes
pinctrl: single: fix missing error code in pcs_probe()
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
PCI: xilinx-nwl: Fix register misspelling
PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
perf time-utils: Fix 32-bit nsec parsing
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
perf sched timehist: Fix missing free of session in perf_sched__timehist()
bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
nilfs2: fix potential oob read in nilfs_btree_check_delete()
nilfs2: determine empty node blocks as corrupted
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
ext4: avoid OOB when system.data xattr changes underneath the filesystem
ext4: return error on ext4_find_inline_entry
ext4: avoid negative min_clusters in find_group_orlov()
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
kthread: fix task state in kthread worker if being frozen
kthread: add kthread_work tracepoints
xz: cleanup CRC32 edits from 2018
selftests/bpf: Fix error compiling test_lru_map.c
selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
selftests/bpf: Fix compiling flow_dissector.c with musl-libc
selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
tpm: Clean up TPM space after command failure
xen/swiotlb: add alignment check for dma buffers
xen: use correct end address of kernel for conflict checking
drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
drm/msm: fix %s null argument error
ipmi: docs: don't advertise deprecated sysfs entries
drm/msm/a5xx: fix races in preemption evaluation stage
drm/msm/a5xx: properly clear preemption records on resume
drm/msm/a5xx: disable preemption in submits by default
drm/msm: Fix incorrect file name output in adreno_request_fw()
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
drm/rockchip: vop: Allow 4096px width scaling
drm/radeon: properly handle vbios fake edid sizing
drm/radeon: Replace one-element array with flexible-array member
drm/amdgpu: properly handle vbios fake edid sizing
drm/amdgpu: Replace one-element array with flexible-array member
drm/stm: Fix an error handling path in stm_drm_platform_probe()
mtd: powernv: Add check devm_kasprintf() returned value
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
power: supply: axp20x_battery: Remove design from min and max voltage
power: supply: axp20x_battery: allow disabling battery charging
hwmon: (ntc_thermistor) fix module autoloading
mtd: slram: insert break after errors in parsing the map
hwmon: (max16065) Fix overflows seen when writing limits
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
reset: berlin: fix OF node leak in probe() error path
ARM: versatile: fix OF node leak in CPUs prepare
ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
spi: ppc4xx: handle irq_of_parse_and_map() errors
block, bfq: don't break merge chain in bfq_split_bfqq()
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
block, bfq: fix possible UAF for bfqq->bic with merge chain
net: tipc: avoid possible garbage value
Bluetooth: btusb: Fix not handling ZPL/short-transfer
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
sock_map: Add a cond_resched() in sock_hash_free()
wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
mac80211: parse radiotap header when selecting Tx queue
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
netfilter: nf_tables: reject expiration higher than timeout
netfilter: nf_tables: reject element expiration with no timeout
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
can: j1939: use correct function name in comment
mount: handle OOM on mnt_warn_timestamp_expiry
fs/namespace: fnic: Switch to use %ptTd
mount: warn only once about timestamp range expiration
fs: explicitly unregister per-superblock BDIs
wifi: ath9k: Remove error checks when creating debugfs entries
wifi: ath9k: fix parameter check in ath9k_init_debug()
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
USB: usbtmc: prevent kernel-usb-infoleak
USB: serial: pl2303: add device id for Macrosilicon MS3020
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
inet: inet_defrag: prevent sk release while still in use
gpio: prevent potential speculation leaks in gpio_device_get_desc()
ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
spi: bcm63xx: Enable module autoloading
drm: komeda: Fix an issue related to normalized zpos
ASoC: tda7419: fix module autoloading
wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
net: ftgmac100: Ensure tx descriptor updates are visible
microblaze: don't treat zero reserved memory regions as error
pinctrl: at91: make it work with current gpiolib
ALSA: hda/realtek - FIxed ALC285 headphone no sound
ALSA: hda/realtek - Fixed ALC256 headphone no sound
ASoC: allow module autoloading for table db1200_pids
selftests: breakpoints: Fix a typo of function name
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
spi: nxp-fspi: fix the KASAN report out-of-bounds bug
net: dpaa: Pad packets to ETH_ZLEN
net: ftgmac100: Enable TX interrupt to avoid TX timeout
net/mlx5e: Add missing link modes to ptys2ethtool_map
ice: fix accounting for filters shared by multiple VSIs
arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
scripts: kconfig: merge_config: config files: add a trailing newline
net: phy: vitesse: repair vsc73xx autonegotiation
net: ethernet: use ip_hdrlen() instead of bit shift
usbnet: ipheth: fix carrier detection in modes 1 and 4
UPSTREAM: unicode: Don't special case ignorable code points
ANDROID: 16K: Fixup padding vm_flags bits on VMA splits
ANDROID: 16K: Introduce pgsize_migration_inline.h
Revert "clocksource/drivers/timer-of: Remove percpu irq related code"
Linux 5.4.284
Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367"
cx82310_eth: fix error return code in cx82310_bind()
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
rtmutex: Drop rt_mutex::wait_lock before scheduling
drm/i915/fence: Mark debug_fence_free() with __maybe_unused
drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
nvmet-tcp: fix kernel crash if commands allocation fails
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
arm64: acpi: Move get_cpu_for_acpi_id() to a header
ACPI: processor: Fix memory leaks in error paths of processor_add()
ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
nilfs2: protect references to superblock parameters exposed in sysfs
nilfs2: replace snprintf in show functions with sysfs_emit
tracing: Avoid possible softlockup in tracing_iter_reset()
ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance()
uprobes: Use kzalloc to allocate xol area
clocksource/drivers/timer-of: Remove percpu irq related code
clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
binder: fix UAF caused by offsets overwrite
iio: fix scale application in iio_convert_raw_to_processed_unlocked
iio: buffer-dmaengine: fix releasing dma channel on error
staging: iio: frequency: ad9834: Validate frequency parameter value
NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations
ata: pata_macio: Use WARN instead of BUG
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
of/irq: Prevent device address out-of-bounds read in interrupt map walk
Squashfs: sanity check symbolic link size
usbnet: ipheth: race between ipheth_close and error handling
Input: uinput - reject requests with unreasonable number of slots
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()
PCI: Add missing bridge lock to pci_bus_lock()
btrfs: clean up our handling of refs == 0 in snapshot delete
btrfs: replace BUG_ON with ASSERT in walk_down_proc()
smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
hwmon: (lm95234) Fix underflows seen when writing limit attributes
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
devres: Initialize an uninitialized struct member
um: line: always fill *error_out in setup_one_line()
cgroup: Protect css->cgroup write under css_set_lock
iommu/vt-d: Handle volatile descriptor status read
dm init: Handle minors larger than 255
ASoC: topology: Properly initialize soc_enum values
net: dsa: vsc73xx: fix possible subblocks range of CAPT block
net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
net: bridge: fdb: convert added_by_external_learn to use bitops
net: bridge: fdb: convert added_by_user to bitops
net: bridge: fdb: convert is_sticky to bitops
net: bridge: fdb: convert is_static to bitops
net: bridge: fdb: convert is_local to bitops
usbnet: modern method to get random MAC
net: usb: don't write directly to netdev->dev_addr
drivers/net/usb: Remove all strcpy() uses
cx82310_eth: re-enable ethernet mode after router reboot
tcp_bpf: fix return value of tcp_bpf_sendmsg()
platform/x86: dell-smbios: Fix error path in dell_smbios_init()
igb: Fix not clearing TimeSync interrupts for 82580
can: bcm: Remove proc entry when dev is unregistered.
pcmcia: Use resource_size function on resource object
media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
usb: uas: set host status byte on data completion error
wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
udf: Avoid excessive partition lengths
netfilter: nf_conncount: fix wrong variable type
af_unix: Remove put_pid()/put_cred() in copy_peercred().
irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
smack: unix sockets: fix accept()ed socket label
ALSA: hda: Add input value sanity checks to HDMI channel map controls
nilfs2: fix state management in error path of log writing function
nilfs2: fix missing cleanup on rollforward recovery error
sched: sch_cake: fix bulk flow accounting logic for host fairness
ila: call nf_unregister_net_hooks() sooner
clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
clk: qcom: clk-alpha-pll: Fix the pll post div mask
clk: hi6220: use CLK_OF_DECLARE_DRIVER
reset: hi6220: Add support for AO reset controller
fuse: use unsigned type for getxattr/listxattr size truncation
fuse: update stats for pages in dropped aux writeback list
mmc: sdhci-of-aspeed: fix module autoloading
mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
ata: libata: Fix memory leak for error path in ata_host_alloc()
ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
sch/netem: fix use after free in netem_dequeue
i2c: Use IS_REACHABLE() for substituting empty ACPI functions
udf: Limit file size to 4TB
virtio_net: Fix napi_skb_cache_put warning
net: set SOCK_RCU_FREE before inserting socket into hashtable
block: initialize integrity buffer to zero before writing it to media
media: uvcvideo: Enforce alignment of frame and interval
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
wifi: cfg80211: make hash table duplicates more survivable
smack: tcp: ipv4, fix incorrect labeling
usb: typec: ucsi: Fix null pointer dereference in trace
usbip: Don't submit special requests twice
ionic: fix potential irq name truncation
apparmor: fix possible NULL pointer dereference
drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
drm/amdgpu: fix mc_data out-of-bounds read warning
drm/amdgpu: fix ucode out-of-bounds read warning
drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
drm/amd/display: Check gpio_id before used as array index
drm/amdgpu: fix overflowed array index read warning
drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
net: usb: qmi_wwan: add MeiG Smart SRM825L
i2c: Fix conditional for substituting empty ACPI functions
drm: panel-orientation-quirks: Add quirk for OrangePi Neo
Linux 5.4.283
scsi: aacraid: Fix double-free on probe failure
net: dsa: mv8e6xxx: Fix stub function parameters
usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
usb: dwc3: st: add missing depopulate in probe error path
usb: dwc3: st: fix probed platform device ref count on probe error path
usb: dwc3: core: Prevent USB core invalid event buffer address access
usb: dwc3: omap: add missing depopulate in probe error path
USB: serial: option: add MeiG Smart SRM825L
cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
soc: qcom: cmd-db: Map shared memory as WC, not WB
nfc: pn533: Add poll mod list filling check
nfc: pn533: Add autopoll capability
nfc: pn533: Add dev_up/dev_down hooks to phy_ops
net: busy-poll: use ktime_get_ns() instead of local_clock()
gtp: fix a potential NULL pointer dereference
ethtool: check device is present when getting link settings
r8152: Factor out OOB link list waits
soundwire: stream: fix programming slave ports for non-continous port maps
net:rds: Fix possible deadlock in rds_message_put
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
ata: libata-core: Fix null pointer dereference on error
media: uvcvideo: Fix integer overflow calculating timestamp
filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
ipc: replace costly bailout check in sysvipc_find_ipc()
wifi: mwifiex: duplicate static structs used in driver instances
pinctrl: single: fix potential NULL dereference in pcs_get_function()
drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
tools: move alignment-related macros to new <linux/align.h>
Input: MT - limit max slots
Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
ALSA: timer: Relax start tick time check for slave timer elements
mmc: dw_mmc: allow biu and ciu clocks to defer
cxgb4: add forgotten u64 ivlan cast before shift
HID: microsoft: Add rumble support to latest xbox controllers
HID: wacom: Defer calculation of resolution until resolution_code is known
Bluetooth: MGMT: Add error handling to pair_device()
mmc: mmc_test: Fix NULL dereference on allocation failure
drm/msm/dpu: don't play tricks with debug macros
drm/msm: use drm_debug_enabled() to check for debug categories
net: xilinx: axienet: Fix dangling multicast addresses
net: xilinx: axienet: Always disable promiscuous mode
ipv6: prevent UAF in ip6_send_skb()
netem: fix return value if duplicate enqueue fails
net: dsa: mv88e6xxx: Fix out-of-bound access
net: dsa: mv88e6xxx: replace ATU violation prints with trace points
net: dsa: mv88e6xxx: read FID when handling ATU violations
net: dsa: mv88e6xxx: global1_atu: Add helper for get next
net: dsa: mv88e6xxx: global2: Expose ATU stats register
netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
kcm: Serialise kcm_sendmsg() for the same socket.
tc-testing: don't access non-existent variable on exception
Bluetooth: hci_core: Fix LE quote calculation
Bluetooth: hci_core: Fix not handling link timeouts propertly
Bluetooth: Make use of __check_timeout on hci_sched_le
dm suspend: return -ERESTARTSYS instead of -EINTR
dm: do not use waitqueue for request-based DM
dm mpath: pass IO start time to path selector
media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
block: use "unsigned long" for blk_validate_block_size().
gtp: pull network headers in gtp_dev_xmit()
hrtimer: Prevent queuing of hrtimer without a function callback
nvmet-rdma: fix possible bad dereference when freeing rsps
ext4: set the type of max_zeroout to unsigned int to avoid overflow
irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
usb: dwc3: core: Skip setting event buffers for host only controllers
s390/iucv: fix receive buffer virtual vs physical address confusion
openrisc: Call setup_memory() earlier in the init sequence
NFS: avoid infinite loop in pnfs_update_layout.
nvmet-tcp: do not continue for invalid icreq
Bluetooth: bnep: Fix out-of-bound access
nvme: clear caller pointer on identify failure
usb: gadget: fsl: Increase size of name buffer for endpoints
f2fs: fix to do sanity check in update_sit_entry
btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
btrfs: send: handle unexpected data in header buffer in begin_cmd()
btrfs: handle invalid root reference found in may_destroy_subvol()
btrfs: change BUG_ON to assertion when checking for delayed_node root
powerpc/boot: Only free if realloc() succeeds
powerpc/boot: Handle allocation failure in simple_realloc()
parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
x86: Increase brk randomness entropy for 64-bit systems
md: clean up invalid BUG_ON in md_ioctl
virtiofs: forbid newlines in tags
drm/lima: set gp bus_stop bit before hard reset
net/sun3_82586: Avoid reading past buffer in debug output
scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
fs: binfmt_elf_efpic: don't use missing interpreter's properties
media: pci: cx23885: check cx23885_vdev_init() return
quota: Remove BUG_ON from dqget()
ext4: do not trim the group with corrupted block bitmap
nvmet-trace: avoid dereferencing pointer too early
powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
wifi: iwlwifi: abort scan when rfkill on but device enabled
gfs2: setattr_chown: Add missing initialization
scsi: spi: Fix sshdr use
binfmt_misc: cleanup on filesystem umount
staging: ks7010: disable bh on tx_dev_lock
media: radio-isa: use dev_name to fill in bus_info
i2c: riic: avoid potential division by zero
wifi: cw1200: Avoid processing an invalid TIM IE
ssb: Fix division by zero issue in ssb_calc_clock_rate
ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
net: hns3: fix a deadlock problem when config TC during resetting
net: dsa: vsc73xx: pass value in phy_write operation
net: axienet: Fix register defines comment description
net: axienet: Autodetect 64-bit DMA capability
net: axienet: Upgrade descriptors to hold 64-bit addresses
net: axienet: Wrap DMA pointer writes to prepare for 64 bit
net: axienet: Drop MDIO interrupt registers from ethtools dump
net: axienet: Check for DMA mapping errors
net: axienet: Factor out TX descriptor chain cleanup
net: axienet: Improve DMA error handling
net: axienet: Fix DMA descriptor cleanup path
atm: idt77252: prevent use after free in dequeue_rx()
net/mlx5e: Correctly report errors for ethtool rx flows
s390/uv: Panic for set and remove shared access UVC errors
btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
s390/cio: rename bitmap_size() -> idset_bitmap_size()
overflow: Implement size_t saturating arithmetic helpers
overflow.h: Add flex_array_size() helper
memcg_write_event_control(): fix a user-triggerable oops
drm/amdgpu: Actually check flags for all context ops.
selinux: fix potential counting error in avc_add_xperms_decision()
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
bitmap: introduce generic optimized bitmap_size()
vfs: Don't evict inode under the inode lru traversing context
dm persistent data: fix memory allocation failure
dm resume: don't return EINVAL when signalled
arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
s390/dasd: fix error recovery leading to data corruption on ESE devices
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
ALSA: usb-audio: Support Yamaha P-125 quirk entry
fuse: Initialize beyond-EOF page contents before setting uptodate
Revert "genirq: Allow the PM device to originate from irq domain"
Revert "genirq: Allow irq_chip registration functions to take a const irq_chip"
Revert "irqchip/imx-irqsteer: Constify irq_chip struct"
Revert "irqchip/imx-irqsteer: Add runtime PM support"
Revert "irqchip/imx-irqsteer: Handle runtime power management correctly"
Linux 5.4.282
media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
nvme/pci: Add APST quirk for Lenovo N60z laptop
exec: Fix ToCToU between perm check and set-uid/gid usage
media: uvcvideo: Use entity get_cur in uvc_ctrl_set
arm64: cpufeature: Fix the visibility of compat hwcaps
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
netfilter: nf_tables: prefer nft_chain_validate
netfilter: nf_tables: use timestamp to check for set element timeout
netfilter: nf_tables: set element extended ACK reporting support
kbuild: Fix '-S -c' in x86 stack protector scripts
Fix gcc 4.9 build issue in 5.4.y
drm/mgag200: Set DDC timeout in milliseconds
drm/bridge: analogix_dp: properly handle zero sized AUX transactions
x86/mtrr: Check if fixed MTRRs exist before saving them
tracing: Fix overflow in get_free_elt()
power: supply: axp288_charger: Round constant_charge_voltage writes down
power: supply: axp288_charger: Fix constant_charge_voltage writes
genirq/irqdesc: Honor caller provided affinity in alloc_desc()
serial: core: check uartclk for zero to avoid divide by zero
scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
scsi: mpt3sas: Remove scsi_dma_map() error messages
ntp: Safeguard against time_constant overflow
driver core: Fix uevent_show() vs driver detach race
ntp: Clamp maxerror and esterror to operating range
tick/broadcast: Move per CPU pointer access into the atomic section
scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
usb: gadget: core: Check for unset descriptor
USB: serial: debug: do not echo input by default
usb: vhci-hcd: Do not drop references before new references are gained
ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
ALSA: line6: Fix racy access to midibuf
drm/client: fix null pointer dereference in drm_client_modeset_probe
spi: spi-fsl-lpspi: Fix scldiv calculation
spi: fsl-lpspi: remove unneeded array
bpf: kprobe: remove unused declaring of bpf_kprobe_override
i2c: smbus: Send alert notifications to all devices if source not found
i2c: smbus: Improve handling of stuck alerts
i2c: smbus: Don't filter out duplicate alerts
arm64: errata: Expand speculative SSBS workaround (again)
arm64: cputype: Add Cortex-A725 definitions
arm64: cputype: Add Cortex-X1C definitions
arm64: errata: Expand speculative SSBS workaround
arm64: errata: Unify speculative SSBS errata logic
arm64: cputype: Add Cortex-X925 definitions
arm64: cputype: Add Cortex-A720 definitions
arm64: cputype: Add Cortex-X3 definitions
arm64: errata: Add workaround for Arm errata 3194386 and 3312417
arm64: cputype: Add Neoverse-V3 definitions
arm64: cputype: Add Cortex-X4 definitions
arm64: Add Neoverse-V2 part
arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
ext4: fix wrong unit use in ext4_mb_find_by_goal
SUNRPC: Fix a race to wake a sync task
s390/sclp: Prevent release of buffer in I/O
jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
media: uvcvideo: Fix the bandwdith quirk on USB 3.x
media: uvcvideo: Ignore empty TS packets
drm/amdgpu: Fix the null pointer dereference to ras_manager
btrfs: fix bitmap leak when loading free space cache on duplicate entry
wifi: nl80211: don't give key data to userspace
udf: prevent integer overflow in udf_bitmap_free_blocks()
PCI: Add Edimax Vendor ID to pci_ids.h
selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
ACPI: SBS: manage alarm sysfs attribute through psy core
ACPI: battery: create alarm sysfs attribute atomically
clocksource/drivers/sh_cmt: Address race condition for clock events
md/raid5: avoid BUG_ON() while continue reshape after reassembling
net: fec: Stop PPS on driver remove
Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
net: linkwatch: use system_unbound_wq
net: usb: qmi_wwan: fix memory leak for not ip packets
sctp: Fix null-ptr-deref in reuseport_add_sock().
sctp: move hlist_node and hashent out of sctp_ep_common
x86/mm: Fix pti_clone_pgtable() alignment assumption
irqchip/mbigen: Fix mbigen node address layout
genirq: Allow irq_chip registration functions to take a const irq_chip
netfilter: ipset: Add list flush to cancel_gc
net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
ALSA: usb-audio: Correct surround channels in UAC1 channel map
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
HID: wacom: Modify pen IDs
ipv6: fix ndisc_is_useropt() handling for PIO
net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
net/iucv: fix use after free in iucv_sock_close()
drm/vmwgfx: Fix overlay when using Screen Targets
drm/nouveau: prime: fix refcount underflow
remoteproc: imx_rproc: Skip over memory region when node value is NULL
remoteproc: imx_rproc: Fix ignoring mapping vdev regions
remoteproc: imx_rproc: ignore mapping vdev regions
irqchip/imx-irqsteer: Handle runtime power management correctly
irqchip/imx-irqsteer: Add runtime PM support
irqchip/imx-irqsteer: Constify irq_chip struct
genirq: Allow the PM device to originate from irq domain
devres: Fix memory leakage caused by driver API devm_free_percpu()
driver core: Cast to (void *) with __force for __percpu pointer
dev/parport: fix the array out-of-bounds risk
parport: Standardize use of printmode
parport: Convert printk(KERN_<LEVEL> to pr_<level>(
PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
PCI: rockchip: Make 'ep-gpios' DT property optional
mm: avoid overflows in dirty throttling logic
nvme-pci: add missing condition check for existence of mapped data
ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
ASoC: Intel: Convert to new X86 CPU match macros
powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
apparmor: Fix null pointer deref when receiving skb during sock creation
mISDN: Fix a use after free in hfcmulti_tx()
bpf: Fix a segment issue when downgrading gso_size
net: nexthop: Initialize all fields in dumped nexthops
tipc: Return non-zero value from tipc_udp_addr2str() on error
net: bonding: correctly annotate RCU in bond_should_notify_peers()
ipv4: Fix incorrect source address in Record Route option
MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
dma: fix call order in dmam_free_coherent
libbpf: Fix no-args func prototype BTF dumping syntax
um: time-travel: fix time-travel-start option
jfs: Fix array-index-out-of-bounds in diFree
kdb: Use the passed prompt in kdb_position_cursor()
kdb: address -Wformat-security warnings
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
drm/panfrost: Mark simple_ondemand governor as softdep
rbd: don't assume rbd_is_lock_owner() for exclusive mappings
selftests/sigaltstack: Fix ppc64 GCC build
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
platform: mips: cpu_hwmon: Disable driver on unsupported hardware
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
rtc: isl1208: Fix return value of nvmem callbacks
perf/x86/intel/pt: Fix a topa_entry base address calculation
perf/x86/intel/pt: Fix topa_entry base length
scsi: qla2xxx: validate nvme_local_port correctly
scsi: qla2xxx: Complete command early within lock
scsi: qla2xxx: Fix for possible memory corruption
scsi: qla2xxx: During vport delete send async logout explicitly
rtc: cmos: Fix return value of nvmem callbacks
kobject_uevent: Fix OOB access within zap_modalias_env()
decompress_bunzip2: fix rare decompression failure
ubi: eba: properly rollback inside self_check_eba
clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
f2fs: fix to don't dirty inode for readonly filesystem
scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
binder: fix hang of unregistered readers
PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
hwrng: amd - Convert PCIBIOS_* return codes to errnos
tools/memory-model: Fix bug in lock.cat
leds: ss4200: Convert PCIBIOS_* return codes to errnos
wifi: mwifiex: Fix interface type change
ext4: make sure the first directory block is not a hole
ext4: check dot and dotdot of dx_root before making dir indexed
m68k: amiga: Turn off Warp1260 interrupts during boot
udf: Avoid using corrupted block bitmap buffer
drm/amd/display: Check for NULL pointer
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
media: venus: fix use after free in vdec_close
char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
ipv6: take care of scope when choosing the src addr
af_packet: Handle outgoing VLAN packets without hardware offloading
net: netconsole: Disable target before netpoll cleanup
tick/broadcast: Make takeover of broadcast hrtimer reliable
rtc: interface: Add RTC offset to alarm after fix-up
nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
fs/nilfs2: remove some unused macros to tame gcc
pinctrl: freescale: mxs: Fix refcount of child
pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
pinctrl: ti: ti-iodelay: Drop if block with always false condition
pinctrl: single: fix possible memory leak when pinctrl_enable() fails
pinctrl: core: fix possible memory leak when pinctrl_enable() fails
netfilter: ctnetlink: use helper function to calculate expect ID
bnxt_re: Fix imm_data endianness
macintosh/therm_windtunnel: fix module unload.
powerpc/xmon: Fix disassembly CPU feature checks
MIPS: Octeron: remove source file executable bit
Input: elan_i2c - do not leave interrupt disabled on suspend failure
RDMA/device: Return error earlier if port in not valid
mtd: make mtd_test.c a separate module
ASoC: max98088: Check for clk_prepare_enable() error
RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
RDMA/mlx4: Fix truncated output warning in alias_GUID.c
RDMA/mlx4: Fix truncated output warning in mad.c
Input: qt1050 - handle CHIP_ID reading error
PCI: Fix resource double counting on remove & rescan
SUNRPC: Fixup gss_status tracepoint error output
sparc64: Fix incorrect function signature and add prototype for prom_cif_init
ext4: avoid writing unitialized memory to disk in EA inodes
SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
mfd: omap-usb-tll: Use struct_size to allocate tll
drm/qxl: Add check for drm_cvt_mode
drm/etnaviv: fix DMA direction handling for cached RW buffers
perf report: Fix condition in sort__sym_cmp()
leds: trigger: Unregister sysfs attributes before calling deactivate()
media: renesas: vsp1: Store RPF partition configuration per RPF instance
media: renesas: vsp1: Fix _irqsave and _irq mix
media: uvcvideo: Override default flags
media: uvcvideo: Allow entity-defined get_info and get_cur
saa7134: Unchecked i2c_transfer function result fixed
media: imon: Fix race getting ictx->lock
media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
USB: move snd_usb_pipe_sanity_check into the USB core
selftests: forwarding: devlink_lib: Wait for udev events after reloading
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
wifi: virt_wifi: don't use strlen() in const context
gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
wifi: virt_wifi: avoid reporting connection success with wrong SSID
qed: Improve the stack space of filter_config()
perf: Prevent passing zero nr_pages to rb_alloc_aux()
perf: Fix perf_aux_size() for greater-than 32-bit size
perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
netfilter: nf_tables: rise cap on SELinux secmark context
ipvs: Avoid unnecessary calls to skb_is_gso_sctp
net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
net: fec: Refactor: #define magic constants
wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
mlxsw: spectrum_acl_erp: Fix object nesting warning
lib: objagg: Fix general protection fault
selftests/bpf: Check length of recv in test_sockmap
net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
net/smc: Allow SMC-D 1MB DMB allocations
wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
firmware: turris-mox-rwtm: Initialize completion before mailbox
firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
m68k: cmpxchg: Fix return value for default case in __arch_xchg()
x86/xen: Convert comma to semicolon
m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
arm64: dts: amlogic: gx: correct hdmi clocks
arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
ARM: dts: imx6qdl-kontron-samx6i: fix board reset
ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
arm64: dts: rockchip: Increase VOP clk rate on RK3328
arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
arm64: dts: qcom: sdm845: add power-domain to UFS PHY
hwmon: (max6697) Fix swapped temp{1,8} critical alarms
hwmon: (max6697) Fix underflow when writing limit attributes
pwm: stm32: Always do lazy disabling
hwmon: (adt7475) Fix default duty on fan is disabled
x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
x86/pci/xen: Fix PCIBIOS_* return code handling
x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
x86/of: Return consistent error type from x86_of_pci_irq_enable()
hfsplus: fix to avoid false alarm of circular locking
platform/chrome: cros_ec_debugfs: fix wrong EC message version
EDAC, i10nm: make skx_common.o a separate module
EDAC/skx_common: Add new ADXL components for 2-level memory
EDAC, skx: Retrieve and print retry_rd_err_log registers
EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode.
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/vendor-prefixes.yaml
drivers/clk/qcom/clk-rpmh.c
drivers/rpmsg/qcom_glink_native.c
drivers/soc/qcom/socinfo.c
drivers/usb/dwc3/core.c
fs/userfaultfd.c
mm/madvise.c
net/qrtr/qrtr.c
Change-Id: I5064cb8c11d2c104b445035a948867f10c88da1b
Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
|
||
|
Michael Bestas
|
869b1e64a6 |
Merge branch 'staging/kernel-msm/MMI-U1UGS34.23-110-23-2' into lineage-22.2
Based on tag 'MMI-U1UGS34.23-110-23-2' of https://github.com/MotorolaMobilityLLC/kernel-msm "Fogos push for Android 14" * staging/kernel-msm/MMI-U1UGS34.23-110-23-2: (698 commits) mmc: sdhci-msm: Move MMC_CAP2_MAX_DISCARD_SIZE to prevent merge conflict Reapply "UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings" Revert "qseecom: Suppress suspend warning if without bus scaling." Revert "Penang: fix for device suspend tests fail. [1/2]" Revert "Penang: resolve kasan panic" Revert "Penang: kasan panic" Revert "penang: device suspend tests fail" Revert "net: qrtr: get svc_id before queueing sk_buff" Revert "af_unix: Do not use atomic ops for unix_sk(sk)->inflight." Revert "af_unix: Fix garbage collector racing against connect()" Revert "BACKPORT: net: fix __dst_negative_advice() race" Revert "ANDROID: ABI fixup for abi break in struct dst_ops" Revert "BACKPORT:sched: Provide sched_set_fifo()" Revert "msm: npu: Fix use after free issue" Revert "fs:EROFS:Porting 5.10 erofs to 5.4" Revert "BACKPORT:erofs: add per-cpu threads for decompression as an option" Revert "UPSTREAM: erofs: fix an error code in z_erofs_init_zip_subsystem()" msm: adsprpc: Avoid taking reference for group_info adsprpc: Handle UAF scenario in put_args msm: adsprpc: use-after-free (UAF) in global maps ... Change-Id: Ia48438f247670d77560472205994632fa62062dd |
||
|
Greg Kroah-Hartman
|
d6a7c6fab0 |
This is the 5.4.291 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmfSxSAACgkQONu9yGCS aT4xFxAAlZPsz8ZaSZdkyMSpr9lnz1P7Z/ONSc4f2j9dURdLz+HfP1jwQHRzK/jd JDtO9c9eg77/3UjKIyszTeHlaPbyA5bKsNF2zE+UjonSXzRNvsASmZW7Wee770Rf Yt6ZOn2tbDPwRfEsUILhKugNHkoZABSDUj+3FCbPQm5XzaTNeB0ofjWaRxbop5qv +GJnaFKwtu9yOWRIvRCQ5tE9zxW39xt767uuOBmsN1C6YECx5SAtgXXPQrpjCJEL TY09ATSAqbTjxdHDsQGBL1oe2XEXHJmD4hBKY/FysXuq2i+oFxXEavk7Eq6dR34M CoDKbeMXyTL3XnZ6iOzcqsyB/9hWHqRqvkqJI7fOqeJUWydRy7xy3Arf93M3Occ1 nGyJ1k51Wl19TaOE9G4hjWtBwBVx0rPtMIBOuWwBU1KP13R3pbPvUU41GKTEtw78 7ruTFycqRbU3uxYUoyV/XEUqLoWEuPyGk6DRCZy8rls0jLXnRzeKLJ6FxfhwBbrP B/NHcI6yUGwxpIPhwFJxwy+H/0eprxxBKrqldJBK3NkI1IyB2azldHWmdMdJKUiO e7Gxqi2SFOyjTRYb2GSgD25nQMbXyarwyS3vQxDb8XCDuZw2KJCBoD6OCTbtEeMZ pytJMQrM/GM6+tlqAWZqMZaNwStA4FnJzBL17fLmoTIWEpdmy0o= =LuVk -----END PGP SIGNATURE----- Merge 5.4.291 into android11-5.4-lts Changes in 5.4.291 perf cs-etm: Add missing variable in cs_etm__process_queues() udf: Fix use of check_add_overflow() with mixed type arguments overflow: Add __must_check attribute to check_*() helpers overflow: Correct check_shl_overflow() comment overflow: Allow mixed type arguments afs: Fix directory format encoding struct nbd: don't allow reconnect after disconnect partitions: ldm: remove the initial kernel-doc notation drm/etnaviv: Fix page property being used for non writecombine buffers drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table ipmi: ipmb: Add check devm_kasprintf() returned value wifi: rtlwifi: do not complete firmware loading needlessly rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step wifi: rtlwifi: usb: fix workqueue leak when probe fails dt-bindings: mmc: controller: clarify the address-cells description rtlwifi: replace usage of found with dedicated list iterator variable wifi: rtlwifi: remove unused timer and related code wifi: rtlwifi: remove unused dualmac control leftovers wifi: rtlwifi: remove unused check_buddy_priv wifi: rtlwifi: fix memory leaks and invalid access at probe error path wifi: rtlwifi: pci: wait for firmware loading before releasing memory cpupower: fix TSC MHz calculation team: prevent adding a device which is already a team device lower regulator: of: Implement the unwind path of of_regulator_match() wifi: wlcore: fix unbalanced pm_runtime calls selftests/harness: Display signed values correctly selftests: harness: fix printing of mismatch values in __EXPECT() clk: analogbits: Fix incorrect calculation of vco rate delta net: let net.core.dev_weight always be non-zero net/mlxfw: Drop hard coded max FW flash image size net: sched: Disallow replacing of child qdisc from one parent to another tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind ASoC: sun4i-spdif: Add clock multiplier settings perf header: Fix one memory leakage in process_bpf_btf() perf header: Fix one memory leakage in process_bpf_prog_info() ktest.pl: Remove unused declarations in run_bisect_test function padata: fix sysfs store callback check perf top: Don't complain about lack of vmlinux when not resolving some kernel samples perf report: Fix misleading help message about --demangle bpf: Send signals asynchronously if !preemptible RDMA/mlx4: Avoid false error about access to uninitialized gids array rdma/cxgb4: Prevent potential integer overflow on 32bit arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names ARM: dts: mediatek: mt7623: fix IR nodename fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() media: rc: iguanair: handle timeouts media: lmedm04: Use GFP_KERNEL for URB allocation/submission. media: lmedm04: Handle errors for lme2510_int_read PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() media: mipi-csis: Add check for clk_enable() media: camif-core: Add check for clk_enable() media: uvcvideo: Propagate buf->error to userspace staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails ocfs2: mark dquot as inactive if failed to start trans while releasing dquot module: Extend the preempt disabled section in dereference_symbol_descriptor(). dmaengine: ti: edma: fix OF node reference leaks in edma_driver rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read ubifs: skip dumping tnc tree when zroot is null net: fec: implement TSO descriptor cleanup ipmr: do not call mr_mfc_uses_dev() for unres entries PM: hibernate: Add error handling for syscore_suspend() net: rose: fix timer races against user threads net: davicom: fix UAF in dm9000_drv_remove perf trace: Fix runtime error of index out of bounds vsock: Allow retrying on connect() failure net: sh_eth: Fix missing rtnl lock in suspend/resume path genksyms: fix memory leak when the same symbol is added from source genksyms: fix memory leak when the same symbol is read from *.symref file hexagon: fix using plain integer as NULL pointer warning in cmpxchg hexagon: Fix unbalanced spinlock in die() NFSD: Reset cb_seq_status after NFS4ERR_DELAY ktest.pl: Check kernelrelease return in get_version drivers/card_reader/rtsx_usb: Restore interrupt based detection usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections media: uvcvideo: Fix double free in error path usb: gadget: f_tcm: Don't free command immediately btrfs: output the reason for open_ctree() failure btrfs: fix use-after-free when attempting to join an aborted transaction btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling sched: Don't try to catch up excess steal time. x86/amd_nb: Restrict init function to AMD-based systems printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX tun: fix group permission check mmc: core: Respect quirk_max_rate for non-UHS SDIO card wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() tomoyo: don't emit warning in tomoyo_write_control() mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id HID: Wacom: Add PCI Wacom device support APEI: GHES: Have GHES honor the panic= setting x86/mm: Don't disable PCID when INVLPG has been fixed by microcode spi-mxs: Fix chipselect glitch nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link nilfs2: eliminate staggered calls to kunmap in nilfs_rename nilfs2: handle errors that nilfs_prepare_chunk() may return media: uvcvideo: Only save async fh if success media: uvcvideo: Remove dangling pointers sched: sch_cake: add bounds checks to host bulk flow fairness counts kbuild: userprogs: use correct lld when linking through clang tasklet: Introduce new initialization API net: usb: rtl8150: use new tasklet API net: usb: rtl8150: enable basic endpoint checking usb: xhci: Add timeout argument in address_device USB HCD callback usb: xhci: Fix NULL pointer dereference on certain command aborts nvme: handle connectivity loss in nvme_set_queue_count firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry gpu: drm_dp_cec: fix broken CEC adapter properties check tg3: Disable tg3 PCIe AER on system reboot udp: gso: do not drop small packets when PMTU reduces net: rose: lock the socket in rose_bind() netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() tun: revert fix group permission check cpufreq: s3c64xx: Fix compilation warning leds: lp8860: Write full EEPROM, not only half of it s390/futex: Fix FUTEX_OP_ANDN implementation m68k: vga: Fix I/O defines binfmt_flat: Fix integer overflow bug on 32 bit systems arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() KVM: s390: vsie: fix some corner-cases when grabbing vsie pages drm/komeda: Add check for komeda_get_layer_fourcc_list() Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc clk: qcom: clk-alpha-pll: fix alpha mode configuration clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate perf bench: Fix undefined behavior in cmpworker() of: Correct child specifier used as input of the 2nd nexus node of: Fix of_find_node_opts_by_path() handling of alias+path+options of: reserved-memory: Fix using wrong number of cells to get property 'alignment' HID: hid-sensor-hub: don't use stale platform-data on remove wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() usb: gadget: f_tcm: Translate error to sense usb: gadget: f_tcm: Decrement command ref count on cleanup usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint usb: gadget: f_tcm: Don't prepare BOT write request twice soc: qcom: socinfo: Avoid out of bounds read of serial number serial: sh-sci: Drop __initdata macro for port_cfg serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use powerpc/pseries/eeh: Fix get PE state translation kbuild: Move -Wenum-enum-conversion to W=2 soc: qcom: smem_state: fix missing of_node_put in error path media: ov5640: fix get_light_freq on auto media: uvcvideo: Fix event flags in uvc_ctrl_send_events media: uvcvideo: Remove redundant NULL assignment crypto: qce - fix goto jump in error path crypto: qce - unregister previously registered algos in error path nvmem: core: improve range check for nvmem_cell_write() vfio/platform: check the bounds of read/write syscalls ocfs2: fix incorrect CPU endianness conversion causing mount failure ocfs2: handle a symlink read error correctly nilfs2: fix possible int overflows in nilfs_fiemap() NFC: nci: Add bounds checking in nci_hci_create_pipe() mtd: onenand: Fix uninitialized retlen in do_otp_read() misc: fastrpc: Fix registered buffer page address net/ncsi: wait for the last response to Deselect Package before configuring channel ptp: Ensure info->enable callback is always set MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static ocfs2: check dir i_size in ocfs2_find_entry HID: multitouch: Add NULL check in mt_input_configured ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() vrf: use RCU protection in l3mdev_l3_out() team: better TEAM_OPTION_TYPE_STRING validation arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0 gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ gpio: bcm-kona: Add missing newline to dev_err format string xen: remove a confusing comment on auto-translated guest I/O x86/xen: allow larger contiguous memory regions in PV guests media: cxd2841er: fix 64-bit division on gcc-9 vfio/pci: Enable iowrite64 and ioread64 for vfio pci Grab mm lock before grabbing pt lock orangefs: fix a oob in orangefs_debug_write ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V batman-adv: fix panic during interface removal usb: roles: set switch registered flag early on usb: gadget: udc: renesas_usb3: Fix compiler warning usb: dwc2: gadget: remove of_node reference upon udc_stop USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone usb: gadget: f_midi: fix MIDI Streaming descriptor lengths USB: hub: Ignore non-compliant devices with too many configs or interfaces USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk usb: cdc-acm: Check control transfer buffer size before access usb: cdc-acm: Fix handling of oversized fragments USB: serial: option: add MeiG Smart SLM828 USB: serial: option: add Telit Cinterion FN990B compositions USB: serial: option: fix Telit Cinterion FN990A name USB: serial: option: drop MeiG Smart defines can: c_can: fix unbalanced runtime PM disable in error path can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero alpha: make stack 16-byte aligned (most cases) serial: 8250: Fix fifo underflow on flush alpha: align stack for page fault and user unaligned trap handlers gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock partitions: mac: fix handling of bogus partition table regmap-irq: Add missing kfree() net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() net: add dev_net_rcu() helper ipv4: use RCU protection in rt_is_expired() ipv4: use RCU protection in inet_select_addr() ipv6: use RCU protection in ip6_default_advmss() ndisc: use RCU protection in ndisc_alloc_skb() neighbour: delete redundant judgment statements neighbour: use RCU protection in __neigh_notify() arp: use RCU protection in arp_xmit() openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ndisc: extend RCU protection in ndisc_send_skb() alpha: replace hardcoded stack offsets with autogenerated ones nilfs2: do not output warnings when clearing dirty buffers nilfs2: do not force clear folio if buffer is referenced nilfs2: protect access to buffers with no active references can: ems_pci: move ASIX AX99100 ids to pci_ids.h serial: 8250_pci: add support for ASIX AX99100 parport_pc: add support for ASIX AX99100 x86/i8253: Disable PIT timer 0 when not in use Revert "btrfs: avoid monopolizing a core when activating a swap file" btrfs: avoid monopolizing a core when activating a swap file pps: Fix a use-after-free ima: Fix use-after-free on a dentry's dname.name vlan: introduce vlan_dev_free_egress_priority vlan: move dev_put into vlan_dev_uninit scsi: storvsc: Set correct data length for sending SCSI command without payload driver core: bus: Fix double free in driver API bus_register() crypto: testmgr - fix wrong key length for pkcs1pad crypto: testmgr - Fix wrong test case of RSA crypto: testmgr - fix version number of RSA tests crypto: testmgr - populate RSA CRT parameters in RSA test vectors crypto: testmgr - some more fixes to RSA test vectors mm: update mark_victim tracepoints fields memcg: fix soft lockup in the OOM process usb: dwc3: Increase DWC3 controller halt timeout usb: dwc3: Fix timeout issue during controller enter/exit from halt state usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API usb/gadget: f_midi: Replace tasklet with work USB: gadget: f_midi: f_midi_complete to call queue_work powerpc/64s/mm: Move __real_pte stubs into hash-4k.h powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline ALSA: hda/realtek - Add type for ALC287 ALSA: hda/realtek: Fixup ALC225 depop procedure powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC geneve: Fix use-after-free in geneve_find_dev(). gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). net: extract port range fields from fl_flow_key flow_dissector: Fix handling of mixed port and port-range keys flow_dissector: Fix port range key handling in BPF conversion power: supply: da9150-fg: fix potential overflow tee: optee: Fix supplicant wait loop nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED acct: block access to kernel internal filesystems batman-adv: Ignore neighbor throughput metrics in error case batman-adv: Drop unmanaged ELP metric worker sunrpc: suppress warnings for unused procfs functions net: loopback: Avoid sending IP packets without an Ethernet header net: cadence: macb: Synchronize stats calculations ASoC: es8328: fix route from DAC to output ipvs: Always clear ipvs_property flag in skb_scrub_packet() net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination. x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems ftrace: Avoid potential division by zero in function_stat_show() perf/core: Fix low freq setting via IOC_PERIOD usbnet: gl620a: fix endpoint checking in genelink_bind() phy: tegra: xusb: reset VBUS & ID OVERRIDE phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk sched/core: Prevent rescheduling when interrupts are disabled pfifo_tail_enqueue: Drop new packet when sch->limit == 0 drop_monitor: fix incorrect initialization order kernel/acct.c: use #elif instead of #end and #elif kernel/acct.c: use dedicated helper to access rlimit values acct: perform last write from workqueue drm/amdgpu: skip BAR resizing if the bios already did it drm/amdgpu: Check extended configuration space register when system uses large bar drm/amdgpu: disable BAR resize on Dell G5 SE Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" HID: appleir: Fix potential NULL dereference at raw event handle ALSA: hda: intel: Add Dell ALC3271 to power_save denylist ALSA: hda/realtek: update ALC222 depop optimize drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e x86/cacheinfo: Validate CPUID leaf 0x2 EDX output x86/cpu: Validate CPUID leaf 0x2 EDX output x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 wifi: cfg80211: regulatory: improve invalid hints checking wifi: nl80211: reject cooked mode if it is set along with other flags rapidio: add check for rio_add_net() in rio_scan_alloc_net() rapidio: fix an API misues when rio_add_net() fails mm/page_alloc: fix uninitialized variable wifi: iwlwifi: limit printed string from FW file HID: google: fix unused variable warning under !CONFIG_ACPI HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() net: gso: fix ownership in __udp_gso_segment caif_virtio: fix wrong pointer check in cfv_probe() hwmon: (pmbus) Initialise page count in pmbus_identify() hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table hwmon: (ad7314) Validate leading zero bits and return error llc: do not use skb_get() before dev_queue_xmit() hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() drm/sched: Fix preprocessor guard be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink ppp: Fix KMSAN uninit-value warning with bpf vlan: enforce underlying device type net-timestamp: support TCP GSO case for a few missing flags net: ipv6: fix dst ref loop in ila lwtunnel net: ipv6: fix missing dst ref drop in ila lwtunnel gpio: rcar: Fix missing of_node_put() call Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" usb: renesas_usbhs: Call clk_put() usb: renesas_usbhs: Use devm_usb_get_phy() usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader usb: renesas_usbhs: Flush the notify_hotplug_work usb: atm: cxacru: fix a flaw in existing endpoint checks usb: typec: ucsi: increase timeout for PPM reset operations usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality usb: gadget: Set self-powered based on MaxPower and bmAttributes usb: gadget: Fix setting self-powered state on suspend usb: gadget: Check bmAttributes only if configuration is valid xhci: pci: Fix indentation in the PCI device ID definitions Squashfs: check the inode number is not the invalid value of zero intel_th: pci: Add Arrow Lake support intel_th: pci: Add Panther Lake-H support intel_th: pci: Add Panther Lake-P/U support slimbus: messaging: Free transaction ID in delayed interrupt scenario eeprom: digsy_mtc: Make GPIO lookup table match the device Linux 5.4.291 Change-Id: Ica7eab9e6472f50da32bd885ba09d09dbb450ef0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
Krzysztof Kozlowski
|
5d50d51d50 |
soc: qcom: smem_state: fix missing of_node_put in error path
commit 70096b4990848229d0784c5e51dc3c7c072f1111 upstream.
If of_parse_phandle_with_args() succeeds, the OF node reference should
be dropped, regardless of number of phandle arguments.
Cc: stable@vger.kernel.org
Fixes:
|
||
Stephan Gerhold
|
7445fa0531 |
soc: qcom: socinfo: Avoid out of bounds read of serial number
commit 22cf4fae6660b6e1a583a41cbf84e3046ca9ccd0 upstream.
On MSM8916 devices, the serial number exposed in sysfs is constant and does
not change across individual devices. It's always:
db410c:/sys/devices/soc0$ cat serial_number
2644893864
The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not
have support for the serial_num field in the socinfo struct. There is an
existing check to avoid exposing the serial number in that case, but it's
not correct: When checking the item_size returned by SMEM, we need to make
sure the *end* of the serial_num is within bounds, instead of comparing
with the *start* offset. The serial_number currently exposed on MSM8916
devices is just an out of bounds read of whatever comes after the socinfo
struct in SMEM.
Fix this by changing offsetof() to offsetofend(), so that the size of the
field is also taken into account.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Michael Bestas
|
b9715311a2 |
Merge tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-02-01 CVE-2024-53104 CVE-2025-0088 * tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits) ANDROID: gki - change networking configuration ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only) Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics" Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER" ANDROID: GKI: add Trimble symbol list UPSTREAM: selinux: ignore unknown extended permissions ANDROID: ABI: Update allowed list for galaxy Revert "netfilter: Replace zero-length array with flexible-array member" Revert "tracing: Constify string literal data member in struct trace_event_call" Revert "skb_expand_head() adjust skb->truesize incorrectly" Linux 5.4.289 ftrace: use preempt_enable/disable notrace macros to avoid double fault mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() drm: adv7511: Drop dsi single lane support net/sctp: Prevent autoclose integer overflow in sctp_association_init() sky2: Add device ID 11ab:4373 for Marvell 88E8075 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking RDMA/uverbs: Prevent integer overflow issue modpost: fix the missed iteration for the max bit in do_input() modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host ... Conflicts: arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt drivers/rpmsg/qcom_glink_native.c drivers/soc/qcom/socinfo.c Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a |
||
|
Michael Bestas
|
0262d4e51f |
Merge tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2024-12-01 * tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common: (552 commits) UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT ANDROID: add file for recording allowed ABI breaks Revert "spi: Fix deadlock when adding SPI controllers on SPI buses" Revert "spi: fix use-after-free of the add_lock mutex" ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics UPSTREAM: x86/percpu: Clean up percpu_add_op() UPSTREAM: x86/percpu: Clean up percpu_from_op() UPSTREAM: x86/percpu: Clean up percpu_to_op() UPSTREAM: x86/percpu: Introduce size abstraction macros BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze FROMGIT: binder: allow freeze notification for dead nodes FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() FROMGIT: binder: fix OOB in binder_add_freeze_work() FROMGIT: binder: fix node UAF in binder_add_freeze_work() Linux 5.4.286 mm: avoid leaving partial pfn mappings around in error case ... Conflicts: arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.txt arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.yaml drivers/clk/qcom/clk-rpmh.c drivers/usb/dwc3/core.c fs/erofs/decompressor.c net/qrtr/qrtr.c Change-Id: Iae3a7502b304d7be66da795411c4f330eef8b693 |
||
|
Greg Kroah-Hartman
|
ad8d63bdc6 |
Merge 5.4.287 into android11-5.4-lts
Changes in 5.4.287
netlink: terminate outstanding dump on socket close
net/mlx5: fs, lock FTE when checking if active
net/mlx5e: kTLS, Fix incorrect page refcounting
ocfs2: uncache inode which has failed entering the group
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
kbuild: Use uname for LINUX_COMPILE_HOST detection
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mac80211: fix user-power when emulating chanctx
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
net: usb: qmi_wwan: add Quectel RG650V
soc: qcom: Add check devm_kasprintf() returned value
regulator: rk808: Add apply_bit for BUCK3 on RK809
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
ipmr: Fix access to mfc_cache_list without lock held
cifs: Fix buffer overflow when parsing NFS reparse points
NFSD: Force all NFSv4.2 COPY requests to be synchronous
nvme: fix metadata handling in nvme-passthrough
x86/xen/pvh: Annotate indirect branch as safe
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
initramfs: avoid filename buffer overrun
nvme-pci: fix freeing of the HMB descriptor table
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Reinstate early console
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
firmware: google: Unregister driver_info on failure and exit in gsmi
firmware: google: Unregister driver_info on failure
EDAC/bluefield: Fix potential integer overflow
EDAC/fsl_ddr: Fix bad bit shift operations
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
time: Fix references to _msecs_to_jiffies() handling of values
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
mmc: mmc_spi: drop buggy snprintf()
efi/tpm: Pass correct address to memblock_reserve
tpm: fix signed/unsigned bug when checking event logs
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
regmap: irq: Set lockdep class for hierarchical IRQ domains
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix locking in omap_gem_new_dmabuf()
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
ASoC: fsl_micfil: Drop unnecessary register read
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
ASoC: fsl_micfil: use GENMASK to define register bit fields
ASoC: fsl_micfil: fix regmap_write_bits usage
bpf: Fix the xdp_adjust_tail sample prog issue
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm/panfrost: Remove unused id_mask from struct panfrost_model
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/etnaviv: dump: fix sparse warnings
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: hold GPU lock across perfmon sampling
bpf, sockmap: Several fixes to bpf_msg_push_data
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Fix sk_msg_reset_curr
selftests: net: really check for bg process completion
net: rfkill: gpio: Add check for clk_enable()
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
mfd: da9052-spi: Change read-mask to write-mask
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
cpufreq: loongson2: Unregister platform_driver on failure
mtd: rawnand: atmel: Fix possible memory leak
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mfd: rt5033: Fix missing regmap_del_irq_chip()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
fbdev/sh7760fb: Alloc DMA memory from hardware device
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
dt-bindings: clock: axi-clkgen: include AXI clk
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
perf cs-etm: Don't flush when packet_queue fills up
perf probe: Correct demangled symbols in C++ program
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
PCI: cpqphp: Fix PCIBIOS_* return value confusion
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
perf trace: Do not lose last events in a race
perf trace: Avoid garbage when not printing a syscall's arguments
rpmsg: glink: Add TX_DATA_CONT command while sending
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
NFSD: Fix nfsd4_shutdown_copy()
vfio/pci: Properly hide first-in-list PCIe extended capability
power: supply: core: Remove might_sleep() from power_supply_put()
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
ipmr: convert /proc handlers to rcu_read_lock()
ipmr: fix tables suspicious RCU usage
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
usb: yurex: make waiting on yurex_write interruptible
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
staging: greybus: uart: clean up TIOCGSERIAL
apparmor: fix 'Do simple duplicate message elimination'
usb: ehci-spear: fix call balance of sehci clk handling routines
cgroup: Make operations on the cgroup root_list RCU safe
cgroup: Move rcu_head up near the top of cgroup_root
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
jfs: xattr: check invalid xattr size more strictly
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
PCI: Fix use-after-free of slot->bus on hot remove
comedi: Flush partial mappings in error case
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
media: wl128x: Fix atomicity violation in fmc_send_cmd()
ALSA: hda/realtek: Update ALC225 depop procedure
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: Apply quirk for Medion E15433
usb: dwc3: gadget: Fix checking for number of TRBs left
lib: string_helpers: silence snprintf() output truncation warning
NFSD: Prevent a potential integer overflow
SUNRPC: make sure cache entry active before cache_show
rpmsg: glink: Propagate TX failures in intentless mode as well
um: Fix potential integer overflow during physmem setup
um: Fix the return value of elf_core_copy_task_fpregs
um/sysrq: remove needless variable sp
um: add show_stack_loglvl()
um: Clean up stacktrace dump
um: Always dump trace for specified task in show_stack
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
rtc: abx80x: Fix WDT bit position of the status register
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
jffs2: fix use of uninitialized variable
block: return unsigned int from bdev_io_min
9p/xen: fix init sequence
9p/xen: fix release of IRQ
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
modpost: remove incorrect code in do_eisa_entry()
SUNRPC: correct error code comment in xs_tcp_setup_socket()
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
sh: intc: Fix use-after-free bug in register_intc_controller()
ASoC: fsl_micfil: fix the naming style for mask definition
quota: flush quota_release_work upon quota writeback
btrfs: ref-verify: fix use-after-free after invalid ref action
media: i2c: tc358743: Fix crash in the probe error path when using polling
media: ts2020: fix null-ptr-deref in ts2020_probe()
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
ovl: Filter invalid inodes with missing lookup function
ftrace: Fix regression with module command in stack_trace_filter
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
ad7780: fix division by zero in ad7780_write_raw()
util_macros.h: fix/rework find_closest() macros
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
dm thin: Add missing destroy_work_on_stack()
nfsd: make sure exp active before svc_export_show
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
drm/etnaviv: flush shader L1 cache after user commandstream
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
netfilter: x_tables: fix LED ID check in led_tg_check()
net/sched: tbf: correct backlog statistic for GSO packets
can: j1939: j1939_session_new(): fix skb reference counting
net/ipv6: release expired exception dst cached in socket
dccp: Fix memory leak in dccp_feat_change_recv
tipc: add reference counter to bearer
tipc: enable creating a "preliminary" node
tipc: add new AEAD key structure for user API
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
net/qed: allow old cards not supporting "num_images" to work
igb: Fix potential invalid memory access in igb_init_module()
netfilter: ipset: Hold module reference while requesting a module
netfilter: nft_set_hash: skip duplicated elements pending gc run
xen/xenbus: reference count registered modules
xenbus/backend: Add memory pressure handler callback
xenbus/backend: Protect xenbus callback with lock
xen/xenbus: fix locking
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
x86/asm: Reorder early variables
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
gpio: grgpio: use a helper variable to store the address of ofdev->dev
gpio: grgpio: Add NULL check in grgpio_probe
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
spi: mpc52xx: Add cancel_work_sync before module remove
ocfs2: free inode when ocfs2_get_init_inode() fails
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
bpf: Fix exact match conditions in trie_get_next_key()
HID: wacom: fix when get product name maybe null pointer
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
ocfs2: update seq_file index in ocfs2_dlm_seq_next
scsi: qla2xxx: Fix NVMe and NPIV connect issue
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
dma-buf: fix dma_fence_array_signaled v4
regmap: detach regmap from dev on regmap_exit
mmc: core: Further prevent card detect during shutdown
s390/cpum_sf: Handle CPU hotplug remove during sampling
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
drm/mcde: Enable module autoloading
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
samples/bpf: Fix a resource leak
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
net: ethernet: fs_enet: Use %pa to format resource_size_t
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
af_packet: avoid erroring out after sock_init_data() in packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
wifi: ath5k: add PCI ID for SX76X
wifi: ath5k: add PCI ID for Arcadyan devices
jfs: array-index-out-of-bounds fix in dtReadFirst
jfs: fix shift-out-of-bounds in dbSplit
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
drm/amdgpu: set the right AMDGPU sg segment limitation
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
ASoC: hdmi-codec: reorder channel allocation list
rocker: fix link status detection in rocker_carrier_init()
net/neighbor: clear error in case strict check is not set
netpoll: Use rcu_access_pointer() in __netpoll_setup
tracing: Use atomic64_inc_return() in trace_clock_counter()
leds: class: Protect brightness_show() with led_cdev->led_access mutex
scsi: st: Don't modify unknown block number in MTIOCGET
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
pinctrl: qcom-pmic-gpio: add support for PM8937
nvdimm: rectify the illogical code within nd_dax_probe()
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
PCI: Add ACS quirk for Wangxun FF5xxx NICs
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
powerpc/prom_init: Fixup missing powermac #size-cells
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
xdp: Simplify devmap cleanup
bpf: fix OOB devmap writes when deleting elements
Revert "unicode: Don't special case ignorable code points"
perf/x86/intel/pt: Fix buffer full but size is 0 case
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
jffs2: Prevent rtime decompress memory corruption
jffs2: Fix rtime decompressor
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
modpost: Add .irqentry.text to OTHER_SECTIONS
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
PCI: rockchip-ep: Fix address translation unit programming
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
bpf, xdp: Update devmap comments to reflect napi/rcu usage
Linux 5.4.287
Change-Id: Ib48a7a0e01226c0f910efae2139893c6a139b9b5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
Manikanta Mylavarapu
|
f7b0952a70 |
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
commit 128fdbf36cddc2a901c4889ba1c89fa9f2643f2c upstream.
In success case, the revision holds a non-null pointer. The current
logic incorrectly returns an error for a non-null pointer, whereas
it should return an error for a null pointer.
The socinfo driver for IPQ9574 and IPQ5332 is currently broken,
resulting in the following error message
qcom-socinfo qcom-socinfo: probe with driver qcom-socinfo failed with
error -12
Add a null check for the revision to ensure it returns an error only in
failure case (null pointer).
Fixes: e694d2b5c58b ("soc: qcom: Add check devm_kasprintf() returned value")
Signed-off-by: Manikanta Mylavarapu <quic_mmanikan@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241016144852.2888679-1-quic_mmanikan@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Dan Carpenter
|
7a3465b79e |
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ]
This loop is supposed to break if the frequency returned from
clk_round_rate() is the same as on the previous iteration. However,
that check doesn't make sense on the first iteration through the loop.
It leads to reading before the start of these->clk_perf_tbl[] array.
Fixes:
|
||
Charles Han
|
e5137997b8 |
soc: qcom: Add check devm_kasprintf() returned value
[ Upstream commit e694d2b5c58ba2d1e995d068707c8d966e7f5f2a ] devm_kasprintf() can return a NULL pointer on failure but this returned value in qcom_socinfo_probe() is not checked. Signed-off-by: Charles Han <hanchunchao@inspur.com> Link: https://lore.kernel.org/r/20240929072349.202520-1-hanchunchao@inspur.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Greg Kroah-Hartman
|
94424b0fce |
This is the 5.4.285 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmcuLG4ACgkQONu9yGCS aT7BrA/+NGLfwp3lfOunHEhrw/IwD/tbMJuAOn5P2rvrg3f2aCVjboJpHh0pwL6O Axt4uEmJOo7++8mEo9cCBdLPSv5lQPK+j1uIXjKfdISODJYVqLf6g7GGHSdq/Ijj BCSW24P+Kl+XK0NHiyzlS2+XFP+Xk6T5yErV0cBwt6KFotYWjaAlpwDlCGHtvdra RROVwCQWVxGrCDLPEYeQIP3cD1fp/A3Q/d3quJLK1xo6SXAFBZjlYcOvl76i4ogj 6ZZPBdIusk24pjpnhaIwmlzbmfqWbp5T2uJHJGaXNfSioIKSs1CdKP9zsOnGxoDl Iv3c65O/IZbLz/77z1yKDPWn9lQ1uu0sr15Bq6G720HOvk1reKbBwP+XeWNnl8PF RLdDxVAYqIFxfMsWGHgc7NzToRH/Z2AkqmTcm+uYHh+u9z4gXbVKXcgOX/EBFKKL rlVjwOsTzPm2NV81EP4bDKNag+3D6yoYn1zJV6Qdu7j/Wsn69OjFEuMIVeXf1olv BGGdTwleHgA8ml18xZkoCun3J9NORhaCgdfz979fwSdxBBpGHxDcklWZtQMJxfgl UpD0huZWoD3mjIx557N9Rxh270L7ETQMSLd3B6Bu2qy6Gd9V4Ik0R33nEEiodPfU bxmZ3r/Fzqs8Zzc3V/NrKCgxopf/yLcdXfOJCpNyL9oXaxCH8oQ= =W8Y0 -----END PGP SIGNATURE----- Merge 5.4.285 into android11-5.4-lts Changes in 5.4.285 usbnet: ipheth: fix carrier detection in modes 1 and 4 net: ethernet: use ip_hdrlen() instead of bit shift net: phy: vitesse: repair vsc73xx autonegotiation scripts: kconfig: merge_config: config files: add a trailing newline arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma ice: fix accounting for filters shared by multiple VSIs net/mlx5e: Add missing link modes to ptys2ethtool_map net: ftgmac100: Enable TX interrupt to avoid TX timeout net: dpaa: Pad packets to ETH_ZLEN spi: nxp-fspi: fix the KASAN report out-of-bounds bug soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" selftests: breakpoints: Fix a typo of function name ASoC: allow module autoloading for table db1200_pids ALSA: hda/realtek - Fixed ALC256 headphone no sound ALSA: hda/realtek - FIxed ALC285 headphone no sound pinctrl: at91: make it work with current gpiolib microblaze: don't treat zero reserved memory regions as error net: ftgmac100: Ensure tx descriptor updates are visible wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead ASoC: tda7419: fix module autoloading drm: komeda: Fix an issue related to normalized zpos spi: bcm63xx: Enable module autoloading x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() gpio: prevent potential speculation leaks in gpio_device_get_desc() inet: inet_defrag: prevent sk release while still in use bpf: Fix DEVMAP_HASH overflow check on 32-bit arches USB: serial: pl2303: add device id for Macrosilicon MS3020 USB: usbtmc: prevent kernel-usb-infoleak ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() wifi: ath9k: fix parameter check in ath9k_init_debug() wifi: ath9k: Remove error checks when creating debugfs entries fs: explicitly unregister per-superblock BDIs mount: warn only once about timestamp range expiration fs/namespace: fnic: Switch to use %ptTd mount: handle OOM on mnt_warn_timestamp_expiry can: j1939: use correct function name in comment netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire netfilter: nf_tables: reject element expiration with no timeout netfilter: nf_tables: reject expiration higher than timeout wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors mac80211: parse radiotap header when selecting Tx queue wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param sock_map: Add a cond_resched() in sock_hash_free() can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). Bluetooth: btusb: Fix not handling ZPL/short-transfer net: tipc: avoid possible garbage value block, bfq: fix possible UAF for bfqq->bic with merge chain block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: don't break merge chain in bfq_split_bfqq() spi: ppc4xx: handle irq_of_parse_and_map() errors spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property ARM: versatile: fix OF node leak in CPUs prepare reset: berlin: fix OF node leak in probe() error path clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() hwmon: (max16065) Fix overflows seen when writing limits mtd: slram: insert break after errors in parsing the map hwmon: (ntc_thermistor) fix module autoloading power: supply: axp20x_battery: allow disabling battery charging power: supply: axp20x_battery: Remove design from min and max voltage power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() mtd: powernv: Add check devm_kasprintf() returned value drm/stm: Fix an error handling path in stm_drm_platform_probe() drm/amdgpu: Replace one-element array with flexible-array member drm/amdgpu: properly handle vbios fake edid sizing drm/radeon: Replace one-element array with flexible-array member drm/radeon: properly handle vbios fake edid sizing drm/rockchip: vop: Allow 4096px width scaling drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets jfs: fix out-of-bounds in dbNextAG() and diAlloc() drm/msm: Fix incorrect file name output in adreno_request_fw() drm/msm/a5xx: disable preemption in submits by default drm/msm/a5xx: properly clear preemption records on resume drm/msm/a5xx: fix races in preemption evaluation stage ipmi: docs: don't advertise deprecated sysfs entries drm/msm: fix %s null argument error drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() xen: use correct end address of kernel for conflict checking xen/swiotlb: add alignment check for dma buffers tpm: Clean up TPM space after command failure selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c selftests/bpf: Fix compiling flow_dissector.c with musl-libc selftests/bpf: Fix compiling tcp_rtt.c with musl-libc selftests/bpf: Fix error compiling test_lru_map.c xz: cleanup CRC32 edits from 2018 kthread: add kthread_work tracepoints kthread: fix task state in kthread worker if being frozen jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso ext4: avoid negative min_clusters in find_group_orlov() ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit perf sched timehist: Fix missing free of session in perf_sched__timehist() perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time perf time-utils: Fix 32-bit nsec parsing clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error PCI: keystone: Fix if-statement expression in ks_pcie_quirk() PCI: xilinx-nwl: Fix register misspelling RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency pinctrl: single: fix missing error code in pcs_probe() clk: ti: dra7-atl: Fix leak of of_nodes pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function watchdog: imx_sc_wdt: Don't disable WDT in suspend RDMA/hns: Optimize hem allocation performance riscv: Fix fp alignment bug in perf_callchain_user() RDMA/cxgb4: Added NULL check for lookup_atid ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() nfsd: call cache_put if xdr_reserve_space returns NULL nfsd: return -EINVAL when namelen is 0 f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() f2fs: fix typo f2fs: fix to update i_ctime in __f2fs_setxattr() f2fs: remove unneeded check condition in __f2fs_setxattr() f2fs: reduce expensive checkpoint trigger frequency iio: adc: ad7606: fix oversampling gpio array iio: adc: ad7606: fix standby gpio state to match the documentation coresight: tmc: sg: Do not leak sg_table netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition tcp: check skb is non-NULL in tcp_rto_delta_us() net: qrtr: Update packets cloning when broadcasting netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS crypto: aead,cipher - zeroize key buffer after use Remove *.orig pattern from .gitignore soc: versatile: integrator: fix OF node leak in probe() error path drm/amd/display: Round calculated vtotal USB: appledisplay: close race between probe and completion handler USB: misc: cypress_cy7c63: check for short transfer USB: class: CDC-ACM: fix race between get_serial and set_serial firmware_loader: Block path traversal tty: rp2: Fix reset with non forgiving PCIe host bridges drbd: Fix atomicity violation in drbd_uuid_set_bm() drbd: Add NULL check for net_conf to prevent dereference in state validation ACPI: sysfs: validate return type of _STR method ACPI: resource: Add another DMI match for the TongFang GMxXGxx wifi: rtw88: 8822c: Fix reported RX band width debugobjects: Fix conditions in fill_pool() f2fs: prevent possible int overflow in dir_block_index() f2fs: avoid potential int overflow in sanity_check_area_boundary() hwrng: mtk - Use devm_pm_runtime_enable vfs: fix race between evice_inodes() and find_inode()&iput() fs: Fix file_set_fowner LSM hook inconsistencies nfs: fix memory leak in error path of nfs4_do_reclaim ASoC: meson: axg: extract sound card utils ASoC: meson: axg-card: fix 'use-after-free' PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler soc: versatile: realview: fix memory leak during device remove soc: versatile: realview: fix soc_dev leak during device remove usb: yurex: Replace snprintf() with the safer scnprintf() variant USB: misc: yurex: fix race between read and write pps: remove usage of the deprecated ida_simple_xx() API pps: add an error check in parport_attach mm: only enforce minimum stack gap size if it's sensible i2c: aspeed: Update the stop sw state when the bus recovery occurs i2c: isch: Add missed 'else' usb: yurex: Fix inconsistent locking bug in yurex_read() mailbox: rockchip: fix a typo in module autoloading mailbox: bcm2835: Fix timeout during suspend mode ceph: remove the incorrect Fw reference check when dirtying pages Minor fixes to the CAIF Transport drivers Kconfig file drivers: net: Fix Kconfig indentation, continued ieee802154: Fix build error net/mlx5: Added cond_resched() to crdump collection netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq() netfilter: nf_tables: prevent nf_skb_duplicated corruption Bluetooth: btmrvl_sdio: Refactor irq wakeup Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq() net: ethernet: lantiq_etop: fix memory disclosure net: avoid potential underflow in qdisc_pkt_len_init() with UFO net: add more sanity checks to qdisc_pkt_len_init() ipv4: ip_gre: Fix drops of small packets in ipgre_xmit sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start ALSA: hda/realtek: Fix the push button function for the ALC257 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin f2fs: Require FMODE_WRITE for atomic write ioctls wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node() net: hisilicon: hip04: fix OF node leak in probe() net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() net: hisilicon: hns_mdio: fix OF node leak in probe() ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails ACPICA: Fix memory leak if acpi_ps_get_next_field() fails net: sched: consistently use rcu_replace_pointer() in taprio_change() wifi: rtw88: select WANT_DEV_COREDUMP ACPI: EC: Do not release locks during operation region accesses ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() tipc: guard against string buffer overrun net: mvpp2: Increase size of queue_name buffer ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process ACPICA: iasl: handle empty connection_node proc: add config & param to block forcing mem writes wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() nfp: Use IRQF_NO_AUTOEN flag in request_irq() signal: Replace BUG_ON()s ALSA: asihpi: Fix potential OOB array access ALSA: hdsp: Break infinite MIDI input flush loop x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments() fbdev: pxafb: Fix possible use after free in pxafb_task() power: reset: brcmstb: Do not go into infinite loop if reset fails ata: sata_sil: Rename sil_blacklist to sil_quirks jfs: UBSAN: shift-out-of-bounds in dbFindBits jfs: Fix uaf in dbFreeBits jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uninit-value access of new_ea in ea_buffer drm/amd/display: Check stream before comparing them drm/amd/display: Fix index out of bounds in degamma hardware format translation drm/amd/display: Initialize get_bytes_per_element's default to 1 drm/printer: Allow NULL data in devcoredump printer scsi: aacraid: Rearrange order of struct aac_srb_unit drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() of/irq: Refer to actual buffer size in of_irq_parse_one() ext4: ext4_search_dir should return a proper error ext4: fix i_data_sem unlock order in ext4_ind_migrate() spi: s3c64xx: fix timeout counters in flush_fifo selftests: breakpoints: use remaining time to check if suspend succeed selftests: vDSO: fix vDSO symbols lookup for powerpc64 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume i2c: xiic: Wait for TX empty to avoid missed TX NAKs firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() spi: bcm63xx: Fix module autoloading perf/core: Fix small negative period being ignored parisc: Fix itlb miss handler for 64-bit programs drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS ALSA: core: add isascii() check to card ID generator ext4: no need to continue when the number of entries is 1 ext4: propagate errors from ext4_find_extent() in ext4_insert_range() ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() ext4: aovid use-after-free in ext4_ext_insert_extent() ext4: fix double brelse() the buffer of the extents path ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() parisc: Fix 64-bit userspace syscall path parisc: Fix stack start for ADDR_NO_RANDOMIZE personality of/irq: Support #msi-cells=<0> in of_msi_get_domain drm: omapdrm: Add missing check for alloc_ordered_workqueue jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error mm: krealloc: consider spare memory for __GFP_ZERO ocfs2: fix the la space leak when unmounting an ocfs2 volume ocfs2: fix uninit-value in ocfs2_get_block() ocfs2: reserve space for inline xattr before attaching reflink tree ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2: remove unreasonable unlock in ocfs2_read_blocks ocfs2: fix null-ptr-deref when journal load failed. ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate riscv: define ILLEGAL_POINTER_VALUE for 64bit aoe: fix the potential use-after-free problem in more places clk: rockchip: fix error for unknown clocks media: sun4i_csi: Implement link validate for sun4i_csi subdev media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags media: venus: fix use after free bug in venus_remove due to race condition iio: magnetometer: ak8975: Fix reading for ak099xx sensors tomoyo: fallback to realpath if symlink's pathname does not exist rtc: at91sam9: fix OF node leak in probe() error path Input: adp5589-keys - fix adp5589_gpio_get_value() ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[] ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[] btrfs: fix a NULL pointer dereference when failed to start a new trasacntion btrfs: wait for fixup workers before stopping cleaner kthread during umount gpio: davinci: fix lazy disable i2c: qcom-geni: Let firmware specify irq trigger flags i2c: qcom-geni: Grow a dev pointer to simplify code i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() arm64: Add Cortex-715 CPU part definition arm64: cputype: Add Neoverse-N3 definitions arm64: errata: Expand speculative SSBS workaround once more uprobes: fix kernel info leak via "[uprobes]" vma nfsd: use ktime_get_seconds() for timestamps nfsd: fix delegation_blocked() to block correctly for at least 30 seconds clk: qcom: rpmh: Simplify clk_rpmh_bcm_send_cmd() clk: qcom: clk-rpmh: Fix overflow in BCM vote r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun" r8169: add tally counter fields added with RTL8125 ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook ext4: fix inode tree inconsistency caused by ENOMEM unicode: Don't special case ignorable code points net: ethernet: cortina: Drop TSO support tracing: Remove precision vsnprintf() check from print event drm/crtc: fix uninitialized variable use even harder tracing: Have saved_cmdlines arrays all in one allocation virtio_console: fix misc probe bugs Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal bpf: Check percpu map value size first s390/facility: Disable compile time optimization for decompressor code s390/mm: Add cond_resched() to cmm_alloc/free_pages() ext4: nested locking for xattr inode s390/cpum_sf: Remove WARN_ON_ONCE statements ktest.pl: Avoid false positives with grub2 skip regex clk: bcm: bcm53573: fix OF node leak in init PCI: Add ACS quirk for Qualcomm SA8775P i2c: i801: Use a different adapter-name for IDF adapters PCI: Mark Creative Labs EMU20k2 INTx masking as broken ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() usb: chipidea: udc: enable suspend interrupt after usb reset usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario virtio_pmem: Check device status before requesting flush tools/iio: Add memory allocation failure check for trigger_name driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute fbdev: sisfb: Fix strbuf array overflow RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt ice: fix VLAN replay after reset SUNRPC: Fix integer overflow in decode_rc_list() tcp: fix to allow timestamp undo if no retransmits were sent tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe netfilter: br_netfilter: fix panic with metadata_dst skb Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change gpio: aspeed: Add the flush write to ensure the write complete. gpio: aspeed: Use devm_clk api to manage clock source igb: Do not bring the device up after non-fatal error net/sched: accept TCA_STAB only for root qdisc net: ibm: emac: mal: fix wrong goto net: annotate lockless accesses to sk->sk_ack_backlog net: annotate lockless accesses to sk->sk_max_ack_backlog sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start ppp: fix ppp_async_encode() illegal access slip: make slhc_remember() more robust against malicious packets locking/lockdep: Fix bad recursion pattern locking/lockdep: Rework lockdep_lock locking/lockdep: Avoid potential access of invalid memory in lock_class lockdep: fix deadlock issue between lockdep and rcu resource: fix region_intersects() vs add_memory_driver_managed() CDC-NCM: avoid overflow in sanity checking HID: plantronics: Workaround for an unexcepted opposite volume key Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" usb: dwc3: core: Stop processing of pending events if controller is halted usb: xhci: Fix problem with xhci resume from suspend usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma net: Fix an unsafe loop on the list nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error posix-clock: Fix missing timespec64 check in pc_clock_settime() arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols tracing/kprobes: Fix symbol counting logic by looking at modules as well PCI: Add function 0 DMA alias quirk for Glenfly Arise chip fat: fix uninitialized variable mm/swapfile: skip HugeTLB pages for unuse_vma wifi: mac80211: fix potential key use-after-free KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: s390: Change virtual to physical address access in diag 0x258 handler x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race drm/vmwgfx: Handle surface check failure correctly iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: light: opt3001: add missing full-scale range value iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Bluetooth: Remove debugfs directory on module init failure Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 xhci: Fix incorrect stream context type macro USB: serial: option: add support for Quectel EG916Q-GL USB: serial: option: add Telit FN920C04 MBIM compositions parport: Proper fix for array out-of-bounds access x86/resctrl: Annotate get_mem_config() functions as __init x86/apic: Always explicitly disarm TSC-deadline timer nilfs2: propagate directory read errors from nilfs_find_entry() erofs: fix lz4 inplace decompression mac80211: Fix NULL ptr deref for injected rate info RDMA/bnxt_re: Fix incorrect AVID type in WQE structure ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP ipv4: give an IPv4 dev to blackhole_netdev RDMA/bnxt_re: Return more meaningful error drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation macsec: don't increment counters for an unrelated SA net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: systemport: fix potential memory leak in bcm_sysport_xmit() genetlink: hold RCU in genlmsg_mcast() smb: client: fix OOBs when building SMB2_IOCTL request usb: typec: altmode should keep reference to parent Bluetooth: bnep: fix wild-memory-access in proto_unregister arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64: probes: Fix uprobes for big-endian kernels KVM: s390: gaccess: Refactor gpa and length calculation KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Cleanup access to guest pages KVM: s390: gaccess: Check if guest address is in memslot drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA udf: fix uninit-value use in udf_get_fileshortad jfs: Fix sanity check in dbMount tracing: Consider the NULL character when validating the event length net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() net: usb: usbnet: fix name regression net: sched: fix use-after-free in taprio_change() r8169: avoid unsolicited interrupts posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() ALSA: hda/realtek: Update default depop procedure drm/amd: Guard against bad data for ATIF ACPI method ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue nilfs2: fix kernel bug due to missing clearing of buffer delay flag ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event selinux: improve error checking in sel_write_load() arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning xfrm: validate new SA's prefixlen using SA family when sel.family is unset cgroup: Fix potential overflow issue when checking max_depth wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys mac80211: do drv_reconfig_complete() before restarting all mac80211: Add support to trigger sta disconnect on hardware restart wifi: iwlwifi: mvm: disconnect station vifs if recovery failed wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() ASoC: cs42l51: Fix some error handling paths in cs42l51_probe() dt-bindings: gpu: Convert Samsung Image Rotator to dt-schema gtp: simplify error handling code in 'gtp_encap_enable()' gtp: allow -1 to be specified as file description from userspace net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT bpf: Fix out-of-bounds write in trie_get_next_key() net: support ip generic csum processing in skb_csum_hwoffload_help net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension netfilter: nft_payload: sanitize offset and length before calling skb_checksum() drivers/misc: ti-st: Remove unneeded variable in st_tty_open firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() net: amd: mvme147: Fix probe banner message misc: sgi-gru: Don't disable preemption in GRU driver usbip: tools: Fix detach_port() invalid port error path usb: phy: Fix API devm_usb_put_phy() can not release the phy xhci: Fix Link TRB DMA in command ring stopped completion event Revert "driver core: Fix uevent_show() vs driver detach race" wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower wifi: ath10k: Fix memory leak in management tx wifi: iwlegacy: Clear stale interrupts before resuming device staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() nilfs2: fix potential deadlock with newly created symlinks riscv: Remove unused GENERATING_ASM_OFFSETS ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow nilfs2: fix kernel bug due to missing clearing of checked flag mm: shmem: fix data-race in shmem_getattr() Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device" vt: prevent kernel-infoleak in con_font_get() mac80211: always have ieee80211_sta_restart() mm: krealloc: Fix MTE false alarm in __do_krealloc Linux 5.4.285 Change-Id: Ie1859b6122e2fdacf18a1fe83f792b855fd0e54c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Krzysztof Kozlowski
|
c37bca2ce7 |
soc: versatile: realview: fix soc_dev leak during device remove
[ Upstream commit c774f2564c0086c23f5269fd4691f233756bf075 ]
If device is unbound, the soc_dev should be unregistered to prevent
memory leak.
Fixes:
|
||
|
Krzysztof Kozlowski
|
0f167c1456 |
soc: versatile: realview: fix memory leak during device remove
[ Upstream commit 1c4f26a41f9d052f334f6ae629e01f598ed93508 ] If device is unbound, the memory allocated for soc_dev_attr should be freed to prevent leaks. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/20240825-soc-dev-fixes-v1-2-ff4b35abed83@linaro.org Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Stable-dep-of: c774f2564c00 ("soc: versatile: realview: fix soc_dev leak during device remove") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Krzysztof Kozlowski
|
00ff88849b |
soc: versatile: integrator: fix OF node leak in probe() error path
commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream.
Driver is leaking OF node reference obtained from
of_find_matching_node().
Fixes:
|
||
|
kamasali Satyanarayan
|
222ee0825f |
Merge android11-5.4.281 (d62984a) into msm-5.4
* remotes/origin/tmp-d62984a:
ANDROID: delete tool added by mistake
ANDROID: fix ENOMEM check of binder_proc_ext
ANDROID: binder: fix KMI issues due to frozen notification
BACKPORT: FROMGIT: binder: frozen notification binder_features flag
BACKPORT: FROMGIT: binder: frozen notification
BACKPORT: selftests/binderfs: add test for feature files
UPSTREAM: docs: binderfs: add section about feature files
BACKPORT: binderfs: add support for feature files
FROMLIST: binder: fix memory leaks of spam and pending work
FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn
BACKPORT: binder: tell userspace to dump current backtrace when detected oneway spamming
UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
FROMLIST: binder: fix UAF caused by offsets overwrite
Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"
Linux 5.4.281
tap: add missing verification for short frame
tun: add missing verification for short frame
filelock: Fix fcntl/close race recovery compat path
ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
jfs: don't walk off the end of ealist
ocfs2: add bounds checking to ocfs2_check_dir_entry()
net: relax socket state check at accept time.
drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
ACPI: processor_idle: Fix invalid comparison with insertion sort for latency
ARM: 9324/1: fix get_user() broken with veneer
hfsplus: fix uninit-value in copy_name
selftests/vDSO: fix clang build errors and warnings
spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
fs: better handle deep ancestor chains in is_subdir()
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed
powerpc/eeh: avoid possible crash when edev->pdev changes
powerpc/pseries: Whitelist dtl slub object for copying to userspace
net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()
net: usb: qmi_wwan: add Telit FN912 compositions
ALSA: dmaengine_pcm: terminate dmaengine before synchronize
s390/sclp: Fix sclp_init() cleanup on failure
can: kvaser_usb: fix return value for hif_usb_send_regout
ASoC: ti: omap-hdmi: Fix too long driver name
ASoC: ti: davinci-mcasp: Set min period size using FIFO config
bytcr_rt5640 : inverse jack detect for Archos 101 cesium
Input: elantech - fix touchpad state on resume for Lenovo N24
mips: fix compat_sys_lseek syscall
ALSA: hda/realtek: Add more codec ID to no shutup pins list
KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
mei: demote client disconnect warning on suspend to debug
fs/file: fix the check in find_next_fd()
kconfig: remove wrong expr_trans_bool()
kconfig: gconf: give a proper initial state to the Save button
ila: block BH in ila_output()
Input: silead - Always support 10 fingers
wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata
ACPI: EC: Avoid returning AE_OK on errors in address space handler
ACPI: EC: Abort address space access upon error
scsi: qedf: Set qed_slowpath_params to zero before use
filelock: Remove locks reliably when fcntl/close race is detected
gcc-plugins: Rename last_stmt() for GCC 14+
ANDROID: GKI: refresh ABI to include kimage_vaddr
ANDROID: preserve CRC for struct tcp_sock
Linux 5.4.280
i2c: rcar: bring hardware to known state when probing
nilfs2: fix kernel bug on rename operation of broken directory
tcp: avoid too many retransmit packets
tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
net: tcp: fix unexcepted socket die when snd_wnd is 0
tcp: refactor tcp_retransmit_timer()
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
libceph: fix race between delayed_work() and ceph_monc_stop()
ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
nvmem: meson-efuse: Fix return value of nvmem callbacks
hpet: Support 32-bit userspace
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
USB: serial: option: add Rolling RW350-GL variants
USB: serial: option: add Netprisma LCUK54 series modules
USB: serial: option: add support for Foxconn T99W651
USB: serial: option: add Fibocom FM350-GL
USB: serial: option: add Telit FN912 rmnet compositions
USB: serial: option: add Telit generic core-dump composition
octeontx2-af: fix detection of IP layer
ARM: davinci: Convert comma to semicolon
s390: Mark psw in __load_psw_mask() as __unitialized
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
ppp: reject claimed-as-LCP but actually malformed packets
net: ethernet: lantiq_etop: fix double free in detach
net: lantiq_etop: add blank line after declaration
octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability()
tcp: fix incorrect undo caused by DSACK of TLP retransmit
tcp: add TCP_INFO status for failed client TFO
vfs: don't mod negative dentry count when on shrinker list
fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
filelock: fix potential use-after-free in posix_lock_inode
nilfs2: fix incorrect inode allocation from reserved inodes
nvme-multipath: find NUMA path only for online numa-node
ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
media: dw2102: fix a potential buffer overflow
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
drm/amdgpu/atomfirmware: silence UBSAN warning
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
fsnotify: Do not generate events for O_PATH file descriptors
can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
mm: optimize the redundant loop of mm_update_owner_next()
nilfs2: add missing check for inode numbers on directory entries
nilfs2: fix inode number range checks
inet_diag: Initialize pad field in struct inet_diag_req_v2
selftests: make order checking verbose in msg_zerocopy selftest
selftests: fix OOM in msg_zerocopy selftest
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
wifi: wilc1000: fix ies_len type in connect path
tcp_metrics: validate source addr length
UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
net: tcp better handling of reordering then loss cases
tcp: add ece_ack flag to reno sack functions
tcp: tcp_mark_head_lost is only valid for sack-tcp
s390/pkey: Wipe sensitive data on failure
jffs2: Fix potential illegal address access in jffs2_free_inode
powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
orangefs: fix out-of-bounds fsid access
powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
i2c: i801: Annotate apanel_addr as __ro_after_init
media: dvb-frontends: tda10048: Fix integer overflow
media: s2255: Use refcount_t instead of atomic_t for num_channels
media: dvb-frontends: tda18271c2dd: Remove casting during div
net: dsa: mv88e6xxx: Correct check for empty list
Input: ff-core - prefer struct_size over open coded arithmetic
firmware: dmi: Stop decoding on broken entry
sctp: prefer struct_size over open coded arithmetic
media: dw2102: Don't translate i2c read into write
drm/amd/display: Skip finding free audio for unknown engine_id
drm/amdgpu: Initialize timestamp for some legacy SOCs
scsi: qedf: Make qedf_execute_tmf() non-preemptible
IB/core: Implement a limit on UMAD receive List
media: dvb-usb: dib0700_devices: Add missing release_firmware()
media: dvb: as102-fe: Fix as10x_register_addr packing
drm/lima: fix shared irq handling on driver remove
Compiler Attributes: Add __uninitialized macro
Linux 5.4.279
arm64: dts: rockchip: Add sound-dai-cells for RK3368
ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
tcp: Fix data races around icsk->icsk_af_ops.
ipv6: Fix data races around sk->sk_prot.
ipv6: annotate some data-races around sk->sk_prot
nfs: Leave pages in the pagecache if readpage failed
pwm: stm32: Refuse too small period requests
mtd: spinand: macronix: Add support for serial NAND flash
ftruncate: pass a signed offset
ata: libata-core: Fix double free on error
batman-adv: Don't accept TT entries for out-of-spec VIDs
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
hexagon: fix fadvise64_64 calling conventions
csky, hexagon: fix broken sys_sync_file_range
net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
net: can: j1939: recover socket queue on CAN bus error during BAM transmission
net: can: j1939: Initialize unused data in j1939_send_one()
tty: mcf: MCF54418 has 10 UARTS
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
usb: musb: da8xx: fix a resource leak in probe()
usb: gadget: printer: SS+ support
net: usb: ax88179_178a: improve link status logs
iio: chemical: bme680: Fix sensor data read operation
iio: chemical: bme680: Fix overflows in compensate() functions
iio: chemical: bme680: Fix calibration data variable
iio: chemical: bme680: Fix pressure value output
iio: adc: ad7266: Fix variable checking bug
mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
mmc: sdhci: Do not invert write-protect twice
mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
x86: stop playing stack games in profile_pc()
gpio: davinci: Validate the obtained number of IRQs
nvme: fixup comment for nvme RDMA Provider Type
soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
media: dvbdev: Initialize sbuf
ALSA: emux: improve patch ioctl data validation
net/dpaa2: Avoid explicit cpumask var allocation on stack
net/iucv: Avoid explicit cpumask var allocation on stack
mtd: partitions: redboot: Added conversion of operands to a larger type
drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
parisc: use correct compat recv/recvfrom syscalls
sparc: fix old compat_sys_select()
net: phy: micrel: add Microchip KSZ 9477 to the device table
net: phy: mchp: Add support for LAN8814 QUAD PHY
net: dsa: microchip: fix initial port flush problem
ASoC: fsl-asoc-card: set priv->pdev before using it
netfilter: nf_tables: validate family when identifying table via handle
drm/amdgpu: fix UBSAN warning in kv_dpm.c
pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
iio: dac: ad5592r: fix temperature channel scaling value
iio: dac: ad5592r: un-indent code-block for scale read
iio: dac: ad5592r-base: Replace indio_dev->mlock with own device lock
x86/amd_nb: Check for invalid SMN reads
PCI: Add PCI_ERROR_RESPONSE and related definitions
perf/core: Fix missing wakeup when waiting for context reference
kheaders: explicitly define file modes for archived headers
Revert "kheaders: substituting --sort in archive creation"
tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
arm64: dts: qcom: qcs404: fix bluetooth device address
ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
i2c: ocores: set IACK bit after core is enabled
gcov: add support for GCC 14
drm/radeon: fix UBSAN warning in kv_dpm.c
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
dmaengine: ioatdma: Fix missing kmem_cache_destroy()
regulator: core: Fix modpost error "regulator_get_regmap" undefined
net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
netfilter: ipset: Fix suspicious rcu_dereference_protected()
virtio_net: checksum offloading handling fix
net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
net/sched: act_api: rely on rcu in tcf_idr_check_alloc
netns: Make get_net_ns() handle zero refcount net
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
ipv6: prevent possible NULL dereference in rt6_probe()
ipv6: prevent possible NULL deref in fib6_nh_init()
netrom: Fix a memory leak in nr_heartbeat_expiry()
cipso: fix total option length computation
mips: bmips: BCM6358: make sure CBR is correctly set
MIPS: Routerboard 532: Fix vendor retry check code
MIPS: Octeon: Add PCIe link status check
PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
udf: udftime: prevent overflow in udf_disk_stamp_to_time()
usb: misc: uss720: check for incompatible versions of the Belkin F5U002
powerpc/io: Avoid clang null pointer arithmetic warnings
powerpc/pseries: Enforce hcall result buffer validity and size
Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
scsi: qedi: Fix crash while reading debugfs attribute
drop_monitor: replace spin_lock by raw_spin_lock
batman-adv: bypass empty buckets in batadv_purge_orig_ref()
selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
i2c: at91: Fix the functionality flags of the slave-only interface
usb-storage: alauda: Check whether the media is initialized
greybus: Fix use-after-free bug in gb_interface_release due to race condition.
netfilter: nftables: exthdr: fix 4-byte stack OOB write
hugetlb_encode.h: fix undefined behaviour (34 << 26)
hv_utils: drain the timesync packets on onchannelcallback
tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device()
nilfs2: fix potential kernel bug due to lack of writeback flag waiting
intel_th: pci: Add Lunar Lake support
intel_th: pci: Add Meteor Lake-S support
intel_th: pci: Add Sapphire Rapids SOC support
intel_th: pci: Add Granite Rapids SOC support
intel_th: pci: Add Granite Rapids support
dmaengine: axi-dmac: fix possible race in remove()
PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
ocfs2: fix races between hole punching and AIO+DIO
ocfs2: use coarse time for new created files
fs/proc: fix softlockup in __read_vmcore
vmci: prevent speculation leaks by sanitizing event in event_deliver()
tracing/selftests: Fix kprobe event name test for .isra. functions
drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
drm/exynos/vidi: fix memory leak in .get_modes()
drivers: core: synchronize really_probe() and dev_uevent()
ionic: fix use after netif_napi_del()
net/ipv6: Fix the RT cache flush via sysctl using a previous delay
netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets
tcp: fix race in tcp_v6_syn_recv_sock()
drm/bridge/panel: Fix runtime warning on panel bridge release
drm/komeda: check for error-valued pointer
liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
iommu: Return right value in iommu_sva_bind_device()
iommu/amd: Fix sysfs leak in iommu init
HID: core: remove unnecessary WARN_ON() in implement()
gpio: tqmx86: fix typo in Kconfig label
SUNRPC: return proper error from gss_wrap_req_priv
Input: try trimming too long modalias strings
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
xhci: Apply broken streams quirk to Etron EJ188 xHCI host
xhci: Apply reset resume quirk to Etron EJ188 xHCI host
xhci: Set correct transferred length for cancelled bulk transfers
jfs: xattr: fix buffer overflow for invalid xattr
mei: me: release irq in mei_me_pci_resume error path
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
nilfs2: return the mapped address from nilfs_get_page()
nilfs2: Remove check for PageError
selftests/mm: compaction_test: fix bogus test success on Aarch64
selftests/mm: conform test to TAP format output
selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
drm/amd/display: Handle Y carry-over in VCP X.Y calculation
ASoC: ti: davinci-mcasp: Fix race condition during probe
ASoC: ti: davinci-mcasp: Handle missing required DT properties
ASoC: ti: davinci-mcasp: Simplify the configuration parameter handling
ASoC: ti: davinci-mcasp: Remove legacy dma_request parsing
ASoC: ti: davinci-mcasp: Use platform_get_irq_byname_optional
ASoC: ti: davinci-mcasp: remove always zero of davinci_mcasp_get_dt_params
ASoC: ti: davinci-mcasp: remove redundant assignment to variable ret
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
ipv6: fix possible race in __fib6_drop_pcpu_from()
af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll().
af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
ptp: Fix error message on failed pin verification
net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
net/mlx5: Stop waiting for PCI if pci channel is offline
tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
vxlan: Fix regression when dropping packets due to invalid src addresses
net: sched: sch_multiq: fix possible OOB write in multiq_tune()
ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
wifi: cfg80211: pmsr: use correct nla_get_uX functions
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
Conflicts:
kernel/gen_kheaders.sh
Change-Id: I4a0de5504b5e61a23b78a1a8f06aceaac810f3c7
Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
|
||
Divisha Bisht
|
a4b6b7079b |
smcinvoke: Rename size_add to smci_size_add
Rename size_add api of smcivoke driver to smci_size_add, as smcinvoke's size_add is giving redefinition error with the size_add api recently added in upstream patch 'overflow: Implement size_t saturating arithmetic helpers'. cherry-pick hash 4dab23059f51e324451b8fe02debc3df8812afd8. Change-Id: I864c3065e63f53a3f4473edc24dc96d067dbfe60 Signed-off-by: Divisha Bisht <quic_divibish@quicinc.com> |
||
|
Michael Bestas
|
a421f676d6 |
Merge tag 'ASB-2024-10-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2024-10-01 * tag 'ASB-2024-10-05_11-5.4' of https://android.googlesource.com/kernel/common: (397 commits) Linux 5.4.283 scsi: aacraid: Fix double-free on probe failure net: dsa: mv8e6xxx: Fix stub function parameters usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() usb: dwc3: st: add missing depopulate in probe error path usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: omap: add missing depopulate in probe error path USB: serial: option: add MeiG Smart SRM825L cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller soc: qcom: cmd-db: Map shared memory as WC, not WB nfc: pn533: Add poll mod list filling check nfc: pn533: Add autopoll capability nfc: pn533: Add dev_up/dev_down hooks to phy_ops net: busy-poll: use ktime_get_ns() instead of local_clock() gtp: fix a potential NULL pointer dereference ethtool: check device is present when getting link settings r8152: Factor out OOB link list waits soundwire: stream: fix programming slave ports for non-continous port maps net:rds: Fix possible deadlock in rds_message_put ... Change-Id: Ia6559a770f5db990f2bf6e5a034c63e3d7df4510 |
||
|
Michael Bestas
|
defbd8dccd |
Merge tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina
"LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0" * tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4: msm-5.4.c3: qseecom: Fix possible race condition msm: adsprpc: Avoid taking reference for group_info adsprpc: Handle UAF scenario in put_args msm-5.4.c3: qseecom: Fix possible race condition USB: storage: Replace the sprintf with scnprintf adsprpc: Handle UAF scenario in put_args msm: adsprpc: Avoid taking reference for group_info usb: gadget: f_gsi: bail out if opts is null msm: ep_pcie: Avoid setting host wake pending flag for D0 msm: ep_pcie: Prevent repetitive wake operation if wake is in process msm_ipa: Install exception rule for PPPoE-MPLS securemsm-kernel: Decrement the server object ref count in mutex context qcedev: fix UAF in qcedev_smmu thermal: qcom: Add support to update tsens trip based on nvmem data msm: eva: Fix UAF issue when remove module msm: cvp: OOB write fix due to integer underflow msm: ep_pcie: Avoid writing req_L1_exit during dstate change msm: eva: Adding kref count for cvp_get_inst_from_id Change-Id: I3dad70dec062688b50554d7676a4b85bcb42fad9 |
||
|
Greg Kroah-Hartman
|
ac0b99d778 |
This is the 5.4.283 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmbYQYIACgkQONu9yGCS aT5Yvg//a5nvSr37zxUnJ8Km+d2X4RysNh+853C/ydDj3Vr/zy/RrLPq2XQ9Cvfl 0zW6VLkrC+g8tQFBdJKYZH/EFRTriKNhMnjudgoanLCm8KaA7UbR/Zp9h9L9Czzi G1aUvS/+ZBe83BLCQQul8sonlVE8AtfjwVjEkj6rXJZMn3URh278i84CuosZRg5R Ao45mn8Gv+gxCrUtLU6Qy5gHKFJ2zGXyYP4Mn1UyUkLkgnUm7E1ZFelyrOxryILP mEcs700qT5BIlbodKdNQDP/ezbrLbljKliVS/z1YLZLfVI5v6OTGzMc81GPILHXj 1pK+DwQIZnFB/1E+AyER+i7n1i7id2lIRxmaJ4+TSxoNUKBP0+KuuZSFsAsDSXbS NXnGpPC5wJQcyf+DD7l9+XbdViCoDfTXMlIBMpmAdBhvsPfhAhtsgJV/DPiir6V7 JszP1AZlhwvvb4FOyr8AJ6jmFxDBfM3HniWDEn/zN/1GBMebwghchLP4CFflV6aN 1BqTONiWHvtqRm6nvBJVBV2frWzm4TmKr/RdlMGPTBr60GJqV/qwO5m7a7c+OBnF WscJ2wht2P2RgWOhnaS4NQF+IIbRaQm9AisvQCYoZlQIplS9RH61pnutfpYWNUZJ Zd7lIDLbifojX9mGTg1fUcrffHFnewSAag0oEeuMFuZOR6WaQs0= =2It1 -----END PGP SIGNATURE----- Merge 5.4.283 into android11-5.4-lts Changes in 5.4.283 fuse: Initialize beyond-EOF page contents before setting uptodate ALSA: usb-audio: Support Yamaha P-125 quirk entry xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration s390/dasd: fix error recovery leading to data corruption on ESE devices arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE dm resume: don't return EINVAL when signalled dm persistent data: fix memory allocation failure vfs: Don't evict inode under the inode lru traversing context bitmap: introduce generic optimized bitmap_size() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE selinux: fix potential counting error in avc_add_xperms_decision() drm/amdgpu: Actually check flags for all context ops. memcg_write_event_control(): fix a user-triggerable oops overflow.h: Add flex_array_size() helper overflow: Implement size_t saturating arithmetic helpers s390/cio: rename bitmap_size() -> idset_bitmap_size() btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() s390/uv: Panic for set and remove shared access UVC errors net/mlx5e: Correctly report errors for ethtool rx flows atm: idt77252: prevent use after free in dequeue_rx() net: axienet: Fix DMA descriptor cleanup path net: axienet: Improve DMA error handling net: axienet: Factor out TX descriptor chain cleanup net: axienet: Check for DMA mapping errors net: axienet: Drop MDIO interrupt registers from ethtools dump net: axienet: Wrap DMA pointer writes to prepare for 64 bit net: axienet: Upgrade descriptors to hold 64-bit addresses net: axienet: Autodetect 64-bit DMA capability net: axienet: Fix register defines comment description net: dsa: vsc73xx: pass value in phy_write operation net: hns3: fix a deadlock problem when config TC during resetting ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 ssb: Fix division by zero issue in ssb_calc_clock_rate wifi: cw1200: Avoid processing an invalid TIM IE i2c: riic: avoid potential division by zero media: radio-isa: use dev_name to fill in bus_info staging: ks7010: disable bh on tx_dev_lock binfmt_misc: cleanup on filesystem umount scsi: spi: Fix sshdr use gfs2: setattr_chown: Add missing initialization wifi: iwlwifi: abort scan when rfkill on but device enabled IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu nvmet-trace: avoid dereferencing pointer too early ext4: do not trim the group with corrupted block bitmap quota: Remove BUG_ON from dqget() media: pci: cx23885: check cx23885_vdev_init() return fs: binfmt_elf_efpic: don't use missing interpreter's properties scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() net/sun3_82586: Avoid reading past buffer in debug output drm/lima: set gp bus_stop bit before hard reset virtiofs: forbid newlines in tags md: clean up invalid BUG_ON in md_ioctl x86: Increase brk randomness entropy for 64-bit systems parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 powerpc/boot: Handle allocation failure in simple_realloc() powerpc/boot: Only free if realloc() succeeds btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() f2fs: fix to do sanity check in update_sit_entry usb: gadget: fsl: Increase size of name buffer for endpoints nvme: clear caller pointer on identify failure Bluetooth: bnep: Fix out-of-bound access nvmet-tcp: do not continue for invalid icreq NFS: avoid infinite loop in pnfs_update_layout. openrisc: Call setup_memory() earlier in the init sequence s390/iucv: fix receive buffer virtual vs physical address confusion usb: dwc3: core: Skip setting event buffers for host only controllers irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc ext4: set the type of max_zeroout to unsigned int to avoid overflow nvmet-rdma: fix possible bad dereference when freeing rsps hrtimer: Prevent queuing of hrtimer without a function callback gtp: pull network headers in gtp_dev_xmit() block: use "unsigned long" for blk_validate_block_size(). media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) dm mpath: pass IO start time to path selector dm: do not use waitqueue for request-based DM dm suspend: return -ERESTARTSYS instead of -EINTR Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation tc-testing: don't access non-existent variable on exception kcm: Serialise kcm_sendmsg() for the same socket. netfilter: nft_counter: Synchronize nft_counter_reset() against reader. net: dsa: mv88e6xxx: global2: Expose ATU stats register net: dsa: mv88e6xxx: global1_atu: Add helper for get next net: dsa: mv88e6xxx: read FID when handling ATU violations net: dsa: mv88e6xxx: replace ATU violation prints with trace points net: dsa: mv88e6xxx: Fix out-of-bound access netem: fix return value if duplicate enqueue fails ipv6: prevent UAF in ip6_send_skb() net: xilinx: axienet: Always disable promiscuous mode net: xilinx: axienet: Fix dangling multicast addresses drm/msm: use drm_debug_enabled() to check for debug categories drm/msm/dpu: don't play tricks with debug macros mmc: mmc_test: Fix NULL dereference on allocation failure Bluetooth: MGMT: Add error handling to pair_device() HID: wacom: Defer calculation of resolution until resolution_code is known HID: microsoft: Add rumble support to latest xbox controllers cxgb4: add forgotten u64 ivlan cast before shift mmc: dw_mmc: allow biu and ciu clocks to defer ALSA: timer: Relax start tick time check for slave timer elements Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Input: MT - limit max slots tools: move alignment-related macros to new <linux/align.h> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc pinctrl: single: fix potential NULL dereference in pcs_get_function() wifi: mwifiex: duplicate static structs used in driver instances ipc: replace costly bailout check in sysvipc_find_ipc() drm/amdkfd: don't allow mapping the MMIO HDP page with large pages filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 media: uvcvideo: Fix integer overflow calculating timestamp ata: libata-core: Fix null pointer dereference on error cgroup/cpuset: Prevent UAF in proc_cpuset_show() net:rds: Fix possible deadlock in rds_message_put soundwire: stream: fix programming slave ports for non-continous port maps r8152: Factor out OOB link list waits ethtool: check device is present when getting link settings gtp: fix a potential NULL pointer dereference net: busy-poll: use ktime_get_ns() instead of local_clock() nfc: pn533: Add dev_up/dev_down hooks to phy_ops nfc: pn533: Add autopoll capability nfc: pn533: Add poll mod list filling check soc: qcom: cmd-db: Map shared memory as WC, not WB cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller USB: serial: option: add MeiG Smart SRM825L usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: st: add missing depopulate in probe error path usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() net: dsa: mv8e6xxx: Fix stub function parameters scsi: aacraid: Fix double-free on probe failure Linux 5.4.283 Change-Id: I78f8124947acd3af2d3059f4be29388e41e6950f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |