With psy initialized in battery_chg_init_psy(), read_property_id()
when called from battery_chg_parse_dt() can try accessing
psy->desc->name when dynamic debugging is enabled. Fix it.
Change-Id: I88114ea9779d5113524b8b15659bf8bafe6364ed
Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
Update DRV support flag in the feature list of host cap so that
the firmware is aware of the DRV feature support on the host.
Change-Id: I6effd21293da80e023076469f7a42f5bf0018830
Signed-off-by: Mohammed Siddiq <msiddiq@codeaurora.org>
A check is introduced to restrict the double call of
hyp_assign_phys for the same address.
Change-Id: I0ac984af9fe456d317c7c2d99d6d1290f86830e8
Acked-by: Ansa Ahmed <ansaahme@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Update header to fix struct re-definition errors
by including host time header instead of uapi
specific time header file.
Change-Id: I67b52ba2928480c24abbdf7a2d246635fedfaafd
Signed-off-by: Saurav Kumar <quic_sauravk@quicinc.com>
Define the MAC_PUSH action which pushes an MPLS LSE before the mac
header (instead of between the mac and the network headers as the
plain PUSH action does).
The only special case is when the skb has an offloaded VLAN. In that
case, it has to be inlined before pushing the MPLS header.
Change-Id: Iea0792dac8682bccc4a6a506244c81ed799f779f
Signed-off-by: Guillaume Nault gnault@redhat.com
Signed-off-by: David S. Miller davem@davemloft.net
Git-commit: a45294af9e96a3e060b6272fa7cd2c4b196de335
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[quic_jguidry@quicinc.com: Enabled net/sched filtering and classification in
sdxlemur.config]
Signed-off-by: James Wyatt Guidry <quic_jguidry@quicinc.com>
Add support to send pipe info based on the tethering protocal.
Change-Id: I8d27461b4b64e1651f3f74188197156fde282d7e
Signed-off-by: Vinayaka B M <quic_vinaybm@quicinc.com>
* refs/heads/tmp-3970bc6:
UPSTREAM: Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls
ANDROID: abi_gki_aarch64_qcom: Add vmemdup_user to qcom symbol list
ANDROID: GKI: update Sony KMI symbol list
UPSTREAM: mm: fix misplaced unlock_page in do_wp_page()
BACKPORT: mm: do_wp_page() simplification
UPSTREAM: mm/ksm: Remove reuse_ksm_page()
BACKPORT: ALSA: pcm: Fix races among concurrent prealloc proc writes
BACKPORT: ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
BACKPORT: ALSA: pcm: Fix races among concurrent read/write and buffer changes
ANDROID: Fix up abi issue with struct snd_pcm_runtime
BACKPORT: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
BACKPORT: nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
Linux 5.4.197
bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
NFSD: Fix possible sleep during nfsd4_release_lockowner()
NFS: Memory allocation failures are not server fatal errors
docs: submitting-patches: Fix crossref to 'The canonical patch format'
tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
tpm: Fix buffer access in tpm2_get_tpm_pt()
HID: multitouch: Add support for Google Whiskers Touchpad
raid5: introduce MD_BROKEN
dm verity: set DM_TARGET_IMMUTABLE feature flag
dm stats: add cond_resched when looping over entries
dm crypt: make printing of the key constant-time
dm integrity: fix error code in dm_integrity_ctr()
zsmalloc: fix races between asynchronous zspage free and page migration
crypto: ecrdsa - Fix incorrect use of vli_cmp
netfilter: conntrack: re-fetch conntrack after insertion
exec: Force single empty string when argv is empty
drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
cfg80211: set custom regdomain after wiphy registration
assoc_array: Fix BUG_ON during garbage collect
drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
net: ftgmac100: Disable hardware checksum on AST2600
net: af_key: check encryption module availability consistency
pinctrl: sunxi: fix f1c100s uart2 function
ACPI: sysfs: Fix BERT error region memory mapping
ACPI: sysfs: Make sparse happy about address space in use
media: vim2m: initialize the media device earlier
media: vim2m: Register video device after setting up internals
secure_seq: use the 64 bits of the siphash for port offset calculation
tcp: change source port randomizarion at connect() time
Input: goodix - fix spurious key release events
staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
lockdown: also lock down previous kgdb use
Linux 5.4.196
afs: Fix afs_getattr() to refetch file status if callback break occurred
i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe()
x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
x86/xen: fix booting 32-bit pv guest
Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
firmware_loader: use kernel credentials when reading firmware
net: stmmac: disable Split Header (SPH) for Intel platforms
block: return ELEVATOR_DISCARD_MERGE if possible
Input: ili210x - fix reset timing
net: atlantic: verify hw_head_ lies within TX buffer ring
net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
selftests: add ping test with ping_group_range tuned
mac80211: fix rx reordering with non explicit / psmp ack policy
scsi: qla2xxx: Fix missed DMA unmap for aborted commands
perf bench numa: Address compiler error on s390
gpio: mvebu/pwm: Refuse requests with inverted polarity
gpio: gpio-vf610: do not touch other bits when set the target bit
net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
igb: skip phy status check where unavailable
ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
ARM: 9196/1: spectre-bhb: enable for Cortex-A15
net: af_key: add check for pfkey_broadcast in function pfkey_process
net/mlx5e: Properly block LRO when XDP is enabled
NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
net/qla3xxx: Fix a test in ql_reset_work()
clk: at91: generated: consider range when calculating best rate
ice: fix possible under reporting of ethtool Tx and Rx statistics
net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
net/sched: act_pedit: sanitize shift argument before usage
net: macb: Increment rx bd head after allocating skb and buffer
ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
KVM: x86/mmu: Update number of zapped pages even if page list is stable
PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
Fix double fget() in vhost_net_set_backend()
perf: Fix sys_perf_event_open() race against self
ALSA: wavefront: Proper check of get_user() error
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
SUNRPC: Don't call connect() more than once on a TCP socket
SUNRPC: Prevent immediate close+reconnect
SUNRPC: Clean up scheduling of autoclose
mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
nilfs2: fix lockdep warnings during disk space reclamation
nilfs2: fix lockdep warnings in page operations for btree nodes
ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
platform/chrome: cros_ec_debugfs: detach log reader wq from devm
drbd: remove usage of list iterator variable after loop
MIPS: lantiq: check the return value of kzalloc()
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
nvme-multipath: fix hang when disk goes live over reconnect
ALSA: hda/realtek: Enable headset mic on Lenovo P360
crypto: x86/chacha20 - Avoid spurious jumps to other functions
crypto: stm32 - fix reference leak in stm32_crc_remove
Input: stmfts - fix reference leak in stmfts_input_open
Input: add bounds checking to input_set_capability()
um: Cleanup syscall_handler_t definition/cast, fix warning
rtc: fix use-after-free on device removal
x86/xen: Make the secondary CPU idle tasks reliable
x86/xen: Make the boot CPU idle task reliable
floppy: use a statically allocated error counter
ANDROID: fix up abi issue with struct snd_pcm_runtime
Linux 5.4.195
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
ping: fix address binding wrt vrf
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
net: phy: Fix race condition on link status change
MIPS: fix build with gcc-12
drm/vmwgfx: Initialize drm_mode_fb_cmd2
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
i40e: i40e_main: fix a missing check on list iterator
drm/nouveau/tegra: Stop using iommu_present()
serial: 8250_mtk: Fix register address for XON/XOFF character
serial: 8250_mtk: Fix UART_EFR register address
slimbus: qcom: Fix IRQ check in qcom_slim_probe
USB: serial: option: add Fibocom MA510 modem
USB: serial: option: add Fibocom L610 modem
USB: serial: qcserial: add support for Sierra Wireless EM7590
USB: serial: pl2303: add device id for HP LM930 Display
usb: typec: tcpci: Don't skip cleanup in .remove() on error
usb: cdc-wdm: fix reading stuck on device close
tty: n_gsm: fix mux activation issues in gsm_config()
tcp: resalt the secret every 10 seconds
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
s390: disable -Warray-bounds
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
ASoC: max98090: Generate notifications on changes for custom control
ASoC: max98090: Reject invalid values in custom control put()
hwmon: (f71882fg) Fix negative temperature
gfs2: Fix filesystem block deallocation for short writes
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
net/sched: act_pedit: really ensure the skb is writable
s390/lcs: fix variable dereferenced before check
s390/ctcm: fix potential memory leak
s390/ctcm: fix variable dereferenced before check
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
dim: initialize all struct fields
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
netlink: do not reset transport header in netlink_recvmsg()
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
ipv4: drop dst in multicast routing path
net: Fix features skip in for_each_netdev_feature()
mac80211: Reset MBSSID parameters upon connection
hwmon: (tmp401) Add OF device ID table
batman-adv: Don't skb_split skbuffs with frag_list
Linux 5.4.194
mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
mm: fix missing cache flush for all tail pages of compound page
Bluetooth: Fix the creation of hdev->name
KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
x86: kprobes: Prohibit probing on instruction which has emulate prefix
x86: xen: insn: Decode Xen and KVM emulate-prefix signature
x86: xen: kvm: Gather the definition of emulate prefixes
x86/asm: Allow to pass macros to __ASM_FORM()
KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
can: grcan: only use the NAPI poll budget for RX
can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
nfp: bpf: silence bitwise vs. logical OR warning
drm/i915: Cast remain to unsigned long in eb_relocate_vma
drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version, environment} types
block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
MIPS: Use address-of operator on section symbols
ANDROID: GKI: update the abi .xml file
Revert "tcp: ensure to use the most recently sent skb when filling the rate sample"
Linux 5.4.193
mmc: rtsx: add 74 Clocks in power on flow
PCI: aardvark: Fix reading MSI interrupt number
PCI: aardvark: Clear all MSIs at setup
dm: interlock pending dm_io and dm_wait_for_bios_completion
dm: fix mempool NULL pointer race when completing IO
tcp: make sure treq->af_specific is initialized
ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
ALSA: pcm: Fix races among concurrent prealloc proc writes
ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
ALSA: pcm: Fix races among concurrent read/write and buffer changes
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
mm: fix unexpected zeroed page mapping with zram swap
block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
net: ipv6: ensure we call ipv6_mc_down() at most once
KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
NFSv4: Don't invalidate inode attributes on delegation return
drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
btrfs: always log symlinks in full mode
smsc911x: allow using IRQ0
bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
net: emaclite: Add error handling for of_address_to_resource()
net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
RDMA/siw: Fix a condition race issue in MPA request processing
ASoC: dmaengine: Restore NULL prepare_slave_config() callback
hwmon: (adt7470) Fix warning on module removal
NFC: netlink: fix sleep in atomic bug when firmware download timeout
nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
nfc: replace improper check device_is_registered() in netlink related functions
can: grcan: use ofdev->dev when allocating DMA memory
can: grcan: grcan_close(): fix deadlock
s390/dasd: Fix read inconsistency for ESE DASD devices
s390/dasd: Fix read for ESE with blksize < 4k
s390/dasd: prevent double format of tracks for ESE devices
s390/dasd: fix data corruption for ESE devices
ASoC: meson: Fix event generation for G12A tohdmi mux
ASoC: wm8958: Fix change notifications for DSP controls
ASoC: da7219: Fix change notifications for tone generator frequency
genirq: Synchronize interrupt thread startup
ACPICA: Always create namespace nodes using acpi_ns_create_node()
firewire: core: extend card->lock in fw_core_handle_bus_reset
firewire: remove check of list iterator against head past the loop body
firewire: fix potential uaf in outbound_phy_packet_callback()
Revert "SUNRPC: attempt AF_LOCAL connect on setup"
gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
parisc: Merge model and model name into one line in /proc/cpuinfo
MIPS: Fix CP0 counter erratum detection for R4k CPUs
Linux 5.4.192
mm, hugetlb: allow for "high" userspace addresses
hugetlbfs: get unmapped area below TASK_UNMAPPED_BASE for hugetlbfs
tty: n_gsm: fix incorrect UA handling
tty: n_gsm: fix wrong command frame length field encoding
tty: n_gsm: fix wrong command retry handling
tty: n_gsm: fix missing explicit ldisc flush
tty: n_gsm: fix insufficient txframe size
netfilter: nft_socket: only do sk lookups when indev is available
tty: n_gsm: fix malformed counter for out of frame data
tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
x86/cpu: Load microcode during restore_processor_state()
net: ethernet: stmmac: fix write to sgmii_adapter_base
drivers: net: hippi: Fix deadlock in rr_close()
cifs: destage any unwritten data to the server before calling copychunk_write
x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
ASoC: wm8731: Disable the regulator when probing fails
tcp: fix F-RTO may not work correctly when receiving DSACK
ixgbe: ensure IPsec VF<->PF compatibility
bnx2x: fix napi API usage sequence
tls: Skip tls_append_frag on zero copy size
drm/amd/display: Fix memory leak in dcn21_clock_source_create
net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
net: bcmgenet: hide status block before TX timestamping
clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
ip_gre: Make o_seqno start from 0 in native mode
net/smc: sync err code when tcp connection was refused
net: hns3: add validity check for message data length
cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
pinctrl: pistachio: fix use of irq_of_parse_and_map()
arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
ARM: dts: imx6ull-colibri: fix vqmmc regulator
sctp: check asoc strreset_chunk in sctp_generate_reconf_event
tcp: ensure to use the most recently sent skb when filling the rate sample
tcp: md5: incorrect tcp_header_len for incoming connections
bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
mtd: rawnand: Fix return value check of wait_for_completion_timeout
ipvs: correctly print the memory size of ip_vs_conn_tab
ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
ARM: dts: am3517-evm: Fix misc pinmuxing
ARM: dts: Fix mmc order for omap3-gta04
phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
phy: samsung: exynos5250-sata: fix missing device put in probe error paths
phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
USB: Fix xhci event ring dequeue pointer ERDP update issue
mtd: rawnand: fix ecc parameters for mt7622
arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
video: fbdev: udlfb: properly check endpoint type
hex2bin: fix access beyond string end
hex2bin: make the function hex_to_bin constant-time
arch_topology: Do not set llc_sibling if llc_id is invalid
serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
serial: 8250: Also set sticky MCR bits in console restoration
serial: imx: fix overrun interrupts in DMA mode
usb: dwc3: gadget: Return proper request status
usb: dwc3: core: Fix tx/rx threshold settings
usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
usb: gadget: uvc: Fix crash when encoding data for usb request
usb: typec: ucsi: Fix role swapping
usb: misc: fix improper handling of refcount in uss720_probe()
iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
iio: dac: ad5446: Fix read_raw not returning set value
iio: dac: ad5592r: Fix the missing return value.
xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
xhci: stop polling roothubs after shutdown
USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
USB: quirks: add STRING quirk for VCOM device
USB: quirks: add a Realtek card reader
usb: mtu3: fix USB 3.0 dual-role-switch from device to host
lightnvm: disable the subsystem
hamradio: remove needs_free_netdev to avoid UAF
hamradio: defer 6pack kfree after unregister_netdev
floppy: disable FDRAWCMD by default
Conflicts:
drivers/usb/dwc3/gadget.c
include/linux/dma-mapping.h
include/linux/stmmac.h
mm/memory.c
Change-Id: I3bf49e11ae4aeaf1db353efbdfee950cd12de8cf
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Implement TCA_VLAN_ACT_POP_ETH and TCA_VLAN_ACT_PUSH_ETH, to
respectively pop and push a base Ethernet header at the beginning of a
frame.
POP_ETH is just a matter of pulling ETH_HLEN bytes. VLAN tags, if any,
must be stripped before calling POP_ETH.
PUSH_ETH is restricted to skbs with no mac_header, and only the MAC
addresses can be configured. The Ethertype is automatically set from
skb->protocol. These restrictions ensure that all skb's fields remain
consistent, so that this action can't confuse other part of the
networking stack (like GSO).
Since openvswitch already had these actions, consolidate the code in
skbuff.c (like for vlan and mpls push/pop).
Change-Id: Ifce1d5fee3eb1741bdc88b22f9000226744cc56c
Signed-off-by: Guillaume Nault gnault@redhat.com
Signed-off-by: David S. Miller davem@davemloft.net
Git-commit: 19fbcb36a39eefbe8912a13ccc02e937b1c418d6
Git-repo: https://android.googlesource.com/kernel/common/
[quic_jguidry@quicinc.com: Added CONFIG_NET_SCHED_ACT_VLAN_QGKI to
sdxlemur.config]
Signed-off-by: James Wyatt Guidry <quic_jguidry@quicinc.com>
Add support for calibrated bat_therm channel which
has more accuracy than default bat_therm channel.
Change-Id: I7516c96aaca90db2dd84ed47364ea8f5d1259360
Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
Add support for calibrated bat_therm channel on charger PMICs
PM8350B and PM7325B, which has more accuracy than default bat_therm
channel.
Change-Id: Id24e187c5a83519f9913457e871429bf729d9213
Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
Add check for channel ID in fastrpc_buf_alloc to
fix out of bounds access.
Change-Id: I92f2717edcc91c19309589ce7c11c91c8129b71a
Signed-off-by: Swathi K <quic_c_kataka@quicinc.com>
Consider a case where dut enters suspend before port_bridge is started.
In that case, ep_queue in start_rx function fails as dut is in suspend
mode. The expectation is that when host resumes the DUT, the request
must be requeued in cser_resume as ep_queue of start_rx which was
called earlier was a failure.
Change-Id: I87015f00267af20450d625e2ea7a19a9de45c79a
Signed-off-by: Rohith Kollalsi <quic_rkollals@quicinc.com>
Device polls for ltssm state by reading PCIE status register as part
of ep_pcie_core_enable_endpoint. If it receives a perst assertion
event during polling, device completes polling and then handles perst
assertion with the existing logic. But polling for ltssm state is not
necessary here as the L0 link state is not possible after perst
assertion. This delays the handling of perst assertion and subsequent
perst deaasertion events.
To avoid this delay, avoiding polling for ltssm state if perst is
asserted. Added check for perst during polling of ltssm state and
breaking the loop if perst is asserted.
Change-Id: I38dc82070749751cfd14661ac95eb95eb8dcb665
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
Validate n_acl_entries specified by the requesting VM.
Limiting n_acl_entries to 1 for now based on the existing check in
mem_buf_alloc().
Change-Id: I802219ada9ee9109d18a42b2a80539d1cbd4df64
Signed-off-by: Vijayanand Jitta <quic_vjitta@quicinc.com>
Add support for dynamic cpu's in cpu voltage cooling driver.
Change-Id: Id8dd7800d230e657c16d853da673cb5e9aaf3ca6
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
When size of user client buffer is smaller than the size of data read,
client calls the mhi_uci_client_read API for the second time with the
remaining bytes of data to be copied. In this, data is already read
from host but copying to client buffer is pending. With the current
logic device waits for read_wq and then eventually exits as there is
no data to read from host. This is causing a delay in the transfer
completion in the case where user client buffer is less than data read
from host.
To avoid this delay, entering the loop to read data from host only if
it is a new transfer. For old transfers, as read from host is already
done, waiting for read_wq is avoided with this change.
Change-Id: I75b6f6e3673cf5c05693579acaddf189b5478926
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
This change adds a NULL pointer check for i2c rx callback function.
In some corner case and rare scenario, it may happen that delayed
callback from GSI for any unexpected sequence can result into accessing
stale message pointer which can be NULL.
Actual root cause should be found but this adds a protection check.
Change-Id: Iab2196812289026674ee3b26d27c4f20a01bbda2
Signed-off-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
Added the support for disabling the PCIe halt write and read feature.
By default PCIe halt write/read feature is enabled and through
device tree flag, PCIe halt Wr/Rd feature can be disabled.
In some targets reported throughput degradation due to PCIe latencies with
PCIe halt write/read feature. So, provided the support to enable and
disable PCIe halt feature.
Change-Id: I83813571bedd0a0399f4ab473e6ddfbb975c8fe4
Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu@quicinc.com>
[ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ]
This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7.
A non-zero return value from pfkey_broadcast() does not necessarily mean
an error occurred as this function returns -ESRCH when no registered
listener received the message. In particular, a call with
BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return
zero so that this commit in fact prevents processing any PF_KEY message.
One visible effect is that racoon daemon fails to find encryption
algorithms like aes and refuses to start.
Excluding -ESRCH return value would fix this but it's not obvious that
we really want to bail out here and most other callers of
pfkey_broadcast() also ignore the return value. Also, as pointed out by
Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code
should use netlink instead so that we should only disturb the code for
really important fixes.
v2: add a comment explaining why is the return value ignored
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7df12bee54)
Bug: 235429059
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ica140cb11cd174eded4121d66de6a7239ee4a21d
This is the merge of the upstream LTS release of 5.4.197 into the
android11-5.4 branch.
It contains the following commits:
9eae8fc396 Merge 5.4.197 into android11-5.4-lts
35c6471fd2 Linux 5.4.197
e00c2f22fb bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes
a2235bc65a NFSD: Fix possible sleep during nfsd4_release_lockowner()
f5b6bc69a7 NFS: Memory allocation failures are not server fatal errors
0490cd2aee docs: submitting-patches: Fix crossref to 'The canonical patch format'
72ef5d01fe tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe()
7ecd237e50 tpm: Fix buffer access in tpm2_get_tpm_pt()
396d1f5176 HID: multitouch: Add support for Google Whiskers Touchpad
25f0e9459f raid5: introduce MD_BROKEN
fd2f7e9984 dm verity: set DM_TARGET_IMMUTABLE feature flag
f005973502 dm stats: add cond_resched when looping over entries
65e6282f0d dm crypt: make printing of the key constant-time
a4415f39e3 dm integrity: fix error code in dm_integrity_ctr()
fc658c0839 zsmalloc: fix races between asynchronous zspage free and page migration
7632451ad9 crypto: ecrdsa - Fix incorrect use of vli_cmp
b16bb37398 netfilter: conntrack: re-fetch conntrack after insertion
1fe82bfd9e exec: Force single empty string when argv is empty
241b566e04 drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency()
3dbab9e37c cfg80211: set custom regdomain after wiphy registration
039fa25d95 assoc_array: Fix BUG_ON during garbage collect
8c668da61b drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers
fdcbdb3d08 i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
827980029d net: ftgmac100: Disable hardware checksum on AST2600
e619506ed0 net: af_key: check encryption module availability consistency
fa77d2a3a7 pinctrl: sunxi: fix f1c100s uart2 function
2208c31d86 ACPI: sysfs: Fix BERT error region memory mapping
92d4b5e148 ACPI: sysfs: Make sparse happy about address space in use
5a73bd4f47 media: vim2m: initialize the media device earlier
b7248281af media: vim2m: Register video device after setting up internals
ab5b00cfe0 secure_seq: use the 64 bits of the siphash for port offset calculation
80cca53a48 tcp: change source port randomizarion at connect() time
9ce35dad5a Input: goodix - fix spurious key release events
bdbc7ef3eb staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
4f07508394 x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
8bb828229d lockdown: also lock down previous kgdb use
0cf7a2be06 Merge 5.4.196 into android11-5.4-lts
04b092e4a0 Linux 5.4.196
dba1941f5b afs: Fix afs_getattr() to refetch file status if callback break occurred
ef5374d532 i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe()
10a221e2d3 x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
a12884ff43 x86/xen: fix booting 32-bit pv guest
b2f140a9f9 Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
060f38b1df ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk
b38cf3cb17 firmware_loader: use kernel credentials when reading firmware
e14e3856e9 net: stmmac: disable Split Header (SPH) for Intel platforms
9ea8e6a832 block: return ELEVATOR_DISCARD_MERGE if possible
36ac6caf74 Input: ili210x - fix reset timing
1c450bdf2e net: atlantic: verify hw_head_ lies within TX buffer ring
e5307704c4 net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe()
91d8d7edf1 ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
dd5de66f5c selftests: add ping test with ping_group_range tuned
9919585e5f mac80211: fix rx reordering with non explicit / psmp ack policy
19e2cd737c scsi: qla2xxx: Fix missed DMA unmap for aborted commands
74168c2207 perf bench numa: Address compiler error on s390
d1915d9c9f gpio: mvebu/pwm: Refuse requests with inverted polarity
3fdd67e83c gpio: gpio-vf610: do not touch other bits when set the target bit
1fe6dc5f5d net: bridge: Clear offload_fwd_mark when passing frame up bridge interface.
622be11fa3 igb: skip phy status check where unavailable
eb92a8ecce ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2
463a7b957d ARM: 9196/1: spectre-bhb: enable for Cortex-A15
1b93631c77 net: af_key: add check for pfkey_broadcast in function pfkey_process
c0be5fec78 net/mlx5e: Properly block LRO when XDP is enabled
3277789f33 NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc
b368e07fb4 net/qla3xxx: Fix a test in ql_reset_work()
d672eee9e4 clk: at91: generated: consider range when calculating best rate
8cb1a05fe3 ice: fix possible under reporting of ethtool Tx and Rx statistics
dc64e8874e net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup()
32f779e6fb net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf()
1eb2d78581 net/sched: act_pedit: sanitize shift argument before usage
50f70ee302 net: macb: Increment rx bd head after allocating skb and buffer
a42ffe8833 ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group
6493ff94c0 ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi
fe2a9469ec dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace
8cf6c24ed4 drm/dp/mst: fix a possible memory leak in fetch_monitor_name()
8be06f62b4 crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
f4a093215b KVM: x86/mmu: Update number of zapped pages even if page list is stable
de87451827 PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold
3a12b2c413 Fix double fget() in vhost_net_set_backend()
dd0ea88b0a perf: Fix sys_perf_event_open() race against self
c8a5e14cb4 ALSA: wavefront: Proper check of get_user() error
2f8f6c393b SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
975a0f14d5 SUNRPC: Don't call connect() more than once on a TCP socket
aa4d71edd6 SUNRPC: Prevent immediate close+reconnect
2d6f096476 SUNRPC: Clean up scheduling of autoclose
f3fe8d13ac mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch()
def047ae12 mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD
f10260f359 mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC
1e93f93992 nilfs2: fix lockdep warnings during disk space reclamation
307d021b1a nilfs2: fix lockdep warnings in page operations for btree nodes
77b71a4c87 ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame()
54f7358be1 platform/chrome: cros_ec_debugfs: detach log reader wq from devm
232128f6e6 drbd: remove usage of list iterator variable after loop
83abb076f4 MIPS: lantiq: check the return value of kzalloc()
e7947c031f rtc: mc146818-lib: Fix the AltCentury for AMD platforms
7be785032c nvme-multipath: fix hang when disk goes live over reconnect
ee0323cc8b ALSA: hda/realtek: Enable headset mic on Lenovo P360
c0d86f2a3c crypto: x86/chacha20 - Avoid spurious jumps to other functions
f021389433 crypto: stm32 - fix reference leak in stm32_crc_remove
8c015cd524 Input: stmfts - fix reference leak in stmfts_input_open
bb83a744bc Input: add bounds checking to input_set_capability()
4fd3966956 um: Cleanup syscall_handler_t definition/cast, fix warning
0c319b9988 rtc: fix use-after-free on device removal
05df3bdbc2 x86/xen: Make the secondary CPU idle tasks reliable
0d3817cb4e x86/xen: Make the boot CPU idle task reliable
67e2b62461 floppy: use a statically allocated error counter
abcfb6abb7 Merge 5.4.195 into android11-5.4-lts
e44bd11b47 Merge 5.4.194 into android11-5.4-lts
c336f131c4 ANDROID: fix up abi issue with struct snd_pcm_runtime
0187300e6a Linux 5.4.195
8fcefb43ec tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
6d80857c4f ping: fix address binding wrt vrf
7845532adb arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
c0b735fef2 net: phy: Fix race condition on link status change
a60def7568 MIPS: fix build with gcc-12
a3112d5da1 drm/vmwgfx: Initialize drm_mode_fb_cmd2
463c743149 cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
f25145c37c i40e: i40e_main: fix a missing check on list iterator
17c744716a drm/nouveau/tegra: Stop using iommu_present()
c8f567c465 serial: 8250_mtk: Fix register address for XON/XOFF character
aa3ea7451b serial: 8250_mtk: Fix UART_EFR register address
031fda28d0 slimbus: qcom: Fix IRQ check in qcom_slim_probe
7de6f30596 USB: serial: option: add Fibocom MA510 modem
65732f62f7 USB: serial: option: add Fibocom L610 modem
6c78537f3e USB: serial: qcserial: add support for Sierra Wireless EM7590
e40d004947 USB: serial: pl2303: add device id for HP LM930 Display
056a56f8fb usb: typec: tcpci: Don't skip cleanup in .remove() on error
457d9401b8 usb: cdc-wdm: fix reading stuck on device close
4d93303fd8 tty: n_gsm: fix mux activation issues in gsm_config()
6e34ee5b5b tcp: resalt the secret every 10 seconds
39c26fe93c net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
638bfbc84c s390: disable -Warray-bounds
f66d3fa508 ASoC: ops: Validate input values in snd_soc_put_volsw_range()
13b850a6cc ASoC: max98090: Generate notifications on changes for custom control
5c766c000a ASoC: max98090: Reject invalid values in custom control put()
22f6c68b49 hwmon: (f71882fg) Fix negative temperature
208200e573 gfs2: Fix filesystem block deallocation for short writes
42daae7d84 net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
e038c457bd net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
2ec2dd7d51 net/sched: act_pedit: really ensure the skb is writable
48c6a40e2f s390/lcs: fix variable dereferenced before check
467ddbbe7e s390/ctcm: fix potential memory leak
2cbce01100 s390/ctcm: fix variable dereferenced before check
1c40e85d0a hwmon: (ltq-cputemp) restrict it to SOC_XWAY
0a778db931 dim: initialize all struct fields
522986cc39 mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
0729594cb7 netlink: do not reset transport header in netlink_recvmsg()
33ce32587c drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
5809a1c530 ipv4: drop dst in multicast routing path
c9d75e87f4 net: Fix features skip in for_each_netdev_feature()
5c90576705 mac80211: Reset MBSSID parameters upon connection
cfe74fd41f hwmon: (tmp401) Add OF device ID table
3915341a93 batman-adv: Don't skb_split skbuffs with frag_list
00c4652b41 Merge 5.4.193 into android11-5.4-lts
9065948757 Linux 5.4.194
2f4e0bf651 mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic()
e4db0c3ce0 mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
ea9cad1c5d mm: fix missing cache flush for all tail pages of compound page
45c05171d6 Bluetooth: Fix the creation of hdev->name
f52c4c067a KVM: x86/svm: Account for family 17h event renumberings in amd_pmc_perf_hw_id
c1bdf1e6e7 x86: kprobes: Prohibit probing on instruction which has emulate prefix
6af6427a96 x86: xen: insn: Decode Xen and KVM emulate-prefix signature
c67a4a91f5 x86: xen: kvm: Gather the definition of emulate prefixes
4c39e1ace3 x86/asm: Allow to pass macros to __ASM_FORM()
29afcd5af0 KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
ea65a7d76c arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
5755f946a8 can: grcan: only use the NAPI poll budget for RX
caba5c13a8 can: grcan: grcan_probe(): fix broken system id check for errata workaround needs
76b64c690f nfp: bpf: silence bitwise vs. logical OR warning
86ccefb83e drm/i915: Cast remain to unsigned long in eb_relocate_vma
de542bd765 drm/amd/display/dc/gpio/gpio_service: Pass around correct dce_{version, environment} types
e6ff94d31c block: drbd: drbd_nl: Make conversion to 'enum drbd_ret_code' explicit
f668da98ad MIPS: Use address-of operator on section symbols
44a1f2e6dc ANDROID: GKI: update the abi .xml file
52509afded Revert "tcp: ensure to use the most recently sent skb when filling the rate sample"
01565c91b7 Linux 5.4.193
8a7f92053d mmc: rtsx: add 74 Clocks in power on flow
d789b98917 PCI: aardvark: Fix reading MSI interrupt number
253bc43ca5 PCI: aardvark: Clear all MSIs at setup
786dc86c84 dm: interlock pending dm_io and dm_wait_for_bios_completion
ad1393b92e dm: fix mempool NULL pointer race when completing IO
40bcd39a00 tcp: make sure treq->af_specific is initialized
9661bf674d ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
37b12c16be ALSA: pcm: Fix races among concurrent prealloc proc writes
2a559eec81 ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls
08d1807f09 ALSA: pcm: Fix races among concurrent read/write and buffer changes
fbeb492694 ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
f098f8b982 mm: fix unexpected zeroed page mapping with zram swap
c7337efd1d block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern
9588ac2edd net: ipv6: ensure we call ipv6_mc_down() at most once
367b49086b KVM: LAPIC: Enable timer posted-interrupt only when mwait/hlt is advertised
c2fadf2d0a x86/kvm: Preserve BSP MSR_KVM_POLL_CONTROL across suspend/resume
8b78939f4b kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU
f455c8e657 NFSv4: Don't invalidate inode attributes on delegation return
89e7a625ec drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu
1d14c1c7a3 net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter()
2b99ff4c3e btrfs: always log symlinks in full mode
dc47844894 smsc911x: allow using IRQ0
cff6cb162f bnxt_en: Fix possible bnxt_open() failure caused by wrong RFS flag
64ece01adb selftests: mirror_gre_bridge_1q: Avoid changing PVID while interface is operational
52401926c8 net: emaclite: Add error handling for of_address_to_resource()
354cac1e39 net: stmmac: dwmac-sun8i: add missing of_node_put() in sun8i_dwmac_register_mdio_mux()
0510b6ccfb net: ethernet: mediatek: add missing of_node_put() in mtk_sgmii_init()
102986592f RDMA/siw: Fix a condition race issue in MPA request processing
e6ae21eb94 ASoC: dmaengine: Restore NULL prepare_slave_config() callback
df3ea6cc1a hwmon: (adt7470) Fix warning on module removal
01d4363dd7 NFC: netlink: fix sleep in atomic bug when firmware download timeout
33d3e76fc7 nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs
85aecdef77 nfc: replace improper check device_is_registered() in netlink related functions
da9eb43b9a can: grcan: use ofdev->dev when allocating DMA memory
8b451b7d7e can: grcan: grcan_close(): fix deadlock
8f4246450a s390/dasd: Fix read inconsistency for ESE DASD devices
91193a2c2f s390/dasd: Fix read for ESE with blksize < 4k
1aa75808ed s390/dasd: prevent double format of tracks for ESE devices
061a424dd1 s390/dasd: fix data corruption for ESE devices
860db6cdc5 ASoC: meson: Fix event generation for G12A tohdmi mux
d4864e8c4b ASoC: wm8958: Fix change notifications for DSP controls
6723ab2ed8 ASoC: da7219: Fix change notifications for tone generator frequency
ac5894fb86 genirq: Synchronize interrupt thread startup
8624e2c5af ACPICA: Always create namespace nodes using acpi_ns_create_node()
27183539cf firewire: core: extend card->lock in fw_core_handle_bus_reset
2fefc62598 firewire: remove check of list iterator against head past the loop body
34b9b91829 firewire: fix potential uaf in outbound_phy_packet_callback()
f6b6e93369 Revert "SUNRPC: attempt AF_LOCAL connect on setup"
d403ff32e5 gpiolib: of: fix bounds check for 'gpio-reserved-ranges'
94842485b4 ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
73ce49fa59 parisc: Merge model and model name into one line in /proc/cpuinfo
0d5bb59858 MIPS: Fix CP0 counter erratum detection for R4k CPUs
aa172204d5 Merge 5.4.192 into android11-5.4-lts
1d72b776f6 Linux 5.4.192
aa2a047b58 mm, hugetlb: allow for "high" userspace addresses
6a79b2433e hugetlbfs: get unmapped area below TASK_UNMAPPED_BASE for hugetlbfs
b69e60f6fc tty: n_gsm: fix incorrect UA handling
0f4be29feb tty: n_gsm: fix wrong command frame length field encoding
21cc640385 tty: n_gsm: fix wrong command retry handling
49c40febd4 tty: n_gsm: fix missing explicit ldisc flush
85522dcf00 tty: n_gsm: fix insufficient txframe size
563bb0f794 netfilter: nft_socket: only do sk lookups when indev is available
fae2095210 tty: n_gsm: fix malformed counter for out of frame data
cec2d0782a tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
a6d9847a4f x86/cpu: Load microcode during restore_processor_state()
9e9d12b81d net: ethernet: stmmac: fix write to sgmii_adapter_base
10ba1ac9a2 drivers: net: hippi: Fix deadlock in rr_close()
a827521975 cifs: destage any unwritten data to the server before calling copychunk_write
5335370366 x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
0ecc5304e8 ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
7815710349 ASoC: wm8731: Disable the regulator when probing fails
a71df406a6 tcp: fix F-RTO may not work correctly when receiving DSACK
a4ed61e30e ixgbe: ensure IPsec VF<->PF compatibility
406aaef0fe bnx2x: fix napi API usage sequence
c3e7ea5860 tls: Skip tls_append_frag on zero copy size
cd5cec3a0c drm/amd/display: Fix memory leak in dcn21_clock_source_create
ffce11a391 net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
3a179538bf net: bcmgenet: hide status block before TX timestamping
8ef6d60aa2 clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
194f474ad9 bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
e80054ea0c tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
685ff7d244 ip_gre: Make o_seqno start from 0 in native mode
69555bb27b net/smc: sync err code when tcp connection was refused
daca23846e net: hns3: add validity check for message data length
7763a79566 cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
f5bb5940d7 pinctrl: pistachio: fix use of irq_of_parse_and_map()
d22fc60369 arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
68f5200a1f ARM: dts: imx6ull-colibri: fix vqmmc regulator
c45180375a sctp: check asoc strreset_chunk in sctp_generate_reconf_event
2cba635570 tcp: ensure to use the most recently sent skb when filling the rate sample
3ea6190be9 tcp: md5: incorrect tcp_header_len for incoming connections
2b9a13d98d bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
2e7f70d324 mtd: rawnand: Fix return value check of wait_for_completion_timeout
2a36ba067b ipvs: correctly print the memory size of ip_vs_conn_tab
abe86a10dc ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
54212850e3 ARM: dts: am3517-evm: Fix misc pinmuxing
bba67fe6b0 ARM: dts: Fix mmc order for omap3-gta04
416e0f8907 phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
6ff7c1b827 phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
59bdaed5dd ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
dbce8fc16a phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
b7fc45354b ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
dd99939b70 phy: samsung: exynos5250-sata: fix missing device put in probe error paths
6331b77fdc phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
fccbc3168e ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
b8f0c19d48 USB: Fix xhci event ring dequeue pointer ERDP update issue
1f47c26257 mtd: rawnand: fix ecc parameters for mt7622
0405bd7f18 arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
5f80b5c5f4 arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
f6db63819d video: fbdev: udlfb: properly check endpoint type
c00f3892f4 hex2bin: fix access beyond string end
15b78a8e38 hex2bin: make the function hex_to_bin constant-time
73f4668ee8 arch_topology: Do not set llc_sibling if llc_id is invalid
a3cdd33ca1 serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
89a5728b05 serial: 8250: Also set sticky MCR bits in console restoration
42f749f223 serial: imx: fix overrun interrupts in DMA mode
d29c197df7 usb: dwc3: gadget: Return proper request status
0f3d081315 usb: dwc3: core: Fix tx/rx threshold settings
e2ec7b1f6a usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
debb276670 usb: gadget: uvc: Fix crash when encoding data for usb request
324e67c3b2 usb: typec: ucsi: Fix role swapping
0366beb402 usb: misc: fix improper handling of refcount in uss720_probe()
2c97a2b5ef iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
e82c726c94 iio: dac: ad5446: Fix read_raw not returning set value
1aea30f87c iio: dac: ad5592r: Fix the missing return value.
1e8716a5c0 xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
b8d3a4681f xhci: stop polling roothubs after shutdown
c8fbc2f875 USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
68088dec9b USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
56cbdb9d95 USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
6b10dd966c USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
890fc65448 USB: quirks: add STRING quirk for VCOM device
c4b31d41f5 USB: quirks: add a Realtek card reader
5666334ce3 usb: mtu3: fix USB 3.0 dual-role-switch from device to host
b258964700 lightnvm: disable the subsystem
c9af90f0c6 hamradio: remove needs_free_netdev to avoid UAF
7361a35bf3 hamradio: defer 6pack kfree after unregister_netdev
7dea591300 floppy: disable FDRAWCMD by default
Update the .xml file with the following needed changes that came in from
the -lts branch to handle ABI issues with LTS security fixes:
Leaf changes summary: 2 artifacts changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 1 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
1 function with some sub-type change:
[C] 'function int hex_to_bin(char)' at hexdump.c:52:1 has some sub-type changes:
parameter 1 of type 'char' changed:
type name changed from 'char' to 'unsigned char'
type size hasn't changed
'struct snd_pcm_runtime at pcm.h:342:1' changed:
type size changed from 6336 to 6400 (in bits)
1 data member insertion:
'atomic_t buffer_accessing', at offset 6336 (in bits) at pcm.h:429:1
107 impacted interfaces
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2cc9bdcc4c587e34362082b93990bf9837241a37
emulation_proc_handler() changes table->data for proc_dointvec_minmax
and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
| Internal error: Oops: 96000006 [#1] SMP
| Call trace:
| update_insn_emulation_mode+0xc0/0x148
| emulation_proc_handler+0x64/0xb8
| proc_sys_call_handler+0x9c/0xf8
| proc_sys_write+0x18/0x20
| __vfs_write+0x20/0x48
| vfs_write+0xe4/0x1d0
| ksys_write+0x70/0xf8
| __arm64_sys_write+0x20/0x28
| el0_svc_common.constprop.0+0x7c/0x1c0
| el0_svc_handler+0x2c/0xa0
| el0_svc+0x8/0x200
To fix this issue, keep the table->data as &insn->current_mode and
use container_of() to retrieve the insn pointer. Another mutex is
used to protect against the current_mode update but not for retrieving
insn_emulation as table->data is no longer changing.
Bug: 237540956
Co-developed-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: hewenliang <hewenliang4@huawei.com>
Signed-off-by: Haibin Zhang <haibinzhang@tencent.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com
Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com
Signed-off-by: Will Deacon <will@kernel.org>
[Lee: Added Fixes: tag]
(cherry picked from commit af483947d472eccb79e42059276c4deed76f99a6
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/core)
Fixes: 587064b610 ("arm64: Add framework for legacy instruction emulation")
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If9b96bb79c79903f9d8292e719b06fdef57ef1c5
Add vmemdup_user so we can duplicate on non physically contiguous
memory. No need to update the .xml file, as it is already updated.
Bug: 238705448
Change-Id: I93f0161117d25adff0ead7b33ab319d4ca28c3c7
Signed-off-by: Jairaj Solanki <quic_jsolanki@quicinc.com>
This reverts commit 9611cf8fcfdda47ce41bd48f2f55ad6472e546b8.
Change-Id: Idfba6e78592ccdb09d576a1bbc37c31f769c8ac2
Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
Commit 09854ba94c6a ("mm: do_wp_page() simplification") reorganized all
the code around the page re-use vs copy, but in the process also moved
the final unlock_page() around to after the wp_page_reuse() call.
That normally doesn't matter - but it means that the unlock_page() is
now done after releasing the page table lock. Again, not a big deal,
you'd think.
But it turns out that it's very wrong indeed, because once we've
released the page table lock, we've basically lost our only reference to
the page - the page tables - and it could now be free'd at any time. We
do hold the mmap_sem, so no actual unmap() can happen, but madvise can
come in and a MADV_DONTNEED will zap the page range - and free the page.
So now the page may be free'd just as we're unlocking it, which in turn
will usually trigger a "Bad page state" error in the freeing path. To
make matters more confusing, by the time the debug code prints out the
page state, the unlock has typically completed and everything looks fine
again.
This all doesn't happen in any normal situations, but it does trigger
with the dirtyc0w_child LTP test. And it seems to trigger much more
easily (but not expclusively) on s390 than elsewhere, probably because
s390 doesn't do the "batch pages up for freeing after the TLB flush"
that gives the unlock_page() more time to complete and makes the race
harder to hit.
Fixes: 09854ba94c6a ("mm: do_wp_page() simplification")
Link: https://lore.kernel.org/lkml/a46e9bbef2ed4e17778f5615e818526ef848d791.camel@redhat.com/
Link: https://lore.kernel.org/linux-mm/c41149a8-211e-390b-af1d-d5eee690fecb@linux.alibaba.com/
Reported-by: Qian Cai <cai@redhat.com>
Reported-by: Alex Shi <alex.shi@linux.alibaba.com>
Bisected-and-analyzed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Tested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit be068f29034fb00530a053d18b8cf140c32b12b3)
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I85ea395b6b722fbfc63036041d11615dacf96a7b
How about we just make sure we're the only possible valid user fo the
page before we bother to reuse it?
Simplify, simplify, simplify.
And get rid of the nasty serialization on the page lock at the same time.
[peterx: add subject prefix]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 09854ba94c6aad7886996bfbee2530b3d8a7f4f4)
[Kalesh Singh: Resolve conflict in mm/memory.c]
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I0b855b305332564670b8cbea9660405fed89a044
Remove the function as the last reference has gone away with the do_wp_page()
changes.
Signed-off-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 1a0cf26323c80e2f1c58fc04f15686de61bfab0c)
Bug: 176847924
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Change-Id: I70e5938a046d0fc449288ae46c83cb7c39d7de48
Add and define the ipa_client_type enum for
IPA_CLIENT_MHI_COAL_CONS to be used for the
MHI coalescing pipe.
Change-Id: Ie06765bca995f7e35f4d4d2bc091cdbf3946a676
Signed-off-by: Michael Adisumarta <quic_madisuma@quicinc.com>
commit 69534c48ba8ce552ce383b3dfdb271ffe51820c3 upstream.
We have no protection against concurrent PCM buffer preallocation
changes via proc files, and it may potentially lead to UAF or some
weird problem. This patch applies the PCM open_mutex to the proc
write operation for avoiding the racy proc writes and the PCM stream
open (and further operations).
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[OP: backport to 5.4: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I52d0347c440b87c700b28e082eee9ab9d3ec4910
commit 3c3201f8c7bb77eb53b08a3ca8d9a4ddc500b4c0 upstream.
Like the previous fixes to hw_params and hw_free ioctl races, we need
to paper over the concurrent prepare ioctl calls against hw_params and
hw_free, too.
This patch implements the locking with the existing
runtime->buffer_mutex for prepare ioctls. Unlike the previous case
for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is
performed to the linked streams, hence the lock can't be applied
simply on the top. For tracking the lock in each linked substream, we
modify snd_pcm_action_group() slightly and apply the buffer_mutex for
the case stream_lock=false (formerly there was no lock applied)
there.
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Idcb26b8b178b9617e44443f2ca093074b76068b0
commit dca947d4d26dbf925a64a6cfb2ddbc035e831a3d upstream.
In the current PCM design, the read/write syscalls (as well as the
equivalent ioctls) are allowed before the PCM stream is running, that
is, at PCM PREPARED state. Meanwhile, we also allow to re-issue
hw_params and hw_free ioctl calls at the PREPARED state that may
change or free the buffers, too. The problem is that there is no
protection against those mix-ups.
This patch applies the previously introduced runtime->buffer_mutex to
the read/write operations so that the concurrent hw_params or hw_free
call can no longer interfere during the operation. The mutex is
unlocked before scheduling, so we don't take it too long.
Bug: 232293337
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I4ec9ab14347e88de6b51025b845d13514ac289e9
A portion of the fix for CVE-2022-1048, commit 0f6947f5f520 ("ALSA: pcm:
Fix races among concurrent hw_params and hw_free calls"), caused an ABI
break by adding a new field to struct snd_pcm_runtime. Because we have
to keep this new addition, it is safe to move it to the end of the
structure because this is only ever created by the sound core, and
referenced as a pointer everywhere else.
This does require a .xml update also to handle the increased structure
size:
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
'struct snd_pcm_runtime at pcm.h:342:1' changed:
type size changed from 6080 to 6336 (in bits)
1 data member insertion:
'mutex buffer_mutex', at offset 6080 (in bits) at pcm.h:428:1
92 impacted interfaces
Bug: 161946584
Fixes: 0f6947f5f520 ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[Lee: Update XML files for this branch]
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I20340387fbe85fb82676517a93bb0184c8c1eb65
commit 92ee3c60ec9fe64404dc035e7c41277d74aa26cb upstream.
Currently we have neither proper check nor protection against the
concurrent calls of PCM hw_params and hw_free ioctls, which may result
in a UAF. Since the existing PCM stream lock can't be used for
protecting the whole ioctl operations, we need a new mutex to protect
those racy calls.
This patch introduced a new mutex, runtime->buffer_mutex, and applies
it to both hw_params and hw_free ioctl code paths. Along with it, the
both functions are slightly modified (the mmap_count check is moved
into the state-check block) for code simplicity.
Bug: 5d95acffca4c
Reported-by: Hu Jiahui <kirin.say@gmail.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[OP: backport to 5.4: adjusted context]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I33b5ed3d1f38904e215692a236fe39e8b3ee1f15
commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream.
There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware,
gpio and so on could be destructed while the upper layer functions such as
nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads
to double-free, use-after-free and null-ptr-deref bugs.
There are three situations that could lead to double-free bugs.
The first situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... | nfcmrvl_nci_unregister_dev
release_firmware() | nfcmrvl_fw_dnld_abort
kfree(fw) //(1) | fw_dnld_over
| release_firmware
... | kfree(fw) //(2)
| ...
The second situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_fw_dnld_start |
... |
mod_timer |
(wait a time) |
fw_dnld_timeout | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
... | kfree(fw) //(2)
The third situation is shown below:
(Thread 1) | (Thread 2)
nfcmrvl_nci_recv_frame |
if(..->fw_download_in_progress)|
nfcmrvl_fw_dnld_recv_frame |
queue_work |
|
fw_dnld_rx_work | nfcmrvl_nci_unregister_dev
fw_dnld_over | nfcmrvl_fw_dnld_abort
release_firmware | fw_dnld_over
kfree(fw) //(1) | release_firmware
| kfree(fw) //(2)
The firmware struct is deallocated in position (1) and deallocated
in position (2) again.
The crash trace triggered by POC is like below:
BUG: KASAN: double-free or invalid-free in fw_dnld_over
Call Trace:
kfree
fw_dnld_over
nfcmrvl_nci_unregister_dev
nci_uart_tty_close
tty_ldisc_kill
tty_ldisc_hangup
__tty_hangup.part.0
tty_release
...
What's more, there are also use-after-free and null-ptr-deref bugs
in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or
set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev,
then, we dereference firmware, gpio or the members of priv->fw_dnld in
nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen.
This patch reorders destructive operations after nci_unregister_device
in order to synchronize between cleanup routine and firmware download
routine.
The nci_unregister_device is well synchronized. If the device is
detaching, the firmware download routine will goto error. If firmware
download routine is executing, nci_unregister_device will wait until
firmware download routine is finished.
Bug: 234690530
Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8cc1f6450c7fecf5f5994033931da1d23a522282
As part of posted event, event_data is getting freed.
Check for FW crashed using event_data after posting
event can be incorrect since event_data might have been
freed. Move FW crashed check using event_data after
posting event.
Change-Id: Ie82a0b7b4ceb40063318ab2d926b9c14412fb2c9
Signed-off-by: Naman Padhiar <quic_npadhiar@quicinc.com>
