Author	SHA1	Message	Date
Greg Kroah-Hartman	023cd1cf3f	This is the 5.4.189 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmJZYqcACgkQONu9yGCS aT51cA/+PXr+24MJMwa0PyLuQO9YScRAu/4E8PtEkumpj5dA9FuWJCcuNwO9cmNp YM6IdGGbHfW+JRsX3wLAothut1ID9hfl+Y2tpBFJacS7E5ezgzoiAF1ke8RsBxd/ s+sRwZqRfSVoVmwYGj9/SwXLzJJTdPwY/FwXUdsyxxkn8u99YmAURlNUZdv0+KWs vmAvS6mj4M4GfazS9FfBhnUVMcxbDgY0/rNlek2rMQi1ValvrYeNBATjKMI/NrkR /bRTplCezuDFDw82IqQfiqGQ71mMbpYFXxkbdXsJj3nhIJ1AimWRQhLRg/TqJOi4 0Hhx3cEk/5hs/22VBN9sIYIAbJr+z7Kr9gnhltAETPOrv0s9w9fnJARve5GlwSHV yKBm3Pfq0+abAQ2urnsmiHFvMMzFaiNuWe98TOF0BHkJbwMSFQpgFtp0yWx2bgMf Svx/rEXzd2Cx0h5X4dHAMykPqsJAek0qIb4MgOPAEpuZWLZ09xfXOeVc8lTbHG22 y/HfKE+4FMTw8tsAe/7E7xP+yjosPrAq8De2ymMo9NGDFxT8I9ro+gkqwMWwC+yi trYDVFEX3NNIEG9D6Oh+eP2nY97U898wCI1GFU18J9zOPQsw4peHSS8xPW7vLbqy zrzOxMKW+2khSwj/wFlSXRaj3pogP5/y4jaAXpMSse0Zb3Neu2U= =p4tc -----END PGP SIGNATURE----- Merge 5.4.189 into android11-5.4-lts Changes in 5.4.189 swiotlb: fix info leak with DMA_FROM_DEVICE USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver netdevice: add the case if dev is NULL HID: logitech-dj: add new lightspeed receiver id xfrm: fix tunnel model fragmentation behavior virtio_console: break out of buf poll on remove ethernet: sun: Free the coherent when failing in probing spi: Fix invalid sgs value net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix erroneous sgs value with min_t() af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register net: dsa: microchip: add spi_device_id tables iommu/iova: Improve 32-bit free space estimate tpm: fix reference counting for struct tpm_chip block: Add a helper to validate the block size virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c xhci: fix runtime PM imbalance in USB2 resume xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() coresight: Fix TRCCONFIGR.QE sysfs interface iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation greybus: svc: fix an error handling bug in gb_svc_hello() clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE KEYS: fix length validation in keyctl_pkey_params_get_2() Documentation: add link to stable release candidate tree Documentation: update stable tree link HID: intel-ish-hid: Use dma_alloc_coherent for firmware update SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems f2fs: fix to unlock page correctly in error path of is_alive() f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to do sanity check on .cp_pack_total_block_count pinctrl: samsung: drop pin banks references on error paths spi: mxic: Fix the transmit path can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mm: invalidate hwpoison page cache page in fault path mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands qed: display VF trust config qed: validate and restrict untrusted VFs vlan promisc mode riscv: Fix fill_callchain return value Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 mm,hwpoison: unmap poisoned page before invalidation mm/kmemleak: reset tag when compare object pointer drbd: fix potential silent data corruption powerpc/kvm: Fix kvm_use_magic_page udp: call udp_encap_enable for v6 sockets when enabling encap ACPI: properties: Consistently return -ENOENT if there are no more references drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() mailbox: tegra-hsp: Flush whole channel block: don't merge across cgroup boundaries if blkcg is enabled drm/edid: check basic audio support on CEA extension block video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: at91: sama5d2: Fix PMERRLOC resource size ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 carl9170: fix missing bit-wise or operator for tx_params thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() DEC: Limit PMAX memory probing to R3k systems media: davinci: vpif: fix unbalanced runtime PM get xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs PCI: pciehp: Clear cmd_busy bit in polling mode regulator: qcom_smd: fix for_each_child.cocci warnings crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing spi: tegra114: Add missing IRQ check in tegra_spi_probe selftests/x86: Add validity check and allow field splitting audit: log AUDIT_TIME_* records only from rules crypto: ccree - don't attempt 0 len DMA mappings spi: pxa2xx-pci: Balance reference count for PCI DMA device hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING block: don't delete queue kobject before its children PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler hwrng: atmel - disable trng on failure path crypto: vmx - add missing dependencies clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() ACPI: APEI: fix return value of __setup handlers crypto: ccp - ccp_dmaengine_unregister release dma channels hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel f2fs: fix missing free nid in f2fs_handle_failed_inode f2fs: fix to avoid potential deadlock media: bttv: fix WARNING regression on tunerless devices media: coda: Fix missing put_device() call in coda_get_vdoa_data media: hantro: Fix overfill bottom register field name media: aspeed: Correct value for h-total-pixels video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() ARM: dts: qcom: ipq4019: fix sleep clock soc: qcom: rpmpd: Check for null return of devm_kcalloc soc: qcom: aoss: remove spurious IRQF_ONESHOT flags arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ARM: dts: imx: Add missing LVDS decoder on M53Menlo media: video/hdmi: handle short reads of hdmi info frame. media: em28xx: initialize refcount before kref_get media: usb: go7007: s2250-board: fix leak in probe() uaccess: fix nios2 and microblaze get_user_8() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ivtv: fix incorrect device_caps for ivtvfb ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() mtd: onenand: Check for error irq mtd: rawnand: gpmi: fix controller timings setting drm/edid: Don't clear formats if using deep color drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() ath9k_htc: fix uninit value bugs KVM: PPC: Fix vmx/vsx mixup in mmio emulation i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe ray_cs: Check ioremap return value powerpc/perf: Don't use perf_hw_context for trace IMC PMU mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update net: dsa: mv88e6xxx: Enable port policy support on 6097 PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iommu/ipmmu-vmsa: Check for error num after setting mask drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug IB/cma: Allow XRC INI QPs to set their local ACK timeout dax: make sure inodes are flushed before destroy cache iwlwifi: Fix -EIO error code that is never returned iwlwifi: mvm: Fix an error code in iwl_mvm_up() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix abort all task initialization drm/amd/display: Remove vupdate_int_entry definition TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return scsi: hisi_sas: Change permission of parameter prot_mask drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info libbpf: Skip forward declaration when counting duplicated type names powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() hv_balloon: rate-limit "Unhandled message" warning i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq PCI: Reduce warnings on possible RW1C corruption mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request selftests/bpf: Make test_lwt_ip_encap more stable and faster powerpc: 8xx: fix a return value error in mpc8xx_pic_init vxcan: enable local echo for sent CAN frames MIPS: RB532: fix return value of __setup handler mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init RDMA/mlx5: Fix memory leak in error flow for subscribe event routine bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg USB: storage: ums-realtek: fix error code in rts51x_read_mem() Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt af_netlink: Fix shift out of bounds in group mask calculation i2c: mux: demux-pinctrl: do not deactivate a master that is not active selftests/bpf/test_lirc_mode2.sh: Exit with proper code tcp: ensure PMTU updates are processed during fastopen openvswitch: always update flow key after nat tipc: fix the timer expires after interval 100ms mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() misc: alcor_pci: Fix an error handling path staging:iio:adc:ad7280a: Fix handing of device address bit reversing. pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel clk: qcom: ipq8074: Use floor ops for SDCC1 clock phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250: Fix race condition in RTS-after-send handling iio: adc: Add check for devm_request_threaded_irq NFS: Return valid errors from nfs2/3_decode_dirent() dma-debug: fix return value of __setup handlers clk: imx7d: Remove audio_mclk_root_clk clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler firmware: google: Properly state IOMEM dependency driver core: dd: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error clk: qcom: gcc-msm8994: Fix gpll4 width clk: Initialize orphan req_rate xen: fix is_xen_pmu() net: phy: broadcom: Fix brcm_fet_config_init() selftests: test_vxlan_under_vrf: Fix broken test case qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect NFSv4/pNFS: Fix another issue with a list iterator pointing to the head net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator lib/test: use after free in register_test_dev_kmod() LSM: general protection fault in legacy_parse_param gcc-plugins/stackleak: Exactly match strings instead of prefixes pinctrl: npcm: Fix broken references to chip->parent_device block, bfq: don't move oom_bfqq selinux: use correct type for context length loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/qcom-pdc: Fix broken locking irqchip/nvic: Release nvic_base upon failure bfq: fix use-after-free in bfq_dispatch_request ACPICA: Avoid walking the ACPI Namespace if it is not there lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Revert "Revert "block, bfq: honor already-setup queue merges"" ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() spi: tegra20: Use of_device_get_match_data() ext4: don't BUG if someone dirty pages without asking ext4 first ntfs: add sanity check on allocation size video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information ASoC: madera: Add dependencies on MFD video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: Revert "media: em28xx: add missing em28xx_close_extension" media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing ALSA: hda/realtek: Add alc256-samsung-headphone fixup powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Use correct feature type field during RFF_ID processing KVM: Prevent module exit until all VMs are freed KVM: x86: fix sending PV IPI ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM ubifs: rename_whiteout: Fix double free for whiteout_ui->data ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: rename_whiteout: correct old_dir size computing XArray: Fix xas_create_range() when multi-order entry present can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path can: mcba_usb: properly check endpoint type XArray: Update the LRU list in xas_split() rtc: check if __rtc_read_time was successful gfs2: Make sure FITRIM minlen is rounded up to fs block size net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware pinctrl: pinconf-generic: Print arguments for bias-pull-* pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl ARM: iop32x: offset IRQ numbers by 1 ACPI: CPPC: Avoid out of bounds access when parsing _CPC data powerpc/kasan: Fix early region not updated correctly ASoC: soc-compress: Change the check for codec_dai mm/mmap: return 1 from stack_guard_gap __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler bpf: Fix comment for helper bpf_current_task_under_cgroup() dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties um: Fix uml_mconsole stop/go openvswitch: Fixed nd target mask field in the flow dump. KVM: x86/mmu: do compare-and-exchange of gPTE via the user address KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated ubifs: Rectify space amount budget for mkdir/tmpfile operations rtc: wm8350: Handle error for wm8350_register_irq riscv module: remove (NOLOAD) ARM: 9187/1: JIVE: fix return value of __setup handler KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs drm: Add orientation quirk for GPD Win Max ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj ptp: replace snprintf with sysfs_emit powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 bpf: Make dst_port field in struct bpf_sock 16-bit wide scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() power: supply: axp20x_battery: properly report current when discharging ipv6: make mc_forwarding atomic powerpc: Set crashkernel offset to mid of RMA region drm/amdgpu: Fix recursive locking warning PCI: aardvark: Fix support for MSI interrupts iommu/arm-smmu-v3: fix event handling soft lockup usb: ehci: add pci device support for Aspeed platforms PCI: pciehp: Add Qualcomm quirk for Command Completed erratum power: supply: axp288-charger: Set Vhold to 4.4V ipv4: Invalidate neighbour for broadcast address upon address addition dm ioctl: prevent potential spectre v1 gadget drm/amdkfd: make CRAT table missing message informational only scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: aha152x: Fix aha152x_setup() __setup handler return value net/smc: correct settings of RMB window update limit mips: ralink: fix a refcount leak in ill_acc_of_setup() macvtap: advertise link netns via netlink tuntap: add sanity checks about msg_controllen in sendmsg bnxt_en: Eliminate unintended link toggle during FW reset MIPS: fix fortify panic when copying asm exception handlers scsi: libfc: Fix use after free in fc_exch_abts_resp() usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm xtensa: fix DTC warning unit_address_format Bluetooth: Fix use after free in hci_send_acl netlabel: fix out-of-bounds memory accesses init/main.c: return 1 from handled __setup() functions minix: fix bug when opening a file with O_DIRECT clk: si5341: fix reported clk_rate when output divider is 2 w1: w1_therm: fixes w1_seq for ds28ea00 sensors NFSv4: Protect the state recovery thread against direct reclaim xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 clk: Enforce that disjoints limits are invalid SUNRPC/call_alloc: async tasks mustn't block waiting for memory NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() virtio_console: eliminate anonymous module_init & module_exit jfs: prevent NULL deref in diFree SUNRPC: Fix socket waits for write buffer space parisc: Fix CPU affinity for Lasi, WAX and Dino chips parisc: Fix patch code locking and flushing mm: fix race between MADV_FREE reclaim and blkdev direct IO read KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() Drivers: hv: vmbus: Fix potential crash on module unload scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() net/tls: fix slab-out-of-bounds bug in decrypt_internal net: ipv4: fix route with nexthop object delete warning net: stmmac: Fix unset max_speed difference between DT and non-DT platforms drm/imx: Fix memory leak in imx_pd_connector_get_modes bnxt_en: reserve space inside receive page for skb_shared_info IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe ipv6: Fix stats accounting in ip6_pkt_drop net: openvswitch: don't send internal clone attribute to the userspace. rxrpc: fix a race in rxrpc_exit_net() qede: confirm skb is allocated before using spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() bpf: Support dual-stack sockets in bpf_tcp_check_syncookie drbd: Fix five use after free bugs in get_initial_state SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() perf tools: Fix perf's libperf_print callback perf session: Remap buf if there is no space for event Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete lz4: fix LZ4_decompress_safe_partial read out of bound mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) mm/mempolicy: fix mpol_new leak in shared_policy_replace x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume btrfs: fix qgroup reserve overflow the qgroup limit arm64: patch_text: Fixup last cpu should be master ata: sata_dwc_460ex: Fix crash due to OOB write perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator irqchip/gic-v3: Fix GICR_CTLR.RWP polling tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" mmc: mmci_sdmmc: Replace sg_dma_xxx macros mmc: mmci: stm32: correctly check all elements of sg list mm: don't skip swap entry even if zap_details specified arm64: module: remove (NOLOAD) from linker script mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning drm/amdkfd: add missing void argument to function kgd2kfd_init drm/amdkfd: Fix -Wstrict-prototypes from amdgpu_amdkfd_gfx_10_0_get_functions() io_uring: fix fs->users overflow cgroup: Use open-time credentials for process migraton perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv cgroup: Use open-time cgroup namespace for process migration perm checks selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Linux 5.4.189 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If3564fc9b0854c215e077cf29dabd4d88de266eb	2022-04-19 16:29:31 +02:00
Casey Schaufler	c345724f2b	Fix incorrect type in assignment of ipv6 port for audit ... [ Upstream commit a5cd1ab7ab679d252a6d2f483eee7d45ebf2040c ] Remove inappropriate use of ntohs() and assign the port value directly. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-15 14:18:22 +02:00
Christian Göttsche	799f22279e	selinux: use correct type for context length ... [ Upstream commit b97df7c098c531010e445da88d02b7bf7bf59ef6 ] security_sid_to_context() expects a pointer to an u32 as the address where to store the length of the computed context. Reported by sparse: security/selinux/xfrm.c:359:39: warning: incorrect type in arg 4 (different signedness) security/selinux/xfrm.c:359:39: expected unsigned int [usertype] *scontext_len security/selinux/xfrm.c:359:39: got int * Signed-off-by: Christian Göttsche <cgzones@googlemail.com> [PM: wrapped commit description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-15 14:18:22 +02:00
Casey Schaufler	ddcdda888e	LSM: general protection fault in legacy_parse_param ... [ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ] The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular case Smack sees a mount option that it recognizes, and returns 0. A call to a BPF hook follows, which returns -ENOPARAM, which confuses the caller because Smack has processed its data. The SELinux hook incorrectly returns 1 on success. There was a time when this was correct, however the current expectation is that it return 0 on success. This is repaired. Reported-by: syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: James Morris <jamorris@linux.microsoft.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-15 14:18:21 +02:00
Randy Dunlap	b689622cc4	TOMOYO: fix __setup handlers return values ... [ Upstream commit 39844b7e3084baecef52d1498b5fa81afa2cefa9 ] __setup() handlers should return 1 if the parameter is handled. Returning 0 causes the entire string to be added to init's environment strings (limited to 32 strings), unnecessarily polluting it. Using the documented strings "TOMOYO_loader=string1" and "TOMOYO_trigger=string2" causes an Unknown parameter message: Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5 TOMOYO_loader=string1 \ TOMOYO_trigger=string2", will be passed to user space. and these strings are added to init's environment string space: Run /sbin/init as init process with arguments: /sbin/init with environment: HOME=/ TERM=linux BOOT_IMAGE=/boot/bzImage-517rc5 TOMOYO_loader=string1 TOMOYO_trigger=string2 With this change, these __setup handlers act as expected, and init's environment is not polluted with these strings. Fixes: 0e4ae0e0de ("TOMOYO: Make several options configurable.") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru> Link: https://lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: James Morris <jmorris@namei.org> Cc: Kentaro Takeda <takedakn@nttdata.co.jp> Cc: tomoyo-dev-en@lists.osdn.me Cc: "Serge E. Hallyn" <serge@hallyn.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-15 14:18:13 +02:00
Eric Biggers	d312c0035e	KEYS: fix length validation in keyctl_pkey_params_get_2() ... commit c51abd96837f600d8fd940b6ab8e2da578575504 upstream. In many cases, keyctl_pkey_params_get_2() is validating the user buffer lengths against the wrong algorithm properties. Fix it to check against the correct properties. Probably this wasn't noticed before because for all asymmetric keys of the "public_key" subtype, max_data_size == max_sig_size == max_enc_size == max_dec_size. However, this isn't necessarily true for the "asym_tpm" subtype (it should be, but it's not strictly validated). Of course, future key types could have different values as well. Fixes: 00d60fd3b9 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") Cc: <stable@vger.kernel.org> # v4.20+ Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-15 14:17:58 +02:00
Greg Kroah-Hartman	20d2140d23	This is the 5.4.180 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmIM5agACgkQONu9yGCS aT7ADxAA0Q8+XC98nFxw1ylq+D3lF9CI9ozao0cWge9H2b8QWKYiitZsx1+BEvWg uuc7y9XebsU8fBgAv1l1ri/t4/PoXFmCi5i6ucTcnxTnaio68mASEejl+InRJB9W QS1dnfFzGkzCX880F+8d1lS9ckBPwTt1WEJiTlS6A4H7jS9ZJQEppHLVApEvkp21 Mo1wJnlhsKq+UzMzZuXTM9PWshhhgx8QD4lrXiuEMrAmpIOFuBJZDDJFGDf9xT3V Ft/7NqhCJ6kOzf6KZNlzOortXM52HSaYwhH2QQV5nIBOl0ROn9uPXXTR14T/lDnA u5AIcLvCHZCb9LVtYS34JxIXhJYVMfS/wXCF+pj+Ur76oxTjHz86ZIpvSOnCuQ92 Jx7v0qO53jDeStTwb7yAoSh4ILihSCLbU+dvoTnl5RF4GvU6bbVtjMHopVm+Awe1 ErFOM9eDqDkWT9/+JR7T4M1y+NlpU+B9tbzYDr0ElaOV/HKD+Ggaka8yB5IUl3HK zdzObE6+u/tjmPzEt3wxDQ2P9t8Q2bXQk10Vxf58vq/X2e7Yr2nqj6XLLoV9y+PU FvIchl9SIN5E/1A7+qkJx5W3u2BNDFicZBssMFozb96a91tV6NbWfDujpAhmvWsf 70i+DCciYs8EyYI4WC8mO0ehQL+6TDUNzFsvzJakngM2cMDpFCY= =8/vy -----END PGP SIGNATURE----- Merge 5.4.180 into android11-5.4-lts Changes in 5.4.180 integrity: check the return value of audit_log_start() ima: Remove ima_policy file before directory ima: Allow template selection with ima_template[_fmt]= after ima_hash= ima: Do not print policy rule with inactive LSM labels mmc: sdhci-of-esdhc: Check for error num after setting mask net: phy: marvell: Fix RGMII Tx/Rx delays setting in 88e1121-compatible PHYs net: phy: marvell: Fix MDI-x polarity setting in 88e1118-compatible PHYs NFS: Fix initialisation of nfs_client cl_flags field NFSD: Clamp WRITE offsets NFSD: Fix offset type in I/O trace points nvme: Fix parsing of ANA log page NFSv4 only print the label when its queried nfs: nfs4clinet: check the return value of kstrdup() NFSv4.1: Fix uninitialised variable in devicenotify NFSv4 remove zero number of fs_locations entries error check NFSv4 expose nfs_parse_server_name function drm: panel-orientation-quirks: Add quirk for the 1Netbook OneXPlayer net: sched: Clarify error message when qdisc kind is unknown scsi: target: iscsi: Make sure the np under each tpg is unique scsi: qedf: Fix refcount issue when LOGO is received during TMF scsi: myrs: Fix crash in error case PM: hibernate: Remove register_nosave_region_late() usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend net: stmmac: dwmac-sun8i: use return val of readl_poll_timeout() KVM: nVMX: eVMCS: Filter out VM_EXIT_SAVE_VMX_PREEMPTION_TIMER bpf: Add kconfig knob for disabling unpriv bpf by default riscv: fix build with binutils 2.38 ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group ARM: socfpga: fix missing RESET_CONTROLLER nvme-tcp: fix bogus request completion when failing to send AER ACPI/IORT: Check node revision for PMCG resources PM: s2idle: ACPI: Fix wakeup interrupts handling net: bridge: fix stale eth hdr pointer in br_dev_xmit perf probe: Fix ppc64 'perf probe add events failed' case ARM: dts: meson: Fix the UART compatible strings staging: fbtft: Fix error path in fbtft_driver_module_init() ARM: dts: imx6qdl-udoo: Properly describe the SD card detect usb: f_fs: Fix use-after-free for epfile misc: fastrpc: avoid double fput() on failed usercopy ixgbevf: Require large buffers for build_skb on 82599VF bonding: pair enable_port with slave_arr_updates ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path nfp: flower: fix ida_idx not being released net: do not keep the dst cache when uncloning an skb dst and its metadata net: fix a memleak when uncloning an skb dst and its metadata veth: fix races around rq->rx_notify_masked net: mdio: aspeed: Add missing MODULE_DEVICE_TABLE tipc: rate limit warning for received illegal binding update net: amd-xgbe: disable interrupts during pci removal vt_ioctl: fix array_index_nospec in vt_setactivate vt_ioctl: add array_index_nospec to VT_ACTIVATE n_tty: wake up poll(POLLRDNORM) on receiving data eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup usb: ulpi: Move of_node_put to ulpi_dev_release usb: ulpi: Call of_node_put correctly usb: dwc3: gadget: Prevent core from processing stale TRBs usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition USB: gadget: validate interface OS descriptor requests usb: gadget: rndis: check size of RNDIS_MSG_SET command usb: gadget: f_uac2: Define specific wTerminalType USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 USB: serial: option: add ZTE MF286D modem USB: serial: ch341: add support for GW Instek USB2.0-Serial devices USB: serial: cp210x: add NCR Retail IO box id USB: serial: cp210x: add CPI Bulk Coin Recycler id seccomp: Invalidate seccomp mode to catch death failures hwmon: (dell-smm) Speed up setting of fan speed scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled perf: Fix list corruption in perf_cgroup_switch() ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE Linux 5.4.180 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I00a40753600ee33d1cd1a52c5f689b41d3a58dbb	2022-02-16 17:17:22 +01:00
Stefan Berger	8a9511fd10	ima: Do not print policy rule with inactive LSM labels ... commit 89677197ae709eb1ab3646952c44f6a171c9e74c upstream. Before printing a policy rule scan for inactive LSM labels in the policy rule. Inactive LSM labels are identified by args_p != NULL and rule == NULL. Fixes: 483ec26eed42 ("ima: ima/lsm policy rule loading logic bug fixes") Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Cc: <stable@vger.kernel.org> # v5.6+ Acked-by: Christian Brauner <brauner@kernel.org> [zohar@linux.ibm.com: Updated "Fixes" tag] Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:52:47 +01:00
Roberto Sassu	89e51f2ab8	ima: Allow template selection with ima_template[_fmt]= after ima_hash= ... commit bb8e52e4906f148c2faf6656b5106cf7233e9301 upstream. Commit c2426d2ad5 ("ima: added support for new kernel cmdline parameter ima_template_fmt") introduced an additional check on the ima_template variable to avoid multiple template selection. Unfortunately, ima_template could be also set by the setup function of the ima_hash= parameter, when it calls ima_template_desc_current(). This causes attempts to choose a new template with ima_template= or with ima_template_fmt=, after ima_hash=, to be ignored. Achieve the goal of the commit mentioned with the new static variable template_setup_done, so that template selection requests after ima_hash= are not ignored. Finally, call ima_init_template_list(), if not already done, to initialize the list of templates before lookup_template_desc() is called. Reported-by: Guo Zihua <guozihua@huawei.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org Fixes: c2426d2ad5 ("ima: added support for new kernel cmdline parameter ima_template_fmt") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:52:47 +01:00
Stefan Berger	0939988b16	ima: Remove ima_policy file before directory ... commit f7333b9572d0559e00352a926c92f29f061b4569 upstream. The removal of ima_dir currently fails since ima_policy still exists, so remove the ima_policy file before removing the directory. Fixes: 4af4662fa4 ("integrity: IMA policy") Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Cc: <stable@vger.kernel.org> Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:52:47 +01:00
Xiaoke Wang	ea58704f06	integrity: check the return value of audit_log_start() ... commit 83230351c523b04ff8a029a4bdf97d881ecb96fc upstream. audit_log_start() returns audit_buffer pointer on success or NULL on error, so it is better to check the return value of it. Fixes: 3323eec921 ("integrity: IMA as an integrity service provider") Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com> Cc: <stable@vger.kernel.org> Reviewed-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-16 12:52:47 +01:00
Greg Kroah-Hartman	b3174205cf	This is the 5.4.174 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHyVbEACgkQONu9yGCS aT6r6BAA13mGwb3g/n6W1539J2McTd3Wq7HhkvGnOQmJAHJKLzp51QYAXgLbRLCM gUOCPXh6o2gt3+lFrhFy0TE9F1VQY7Igyb2RziF9mdAcvEqcBXL11n6kZHGxx0TO rOpv/SoWMd/QrKC7Ytf5zgH+81dGYWr1L1Ge9g7KWmCev15zAvJQ4mQv6a8CQhCD pUZRBvFx8AGS6q/s9ZPZfvVBcHJDNF89/mkkWNzFgIOcXJh/01JdqNK635stUXu4 +hQYUpG2gj9X2i+e0bc2i95pql7M5OAdX3TBlMeiEjKkyXJuyWTCXSO332QLTeaP xF8Z6JQ0n4W4GI9AgQCWwOaDahtlh6rmpVj+iekeYOMMB6Y5zAoFOIu1DTBEwDK6 F+s5KGfV8t5zkWY6iFOUwHTsjeNc4qqX8B6Br3Yjo7HHBxiggNDD5k4IYe0wAvJL NzOTjdvVbG+qRmhGMQMOpLhDJaHVEJCaXCmv1G97AceaL/RcenUZkn3pQZbn5O7u iMFV620WB0tYyfsiWaQrC7HgVZRyoUYBcxuxdm/g8NqYAPM61HOBKQbyaG9jClyf dq+lnvipJzUmeTsrzkd0NON24HS53hYBZPQjxp7xuoFooBUQjd5iYJvPzeLUm2+g /PlDC4B48pZa3zm8z2amyxf7leaxZUqc2d/J8wSGM/lvaJ3BV7M= =eMMF -----END PGP SIGNATURE----- Merge 5.4.174 into android11-5.4-lts Changes in 5.4.174 HID: uhid: Fix worker destroying device without any protection HID: wacom: Reset expected and received contact counts at the same time HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Avoid using stale array indicies to read contact count f2fs: fix to do sanity check in is_alive() nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 x86/gpu: Reserve stolen memory for first integrated Intel GPU tools/nolibc: x86-64: Fix startup code bug tools/nolibc: i386: fix initial stack alignment tools/nolibc: fix incorrect truncation of exit code rtc: cmos: take rtc_lock while reading from CMOS media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE media: flexcop-usb: fix control-message timeouts media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: cpia2: fix control-message timeouts media: s2255: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: redrat3: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts can: softing_cs: softingcs_probe(): fix memleak on registration failure lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller mm_zone: add function to check if managed dma zone exists mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Reconfigure hardware on resume() drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm/panel: innolux-p079zca: Delete panel on attach() failure drm/rockchip: dsi: Fix unbalanced clock on probe error Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails clk: bcm-2835: Pick the closest clock rate clk: bcm-2835: Remove rounding up the dividers wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: Release DMA channel descriptor allocations media: videobuf2: Fix the size printk format media: aspeed: fix mode-detect always time out at 2nd run media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: Update signal status immediately to ensure sane hw state arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Bluetooth: stop proccessing malicious adv data tee: fix put order in teedev_close_context() media: dmxdev: fix UAF when dvb_register_device() fails crypto: qce - fix uaf on qce_ahash_register_one arm64: dts: ti: k3-j721e: correct cache-sets info tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() media: rcar-csi2: Correct the selection of hsfreqrange media: imx-pxp: Initialize the spinlock prior to using it media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases ACPI: EC: Rework flushing of EC work while suspended to idle drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() arm64: dts: ti: k3-j721e: Fix the L2 cache sets tty: serial: uartlite: allow 64 bit address serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected staging: rtl8192e: return error code from rtllib_softmac_init() staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() Bluetooth: btmtksdio: fix resume failure media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: si2157: Fix "warm" tuner state detection sched/rt: Try to restart rt period timer when rt runtime exceeded rcu/exp: Mark current CPU as exp-QS in IPI loop second pass mwifiex: Fix possible ABBA deadlock xfrm: fix a small bug in xfrm_sa_len() crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - fix lrw chaining mode ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors media: dw2102: Fix use after free media: msi001: fix possible null-ptr-deref in msi001_probe() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes drm/msm/dpu: fix safe status debugfs file drm/bridge: ti-sn65dsi86: Set max register for regmap media: hantro: Fix probe func error path xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding usb: ftdi-elan: fix memory leak on device disconnect ARM: dts: armada-38x: Add generic compatible to UART nodes mmc: meson-mx-sdio: add IRQ check selinux: fix potential memleak in selinux_add_opt() bpftool: Enable line buffering for stdout x86/mce/inject: Avoid out-of-bounds write when setting flags ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). ppp: ensure minimum packet size in ppp_write() rocker: fix a sleeping in atomic bug staging: greybus: audio: Check null pointer fsl/fman: Check for null pointer after calling devm_ioremap Bluetooth: hci_bcm: Check for error irq HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad debugfs: lockdown: Allow reading debugfs files that are not world readable net/mlx5e: Don't block routes with nexthop objects in SW Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5: Set command entry semaphore up once got index free spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe tpm: add request_locality before write TPM_INT_ENABLE can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls RDMA/hns: Validate the pkey index clk: imx8mn: Fix imx8mn_clko1_sels powerpc/prom_init: Fix improper check of prom_getprop() ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA ALSA: oss: fix compile error when OSS_DEBUG is enabled char/mwave: Adjust io port register size binder: fix handling of error during copy iommu/io-pgtable-arm: Fix table descriptor paddr formatting scsi: ufs: Fix race conditions related to driver data PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() powerpc/powermac: Add additional missing lockdep_register_key() RDMA/core: Let ib_find_gid() continue search even after empty entry RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry ASoC: rt5663: Handle device_property_read_u32_array error codes clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell dmaengine: pxa/mmp: stop referencing config->slave_id iommu/iova: Fix race between FQ timeout and teardown phy: uniphier-usb3ss: fix unintended writing zeros to PHY register ASoC: mediatek: Check for error clk pointer ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() RDMA/cxgb4: Set queue pair state when being queried of: base: Fix phandle argument length mismatch error message Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR ARM: shmobile: rcar-gen2: Add missing of_node_put() batman-adv: allow netlink usage in unprivileged containers usb: gadget: f_fs: Use stream_open() for endpoint files drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L HID: apple: Do not reset quirks when the Fn key is not found media: b2c2: Add missing check in flexcop_pci_isr: EDAC/synopsys: Use the quirk for version instead of ddr version mlxsw: pci: Add shutdown method in PCI driver drm/bridge: megachips: Ensure both bridges are probed before registration gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use HSI: core: Fix return freed object in hsi_new_client mwifiex: Fix skb_over_panic in mwifiex_usb_recv() rsi: Fix use-after-free in rsi_rx_done_handler() rsi: Fix out-of-bounds read in rsi_read_pkt() usb: uhci: add aspeed ast2600 uhci support floppy: Add max size check for user space request x86/mm: Flush global TLB when switching to trampoline page-table media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads iwlwifi: mvm: synchronize with FW after multicast commands ath10k: Fix tx hanging net-sysfs: update the queue counts in the unregistration path net: phy: prefer 1000baseT over 1000baseKX gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock x86/mce: Mark mce_panic() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_read_aux() noinstr net: bonding: debug: avoid printing debug logs when bond is not notifying peers bpf: Do not WARN in bpf_warn_invalid_xdp_action() HID: quirks: Allow inverting the absolute X/Y values media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO audit: ensure userspace is penalized the same as the kernel when under pressure arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus arm64: tegra: Adjust length of CCPLEX cluster MMIO region cpufreq: Fix initialization of min and max frequency QoS requests usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream iwlwifi: fix leaks/bad data after failed firmware load iwlwifi: remove module loading failure message iwlwifi: mvm: Fix calculation of frame length um: registers: Rename function names to avoid conflicts and build problems jffs2: GC deadlock reading a page that is used in jffs2_write_begin() ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Fix wrong interpretation of PCC address ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 drm/amdgpu: fixup bad vram size on gmc v8 ACPI: battery: Add the ThinkPad "Not Charging" quirk btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print mac80211: allow non-standard VHT MCS-10/11 dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() net: phy: marvell: configure RGMII delays for 88E1118 net: gemini: allow any RGMII interface mode regulator: qcom_smd: Align probe function with rpmh-regulator serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync random: do not throw away excess input to crng_fast_load parisc: Avoid calling faulthandler_disabled() twice powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put powerpc/watchdog: Fix missed watchdog reset due to memory ordering race i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB powerpc/powermac: Add missing lockdep_register_key() KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST w1: Misuse of get_user()/put_user() reported by sparse scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup ALSA: seq: Set upper limit of processed events powerpc: handle kdump appropriately with crash_kexec_post_notifiers option MIPS: OCTEON: add put_device() after of_find_device_by_node() i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA ASoC: mediatek: mt8173: fix device_node leak power: bq25890: Enable continuous conversion for ADC at charging rpmsg: core: Clean up resources on announce_create failure. crypto: omap-aes - Fix broken pm_runtime_and_get() usage crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: caam - replace this_cpu_ptr with raw_cpu_ptr ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers fuse: Pass correct lend value to filemap_write_and_wait_range() serial: Fix incorrect rs485 polarity on uart open cputime, cpuacct: Include guest time in user time in cpuacct.stat tracing/kprobes: 'nmissed' not showed correctly for kretprobe iwlwifi: mvm: Increase the scan timeout guard to 30 seconds s390/mm: fix 2KB pgtable release race drm/etnaviv: limit submit sizes drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/bridge: analogix_dp: Make PSR-exit block less PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device xfrm: fix policy lookup for ipv6 gre packets btrfs: fix deadlock between quota enable and other quota operations btrfs: check the root node for uptodate before returning it btrfs: respect the max size in the header when activating swap file ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: don't use the orphan list when migrating an inode drm/radeon: fix error handling in radeon_driver_open_kms of: base: Improve argument length mismatch error firmware: Update Kconfig help text for Google firmware media: rcar-csi2: Optimize the selection PHTW register Documentation: dmaengine: Correctly describe dmatest with channel unset Documentation: ACPI: Fix data node reference documentation Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: fix firewire.rst ABI file path error scsi: core: Show SCMD_LAST in text form RDMA/hns: Modify the mapping attribute of doorbell to device RDMA/rxe: Fix a typo in opcode name dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Revert "net/mlx5: Add retry mechanism to the command entry index allocation" powerpc/cell: Fix clang -Wimplicit-fallthrough warning powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses bpftool: Remove inclusion of utilities.mak from Makefiles ipv4: avoid quadratic behavior in netns dismantle net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries f2fs: fix to reserve space for IO align feature af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress clk: si5341: Fix clock HW provider cleanup net: axienet: limit minimum TX ring size net: axienet: fix number of TX ring slots for available check net: axienet: increase default TX ring size to 128 rtc: pxa: fix null pointer dereference inet: frags: annotate races around fqdir->dead and fqdir->high_thresh netns: add schedule point in ops_exit_list() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() perf script: Fix hex dump character output dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition arm64: dts: qcom: msm8996: drop not documented adreno properties net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property dt-bindings: display: meson-vpu: Add missing amlogic,canvas property scripts/dtc: dtx_diff: remove broken example from help text lib82596: Fix IRQ check in sni_82596_probe lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mtd: nand: bbt: Fix corner case in bad block table handling Revert "ia64: kprobes: Use generic kretprobe trampoline handler" Linux 5.4.174 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia656821e4377afa7ca279a6ed92195989be831b3	2022-01-31 15:14:13 +01:00
Bernard Zhao	eb599bf3ba	selinux: fix potential memleak in selinux_add_opt() ... [ Upstream commit 2e08df3c7c4e4e74e3dd5104c100f0bf6288aaa8 ] This patch try to fix potential memleak in error branch. Fixes: ba64186233 ("selinux: new helper - selinux_add_opt()") Signed-off-by: Bernard Zhao <bernard@vivo.com> [PM: tweak the subject line, add Fixes tag] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 09:19:35 +01:00
Greg Kroah-Hartman	7ada083540	This is the 5.4.170 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHVgw8ACgkQONu9yGCS aT71vhAAgVauEQ0nyXBUsH7vqKS6tYdcjoOor8FdNYSfoZ7iY6MptIdtHMVA0MxZ 793CRZDc7cyNtNVhGIomSzLPI4Nb/U5g57xfGrIQZ9Yzv1vcDsC8iEU1GLELWVAO 1gX6oyVJMXQb4JrbGGdP3QPqLPa6ekZ07c3/Dt2p32e+yqm3JvrcaDqklR7qSzBi Nx6VWp2ZxbvDqmzhzzVX+wWoB1darxp1I08ZgPMqsAbn78MelxrOxp8asNVuJQip KusrhdA4xSrXHfzYj1oxSAWctA0mlHJVie+/x+DPDKDP7/zIop+58fEbSEPLcDHA d+19gkNuNR0CtmEPACm/DAPU/iKiuK1YhmfGvPWQHdQCGQxxMKAdS0sH7BqQ2NU6 c7QiRA0Q3JNc+D2TGO5e2u1D5jqsVnBRaEAOnrHwnX6Dx27I8vwIsSKF1Si6TCdU S7whO8n1r7are5Ahaak25qR83wIpn/2fL4Q0AzP7Ox9kue7ceDQ42RfPzNoYh3LS ITJxRbxZYsnOHjlDS4dc5Hih+WioclSALmYhzSbWsjepzyv0EVEup6vzBffY5A4k ENlXQOCV7jZdfZ+ZdMI+kR9cTGO1F7Le5UKp4H+a0qpY/MWIlUI1C7qWDp5YZTsi 2iYwzrOpKCgqrMBhAR2jHeqmqItkal1dsTvrh2Lwc+3FPYRjNoo= =Lkh+ -----END PGP SIGNATURE----- Merge 5.4.170 into android11-5.4-lts Changes in 5.4.170 HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option tee: handle lookup of shm with reference count 0 Input: i8042 - add deferred probe support Input: i8042 - enable deferred probe quirk for ASUS UM325UA tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). platform/x86: apple-gmux: use resource_size() with res memblock: fix memblock_phys_alloc() section mismatch error recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment sctp: use call_rcu to free endpoint net: usb: pegasus: Do not drop long Ethernet frames net: lantiq_xrx200: fix statistics of received bytes NFC: st21nfca: Fix memory leak in device probe and remove ionic: Initialize the 'lif->dbid_inuse' bitmap net/mlx5e: Fix wrong features assignment in case of error selftests/net: udpgso_bench_tx: fix dst ip argument net/ncsi: check for error return from call to nla_put_u32 fsl/fman: Fix missing put_device() call in fman_port_probe i2c: validate user data in compat ioctl nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler perf script: Fix CPU filtering of a script's switch events Linux 5.4.170 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic66d754505081f001b420af0ee4c8da1edf5c27f	2022-01-05 13:23:05 +01:00
Tom Rix	44937652af	selinux: initialize proto variable in selinux_ip_postroute_compat() ... commit 732bc2ff080c447f8524f40c970c481f5da6eed3 upstream. Clang static analysis reports this warning hooks.c:5765:6: warning: 4th function call argument is an uninitialized value if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ selinux_parse_skb() can return ok without setting proto. The later call to selinux_xfrm_postroute_last() does an early check of proto and can return ok if the garbage proto value matches. So initialize proto. Cc: stable@vger.kernel.org Fixes: eef9b41622 ("selinux: cleanup selinux_xfrm_sock_rcv_skb() and selinux_xfrm_postroute_last()") Signed-off-by: Tom Rix <trix@redhat.com> [PM: typo/spelling and checkpatch.pl description fixes] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:37:44 +01:00
Dmitry Vyukov	930d4986a4	tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). ... [ Upstream commit 04e57a2d952bbd34bc45744e72be3eecdc344294 ] If tomoyo is used in a testing/fuzzing environment in learning mode, for lots of domains the quota will be exceeded and stay exceeded for prolonged periods of time. In such cases it's pointless (and slow) to walk the whole acl list again and again just to rediscover that the quota is exceeded. We already have the TOMOYO_DIF_QUOTA_WARNED flag that notes the overflow condition. Check it early to avoid the slowdown. [penguin-kernel] This patch causes a user visible change that the learning mode will not be automatically resumed after the quota is increased. To resume the learning mode, administrator will need to explicitly clear TOMOYO_DIF_QUOTA_WARNED flag after increasing the quota. But I think that this change is generally preferable, for administrator likely wants to optimize the acl list for that domain before increasing the quota, or that domain likely hits the quota again. Therefore, don't try to care to clear TOMOYO_DIF_QUOTA_WARNED flag automatically when the quota for that domain changed. Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-05 12:37:43 +01:00
Greg Kroah-Hartman	5ba000444a	This is the 5.4.167 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG8VH8ACgkQONu9yGCS aT5J7g/+L4U69OjgLPKllqMk5nNOJqG3RQz008cgUpSo311OPZla3wlI7mGBtd7+ CUy/XEa7ZJ+4DZyedxR88eOrgMyaBS0flIE7Arg4hqRD1YNJBPcOF1ZRvk1K46RH qonIgWgAiWLuHlH5aQ88qgzRqeFkwBg6x3+YyBYLRX8S5w5ylvUd+w1werzji2U6 uDBSj/o8Yre7jjnBMmSBa3IP5WHBHbxgooyhostsywn60+nyNVZwN7pFbryIZual h1M6txLuNrpIOalf+qBbgcCilve+3/4ILCy+0FtrOhL+7FAeawqlNiWDgdSKoEV0 eBBYoZyxDOaf5wpN3PuW29C1pMKlV2hzOm4jslXuDl29E61ZB9HcXcHZk4REWm8C AasjP+cKj2QSqBwHFqU68ezU/CEszlbhjoJ6Za2QQXRsbtdYTyfIeH25fL9b+WWm L5aIaIlHmegPRsDtDXgeBckwsz6KgMZT9iQ1r6B3JkeRC1cxqHn5alDSPJs7tNVo qQdl0f8LsTLV2g+kLl2AaA0I+ESXrAVOXhdAxBIO++6EkX8TzmYXujdt9b39uOBp FDAtmSR4dFmphlIn6OGgSbbME1Ri8dEwaUWiOgLRPJaa9J41Jf0ykFFbOV4Vdgbe 5gIsZ8/+Jh0NoRs6cdsg1TwKhGBAEIrHBTOM/Ys7MUzxk9E3iBY= =aOVH -----END PGP SIGNATURE----- Merge 5.4.167 into android11-5.4-lts Changes in 5.4.167 nfc: fix segfault in nfc_genl_dump_devices_done drm/msm/dsi: set default num_data_lanes net/mlx4_en: Update reported link modes for 1/10G parisc/agp: Annotate parisc agp init functions with __init i2c: rk3x: Handle a spurious start completion interrupt flag net: netlink: af_netlink: Prevent empty skb by adding a check on len. drm/amd/display: Fix for the no Audio bug with Tiled Displays drm/amd/display: add connector type check for CRC source set tracing: Fix a kmemleak false positive in tracing_map KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req selinux: fix race condition when computing ocontext SIDs bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc hwmon: (dell-smm) Fix warning on /proc/i8k creation error memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER memblock: align freed memory map on pageblock boundaries with SPARSEMEM memblock: ensure there is no overflow in memblock_overlaps_region() arm: extend pfn_valid to take into account freed memory map alignment arm: ioremap: don't abuse pfn_valid() to check if pfn is in RAM Linux 5.4.167 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1b912710dd31dba153eb6d859856462ea4c01ddd	2021-12-17 13:08:20 +01:00
Ondrej Mosnacek	b06b1f4630	selinux: fix race condition when computing ocontext SIDs ... commit cbfcd13be5cb2a07868afe67520ed181956579a7 upstream. Current code contains a lot of racy patterns when converting an ocontext's context structure to an SID. This is being done in a "lazy" fashion, such that the SID is looked up in the SID table only when it's first needed and then cached in the "sid" field of the ocontext structure. However, this is done without any locking or memory barriers and is thus unsafe. Between commits 24ed7fdae6 ("selinux: use separate table for initial SID lookup") and 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table"), this race condition lead to an actual observable bug, because a pointer to the shared sid field was passed directly to sidtab_context_to_sid(), which was using this location to also store an intermediate value, which could have been read by other threads and interpreted as an SID. In practice this caused e.g. new mounts to get a wrong (seemingly random) filesystem context, leading to strange denials. This bug has been spotted in the wild at least twice, see [1] and [2]. Fix the race condition by making all the racy functions use a common helper that ensures the ocontext::sid accesses are made safely using the appropriate SMP constructs. Note that security_netif_sid() was populating the sid field of both contexts stored in the ocontext, but only the first one was actually used. The SELinux wiki's documentation on the "netifcon" policy statement [3] suggests that using only the first context is intentional. I kept only the handling of the first context here, as there is really no point in doing the SID lookup for the unused one. I wasn't able to reproduce the bug mentioned above on any kernel that includes commit 66f8e2f03c02, even though it has been reported that the issue occurs with that commit, too, just less frequently. Thus, I wasn't able to verify that this patch fixes the issue, but it makes sense to avoid the race condition regardless. [1] https://github.com/containers/container-selinux/issues/89 [2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/ [3] https://selinuxproject.org/page/NetworkStatements#netifcon Cc: stable@vger.kernel.org Cc: Xinjie Zheng <xinjie@google.com> Reported-by: Sujithra Periasamy <sujithra@google.com> Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> [vijayb: Backport contextual differences are due to v5.10 RCU related changes are not in 5.4] Signed-off-by: Vijay Balakrishna <vijayb@linux.microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-17 10:12:24 +01:00
Greg Kroah-Hartman	b2d37d0916	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: b0f930a58e BACKPORT: f2fs: relocate inline conversion from mmap() to mkwrite() 4f4602b711 BACKPORT: f2fs: support RO feature e6fd4c5c6a BACKPORT: f2fs: fix wrong total_sections check and fsmeta check ce664fbdcc BACKPORT: FROMGIT: binder: fix freeze race b1232b020f FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl a02d0f685d FROMGIT: binder: use EINTR for interrupted wait for work e658e9e4bc BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl 63ef444773 ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request 50c9c8cb33 FROMGIT: binder: fix test regression due to sender_euid change 1c1f571840 BACKPORT: binder: use cred instead of task for getsecid ea1a2391d5 BACKPORT: binder: use cred instead of task for selinux checks 1fe8a2bb64 BACKPORT: binder: use euid from cred instead of using task a080050156 ANDROID: setlocalversion: make KMI_GENERATION optional e785a25f52 Revert "ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC" Change-Id: Ica7d80e62dcd4b12f7294bcc4b5c9291491ad37b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-12-09 11:01:27 +01:00
Greg Kroah-Hartman	26b09f181d	This is the 5.4.161 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGaPeoACgkQONu9yGCS aT4y9RAArO/V2GJCWb2hbycStqH/oLKxDnY2Du0fji5uj7iKaN1wzW2DT5tNstlZ I/aJS5ULZ8IYV/otIxzpCLzc0EHJ82sSqA8l2TgtK/SaqkoWABzcNdeZC3KPoAy+ QLyDIlSIXc2ODhf7Q8sk+6Pxwa5IPjNchKbtjJpaqM3YnMApJ+ub4M89toI6kYYd G9F8BbjCyJ7FQ4TcIXQQG2L+XHWGPXGk/WDrFUlMyj5n4ztOjXMbbT/VmWJdf6cA hyYj1AKfekhKYdb21/ko/6z8D1wlrnZ2OBVVSJJdwbN7VnNB2bA2rxTzds7vJzzW z8dqb3WTnNwkxaoTsKxV59Ii2ienrb7RU60QU9jHg1Yef8g7o7KYknF08OoTl4C5 z2dwxlxr76KR6u19L5jgLSYg/0HXYWNhDq5lyLsDJbrbWjWOFtRIe1jqVc/v3+4f nl54wztGqj0aBGZUsqtK4Ypjs4LJxDD1LqXSKgN9AbZjWq6jtcj25deXPuQNWoBh cZ8PXMD3L6Vl27brHYZ4EmAoLlVQRAdqD4sicUParyMhincb10Eil6xI8ipbvRbR ij0VXhfu6uV/qMfL6nGznIKbbBnK4EgrDzNCAlYC+CiXQvDCHdulZ2Bz3VzK5J3q fIkfSE1DZCwXOzP4JJ43M01BkAk/eOoHI9n4sPC6HZOtokAoIVg= =01H9 -----END PGP SIGNATURE----- Merge 5.4.161 into android11-5.4-lts Changes in 5.4.161 soc/tegra: pmc: Fix imbalanced clock disabling in error code path scsi: ufs: Fix interrupt error message for shared interrupts MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL ext4: fix lazy initialization next schedule time computation in more granular unit scsi: ufs: Fix tm request when non-fatal error happens fortify: Explicitly disable Clang support parisc/entry: fix trace test in syscall exit path PCI/MSI: Destroy sysfs before freeing entries PCI/MSI: Deal with devices lying about their MSI mask capability PCI: Add MSI masking quirk for Nvidia ION AHCI erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() erofs: fix unsafe pagevec reuse of hooked pclusters Linux 5.4.161 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5c1942d0f5c822a788147c7ade349701a9451cee	2021-11-21 15:34:05 +01:00
Kees Cook	258c42a8fb	fortify: Explicitly disable Clang support ... commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream. Clang has never correctly compiled the FORTIFY_SOURCE defenses due to a couple bugs: Eliding inlines with matching __builtin_* names https://bugs.llvm.org/show_bug.cgi?id=50322 Incorrect __builtin_constant_p() of some globals https://bugs.llvm.org/show_bug.cgi?id=41459 In the process of making improvements to the FORTIFY_SOURCE defenses, the first (silent) bug (coincidentally) becomes worked around, but exposes the latter which breaks the build. As such, Clang must not be used with CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13), and the fortify routines have been rearranged. Update the Kconfig to reflect the reality of the current situation. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com Cc: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-21 13:38:50 +01:00
Todd Kjos	ea1a2391d5	BACKPORT: binder: use cred instead of task for selinux checks ... commit 52f88693378a58094c538662ba652aff0253c4fe upstream. Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used. Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem. Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: I9053ce58e7449b92928ed8a17148a598b5c40f21 Bug: 200688826 [ resolved minor conflict ] Signed-off-by: Todd Kjos <tkjos@google.com>	2021-11-19 16:58:43 -08:00
Greg Kroah-Hartman	91a7552bea	This is the 5.4.160 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGUwhUACgkQONu9yGCS aT4hlBAAjcjBBtJ7IuVRAbJhRSIW3H0viMdPTBvydSNwSF6mk9BL56CQ+OyAGLaB Fnb5DNxhIO9DAbwuvBW4wEJibSA1Q4191bRjZEKrf70LRdmA51vz0dBu2KRNV+IV HWtJYyXIyqqU/EXPsVmdmNFxr6YUCUmkyEaE18/rsg/cZmMg/Zot434cnSuzVzrW 9yLQVQAs7CAKD7kICZ/S7P7V1IKQyuLj5meX2BBE24YwukvlA9N5ISXGQuW91683 iqv0cfjwYtfrNMOE7K2AKrDgZ0AxuLrIiyppqHjHPB+zIvgm2ErQU+Hp76hVtWpW yP0cq6ReP3ktc9Hmxr49xU1l3D/6jo+OyqQh5eomP2veGpRh3dq+oe1VoN7Iw9Xg YBvjOuononlBoChsddlbxwQTZIXff9MvOK2zADmHM0740xTlqSIgw6ITdg/lyKG8 7QbM6pSepXKVXDhHtbEQQGIJP/SvLyjGKX5pJjTKQ0cemkGJ/Sp/HNHMlf/CRLen LsS2kHCuBTWKQP0NJaAIp0J3lNfcCnB8Cv2BhmkHkVPx0jEvlZKDVJqdH7tbpIdy hdR9vwq9neBIjAiTFMEAuV1/+zGR4zNqiocUXhkIC9BAzrBKinyct78kV2trVOc2 J4lFhpOv1I9/HwaqP6kYnJW+nNoMzN3sD0uT8fk8dlYo5GBvbVk= =YkOP -----END PGP SIGNATURE----- Merge 5.4.160 into android11-5.4-lts Changes in 5.4.160 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform binder: use euid from cred instead of using task binder: use cred instead of task for selinux checks binder: use cred instead of task for getsecid Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path mmc: dw_mmc: Dont wait for DRTO on Write RSP error parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: ite-cir: IR receiver stop working after receive overflow media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload cavium: Return negative value when pci_alloc_irq_vectors() fails scsi: qla2xxx: Return -ENOMEM if kzalloc() fails scsi: qla2xxx: Fix unmap of already freed sgl cavium: Fix return values of the probe function sfc: Don't use netif_info before net_device setup hyperv/vmbus: include linux/bitops.h ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode reset: socfpga: add empty driver allowing consumers to probe mmc: winbond: don't build on M68K drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT bpf: Prevent increasing bpf_jit_limit above max xen/netfront: stop tx queues during live migration nvmet-tcp: fix a memory leak when releasing a queue spi: spl022: fix Microwire full duplex mode net: multicast: calculate csum of looped-back and forwarded packets watchdog: Fix OMAP watchdog early handling drm: panel-orientation-quirks: Add quirk for GPD Win3 nvmet-tcp: fix header digest verification r8169: Add device 10ec:8162 to driver r8169 vmxnet3: do not stop tx queues after netif_device_detach() nfp: bpf: relax prog rejection for mtu check through max_pkt_offset net/smc: Correct spelling mistake to TCPF_SYN_RECV btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device ia64: kprobes: Fix to pass correct trampoline address to the handler hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init wcn36xx: Fix HT40 capability for 2Ghz band mwifiex: Read a PCI register after writing the TX ring write pointer libata: fix checking of DMA state wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description RDMA/qedr: Fix NULL deref for query_qp on the GSI QP signal: Remove the bogus sigkill_pending in ptrace_stop signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found serial: core: Fix initializing and restoring termios speed ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume xen/balloon: add late_initcall_sync() for initial ballooning done PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() pinctrl: core: fix possible memory leak in pinctrl_enable() iio: dac: ad5446: Fix ad5622_write() return value USB: serial: keyspan: fix memleak on probe errors USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() drm/panel-orientation-quirks: add Valve Steam Deck platform/x86: wmi: do not fail if disabling fails MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes smackfs: Fix use-after-free in netlbl_catmap_walk() x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes ath10k: high latency fixes for beacon buffer media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: imx: set a media_device bus_info string media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic ACPICA: Avoid evaluating methods too early during system resume media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually tracefs: Have tracefs directories not set OTH permission bits by default ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full leaking_addresses: Always print a trailing newline memstick: r592: Fix a UAF bug when removing the driver lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_* functions signature mismatch mwl8k: Fix use-after-free in mwl8k_fw_state_machine() block: remove inaccurate requeue check nvmet: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression Bluetooth: fix init and cleanup of sco_conn.timeout_work rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() drm/v3d: fix wait for TMU write combiner flush virtio-gpu: fix possible memory allocation failure net: net_namespace: Fix undefined member in key_remove_domain() cgroup: Make rebind_subsystems() disable v2 controllers all at once wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync crypto: caam - disable pkc for non-E SoCs rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() net: dsa: rtl8366rb: Fix off-by-one bug ath10k: Fix missing frame timestamp for beacon/probe-resp drm/amdgpu: fix warning for overflow check media: em28xx: add missing em28xx_close_extension media: cxd2880-spi: Fix a null pointer dereference on error handling path media: dvb-usb: fix ununit-value in az6027_rc_query media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath9k: Fix potential interrupt storm on queue reset EDAC/amd64: Handle three rank interleaving mode netfilter: nft_dynset: relax superfluous check on set updates media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops b43legacy: fix a lower bounds test b43: fix a lower bounds test mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() mmc: mxs-mmc: disable regulator on error and in the remove function block: ataflop: fix breakage introduced at blk-mq refactoring platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mt76: mt76x02: fix endianness warnings in mt76x02_mac.c rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec phy: micrel: ksz8041nl: do not use power down mode nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF drm/msm: Fix potential NULL dereference in DPU SSPP smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi libbpf: Fix BTF data layout checks and allow empty BTF s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() irq: mips: avoid nested irq_enter() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits net: amd-xgbe: Toggle PLL settings during rate change net: phylink: avoid mvneta warning when setting pause parameters crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts RDMA/rxe: Fix wrong port_cap_flags clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: meson-g12a: Fix the pwm regulator supply properties ARM: dts: at91: tse850: the emac<->phy interface is rmii scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount ALSA: hda: Reduce udelay() at SKL+ position reporting arm: dts: omap3-gta04a4: accelerometer irq fix soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops video: fbdev: chipsfb: use memset_io() instead of memset() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC ARM: dts: stm32: fix SAI sub nodes register range ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER phy: qcom-qusb2: Fix a memory leak on probe serial: xilinx_uartps: Fix race condition causing stuck TX HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/44x/fsp2: add missing of_node_put mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() fs: orangefs: fix error return code of orangefs_revalidate_lookup() mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() mtd: core: don't remove debugfs directory if device is in use dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip NFSv4: Fix a regression in nfs_set_open_stateid_locked() i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' xen-pciback: Fix return in pm_ctrl_init() net: davinci_emac: Fix interrupt pacing disable net: vlan: fix a UAF in vlan_dev_real_dev() ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: allow configure ETS bandwidth of all TCs vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names parisc: Fix set_fixmap() on PA1.x CPUs irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors ovl: fix deadlock in splice write powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF video: backlight: Drop maximum brightness override for brightness zero s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/cio: make ccw_device_dma_* more robust powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros SUNRPC: Partial revert of commit 6f9f17287e78 ath10k: fix invalid dma_addr_t token assignment selftests/bpf: Fix also no-alu32 strobemeta selftest Linux 5.4.160 Note, binder* patches were manually reverted as part of this merge, they are not present in this merge point at all. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1fb759dd89408adbe9b9ac1527af51bfdc4059de	2021-11-17 10:19:21 +01:00
Tom Rix	bd48bdbfd9	apparmor: fix error check ... [ Upstream commit d108370c644b153382632b3e5511ade575c91c86 ] clang static analysis reports this representative problem: label.c:1463:16: warning: Assigned value is garbage or undefined label->hname = name; ^ ~~~~ In aa_update_label_name(), this the problem block of code if (aa_label_acntsxprint(&name, ...) == -1) return res; On failure, aa_label_acntsxprint() has a more complicated return that just -1. So check for a negative return. It was also noted that the aa_label_acntsxprint() main comment refers to a nonexistent parameter, so clean up the comment. Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels") Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-17 09:48:44 +01:00
Tetsuo Handa	03a818c096	smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi ... [ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ] syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi() is calling kfree() without removing from the cipso_v4_doi_list list after netlbl_cfg_cipsov4_map_add() returned an error. We need to use netlbl_cfg_cipsov4_del() in order to remove from the list and wait for RCU grace period before kfree(). Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd [1] Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: 6c2e8ac095 ("netlabel: Update kernel configuration API") Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-17 09:48:39 +01:00
Tetsuo Handa	681a426e6b	smackfs: use __GFP_NOFAIL for smk_cipso_doi() ... [ Upstream commit f91488ee15bd3cac467e2d6a361fc2d34d1052ae ] syzbot is reporting kernel panic at smk_cipso_doi() due to memory allocation fault injection [1]. The reason for need to use panic() was not explained. But since no fix was proposed for 18 months, for now let's use __GFP_NOFAIL for utilizing syzbot resource on other bugs. Link: https://syzkaller.appspot.com/bug?extid=89731ccb6fec15ce1c22 [1] Reported-by: syzbot <syzbot+89731ccb6fec15ce1c22@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-17 09:48:32 +01:00
Pawan Gupta	91b9c23b6d	smackfs: Fix use-after-free in netlbl_catmap_walk() ... [ Upstream commit 0817534ff9ea809fac1322c5c8c574be8483ea57 ] Syzkaller reported use-after-free bug as described in [1]. The bug is triggered when smk_set_cipso() tries to free stale category bitmaps while there are concurrent reader(s) using the same bitmaps. Wait for RCU grace period to finish before freeing the category bitmaps in smk_set_cipso(). This makes sure that there are no more readers using the stale bitmaps and freeing them should be safe. [1] https://lore.kernel.org/netdev/000000000000a814c505ca657a4e@google.com/ Reported-by: syzbot+3f91de0b813cc3d19a80@syzkaller.appspotmail.com Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-17 09:48:28 +01:00
Austin Kim	301d33c954	evm: mark evm_fixmode as __ro_after_init ... commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream. The evm_fixmode is only configurable by command-line option and it is never modified outside initcalls, so declaring it with __ro_after_init is better. Signed-off-by: Austin Kim <austin.kim@lge.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-17 09:48:23 +01:00
Todd Kjos	fc9c470cd5	binder: use cred instead of task for selinux checks ... commit 52f88693378a58094c538662ba652aff0253c4fe upstream. Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used. Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem. Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-17 09:48:16 +01:00
Greg Kroah-Hartman	3197361248	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: bfb2ce3eb1 ANDROID: GKI: rework the ANDROID_KABI_USE() macro to not use __UNIQUE() 937e6e41cc UPSTREAM: security: selinux: allow per-file labeling for bpffs Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5c3546d9d9a2216f2f81a86e2824fa2de9a6bd8c	2021-11-11 10:13:47 +01:00
Connor O'Brien	937e6e41cc	UPSTREAM: security: selinux: allow per-file labeling for bpffs ... Add support for genfscon per-file labeling of bpffs files. This allows for separate permissions for different pinned bpf objects, which may be completely unrelated to each other. Signed-off-by: Connor O'Brien <connoro@google.com> Signed-off-by: Steven Moreland <smoreland@google.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 4ca54d3d3022ce27170b50e4bdecc3a42f05dbdc) [which is v5.6-rc1-10-g4ca54d3d3022 and thus already included in 5.10] Bug: 200440527 Change-Id: I8234b9047f29981b8140bd81bb2ff070b3b0b843 (cherry picked from commit d52ac987ad2ae16ff313d7fb6185bc412cb221a4)	2021-11-04 19:18:42 +00:00
Greg Kroah-Hartman	5b84549191	Merge tag 'android11-5.4.147_r00' android11-5.4 ... This is the merge of the upstream LTS release of 5.4.147 into the android11-5.4 branch. It contains the following commits: 5e10f36746 Merge 5.4.147 into android11-5.4-lts 48a24510c3 Linux 5.4.147 1f8ee02449 Revert "time: Handle negative seconds correctly in timespec64_to_ns()" dc15f641c6 Revert "posix-cpu-timers: Force next expiration recalc after itimer reset" 541e757944 Revert "block: nbd: add sanity check for first_minor" 5f3ecbf4d5 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue" d756462d85 Merge 5.4.146 into android11-5.4-lts 245f15a48c Linux 5.4.146 b40facee46 clk: kirkwood: Fix a clocking boot regression 8810c51077 backlight: pwm_bl: Improve bootloader/kernel device handover 5de2ee621b fbmem: don't allow too huge resolutions 4a95b04afa IMA: remove the dependency on CRYPTO_MD5 c69935f0b0 IMA: remove -Wmissing-prototypes warning 85b0726d5b fuse: flush extending writes 8a98ced6e1 fuse: truncate pagecache on atomic_o_trunc 06dad664d4 KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter 1735cec1e8 KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted 20fff3ef33 KVM: s390: index kvm->arch.idle_mask by vcpu_idx 0323ab5b25 x86/resctrl: Fix a maybe-uninitialized build warning treated as error 51f4575ca1 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op 03c3e977ee tty: Fix data race between tiocsti() and flush_to_ldisc() 7a25a0a94c time: Handle negative seconds correctly in timespec64_to_ns() ae968e270f bpf: Fix pointer arithmetic mask tightening under state pruning a0a4778fea bpf: verifier: Allocate idmap scratch in verifier env f5893af270 bpf: Fix leakage due to insufficient speculative store bypass mitigation e80c3533c3 bpf: Introduce BPF nospec instruction for mitigating Spectre v4 1c9424a765 ipv4: fix endianness issue in inet_rtm_getroute_build_skb() b3fe6d1921 octeontx2-af: Fix loop in free and unmap counter 8216d7157b net: qualcomm: fix QCA7000 checksum handling 4648917e49 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed e46e23c289 ipv4: make exception cache less predictible f73cbdd1b8 ipv6: make exception cache less predictible aa167dcde4 brcmfmac: pcie: fix oops on failure to resume and reprobe 5debec63a2 bcma: Fix memory leak for internally-handled cores 574e563649 ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() d946e685d6 ASoC: wcd9335: Disable irq on slave ports in the remove function f3ec07f832 ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function a6088f4ed3 ASoC: wcd9335: Fix a double irq free in the remove function 7bfa680f3b tty: serial: fsl_lpuart: fix the wrong mapbase value 0f1375fa69 usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available 06203abb72 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe a0a9ecca2d i2c: mt65xx: fix IRQ check b444064a0e CIFS: Fix a potencially linear read overflow e37eeaf950 bpf: Fix possible out of bound write in narrow load handling fb8e695e9c mmc: moxart: Fix issue with uninitialized dma_slave_config 48b1f117e8 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config 57314d8414 ASoC: Intel: Skylake: Fix module resource and format selection 92397571c2 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs b58cf18e38 rsi: fix an error code in rsi_probe() d82fe3dd0b rsi: fix error code in rsi_load_9116_firmware() 4be8deab6f i2c: s3c2410: fix IRQ check da3e5f3204 i2c: iop3xx: fix deferred probing 2da3272ae0 Bluetooth: add timeout sanity check to hci_inquiry 70d71611eb mm/swap: consider max pages in iomap_swapfile_add_extent 8f5e26053c usb: gadget: mv_u3d: request_irq() after initializing UDC eb3c6a2501 nfsd4: Fix forced-expiry locking 81e69d3fdd lockd: Fix invalid lockowner cast after vfs_test_lock e1c02e2e6a mac80211: Fix insufficient headroom issue for AMSDU 606668e24a usb: phy: tahvo: add IRQ check ecf18ac8ff usb: host: ohci-tmio: add IRQ check abbcd61d09 Bluetooth: Move shutdown callback before flushing tx and rx queue 93ec1fd04f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse 30d9607bcd usb: phy: twl6030: add IRQ checks e1473ac285 usb: phy: fsl-usb: add IRQ check 9535f55d0c usb: gadget: udc: at91: add IRQ check 05e5b16b79 drm/msm/dsi: Fix some reference counted resource leaks 5ccb04c6e1 Bluetooth: fix repeated calls to sco_sock_kill c2451d5439 counter: 104-quad-8: Return error when invalid mode during ceiling_write a1194b805c arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 1b6fcd1037 drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs 156eaacba3 PM: EM: Increase energy calculation precision 5537dc810b Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow c0faa638f0 debugfs: Return error during {full/open}_proxy_open() on rmmod f44714b4eb soc: qcom: smsm: Fix missed interrupts if state changes while masked e7997fe3e9 PCI: PM: Enable PME if it can be signaled from D3cold 9e570f3d47 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently f865b316cc media: venus: venc: Fix potential null pointer dereference on pointer fmt d2ea2f0725 media: em28xx-input: fix refcount bug in em28xx_usb_disconnect ebf570042b leds: trigger: audio: Add an activate callback to ensure the initial brightness is set 0a01dc7766 leds: lt3593: Put fwnode in any case during ->probe() e39c73563a i2c: highlander: add IRQ check fba783ddd9 net: cipso: fix warnings in netlbl_cipsov4_add_std 9fdac650c4 cgroup/cpuset: Fix a partition bug with hotplug ffde058199 net/mlx5e: Prohibit inner indir TIRs in IPoIB 87f817c560 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties e55d7cbe1f ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties 4b0bbc412b ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties f7058060c0 ARM: dts: meson8: Use a higher default GPU clock frequency 37ed461b52 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos 9521362753 drm/amdgpu/acp: Make PM domain really work 252fad3d02 netns: protect netns ID lookups with RCU bd1cd32caa 6lowpan: iphc: Fix an off-by-one check of array index c4895cf45f Bluetooth: sco: prevent information leak in sco_conn_defer_accept() a96eb96ce4 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats 7163014d7d media: go7007: remove redundant initialization 8101492879 media: dvb-usb: Fix error handling in dvb_usb_i2c_init fa8aaa7690 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr 88933f9c93 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init f81c89614e soc: qcom: rpmhpd: Use corner in power_off 5b3987f583 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties 6c106c7320 ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi 004778bf39 bpf: Fix potential memleak and UAF in the verifier. fa4802c54e bpf: Fix a typo of reuseport map in bpf.h. 9a193caf9d media: cxd2880-spi: Fix an error handling path 34106f5260 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally b928930530 media: TDA1997x: enable EDID support 43282ca83a drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() fc9cf22290 EDAC/i10nm: Fix NVDIMM detection 32d8a3684b spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible 4206dbc985 spi: sprd: Fix the wrong WDG_LOAD_VAL 1f70517eac regulator: vctrl: Avoid lockdep warning in enable/disable ops d255d6a645 regulator: vctrl: Use locked regulator_get_voltage in probe path 013177ccc4 certs: Trigger creation of RSA module signing key if it's not an RSA key cc74533a47 crypto: qat - use proper type for vf_mask b3fa499d72 block: nbd: add sanity check for first_minor c60a31db39 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel 6b10d3d3a9 lib/mpi: use kcalloc in mpi_resize 57c8e2ea47 genirq/timings: Fix error return code in irq_timings_test_irqs() 2d00b22c8b spi: spi-pic32: Fix issue with uninitialized dma_slave_config b29593d069 spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config 449884aeb3 sched: Fix UCLAMP_FLAG_IDLE setting 67da2d9c9e m68k: emu: Fix invalid free in nfeth_cleanup() c68ba4a708 s390/debug: fix debug area life cycle 7a67a00ea8 s390/kasan: fix large PMD pages address alignment check 98296eb3de udf_get_extendedattr() had no boundary checks. ae4240d1f4 fcntl: fix potential deadlock for &fasync_struct.fa_lock a6273c8c2a crypto: qat - do not export adf_iov_putmsg() 7dfa7bb69e crypto: qat - fix naming for init/shutdown VF to PF notifications 843b4e713a crypto: qat - fix reuse of completion variable 4a98826455 crypto: qat - handle both source of interrupt in VF ISR c2b3f81125 crypto: qat - do not ignore errors from enable_vf2pf_comms() 1c189ccef0 libata: fix ata_host_start() e55b627d6e s390/cio: add dev_busid sysfs entry for each subchannel 0423517520 power: supply: max17042_battery: fix typo in MAx17042_TOFF eb45ae88bf nvmet: pass back cntlid on successful completion 6cb5d6ae68 nvme-rdma: don't update queue count when failing to set io queues 3073ec7f06 nvme-tcp: don't update queue count when failing to set io queues 93cf19b4d9 bcache: add proper error unwinding in bcache_device_init e55f20798f isofs: joliet: Fix iocharset=utf8 mount option 0f5cd92e5e udf: Fix iocharset=utf8 mount option 86987cf0fb udf: Check LVID earlier cc608af36e hrtimer: Ensure timerfd notification for HIGHRES=n a845787830 hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() c322a963d5 posix-cpu-timers: Force next expiration recalc after itimer reset 28996dbb8a rcu/tree: Handle VM stoppage in stall detection b7c560ae51 sched/deadline: Fix missing clock update in migrate_task_rq_dl() 40db13e3ef crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() ebf0f71ae3 power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors bba2b82d1b sched/deadline: Fix reset_on_fork reporting of DL tasks 53a6ef40c6 crypto: mxs-dcp - Check for DMA mapping errors 344a38789a regmap: fix the offset of register error log a5e42516a6 locking/mutex: Fix HANDOFF condition f019fa5605 Merge branch 'android11-5.4' into 'android11-5.4-lts' 80833b7bc2 ANDROID: GKI: db845c: Update symbols list and ABI for lts v5.4.144 9ccfa71ab0 Merge 5.4.145 into android11-5.4-lts a0f68fb55e Linux 5.4.145 d83f0b39e7 PCI: Call Max Payload Size-related fixup quirks early 0c8277e334 x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions d31a4c35b9 xhci: fix unsafe memory usage in xhci tracing e00d39ca92 usb: mtu3: fix the wrong HS mult value c3ffd35014 usb: mtu3: use @mult for HS isoc or intr 00b6325590 usb: host: xhci-rcar: Don't reload firmware after the completion 7a74ae301c ALSA: usb-audio: Add registration quirk for JBL Quantum 800 c1ea74f642 Revert "btrfs: compression: don't try to compress if we don't have enough pages" f05c74e104 x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating b1ca1665e6 Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM" cf1222b877 mm/page_alloc: speed up the iteration of max_order 17d409c83e net: ll_temac: Remove left-over debug message ccadb91437 powerpc/boot: Delete unneeded .globl _zimage_start 295501c77c ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) 6dec8e17b8 USB: serial: mos7720: improve OOM-handling in read_mos_reg() d84708451d igmp: Add ip_mc_list lock in ip_check_mc_rcu cd8ad6ed9a media: stkwebcam: fix memory leak in stk_camera_probe 9febc9153f ARC: wireup clone3 syscall 417b11d325 ALSA: pcm: fix divide error in snd_pcm_lib_ioctl cf28619cd9 ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 a8146f1490 ARM: 8918/2: only build return_address() if needed ebad44b643 cryptoloop: add a deprecation warning d12526ddf5 perf/x86/amd/power: Assign pmu.module be1f76fcee perf/x86/amd/ibs: Work around erratum #1197 861118d64e perf/x86/intel/pt: Fix mask of num_address_ranges 40d23de514 qede: Fix memset corruption 468623f696 net: macb: Add a NULL check on desc_ptp 50f73f31ae qed: Fix the VF msix vectors flow 92abb09f7a reset: reset-zynqmp: Fixed the argument data type b820c4c651 gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats 48051387fa xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG 56c77c1b52 kthread: Fix PF_KTHREAD vs to_kthread() race af3cf928b9 ubifs: report correct st_size for encrypted symlinks aa4e216156 f2fs: report correct st_size for encrypted symlinks 52d8e5b0ab ext4: report correct st_size for encrypted symlinks 228a4203d8 fscrypt: add fscrypt_symlink_getattr() for computing st_size 9b3849ba66 ext4: fix race writing to an inline_data file while its xattrs are changing 8ac6727e49 Revert "once: Fix panic when module unload" 2e0ca55ea4 Merge 5.4.144 into android11-5.4-lts c6bf0ed9d1 Linux 5.4.144 0634c0f919 audit: move put_tree() to avoid trim_trees refcount underflow and UAF cab0003311 net: don't unconditionally copy_from_user a struct ifreq for socket ioctls 6752b3b062 Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat" 67871ada3a Revert "floppy: reintroduce O_NDELAY fix" d7f7eca72e btrfs: fix NULL pointer dereference when deleting device by invalid id e644da7ace arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88 4f76285f6d KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs 620681d720 net: dsa: mt7530: fix VLAN traffic leaks again 38adbf21f3 bpf: Fix cast to pointer from integer of different size warning 812ee47ad7 bpf: Track contents of read-only maps as scalars f441801520 vt_kdsetmode: extend console locking 8a19e00450 btrfs: fix race between marking inode needs to be logged and log syncing f3a1ac258e net/rds: dma_map_sg is entitled to merge entries ad6a2bc758 drm/nouveau/disp: power down unused DP links during init 689179c462 drm: Copy drm_wait_vblank to user before returning 18ceb99f84 qed: Fix null-pointer dereference in qed_rdma_create_qp() f1a0db49ab qed: qed ll2 race condition fixes 73ba9e4ece vringh: Use wiov->used to check for read/write desc order ee52acae6f virtio_pci: Support surprise removal of virtio pci device be9b79e841 virtio: Improve vq->broken access to avoid any compiler optimization 0d4ba693db opp: remove WARN when no valid OPPs remain baf56a1d81 perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 0ad96094ab usb: gadget: u_audio: fix race condition on endpoint stop c5c2b4ca50 drm/i915: Fix syncmap memory leak 2f3cefa6ab net: hns3: fix get wrong pfc_en when query PFC configuration 6f0c0b35e2 net: hns3: fix duplicate node in VLAN list 951805c23d net: hns3: clear hardware resource when loading driver 08162f6564 rtnetlink: Return correct error on changing device netns f58e42d192 net: marvell: fix MVNETA_TX_IN_PRGRS bit number 45454400a6 xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' 53b480e68c ip_gre: add validation for csum_start bb8ca7e2e6 RDMA/efa: Free IRQ vectors on error flow e29565b451 e1000e: Fix the max snoop/no-snoop latency for 10M 8a21e84334 IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() 944a50f56f RDMA/bnxt_re: Add missing spin lock initialization 28b1895410 scsi: core: Fix hang of freezing queue between blocking and running device 628c582854 usb: dwc3: gadget: Stop EP0 transfers during pullup disable d9da281c8f usb: dwc3: gadget: Fix dwc3_calc_trbs_left() 21880abf19 USB: serial: option: add new VID/PID to support Fibocom FG150 2e098e91ee Revert "USB: serial: ch341: fix character loss at high transfer rates" 16b281a70a can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters 765437d1f0 mm, oom: make the calculation of oom badness more accurate 1cccf5c030 mmc: sdhci-msm: Update the software timeout value for sdhc aec1e470d9 ovl: fix uninitialized pointer read in ovl_lookup_real_one() 57bd5b59f1 once: Fix panic when module unload 5892f910f4 netfilter: conntrack: collect all entries in one cycle 7c95c89b69 ARC: Fix CONFIG_STACKDEPOT a6b049aeef net: qrtr: fix another OOB Read in qrtr_endpoint_post feaf47115a Merge branch 'android11-5.4' into 'android11-5.4-lts' 4a23ba6f12 Merge branch 'android11-5.4' into 'android11-5.4-lts' 406300927b Revert "virtio: Protect vqs list access" 874997f95f Merge 5.4.143 into android11-5.4-lts 2d724dbd16 Revert "net: igmp: fix data-race in igmp_ifc_timer_expire()" 50637be299 Revert "net: igmp: increase size of mr_ifc_count" f5f155f4d6 Revert "PCI/MSI: Protect msi_desc::masked for multi-MSI" 5395faca89 Merge 5.4.142 into android11-5.4-lts 48266f7c1b Merge branch 'android11-5.4' into 'android11-5.4-lts' fd80923202 Linux 5.4.143 4bf1941581 netfilter: nft_exthdr: fix endianness of tcp option cast e4fd994f02 fs: warn about impending deprecation of mandatory locks 41c7f46c89 mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim 1a3aa81444 mm, memcg: avoid stale protection values when cgroup is above protection 9c1c449dcc ASoC: intel: atom: Fix breakage for PCM buffer address setup 846ba58a7c PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI 548b75f490 btrfs: prevent rename2 from exchanging a subvol with a directory from different parents 0fc6a9c202 ipack: tpci200: fix memory leak in the tpci200_register 280d66b317 ipack: tpci200: fix many double free issues in tpci200_pci_probe cb7aa51031 slimbus: ngd: reset dma setup during runtime pm abce32d0f7 slimbus: messaging: check for valid transaction id 0786d315f5 slimbus: messaging: start transaction ids from 1 instead of zero 20c2f141b1 tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name 8fbfebe188 ALSA: hda - fix the 'Capture Switch' value change notifications 85e60614d1 mmc: dw_mmc: Fix hang on data CRC error 4f6c9caf7b ovl: add splice file read write helper 85813f1f9e iavf: Fix ping is lost after untrusted VF had tried to change MAC a498115dcd i40e: Fix ATR queue selection 1b8a8fba78 ovs: clear skb->tstamp in forwarding path 84dbbf5482 net: mdio-mux: Handle -EPROBE_DEFER correctly 453486e79e net: mdio-mux: Don't ignore memory allocation errors 6b70c67849 net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 da92ce3645 virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO 9aeadce8e3 virtio-net: support XDP when not more queues 3ed7cf8386 vrf: Reset skb conntrack connection on VRF rcv 447b160289 bnxt_en: Add missing DMA memory barriers c9566df334 ptp_pch: Restore dependency on PCI a73b9aa142 net: 6pack: fix slab-out-of-bounds in decode_data 2bc7571343 bnxt: disable napi before canceling DIM a9fb0f1559 bnxt: don't lock the tx queue from napi poll 1fe038030c bpf: Clear zext_dst of dead insns 73a45f75a0 vhost: Fix the calculation in vhost_overflow() b9a59636c4 virtio: Protect vqs list access b264e37b35 dccp: add do-while-0 stubs for dccp_pr_debug macros 9112ebc299 cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant cb9a9d5fe6 iommu: Check if group is NULL before remove device 911a8141ef Bluetooth: hidp: use correct wait queue when removing ctrl_wait 5b14c1f16e drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X f92dc3a89d net: usb: lan78xx: don't modify phy_device state concurrently be70436799 ARM: dts: nomadik: Fix up interrupt controller node names 69aa1a1a56 scsi: core: Fix capacity set to zero after offlinining device 935de7ec7a scsi: core: Avoid printing an error if target_alloc() returns -ENXIO 7a721a1e18 scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() 9900e06ae6 scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() e37cf26bd5 dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available 12d1322d93 ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 11145efd29 dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() 9c97a05392 dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers fc566b5a21 USB: core: Avoid WARNings for 0-length descriptor requests 1bd505c814 media: drivers/media/usb: fix memory leak in zr364xx_probe 705660a6d9 media: zr364xx: fix memory leaks in probe() 79dff2a3f4 media: zr364xx: propagate errors from zr364xx_start_readpipe() 7305d6d407 mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards 23f77ad13f ath9k: Postpone key cache entry deletion for TXQ frames reference it c6feaf806d ath: Modify ath_key_delete() to not need full key entry b7d593705e ath: Export ath_hw_keysetmac() add283e251 ath9k: Clear key cache explicitly on disabling hardware 0c049ce432 ath: Use safer key clearing with key cache entries 172b91bbbb x86/fpu: Make init_fpstate correct with optimized XSAVE 81d152c8da ext4: fix EXT4_MAX_LOGICAL_BLOCK macro 62d24bac60 Merge branch 'android11-5.4' into 'android11-5.4-lts' c15b830f7c Linux 5.4.142 a17f2f2c89 KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) 7c1c96ffb6 KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) 456fd88922 iommu/vt-d: Fix agaw for a supported 48 bit guest address width 5b5f855a79 vmlinux.lds.h: Handle clang's module.{c,d}tor sections e9b2b2b29c ceph: take snap_empty_lock atomically with snaprealm refcount change 95ff775df6 ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm 1d8c232afb ceph: add some lockdep assertions around snaprealm handling a6ff0f3f9f KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation ec25d05e18 PCI/MSI: Protect msi_desc::masked for multi-MSI 48d2439c6f PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() 386ead1d35 PCI/MSI: Correct misleading comments 76d81dec16 PCI/MSI: Do not set invalid bits in MSI mask 6b4bcbf133 PCI/MSI: Enforce MSI[X] entry updates to be visible 4495a41fbc PCI/MSI: Enforce that MSI-X table entry is masked for update 1866c8f6d4 PCI/MSI: Mask all unused MSI-X entries 3b4220c2bf PCI/MSI: Enable and mask MSI-X early 0c8dea3fd5 genirq/timings: Prevent potential array overflow in __irq_timings_store() 4dfe809271 genirq/msi: Ensure deactivation on teardown e3e54a9300 x86/resctrl: Fix default monitoring groups reporting a6b594ad74 x86/ioapic: Force affinity setup before startup db5e266694 x86/msi: Force affinity setup before startup eda32c2188 genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP 06b3477436 x86/tools: Fix objdump version check again 74451dd8bf powerpc/kprobes: Fix kprobe Oops happens in booke b74145d858 nbd: Aovid double completion of a request ad9550114d vsock/virtio: avoid potential deadlock when vsock device remove b9cd73cce5 xen/events: Fix race in set_evtchn_to_irq 4d3c5c319b net: igmp: increase size of mr_ifc_count 721ff564cc tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets 2ce8a68a31 net: linkwatch: fix failure to restore device state across suspend/resume 33597972a2 net: bridge: fix memleak in br_add_if() f6eee53beb net: dsa: sja1105: fix broken backpressure in .port_fdb_dump 1e6a570d37 net: dsa: lantiq: fix broken backpressure in .port_fdb_dump 564f6bbd0e net: dsa: lan9303: fix broken backpressure in .port_fdb_dump a9243455e8 net: igmp: fix data-race in igmp_ifc_timer_expire() ed957c77b3 net: Fix memory leak in ieee802154_raw_deliver 13a381b8bc net: dsa: microchip: Fix ksz_read64() 991117eeee drm/meson: fix colour distortion from HDR set during vendor u-boot e114f15de8 net/mlx5: Fix return value from tracer initialization f99aa76bb8 psample: Add a fwd declaration for skbuff 9dc8e396c1 iavf: Set RSS LUT and key in reset handle path 23436edae3 net: sched: act_mirred: Reset ct info when mirror/redirect skb 9636fbfe7b ppp: Fix generating ifname when empty IFLA_IFNAME is specified 1c31ee907f net: phy: micrel: Fix link detection on ksz87xx switch" dfeb64f6e2 platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables 699db2bb96 platform/x86: pcengines-apuv2: revert wiring up simswitch GPIO as LED af7f1539cf net: dsa: mt7530: add the missing RxUnicast MIB counter d353a61860 ASoC: cs42l42: Fix LRCLK frame start edge b036452082 netfilter: nf_conntrack_bridge: Fix memory leak when error cd36a36ea4 ASoC: cs42l42: Remove duplicate control for WNF filter frequency eb789cc917 ASoC: cs42l42: Fix inversion of ADC Notch Switch control 6a33813363 ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J 55e86f07b8 ASoC: cs42l42: Correct definition of ADC Volume control 22d2e3c6a1 ieee802154: hwsim: fix GPF in hwsim_new_edge_nl 5bac8c2a30 ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi ddcf807fbb libnvdimm/region: Fix label activation vs errors bc97fde4c6 ACPI: NFIT: Fix support for virtual SPA ranges a753e3f334 ceph: reduce contention in ceph_check_delayed_caps() aa04486c41 i2c: dev: zero out array used for i2c reads from userspace c18b28e5ad ASoC: intel: atom: Fix reference to PCM buffer address aab3fa5446 ASoC: xilinx: Fix reference to PCM buffer address 60e2854acf iio: adc: Fix incorrect exit of for-loop bcac522592 iio: humidity: hdc100x: Add margin to the conversion time da7cb80905 iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels 7116e6b9d8 Merge 5.4.141 into android11-5.4-lts b704883aa8 Linux 5.4.141 983d6a6b7e btrfs: don't flush from btrfs_delayed_inode_reserve_metadata ea13f678a3 btrfs: export and rename qgroup_reserve_meta 41a9b8f36d btrfs: qgroup: don't commit transaction when we already hold the handle 38b8485b72 net: xilinx_emaclite: Do not print real IOMEM pointer 654c19a7e8 btrfs: fix lockdep splat when enabling and disabling qgroups c55442cdfd btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT fdaf6a322f btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED 36af2de520 btrfs: qgroup: try to flush qgroup space when we get -EDQUOT 5c79287c2b btrfs: qgroup: allow to unreserve range without releasing other ranges b7a722fd75 btrfs: make btrfs_qgroup_reserve_data take btrfs_inode dfadea4061 btrfs: make qgroup_free_reserved_data take btrfs_inode 812f39ed5b ovl: prevent private clone if bind mount is not allowed eeb4742501 ppp: Fix generating ppp unit id when ifname is not specified 3460f3959d ALSA: hda: Add quirk for ASUS Flow x13 81d1a3f976 USB:ehci:fix Kunpeng920 ehci hardware problem d28adaabbb KVM: X86: MMU: Use the correct inherited permissions to get shadow page 5f4ab7e25f usb: dwc3: gadget: Avoid runtime resume if disabling pullup 1782c4af6b usb: dwc3: gadget: Disable gadget IRQ during pullup disable 54b7022f28 usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable e36245a68e usb: dwc3: gadget: Prevent EP queuing while stopping transfers 823f692508 usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup 25a0625fa9 usb: dwc3: gadget: Allow runtime suspend if UDC unbinded 5f081a928d usb: dwc3: Stop active transfers before halting the controller 396f29ea0c tracing: Reject string operand in the histogram expression 28276c280f media: v4l2-mem2mem: always consider OUTPUT queue during poll 236aca7092 tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag 5b774238e8 KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB c33130b10f Merge 5.4.140 into android11-5.4-lts ac1d54ea63 Merge branch 'android11-5.4' into 'android11-5.4-lts' a998faa9c4 Linux 5.4.140 3c197fdd07 arm64: fix compat syscall return truncation 72fcaf6952 net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset 742e85fa9e alpha: Send stop IPI to send to online CPUs 26946d2139 virt_wifi: fix error on connect 17d7c9c940 reiserfs: check directory items on read from disk bcad6ece2a reiserfs: add check for root_inode in reiserfs_fill_super e30a88f1f5 libata: fix ata_pio_sector for CONFIG_HIGHMEM a2671d96a3 bpf, selftests: Adjust few selftest result_unpriv outcomes 4892b4f324 perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest d6cf5342fa soc: ixp4xx/qmgr: fix invalid __iomem access a5bf7ef13e spi: meson-spicc: fix memory leak in meson_spicc_remove 27991c78d6 soc: ixp4xx: fix printing resources 07fd256d53 arm64: vdso: Avoid ISB after reading from cntvct_el0 90e498ef3f KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds 2e1a80b934 KVM: Do not leak memory for duplicate debugfs directories 43486cd739 KVM: x86: accept userspace interrupt only if no event is injected 1b7b9713a5 md/raid10: properly indicate failure when ending a failed write request 790cb68d35 pcmcia: i82092: fix a null pointer dereference bug 42ac2c6348 timers: Move clearing of base::timer_running under base:: Lock 8211bb20da serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts. f73dcb5d63 serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver 607460d386 MIPS: Malta: Do not byte-swap accesses to the CBUS UART 3eb686d01c serial: 8250: Mask out floating 16/32-bit bus bits 3b73a69962 serial: 8250_mtk: fix uart corruption issue when rx power off afdef443a8 serial: tegra: Only print FIFO error message when an error occurs 097a183f9c ext4: fix potential htree corruption when growing large_dir directories ac23a17381 pipe: increase minimum default pipe size to 2 pages f3cae04bd4 media: rtl28xxu: fix zero-length control request e2f6d5b038 staging: rtl8712: get rid of flush_scheduled_work 8f241df0e6 staging: rtl8723bs: Fix a resource leak in sd_int_dpc bbdd4a5162 tpm_ftpm_tee: Free and unregister TEE shared memory during kexec 3c712f14d8 optee: Fix memory leak when failing to register shm pages 0572199b78 tee: add tee_shm_alloc_kernel_buf() b247bf412c optee: Clear stale cache entries during initialization 7da261e6bb tracing / histogram: Give calculation hist_fields a size ba22053f5d scripts/tracing: fix the bug that can't parse raw_trace_func 8d1191f924 clk: fix leak on devm_clk_bulk_get_all() unwind ed5c9a49e6 usb: otg-fsm: Fix hrtimer list corruption 449a705fba usb: gadget: f_hid: idle uses the highest byte for duration 02f336cee5 usb: gadget: f_hid: fixed NULL pointer dereference f780a9580c usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers 134e27da54 usb: cdns3: Fixed incorrect gadget state df1c6eec4e ALSA: usb-audio: Add registration quirk for JBL Quantum 600 639b45456e ALSA: hda/realtek: add mic quirk for Acer SF314-42 d09639528b firmware_loader: fix use-after-free in firmware_fallback_sysfs 1deb6b9030 firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback 0ee687e672 USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 01b2c35b05 USB: serial: ch341: fix character loss at high transfer rates 9ed43cfaa7 USB: serial: option: add Telit FD980 composition 0x1056 518e81874c USB: usbtmc: Fix RCU stall warning ff29fe26ab Bluetooth: defer cleanup of resources in hci_unregister_dev() 580c10a40c blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() ed169b054b net: vxge: fix use-after-free in vxge_device_unregister c5549876a9 net: fec: fix use-after-free in fec_drv_remove 3fed6dee16 net: pegasus: fix uninit-value in get_interrupt_interval 75cef4fc07 bnx2x: fix an error code in bnx2x_nic_load() 437ee90d7b mips: Fix non-POSIX regexp b1fa6747b9 net: ipv6: fix returned variable type in ip6_skb_dst_mtu 3e63b566d9 nfp: update ethtool reporting of pauseframe control d333503de1 sctp: move the active_key update after sh_keys is added de30346dd3 gpio: tqmx86: really make IRQ optional 9d440b5c1d net: natsemi: Fix missing pci_disable_device() in probe and remove 6934040698 net: phy: micrel: Fix detection of ksz87xx switch 2b8ab7aec0 net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones 71b0a935db net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add 88b7781609 net, gro: Set inner transport header offset in tcp/udp GRO hook ba3abe3f82 dmaengine: imx-dma: configure the generic DMA type to make it work ee2f81330a media: videobuf2-core: dequeue if start_streaming fails 3377f2f8c6 scsi: sr: Return correct event when media event code is 3 f588d4b7be spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation b58e3d59a5 spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay 2c1065d40a omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator 299e3968c0 ARM: dts: am437x-l4: fix typo in can@0 node 9cbe7e21dd clk: stm32f4: fix post divisor setup for I2S/SAI PLLs 3f9eed4462 ALSA: usb-audio: fix incorrect clock source setting 16db40fc4a arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode 7c08460773 ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins 1b1f1aa225 ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init aecff98c3e ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz c39907335b ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms 61b71c5f51 ARM: imx: add missing clk_disable_unprepare() d88d6bba3b ARM: imx: add missing iounmap() 6c629cd023 arm64: dts: ls1028a: fix node name for the sysclk 4a830a37d3 ALSA: seq: Fix racy deletion of subscriber 0658a45335 Revert "ACPICA: Fix memory leak caused by _CID repair function" ea224455dd Merge 5.4.139 into android11-5.4-lts 8ab681fd3f ANDROID: GKI: fix up android/abi_gki_aarch64.xml merge 1d03502d2e Merge branch 'android11-5.4' into 'android11-5.4-lts' e350cd02e2 Linux 5.4.139 03ff8a4f9d spi: mediatek: Fix fifo transfer a0f66ddf05 bpf, selftests: Adjust few selftest outcomes wrt unreachable code d3796e8f6b bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones 8dec99abcd bpf: Test_verifier, add alu32 bounds tracking tests fd568de580 bpf: Fix leakage under speculation on mispredicted branches d2f790327f bpf: Do not mark insn as seen under speculative path verification 283d742988 bpf: Inherit expanded/patched seen count from old aux data a0a9546aae Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" 76f5314d78 firmware: arm_scmi: Add delayed response status check 1b38f70bbc firmware: arm_scmi: Ensure drivers provide a probe function 44f522298c Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" 38f54217b4 ACPI: fix NULL pointer dereference 0ea2f55bab nvme: fix nvme_setup_command metadata trace event b508b652d4 net: Fix zero-copy head len calculation. bf692e7ef6 qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() 6bc48348ec r8152: Fix potential PM refcount imbalance a57c75ff07 ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits e2cccb839a spi: stm32h7: fix full duplex irq handler handling b72f2d9e91 regulator: rt5033: Fix n_voltages settings for BUCK and LDO 86f2a3e9aa btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction b7f0fa2192 btrfs: fix race causing unnecessary inode logging during link and rename cb006da62a btrfs: do not commit logs and transactions during link and rename operations 174c27d0f9 btrfs: delete duplicated words + other fixes in comments ae7ff75631 Merge 5.4.138 into android11-5.4-lts 7b90d57b09 Linux 5.4.138 7eef18c047 can: j1939: j1939_session_deactivate(): clarify lifetime of session object 18b536de3b i40e: Add additional info to PHY type error d21eb93110 Revert "perf map: Fix dso->nsinfo refcounting" 16447b2f5c powerpc/pseries: Fix regression while building external modules 265883d1d8 PCI: mvebu: Setup BAR0 in order to fix MSI 21734a31c9 can: hi311x: fix a signedness bug in hi3110_cmd() f4fa45b0f9 sis900: Fix missing pci_disable_device() in probe and remove dff00ce448 tulip: windbond-840: Fix missing pci_disable_device() in probe and remove e0310bbeaa sctp: fix return value check in __sctp_rcv_asconf_lookup 408614108a net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() ac49832306 net/mlx5: Fix flow table chaining 527feae56f net: llc: fix skb_over_panic ede4c93860 mlx4: Fix missing error code in mlx4_load_one() acb97d4b2d net: Set true network header for ECN decapsulation 851946a681 tipc: fix sleeping in tipc accept routine 194b71d28b i40e: Fix log TC creation failure when max num of queues is exceeded 834af62212 i40e: Fix queue-to-TC mapping on Tx 74aea4b715 i40e: Fix firmware LLDP agent related warning b2ab34e862 i40e: Fix logic of disabling queues 519582e44e netfilter: nft_nat: allow to specify layer 4 protocol NAT only 3a7a4cee7b netfilter: conntrack: adjust stop timestamp to real expiry value 1c04378340 cfg80211: Fix possible memory leak in function cfg80211_bss_update 6cf2abea10 nfc: nfcsim: fix use after free during module unload 6b313d0ffa NIU: fix incorrect error return, missed in previous revert c4663c1627 HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT e9e2ce00ae can: esd_usb2: fix memory leak 43726620b2 can: ems_usb: fix memory leak 8198673892 can: usb_8dev: fix memory leak a051dbd17b can: mcba_usb_start(): add missing urb->transfer_dma initialization 793581441b can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF c621638d0e can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms a24d87b429 ocfs2: issue zeroout to EOF blocks eaaa4284e2 ocfs2: fix zero out valid data 9bd1092148 KVM: add missing compat KVM_CLEAR_DIRTY_LOG 7a94dfe5e2 x86/kvm: fix vcpu-id indexed array sizes 2dc291582c Revert "ACPI: resources: Add checks for ACPI IRQ override" a8eec69797 btrfs: mark compressed range uptodate only if all bio succeed 57429c1ec7 btrfs: fix rw device counting in __btrfs_free_extra_devids 61f2cbc792 x86/asm: Ensure asm/proto.h can be included stand-alone 99372c38a9 net_sched: check error pointer in tcf_dump_walker() 758a7acf8b Merge 5.4.137 into android11-5.4-lts 911bc13b3a Merge branch 'android11-5.4' into 'android11-5.4-lts' 5b1de8e15f Linux 5.4.137 ebb1b38be0 ipv6: ip6_finish_output2: set sk into newly allocated nskb 6c04123962 ARM: dts: versatile: Fix up interrupt controller node names befa900533 iomap: remove the length variable in iomap_seek_hole 83fb41b2f6 iomap: remove the length variable in iomap_seek_data 302e1acd4c cifs: fix the out of range assignment to bit fields in parse_server_interfaces 02a470e3c6 firmware: arm_scmi: Fix range check for the maximum number of pending messages 289dd58431 firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow e3acb292f0 hfs: add lock nesting notation to hfs_find_init af1178296d hfs: fix high memory mapping in hfs_bnode_read 89136a47e2 hfs: add missing clean-up in hfs_fill_super ded37d0344 ipv6: allocate enough headroom in ip6_finish_output2() f65b7f377c sctp: move 198 addresses from unusable to private scope c8d32973ee net: annotate data race around sk_ll_usec c23b9a5610 net/802/garp: fix memleak in garp_request_join() 88c4cae3ed net/802/mrp: fix memleak in mrp_request_join() eef99860c6 cgroup1: fix leaked context root causing sporadic NULL deref in LTP 7f0365b4da workqueue: fix UAF in pwq_unbound_release_workfn() 85abe0d47f af_unix: fix garbage collect vs MSG_PEEK af45f3527a KVM: x86: determine if an exception has an error code only when injecting it. 828cab3c8c tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include 525c5513b6 selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c fab7e04ebb ANDROID: Update android/abi_gki_aarch64.xml c1b1b25ee2 ANDROID: Update android/abi_gki_aarch64_goldfish ccc19b14a1 Merge 5.4.136 into android11-5.4-lts 253dccefb5 Linux 5.4.136 587f86b7a2 xhci: add xhci_get_virt_ep() helper f9d0c35556 perf inject: Close inject.output on exit a9c103fa91 PCI: Mark AMD Navi14 GPU ATS as broken 11561d2f7b btrfs: compression: don't try to compress if we don't have enough pages 4980301e1c iio: accel: bma180: Fix BMA25x bandwidth register values d04f2582c4 iio: accel: bma180: Use explicit member assignment 4e0afa8895 net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear 2a4865d154 net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz 7d8c06b8d2 drm: Return -ENOTTY for non-drm ioctls b5d7bebd96 nds32: fix up stack guard gap ba378b7960 rbd: always kick acquire on "acquired" and "released" notifications 13066d6628 rbd: don't hold lock_rwsem while running_list is being drained b12ead825f hugetlbfs: fix mount mode command line processing 60dbbd76f1 userfaultfd: do not untag user pointers 540eee8cbb selftest: use mmap instead of posix_memalign to allocate memory e706ac3fc8 ixgbe: Fix packet corruption due to missing DMA sync e617fa62f6 media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() 77713fb336 btrfs: check for missing device in btrfs_trim_fs f899f24d34 tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. 59a9f75fb2 tracing/histogram: Rename "cpu" to "common_cpu" 379d8da335 firmware/efi: Tell memblock about EFI iomem reservations 281a94362b usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. 167079fbfa USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick 811c4cdf29 USB: serial: cp210x: fix comments for GE CS1000 f54ee7e16d USB: serial: option: add support for u-blox LARA-R6 family e28d28eb9b usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() 863d071dbc usb: max-3421: Prevent corruption of freed memory e4077a90e6 USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS da6f6769ee usb: hub: Fix link power management max exit latency (MEL) calculations fea6b53e63 usb: hub: Disable USB 3 device initiated lpm if exit latency is too high 962ce043ef KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state 2b9ffddd70 KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow c968f563cc xhci: Fix lost USB 2 remote wake a660ecde5c ALSA: hdmi: Expose all pins on MSI MS-7C94 board f73696354d ALSA: sb: Fix potential ABBA deadlock in CSP driver 7aa2dfbc6b ALSA: usb-audio: Add registration quirk for JBL Quantum headsets 46d62c3fe2 ALSA: usb-audio: Add missing proc text entry for BESPOKEN type f1754f96ab s390/boot: fix use of expolines in the DMA code 8eb521d192 s390/ftrace: fix ftrace_update_ftrace_func implementation 268132b070 Revert "MIPS: add PMD table accounting into MIPS'pmd_alloc_one" f323809e31 proc: Avoid mixing integer types in mem_rw() b71a75209f drm/panel: raspberrypi-touchscreen: Prevent double-free 2e6ab87f8e net: sched: cls_api: Fix the the wrong parameter b60461696a sctp: update active_key for asoc when old key is being replaced 9fa89c2cae nvme: set the PRACT bit when using Write Zeroes with T10 PI c50141b3d7 r8169: Avoid duplicate sysfs entry creation error f726817d6b afs: Fix tracepoint string placement with built-in AFS b22c9e433b Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" 69a49e7b5b nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING 8302513614 ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions a88414fb11 net/sched: act_skbmod: Skip non-Ethernet packets c278b954cc net: hns3: fix rx VLAN offload state inconsistent issue 006ed6f4d0 net/tcp_fastopen: fix data races around tfo_active_disable_stamp 3942ba2356 net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition f11f12decd bnxt_en: Check abort error state in bnxt_half_open_nic() 16ce6cb786 bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task() c993e7aadc bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe() 6ee8e6be30 bnxt_en: Improve bnxt_ulp_stop()/bnxt_ulp_start() call sequence. 35637acc98 spi: cadence: Correct initialisation of runtime PM again 2f2150bf41 scsi: target: Fix protect handling in WRITE SAME(32) a6cb717f85 scsi: iscsi: Fix iface sysfs attr detection 25df44e90f netrom: Decrease sock refcount when sock timers expire 8d7924ce85 net: sched: fix memory leak in tcindex_partial_destroy_work f38527f189 KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak b85dadd434 KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash b3224bd318 net: decnet: Fix sleeping inside in af_decnet bd2b3b13aa efi/tpm: Differentiate missing and invalid final event log table. 9413c0abb5 net: fix uninit-value in caif_seqpkt_sendmsg 6d56299ff9 bpftool: Check malloc return value in mount_bpffs_for_pin edec100986 bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats 58259e8b6e s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] cc876a5618 liquidio: Fix unintentional sign extension issue on left shift of u16 42fe8f433b ASoC: rt5631: Fix regcache sync errors on resume d99aaf0736 spi: mediatek: fix fifo rx mode 08cdda8d89 regulator: hi6421: Fix getting wrong drvdata b25be6bf64 regulator: hi6421: Use correct variable type for regmap api val argument a1ade24ccc spi: stm32: fixes pm_runtime calls in probe/remove 40e203ce74 spi: stm32: Use dma_request_chan() instead dma_request_slave_channel() 24b78097a8 spi: imx: add a check for speed_hz before calculating the clock 52cff6123a perf data: Close all files in close_dir() 0f63857d10 perf probe-file: Delete namelist in del_events() on the error path 8b92ea243b perf lzma: Close lzma stream on exit 51351c6d5a perf script: Fix memory 'threads' and 'cpus' leaks on exit d2bfc3eda9 perf dso: Fix memory leak in dso__new_map() 05804a7d22 perf test event_update: Fix memory leak of evlist d257f3abdc perf test session_topology: Delete session->evlist 89d1762a4a perf env: Fix sibling_dies memory leak fd335143be perf probe: Fix dso->nsinfo refcounting 6513dee46f perf map: Fix dso->nsinfo refcounting ff9fc81fa8 nvme-pci: do not call nvme_dev_remove_admin from nvme_remove d029df83c6 cxgb4: fix IRQ free race during driver unload ae9b644344 pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped a37ca2a076 selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect 05364a2794 selftests: icmp_redirect: remove from checking for IPv6 route get 7f4848229e ipv6: fix 'disable_policy' for fwd packets c67fb96f54 gve: Fix an error handling path in 'gve_probe()' e33da4eeaa igb: Fix position of assignment to *ring 7dd8977736 igb: Check if num of q_vectors is smaller than max before array access d3d7cceee8 iavf: Fix an error handling path in 'iavf_probe()' 7a13a8a8a5 e1000e: Fix an error handling path in 'e1000_probe()' 9fc381db75 fm10k: Fix an error handling path in 'fm10k_probe()' 5d6a04927b igb: Fix an error handling path in 'igb_probe()' cddd53237d igc: Fix an error handling path in 'igc_probe()' 47f69d8828 igc: Prefer to use the pci_release_mem_regions method 83b2d55a51 ixgbe: Fix an error handling path in 'ixgbe_probe()' ba4fbb68fc igc: change default return of igc_read_phy_reg() 88e0720133 igb: Fix use-after-free error during reset a9508e0edf igc: Fix use-after-free error during reset f40a4f7a60 Merge 5.4.135 into android11-5.4-lts 0a0beb1f91 Linux 5.4.135 d2f7b384a7 udp: annotate data races around unix_sk(sk)->gso_size c72374978b perf test bpf: Free obj_buf 17bc942c0b bpftool: Properly close va_list 'ap' by va_end() on error 84ed834094 ipv6: tcp: drop silly ICMPv6 packet too big messages 315033cab3 tcp: annotate data races around tp->mtu_info 41f45e91c9 dma-buf/sync_file: Don't leak fences on merge failure 04b0671683 net: fddi: fix UAF in fza_probe 8aa13a8696 net: validate lwtstate->data before returning from skb_tunnel_info() 8cff7b28ab net: send SYNACK packet with accepted fwmark b7e5563f2a net: ti: fix UAF in tlan_remove_one 2b70ca9284 net: qcom/emac: fix UAF in emac_remove 463c0addb4 net: moxa: fix UAF in moxart_mac_probe 7ac4a6a74e net: ip_tunnel: fix mtu calculation for ETHER tunnel devices d5dc50ca1f net: bcmgenet: Ensure all TX/RX queues DMAs are disabled 7ecd40801e net: bridge: sync fdb to new unicast-filtering ports 813d45499f net/sched: act_ct: fix err check for nf_conntrack_confirm 2497307356 netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo c6f4a71153 net: ipv6: fix return value of ip6_skb_dst_mtu 9872273b67 net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz 6148ddff2d net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz d73c180e6a dm writecache: return the exact table values that were set 8a85afc662 mm: slab: fix kmem_cache_create failed when sysfs node not destroyed f53729b828 usb: cdns3: Enable TDL_CHK only for OUT ep 52b01a8086 f2fs: Show casefolding support only when supported 91d8460167 arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file f696cc7f1b firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string e2b28026b8 arm64: dts: armada-3720-turris-mox: add firmware node f7d1fa65e7 cifs: prevent NULL deref in cifs_compose_mount_options() 06d8a7eb58 s390: introduce proper type handling call_on_stack() macro 2a47e0719a sched/fair: Fix CFS bandwidth hrtimer expiry type 5b7d065868 scsi: qedf: Add check to synchronize abort and flush 0fe70c15f9 scsi: libfc: Fix array index out of bound exception d7b647d055 scsi: libsas: Add LUN number check in .slave_alloc callback 863c4bc883 scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 712e9ed613 rtc: max77686: Do not enforce (incorrect) interrupt trigger type 199d8ea4c7 kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set 484193b635 thermal/core: Correct function name thermal_zone_device_unregister() 556cf02830 arm64: dts: imx8mq: assign PCIe clocks 9d3eb68a53 arm64: dts: ls208xa: remove bus-num from dspi node e054b361ca firmware: tegra: bpmp: Fix Tegra234-only builds 94d0095770 soc/tegra: fuse: Fix Tegra234-only builds 270a2e9faf ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15 4bc66215bc ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings 856c753237 ARM: dts: rockchip: fix supply properties in io-domains nodes c5bb9cc2ce arm64: dts: juno: Update SCPI nodes as per the YAML schema f572a91393 ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings 95e795474c ARM: dts: stm32: fix RCC node name on stm32f429 MCU a898aa9f88 ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards 5c17edaaea ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios 3446233096 ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios e79e29a4e1 kbuild: sink stdout from cmd for silent build f817d46775 rtc: mxc_v2: add missing MODULE_DEVICE_TABLE 0a22b51782 ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info e20e85639e ARM: dts: imx6: phyFLEX: Fix UART hardware flow control a5b19d33ae ARM: dts: Hurricane 2: Fix NAND nodes names f83535a47f ARM: dts: BCM63xx: Fix NAND nodes names cb05b84ad7 ARM: NSP: dts: fix NAND nodes names 14e3bad3b5 ARM: Cygnus: dts: fix NAND nodes names 587a757afe ARM: brcmstb: dts: fix NAND nodes names a9c32c7aee reset: ti-syscon: fix to_ti_syscon_reset_data macro b400afa427 arm64: dts: rockchip: Fix power-controller node names for rk3328 dfb4e8ed07 arm64: dts: rockchip: Fix power-controller node names for px30 789070f178 ARM: dts: rockchip: Fix power-controller node names for rk3288 6aaffe6ce8 ARM: dts: rockchip: Fix power-controller node names for rk3188 439115ee56 ARM: dts: rockchip: Fix power-controller node names for rk3066a 3b4c347283 ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x c9d29d62da ARM: dts: rockchip: Fix the timer clocks order d105e15de6 arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi cfe3d29e5c ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288 79573c6441 ARM: dts: gemini: add device_type on pci 7037876393 ARM: dts: gemini: rename mdio to the right name 2a9f50cc6e Merge branch 'android11-5.4' into 'android11-5.4-lts' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1dfe5c5858c0c1f38ccb32e253ff7ff7f509eced	2021-10-20 10:32:16 +02:00
Greg Kroah-Hartman	65d414cb38	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: 05cd3c592d ANDROID: distribute Module.symvers 6eea8a6d1d UPSTREAM: usb: max-3421: Prevent corruption of freed memory f625f1b305 ANDROID: ABI: Update allowed list for QCOM d7aa701af5 UPSTREAM: driver core: Prevent warning when removing a device link from unregistered consumer 2e30052a73 UPSTREAM: udp: properly flush normal packet at GRO time 833c1e231c UPSTREAM: net/xfrm/compat: Copy xfrm_spdattr_type_t atributes a95d35ae26 UPSTREAM: f2fs: Advertise encrypted casefolding in sysfs 8557d5a891 UPSTREAM: loop: Fix missing discard support when using LOOP_CONFIGURE d0cca8a1ea UPSTREAM: thermal/drivers/sprd: Add missing MODULE_DEVICE_TABLE ba83fe23f6 UPSTREAM: nvmem: sprd: Fix an error message 98e9d16b6b UPSTREAM: usb: musb: Fix an error message ace71bcb51 UPSTREAM: scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend dc5ccc2d9c UPSTREAM: scsi: ufs: core: Do not put UFS power into LPM if link is broken 5576e5e477 UPSTREAM: selinux: add proper NULL termination to the secclass_map permissions f87a97cd71 UPSTREAM: of: property: fw_devlink: do not link ".*,nr-gpios" 751aaf9f30 UPSTREAM: udp: never accept GSO_FRAGLIST packets 01228292a6 UPSTREAM: udp: skip L4 aggregation for UDP tunnel packets 13ab504be3 UPSTREAM: xfrm/compat: Cleanup WARN()s that can be user-triggered 236d41699d UPSTREAM: pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller 4f031c8941 UPSTREAM: loop: Set correct device size when using LOOP_CONFIGURE 38866fe5a7 UPSTREAM: loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE c060961254 ANDROID: ion_system_heap: Add __GFP_NOWARN to mid-order allocations 77e911a101 ANDROID: drivers: gpu: drm: increase the MAX_DRM_OPEN_COUNT 0923d5c13b UPSTREAM: af_unix: fix garbage collect vs MSG_PEEK Change-Id: I91712c50821a00aea9165ca5497cead9ade766e6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-10-14 09:25:51 +02:00
Paul Moore	5576e5e477	UPSTREAM: selinux: add proper NULL termination to the secclass_map permissions ... This patch adds the missing NULL termination to the "bpf" and "perf_event" object class permission lists. This missing NULL termination should really only affect the tools under scripts/selinux, with the most important being genheaders.c, although in practice this has not been an issue on any of my dev/test systems. If the problem were to manifest itself it would likely result in bogus permissions added to the end of the object class; thankfully with no access control checks using these bogus permissions and no policies defining these permissions the impact would likely be limited to some noise about undefined permissions during policy load. Cc: stable@vger.kernel.org Fixes: ec27c3568a ("selinux: bpf: Add selinux check for eBPF syscall operations") Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit e4c82eafb609c2badc56f4e11bc50fcf44b8e9eb) Bug: 187129171 Signed-off-by: Connor O'Brien <connoro@google.com> Change-Id: I82a810f0b436bdbca08110e2dcf56d87b2b281df	2021-10-01 11:32:55 -07:00
Greg Kroah-Hartman	2abce4ec2a	Merge 5.4.149 into android11-5.4-lts ... Changes in 5.4.149 PCI: pci-bridge-emul: Fix big-endian support PCI: aardvark: Indicate error in 'val' when config read fails PCI: pci-bridge-emul: Add PCIe Root Capabilities Register PCI: aardvark: Fix reporting CRS value PCI/ACPI: Add Ampere Altra SOC MCFG quirk KVM: remember position in kvm->vcpus array console: consume APC, DM, DCS s390/pci_mmio: fully validate the VMA before calling follow_pte() ARM: Qualify enabling of swiotlb_init() apparmor: remove duplicate macro list_entry_is_head() ARM: 9077/1: PLT: Move struct plt_entries definition to header ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link() ARM: 9079/1: ftrace: Add MODULE_PLTS support ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE sctp: validate chunk size in __rcv_asconf_lookup sctp: add param size validation for SCTP_PARAM_SET_PRIMARY staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() um: virtio_uml: fix memory leak on init failures dmaengine: acpi: Avoid comparison GSI with Linux vIRQ thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() 9p/trans_virtio: Remove sysfs file on probe failure prctl: allow to setup brk for et_dyn executables nilfs2: use refcount_dec_and_lock() to fix potential UAF profiling: fix shift-out-of-bounds bugs pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered phy: avoid unnecessary link-up delay in polling mode net: stmmac: reset Tx desc base address before restarting Tx Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH thermal/core: Fix thermal_cooling_device_register() prototype drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() parisc: Move pci_dev_is_behind_card_dino to where it is used dmaengine: sprd: Add missing MODULE_DEVICE_TABLE dmaengine: ioat: depends on !UML dmaengine: xilinx_dma: Set DMA mask for coherent APIs ceph: request Fw caps before updating the mtime in ceph_write_iter ceph: lockdep annotations for try_nonblocking_invalidate btrfs: fix lockdep warning while mounting sprout fs nilfs2: fix memory leak in nilfs_sysfs_create_device_group nilfs2: fix NULL pointer in nilfs_##name##_attr_release nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group pwm: img: Don't modify HW state in .remove() callback pwm: rockchip: Don't modify HW state in .remove() callback pwm: stm32-lp: Don't modify HW state in .remove() callback blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() rtc: rx8010: select REGMAP_I2C drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV Linux 5.4.149 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic55297fb43e33c9ff518898479a7313aafeb9375	2021-10-01 14:07:54 +02:00
Andy Shevchenko	278df06460	apparmor: remove duplicate macro list_entry_is_head() ... commit 9801ca279ad37f72f71234fa81722afd95a3f997 upstream. Strangely I hadn't had noticed the existence of the list_entry_is_head() in apparmor code when added the same one in the list.h. Luckily it's fully identical and didn't break builds. In any case we don't need a duplicate anymore, thus remove it from apparmor code. Link: https://lkml.kernel.org/r/20201208100639.88182-1-andriy.shevchenko@linux.intel.com Fixes: e130816164e244 ("include/linux/list.h: add a macro to test if entry is pointing to the head") Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: John Johansen <john.johansen@canonical.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E . Hallyn " <serge@hallyn.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-26 14:07:06 +02:00
Greg Kroah-Hartman	c4f92aff87	This is the 5.4.148 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFLBPMACgkQONu9yGCS aT6BIQ//Wb4ZQJtEVvaKnda7vFwe8BoZzPGYZA4Imn9KERDRgHuavEuRfMQtKc2y YHwe/PD2JreuDHcd+Wz32xsdMe045xNvgiE1oGcxq0jNBvhJqANSmVTWpdqAquON cTmwsK3roa7ELC2g1WjrYZDv6CrCggqvbuM9AJ/cLITtd8zerhLdZo+CCDG/28cH EosrWvkBcaGmX+r/IBC86Rt6K2OFQ/3LLbb79L4vjKi5lopsm5CTAmfOfIk8p1gB mGB3PkQZnIqphBfqGXLGuljl4e+zb1SONrugUh78Egom393Ex34oo+RjWEGe9dV2 Stkuqo0GTi85X7JA7SGCA/xgF8A8yvaaLjQBsJsL9+2ji+GW+J7hfn4mE5h8H3Di UBjeLMFJA8Mge8Ng9xUSttvjRdwSTm0jWTS9SOl07w24b0pKYbMrQdWt2eI6CT+/ ytq3nCxNJZKeVcAVH+OJNrbSLYvMy/PgYvGTbzASkNmpAeyNiHOyBz1sRcoiAM9U QCWDdZyaqDKktqEyKHxK3opqPzbnHfZFFlCxR7Gw7vvR+itIGJEh/50RNv2F6vnu wzowrVxe+Bf1h7JiNEqLLVHdiuygRqjH1ygepGM4+3TVF4jYHzDISyrqlA/Se3Pg Hhvlzsbv7PH+KiApwBFjSeHTs5WOrokGMFQ7ZYFDpPkleWiywS0= =50Hk -----END PGP SIGNATURE----- Merge 5.4.148 into android11-5.4-lts Changes in 5.4.148 rtc: tps65910: Correct driver module alias btrfs: wake up async_delalloc_pages waiters after submit btrfs: reset replace target device to allocation state on close blk-zoned: allow zone management send operations without CAP_SYS_ADMIN blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN PCI/MSI: Skip masking MSI-X on Xen PV powerpc/perf/hv-gpci: Fix counter value parsing xen: fix setting of max_pfn in shared_info include/linux/list.h: add a macro to test if entry is pointing to the head 9p/xen: Fix end of loop tests for list_for_each_entry tools/thermal/tmon: Add cross compiling support pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast pinctrl: ingenic: Fix incorrect pull up/down info soc: qcom: aoss: Fix the out of bound usage of cooling_devs soc: aspeed: lpc-ctrl: Fix boundary check for mmap soc: aspeed: p2a-ctrl: Fix boundary check for mmap arm64: head: avoid over-mapping in map_memory crypto: public_key: fix overflow during implicit conversion block: bfq: fix bfq_set_next_ioprio_data() power: supply: max17042: handle fails of reading status register dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() VMCI: fix NULL pointer dereference when unmapping queue pair media: uvc: don't do DMA on stack media: rc-loopback: return number of emitters rather than error Revert "dmaengine: imx-sdma: refine to load context only once" dmaengine: imx-sdma: remove duplicated sdma_load_context libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs ARM: 9105/1: atags_to_fdt: don't warn about stack size PCI/portdrv: Enable Bandwidth Notification only if port supports it PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: xilinx-nwl: Enable the clock through CCF PCI: aardvark: Fix checking for PIO status PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response PCI: aardvark: Fix masking and unmasking legacy INTx interrupts HID: input: do not report stylus battery state as "full" f2fs: quota: fix potential deadlock scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND IB/hfi1: Adjust pkey entry in index 0 RDMA/iwcm: Release resources if iw_cm module initialization fails docs: Fix infiniband uverbs minor number pinctrl: samsung: Fix pinctrl bank pin count vfio: Use config not menuconfig for VFIO_NOIOMMU powerpc/stacktrace: Include linux/delay.h RDMA/efa: Remove double QP type assignment f2fs: show f2fs instance in printk_ratelimited f2fs: reduce the scope of setting fsck tag when de->name_len is zero openrisc: don't printk() unconditionally dma-debug: fix debugfs initialization order SUNRPC: Fix potential memory corruption scsi: fdomain: Fix error return code in fdomain_probe() pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() scsi: smartpqi: Fix an error code in pqi_get_raid_map() scsi: qedi: Fix error codes in qedi_alloc_global_queues() scsi: qedf: Fix error codes in qedf_alloc_global_queues() powerpc/config: Renable MTD_PHYSMAP_OF scsi: target: avoid per-loop XCOPY buffer allocations HID: i2c-hid: Fix Elan touchpad regression KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call fscache: Fix cookie key hashing clk: at91: sam9x60: Don't use audio PLL clk: at91: clk-generated: pass the id of changeable parent at registration clk: at91: clk-generated: Limit the requested rate to our range KVM: PPC: Fix clearing never mapped TCEs in realmode f2fs: fix to account missing .skipped_gc_rwsem f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() f2fs: fix to unmap pages from userspace process in punch_hole() MIPS: Malta: fix alignment of the devicetree buffer kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y userfaultfd: prevent concurrent API initialization drm/amdgpu: Fix amdgpu_ras_eeprom_init() ASoC: atmel: ATMEL drivers don't need HAS_DMA media: dib8000: rewrite the init prbs logic crypto: mxs-dcp - Use sg_mapping_iter to copy data PCI: Use pci_update_current_state() in pci_enable_device_flags() tipc: keep the skb in rcv queue until the whole data is read iio: dac: ad5624r: Fix incorrect handling of an optional regulator. iavf: do not override the adapter state in the watchdog task iavf: fix locking of critical sections ARM: dts: qcom: apq8064: correct clock names video: fbdev: kyro: fix a DoS bug by restricting user input netlink: Deal with ESRCH error in nlmsg_notify() Smack: Fix wrong semantics in smk_access_entry() drm: avoid blocking in drm_clients_info's rcu section igc: Check if num of q_vectors is smaller than max before array access usb: host: fotg210: fix the endpoint's transactional opportunities calculation usb: host: fotg210: fix the actual_length of an iso packet usb: gadget: u_ether: fix a potential null pointer dereference USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() usb: gadget: composite: Allow bMaxPower=0 if self-powered staging: board: Fix uninitialized spinlock when attaching genpd tty: serial: jsm: hold port lock when reporting modem line changes drm/amd/display: Fix timer_per_pixel unit error drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() flow_dissector: Fix out-of-bounds warnings s390/jump_label: print real address in a case of a jump label bug s390: make PCI mio support a machine flag serial: 8250: Define RX trigger levels for OxSemi 950 devices xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure serial: 8250_pci: make setup_port() parameters explicitly unsigned staging: ks7010: Fix the initialization of the 'sleep_status' structure samples: bpf: Fix tracex7 error raised on the missing argument ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() Bluetooth: skip invalid hci_sync_conn_complete_evt workqueue: Fix possible memory leaks in wq_numa_init() bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() arm64: tegra: Fix Tegra194 PCIe EP compatible string ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output media: imx258: Rectify mismatch of VTS value media: imx258: Limit the max analogue gain to 480 media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: TDA1997x: fix tda1997x_query_dv_timings() return value media: tegra-cec: Handle errors of clk_prepare_enable() ARM: dts: imx53-ppd: Fix ACHC entry arm64: dts: qcom: sdm660: use reg value for memory node net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() drm/msm: mdp4: drop vblank get/put from prepare/complete_commit selftests/bpf: Fix xdp_tx.c prog section name Bluetooth: schedule SCO timeouts with delayed_work Bluetooth: avoid circular locks in sco_sock_connect net/mlx5: Fix variable type to match 64bit gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() drm/display: fix possible null-pointer dereference in dcn10_set_clock() mac80211: Fix monitor MTU limit so that A-MSDUs get through ARM: tegra: tamonten: Fix UART pad setting arm64: tegra: Fix compatible string for Tegra132 CPUs arm64: dts: ls1046a: fix eeprom entries nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data Bluetooth: Fix handling of LE Enhanced Connection Complete opp: Don't print an error if required-opps is missing serial: sh-sci: fix break handling for sysrq tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD rpc: fix gss_svc_init cleanup on failure staging: rts5208: Fix get_ms_information() heap buffer size gfs2: Don't call dlm after protocol is unmounted usb: chipidea: host: fix port index underflow and UBSAN complains lockd: lockd server-side shouldn't set fl_ops drm/exynos: Always initialize mapping in exynos_drm_register_dma() m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch btrfs: tree-log: check btrfs_lookup_data_extent return value ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER ASoC: Intel: Skylake: Fix passing loadable flag for module of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS mmc: sdhci-of-arasan: Check return value of non-void funtions mmc: rtsx_pci: Fix long reads when clock is prescaled selftests/bpf: Enlarge select() timeout for test_maps mmc: core: Return correct emmc response in case of ioctl error cifs: fix wrong release in sess_alloc_buffer() failed path Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" usb: musb: musb_dsps: request_irq() after initializing musb usbip: give back URBs for unsent unlink requests during cleanup usbip:vhci_hcd USB port can get stuck in the disabled state ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B drm/amdkfd: Account for SH/SE count when setting up cu masks. iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed iwlwifi: mvm: avoid static queue number aliasing iwlwifi: mvm: fix access to BSS elements net/mlx5: DR, Enable QP retransmission parport: remove non-zero check on count ath9k: fix OOB read ar9300_eeprom_restore_internal ath9k: fix sleeping in atomic context net: fix NULL pointer reference in cipso_v4_doi_free fix array-index-out-of-bounds in taprio_change net: w5100: check return value after calling platform_get_resource() parisc: fix crash with signals and alloca ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() scsi: BusLogic: Fix missing pr_cont() use scsi: qla2xxx: Changes to support kdump kernel scsi: qla2xxx: Sync queue idx with queue_pair_map idx cpufreq: powernv: Fix init_chip_info initialization in numa=off s390/pv: fix the forcing of the swiotlb mm/hugetlb: initialize hugetlb_usage in mm_init mm,vmscan: fix divide by zero in get_scan_count memcg: enable accounting for pids in nested pid namespaces platform/chrome: cros_ec_proto: Send command again when timeout occurs lib/test_stackinit: Fix static initializer test net: dsa: lantiq_gswip: fix maximum frame length drm/msi/mdp4: populate priv->kms in mdp4_kms_init drm/amdgpu: Fix BUG_ON assert drm/panfrost: Simplify lock_region calculation drm/panfrost: Use u64 for size in lock_region drm/panfrost: Clamp lock region to Bifrost minimum btrfs: fix upper limit for max_inline for page size 64K xen: reset legacy rtc flag for PV domU bnx2x: Fix enabling network interfaces without VFs arm64/sve: Use correct size when reinitialising SVE state PM: base: power: don't try to use non-existing RTC for storing data PCI: Add AMD GPU multi-function power dependencies drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 drm/etnaviv: return context from etnaviv_iommu_context_get drm/etnaviv: put submit prev MMU context when it exists drm/etnaviv: stop abusing mmu_context as FE running marker drm/etnaviv: keep MMU context across runtime suspend/resume drm/etnaviv: exec and MMU state is lost when resetting the GPU drm/etnaviv: fix MMU context leak on GPU reset drm/etnaviv: reference MMU context when setting up hardware state drm/etnaviv: add missing MMU context put when reaping MMU mapping s390/sclp: fix Secure-IPL facility detection x86/mm: Fix kern_addr_valid() to cope with existing but not present entries tipc: fix an use-after-free issue in tipc_recvmsg net-caif: avoid user-triggerable WARN_ON(1) ptp: dp83640: don't define PAGE0 dccp: don't duplicate ccid when cloning dccp sock net/l2tp: Fix reference count leak in l2tp_udp_recv_core r6040: Restore MDIO clock frequency after MAC reset tipc: increase timeout in tipc_sk_enqueue() perf machine: Initialize srcline string member in add_location struct net/mlx5: FWTrace, cancel work on alloc pd error flow net/mlx5: Fix potential sleeping in atomic context events: Reuse value read using READ_ONCE instead of re-reading it vhost_net: fix OoB on sendmsg() failure. net/af_unix: fix a data-race in unix_dgram_poll net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() qed: Handle management FW error dt-bindings: arm: Fix Toradex compatible typo ibmvnic: check failover_pending in login response KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers net: hns3: pad the short tunnel frame before sending to hardware net: hns3: change affinity_mask to numa node range net: hns3: disable mac in flr process net: hns3: fix the timing issue of VF clearing interrupt sources mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation mfd: db8500-prcmu: Adjust map to reality PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms fuse: fix use after free in fuse_read_interrupt() mfd: Don't use irq_create_mapping() to resolve a mapping tracing/probes: Reject events which have the same name of existing one PCI: Add ACS quirks for Cavium multi-function devices Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 block, bfq: honor already-setup queue merges PCI: ibmphp: Fix double unmap of io_mem ethtool: Fix an error code in cxgb2.c NTB: Fix an error code in ntb_msit_probe() NTB: perf: Fix an error code in perf_setup_inbuf() mfd: axp20x: Update AXP288 volatile ranges PCI: Fix pci_dev_str_match_path() alloc while atomic bug mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set KVM: arm64: Handle PSCI resets before userspace touches vCPU state PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' ARC: export clear_user_page() for modules perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} net: dsa: b53: Fix calculating number of switch ports netfilter: socket: icmp6: fix use-after-scope fq_codel: reject silly quantum parameters qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom ip_gre: validate csum_start only on pull net: renesas: sh_eth: Fix freeing wrong tx descriptor s390/bpf: Fix optimizing out zero-extensions s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant Linux 5.4.148 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8613b511cb543a7ce0d1623663fc1306aaa45af1	2021-09-25 14:41:58 +02:00
Tianjia Zhang	a1d12196c3	Smack: Fix wrong semantics in smk_access_entry() ... [ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ] In the smk_access_entry() function, if no matching rule is found in the rust_list, a negative error code will be used to perform bit operations with the MAY_ enumeration value. This is semantically wrong. This patch fixes this issue. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-09-22 12:26:27 +02:00
Greg Kroah-Hartman	d756462d85	This is the 5.4.146 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFBpSMACgkQONu9yGCS aT6PRw//T4GhyaqI0+hhYnYv2++RBzAtKsOAPE7JUZ8X5zNNe3NZKD/+c0q9loy3 vs1GpkjppSzZcL2WGZidwpgOTO0fqEYiJKusI+E60UGbu8GmmoUl0EbV3A3PP1K7 n+T1jzMID1j4NwmZQsAA1o3/9pkWrKLb/1+g0mHVCL6WQjA4/YROi5f6xhVeCq/u aZFLxrgJ8YRkT9znEHCBcipEGRLid5kQp1uxSA5KaQh0JJl01eoJ3M52swYiExC/ 8g+QXPHFWOs9a1vVyxUG5o4WCShnjKwY1fNkEJ5j54LMmmg52llHfMHajV2a1Kdt qihSgY5/pPY9FgEDQ3Sy6xiTO2Lvq17lvHtEbGIn5V7SjQ4ISEN15Pqv3l+PqAFc gHeukc28mBfw6/kbolKZ/wksIKyDzxCHd4QNEYZMKjSPbjpzg7zjsvCX53lHkKNb 23I0iJTu9yVDcPzYYCh/8ndFtxEIBGXS8c9kL5YN8p2k1AMqXcr1qUbYzM9CJqwm MSaZ2C1rR58Uhd4CUvOK4N2K7lw+2PH6I0UcSGlp9jv+xHVlmERiM7uaZGBn7oLm +n+5BRAU/qDK+Vm1poIZogrsI4BwMp9ZH4terELR28i0gPwYo+tCzddWqq98BuGT 52ylkG56l0gbC9Bvpf3Ou3K5/qbmhN9HYElt16HNFO6x/ufE2XI= =1neh -----END PGP SIGNATURE----- Merge 5.4.146 into android11-5.4-lts Changes in 5.4.146 locking/mutex: Fix HANDOFF condition regmap: fix the offset of register error log crypto: mxs-dcp - Check for DMA mapping errors sched/deadline: Fix reset_on_fork reporting of DL tasks power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() sched/deadline: Fix missing clock update in migrate_task_rq_dl() rcu/tree: Handle VM stoppage in stall detection posix-cpu-timers: Force next expiration recalc after itimer reset hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() hrtimer: Ensure timerfd notification for HIGHRES=n udf: Check LVID earlier udf: Fix iocharset=utf8 mount option isofs: joliet: Fix iocharset=utf8 mount option bcache: add proper error unwinding in bcache_device_init nvme-tcp: don't update queue count when failing to set io queues nvme-rdma: don't update queue count when failing to set io queues nvmet: pass back cntlid on successful completion power: supply: max17042_battery: fix typo in MAx17042_TOFF s390/cio: add dev_busid sysfs entry for each subchannel libata: fix ata_host_start() crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - handle both source of interrupt in VF ISR crypto: qat - fix reuse of completion variable crypto: qat - fix naming for init/shutdown VF to PF notifications crypto: qat - do not export adf_iov_putmsg() fcntl: fix potential deadlock for &fasync_struct.fa_lock udf_get_extendedattr() had no boundary checks. s390/kasan: fix large PMD pages address alignment check s390/debug: fix debug area life cycle m68k: emu: Fix invalid free in nfeth_cleanup() sched: Fix UCLAMP_FLAG_IDLE setting spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config spi: spi-pic32: Fix issue with uninitialized dma_slave_config genirq/timings: Fix error return code in irq_timings_test_irqs() lib/mpi: use kcalloc in mpi_resize clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel block: nbd: add sanity check for first_minor crypto: qat - use proper type for vf_mask certs: Trigger creation of RSA module signing key if it's not an RSA key regulator: vctrl: Use locked regulator_get_voltage in probe path regulator: vctrl: Avoid lockdep warning in enable/disable ops spi: sprd: Fix the wrong WDG_LOAD_VAL spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible EDAC/i10nm: Fix NVDIMM detection drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() media: TDA1997x: enable EDID support soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally media: cxd2880-spi: Fix an error handling path bpf: Fix a typo of reuseport map in bpf.h. bpf: Fix potential memleak and UAF in the verifier. ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties soc: qcom: rpmhpd: Use corner in power_off media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: dvb-usb: Fix error handling in dvb_usb_i2c_init media: go7007: remove redundant initialization media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats Bluetooth: sco: prevent information leak in sco_conn_defer_accept() 6lowpan: iphc: Fix an off-by-one check of array index netns: protect netns ID lookups with RCU drm/amdgpu/acp: Make PM domain really work tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos ARM: dts: meson8: Use a higher default GPU clock frequency ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties net/mlx5e: Prohibit inner indir TIRs in IPoIB cgroup/cpuset: Fix a partition bug with hotplug net: cipso: fix warnings in netlbl_cipsov4_add_std i2c: highlander: add IRQ check leds: lt3593: Put fwnode in any case during ->probe() leds: trigger: audio: Add an activate callback to ensure the initial brightness is set media: em28xx-input: fix refcount bug in em28xx_usb_disconnect media: venus: venc: Fix potential null pointer dereference on pointer fmt PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: PM: Enable PME if it can be signaled from D3cold soc: qcom: smsm: Fix missed interrupts if state changes while masked debugfs: Return error during {full/open}_proxy_open() on rmmod Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow PM: EM: Increase energy calculation precision drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 counter: 104-quad-8: Return error when invalid mode during ceiling_write Bluetooth: fix repeated calls to sco_sock_kill drm/msm/dsi: Fix some reference counted resource leaks usb: gadget: udc: at91: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse Bluetooth: Move shutdown callback before flushing tx and rx queue usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check mac80211: Fix insufficient headroom issue for AMSDU lockd: Fix invalid lockowner cast after vfs_test_lock nfsd4: Fix forced-expiry locking usb: gadget: mv_u3d: request_irq() after initializing UDC mm/swap: consider max pages in iomap_swapfile_add_extent Bluetooth: add timeout sanity check to hci_inquiry i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check rsi: fix error code in rsi_load_9116_firmware() rsi: fix an error code in rsi_probe() ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs ASoC: Intel: Skylake: Fix module resource and format selection mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config bpf: Fix possible out of bound write in narrow load handling CIFS: Fix a potencially linear read overflow i2c: mt65xx: fix IRQ check usb: ehci-orion: Handle errors of clk_prepare_enable() in probe usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available tty: serial: fsl_lpuart: fix the wrong mapbase value ASoC: wcd9335: Fix a double irq free in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Disable irq on slave ports in the remove function ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() bcma: Fix memory leak for internally-handled cores brcmfmac: pcie: fix oops on failure to resume and reprobe ipv6: make exception cache less predictible ipv4: make exception cache less predictible net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed net: qualcomm: fix QCA7000 checksum handling octeontx2-af: Fix loop in free and unmap counter ipv4: fix endianness issue in inet_rtm_getroute_build_skb() bpf: Introduce BPF nospec instruction for mitigating Spectre v4 bpf: Fix leakage due to insufficient speculative store bypass mitigation bpf: verifier: Allocate idmap scratch in verifier env bpf: Fix pointer arithmetic mask tightening under state pruning time: Handle negative seconds correctly in timespec64_to_ns() tty: Fix data race between tiocsti() and flush_to_ldisc() perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op x86/resctrl: Fix a maybe-uninitialized build warning treated as error KVM: s390: index kvm->arch.idle_mask by vcpu_idx KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter fuse: truncate pagecache on atomic_o_trunc fuse: flush extending writes IMA: remove -Wmissing-prototypes warning IMA: remove the dependency on CRYPTO_MD5 fbmem: don't allow too huge resolutions backlight: pwm_bl: Improve bootloader/kernel device handover clk: kirkwood: Fix a clocking boot regression Linux 5.4.146 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5524baa0c07d9d9b80c0736488e3ea0e4fb8e335	2021-09-15 14:01:16 +02:00
THOBY Simon	4a95b04afa	IMA: remove the dependency on CRYPTO_MD5 ... commit 8510505d55e194d3f6c9644c9f9d12c4f6b0395a upstream. MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there. The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368ab6 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set: ima: Can not allocate md5 (reason: -2) ima: Allocating md5 failed, going to use default hash algorithm sha256 Remove the CRYPTO_MD5 dependency for IMA. Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr> Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> [zohar@linux.ibm.com: include commit number in patch description for stable.] Cc: stable@vger.kernel.org # 4.17 Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:47:41 +02:00
Austin Kim	c69935f0b0	IMA: remove -Wmissing-prototypes warning ... commit a32ad90426a9c8eb3915eed26e08ce133bd9e0da upstream. With W=1 build, the compiler throws warning message as below: security/integrity/ima/ima_mok.c:24:12: warning: no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes] __init int ima_mok_init(void) Silence the warning by adding static keyword to ima_mok_init(). Signed-off-by: Austin Kim <austin.kim@lge.com> Fixes: 41c89b64d7 ("IMA: create machine owner and blacklist keyrings") Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:47:41 +02:00
Greg Kroah-Hartman	a7e747c026	Merge 5.4.133 into android11-5.4-lts ... Changes in 5.4.133 drm/mxsfb: Don't select DRM_KMS_FB_HELPER drm/zte: Don't select DRM_KMS_FB_HELPER drm/amd/amdgpu/sriov disable all ip hw status by default drm/vc4: fix argument ordering in vc4_crtc_get_margins() net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() drm/amd/display: fix use_max_lb flag for 420 pixel formats hugetlb: clear huge pte during flush function on mips platform atm: iphase: fix possible use-after-free in ia_module_exit() mISDN: fix possible use-after-free in HFC_cleanup() atm: nicstar: Fix possible use-after-free in nicstar_cleanup() net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() reiserfs: add check for invalid 1st journal block drm/virtio: Fix double free on probe failure drm/sched: Avoid data corruptions udf: Fix NULL pointer dereference in udf_symlink function e100: handle eeprom as little endian igb: handle vlan types with checker enabled drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() clk: renesas: r8a77995: Add ZA2 clock clk: tegra: Ensure that PLLU configuration is applied properly ipv6: use prandom_u32() for ID generation RDMA/cxgb4: Fix missing error code in create_qp() dm space maps: don't reset space map allocation cursor when committing pinctrl: mcp23s08: fix race condition in irq handler ice: set the value of global config lock timeout longer virtio_net: Remove BUG() to avoid machine dead net: bcmgenet: check return value after calling platform_get_resource() net: mvpp2: check return value after calling platform_get_resource() net: micrel: check return value after calling platform_get_resource() drm/amd/display: Update scaling settings on modeset drm/amd/display: Release MST resources on switch from MST to SST drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7 drm/amdkfd: use allowed domain for vmbo validation fjes: check return value after calling platform_get_resource() selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check xfrm: Fix error reporting in xfrm_state_construct. wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP wl1251: Fix possible buffer overflow in wl1251_cmd_scan cw1200: add missing MODULE_DEVICE_TABLE bpf: Fix up register-based shifts in interpreter to silence KUBSAN mt76: mt7615: fix fixed-rate tx status reporting net: fix mistake path for netdev_features_strings net: sched: fix error return code in tcf_del_walker() drm/amdkfd: Walk through list with dqm lock hold rtl8xxxu: Fix device info for RTL8192EU devices MIPS: add PMD table accounting into MIPS'pmd_alloc_one atm: nicstar: use 'dma_free_coherent' instead of 'kfree' atm: nicstar: register the interrupt handler in the right place vsock: notify server to shutdown when client has pending signal RDMA/rxe: Don't overwrite errno from ib_umem_get() iwlwifi: mvm: don't change band on bound PHY contexts iwlwifi: pcie: free IML DMA memory allocation iwlwifi: pcie: fix context info freeing sfc: avoid double pci_remove of VFs sfc: error code if SRIOV cannot be disabled wireless: wext-spy: Fix out-of-bounds warning media, bpf: Do not copy more entries than user space requested net: ip: avoid OOM kills with large UDP sends over loopback RDMA/cma: Fix rdma_resolve_route() memory leak Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip. Bluetooth: Fix the HCI to MGMT status conversion table Bluetooth: Shutdown controller after workqueues are flushed or cancelled Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. sctp: validate from_addr_param return sctp: add size validation when walking chunks MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops MIPS: set mips32r5 for virt extensions fscrypt: don't ignore minor_hash when hash is 0 crypto: ccp - Annotate SEV Firmware file names perf bench: Fix 2 memory sanitizer warnings powerpc/mm: Fix lockup on kernel exec fault powerpc/barrier: Avoid collision with clang's __lwsync macro drm/amdgpu: Update NV SIMD-per-CU to 2 drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() drm/rockchip: dsi: remove extra component_del() call drm/amd/display: fix incorrrect valid irq check pinctrl/amd: Add device HID for new AMD GPIO controller drm/amd/display: Reject non-zero src_y and src_x for video planes drm/tegra: Don't set allow_fb_modifiers explicitly drm/msm/mdp4: Fix modifier support enabling drm/arm/malidp: Always list modifiers mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode mmc: core: clear flags before allowing to retune mmc: core: Allow UHS-I voltage switch for SDSC cards if supported ata: ahci_sunxi: Disable DIPM cpu/hotplug: Cure the cpusets trainwreck clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround fpga: stratix10-soc: Add missing fpga_mgr_free() call MIPS: fix "mipsel-linux-ld: decompress.c:undefined reference to `memmove'" ASoC: tegra: Set driver_name=tegra for all machine drivers qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute ipmi/watchdog: Stop watchdog timer when the current action is 'none' thermal/drivers/int340x/processor_thermal: Fix tcc setting ubifs: Fix races between xattr_{set|get} and listxattr operations power: supply: ab8500: Fix an old bug nvmem: core: add a missing of_node_put extcon: intel-mrfld: Sync hardware and software state on init seq_buf: Fix overflow in seq_buf_putmem_hex() rq-qos: fix missed wake-ups in rq_qos_throttle try two tracing: Simplify & fix saved_tgids logic tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() dm btree remove: assign new_root only when removal succeeds PCI: Leave Apple Thunderbolt controllers on for s2idle or standby PCI: aardvark: Fix checking for PIO Non-posted Request PCI: aardvark: Implement workaround for the readback value of VEND_ID media: subdev: disallow ioctl for saa6588/davinci media: dtv5100: fix control-request directions media: zr364xx: fix memory leak in zr364xx_start_readpipe media: gspca/sq905: fix control-request direction media: gspca/sunplus: fix zero-length control requests media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() jfs: fix GPF in diFree smackfs: restrict bytes count in smk_set_cipso() Linux 5.4.133 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4daf813e30444755db3a7d587f8be81ccd2f748b	2021-07-20 11:32:58 +02:00
Tetsuo Handa	135122f174	smackfs: restrict bytes count in smk_set_cipso() ... commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream. Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: smackfs: restrict bytes count in smk_set_cipso() Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Reported-by: syzbot <syzbot+77c53db50c9fff774e8e@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-19 08:53:18 +02:00
Minchan Kim	bfb8eb833e	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC ... [ Upstream commit 648f2c6100cfa18e7dfe43bc0b9c3b73560d623c ] In the field, we have seen lots of allocation failure from the call path below. 06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together. [1] 476accbe2f ("selinux: use GFP_NOWAIT in the AVC kmem_caches") Signed-off-by: Minchan Kim <minchan@kernel.org> [PM: subj fix, line wraps, normalized commit refs] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-19 08:53:10 +02:00
Greg Kroah-Hartman	374d020984	This is the 5.4.132 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDu+p0ACgkQONu9yGCS aT5SOw/9F58e4gz7PSTn4A9oCTNodRPe9B9rzf3y1Ol0k7T1aeQoWsPFOkZpNSOJ tdOGEXnwYnLpMC7nuFshWv1uKGAL/weHADyGV6J37AntYFjpEFhJhSH7pGGhDk7V EeIl98luBynPXOKNnDvcrQweeRaHKOInQBT8JJzwwsZbF2oqfOqdU0A787BiRu+3 zoi/mV0upDB443ji/JY0xj+o4jlbsuD0WxEqgkcD2YHL+QvU5Wr0mGys7m5gG9x7 TpKpMic0ILrF1vt/znLL5rOlX497prTvZ74ZXV/DYizeYxqtl/UG3CZjo1uf2yqk pAXA57paz6DY2Ct+3QbJBeuer27bTz6SCClSS1om9AcUk6oNSdULmMdTGvQb0SLU wx1Cy8b2ei04SVl96+McKKZ6ln47LJediGn0qIdwC6O/XHHrLq4u5PkSnQxRU4pA GH1tP5oYy4GzL9RbBeiDJQETFiXwkexSEWVyuSc6BhqQXao9yVzmLQbL1zgjH/zO m/tckZ3vEg+ll8j4QJCisHRyqYhwfru4PsJQH9Q7q6CtIuGOsd0Z/OUcLuF6knXg jDOrDIykE/PnkQ2Dc2RhdONP1ud5j3oBnHvNHs6FDghRKjaixMQzg3g/RNtnAaTj +7Xsfbi6ntpZSDOaY7YNgt+ZH3l4YRnUL/xBA6qIygayz374nzI= =LU0G -----END PGP SIGNATURE----- Merge 5.4.132 into android11-5.4-lts Changes in 5.4.132 ALSA: usb-audio: fix rate on Ozone Z90 USB headset ALSA: usb-audio: Fix OOB access at proc output ALSA: usb-audio: scarlett2: Fix wrong resume call ALSA: intel8x0: Fix breakage at ac97 clock measurement ALSA: hda/realtek: Add another ALC236 variant support ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too media: dvb-usb: fix wrong definition Input: usbtouchscreen - fix control-request directions net: can: ems_usb: fix use-after-free in ems_usb_disconnect() usb: gadget: eem: fix echo command packet response issue USB: cdc-acm: blacklist Heimann USB Appset device usb: dwc3: Fix debugfs creation flow usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() xhci: solve a double free problem while doing s4 ntfs: fix validity check for file name attribute copy_page_to_iter(): fix ITER_DISCARD case iov_iter_fault_in_readable() should do nothing in xarray case Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode ARM: dts: at91: sama5d4: fix pinctrl muxing btrfs: send: fix invalid path for unlink operations after parent orphanization btrfs: clear defrag status of a root if starting transaction fails ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle ext4: fix kernel infoleak via ext4_extent_header ext4: return error code when ext4_fill_flex_info() fails ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() ext4: fix avefreec in find_group_orlov ext4: use ext4_grp_locked_error in mb_find_extent can: bcm: delay release of struct bcm_op after synchronize_rcu() can: gw: synchronize rcu operations before removing gw job entry can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path mac80211: remove iwlwifi specific workaround that broke sta NDP tx SUNRPC: Fix the batch tasks count wraparound. SUNRPC: Should wake up the privileged task firstly. perf/smmuv3: Don't trample existing events with global filter KVM: PPC: Book3S HV: Workaround high stack usage with clang s390/cio: dont call css_wait_for_slow_path() inside a lock rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path iio: light: tcs3472: do not free unallocated IRQ iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR iio: ltr501: ltr501_read_ps(): add missing endianness conversion serial: mvebu-uart: fix calculation of clock divisor serial: sh-sci: Stop dmaengine transfer in sci_stop_tx() serial_cs: Add Option International GSM-Ready 56K/ISDN modem serial_cs: remove wrong GLOBETROTTER.cis entry ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() ssb: sdio: Don't overwrite const buffer if block_write fails rsi: Assign beacon rate settings to the correct rate_info descriptor field rsi: fix AP mode with WPA failure due to encrypted EAPOL tracing/histograms: Fix parsing of "sym-offset" modifier tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing seq_buf: Make trace_seq_putmem_hex() support data longer than 8 powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() evm: Execute evm_inode_init_security() only when an HMAC key is loaded evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded fuse: ignore PG_workingset after stealing fuse: check connected before queueing on fpq->io fuse: reject internal errno spi: Make of_register_spi_device also set the fwnode media: mdk-mdp: fix pm_runtime_get_sync() usage count media: s5p: fix pm_runtime_get_sync() usage count media: sh_vou: fix pm_runtime_get_sync() usage count media: mtk-vcodec: fix PM runtime get logic media: s5p-jpeg: fix pm_runtime_get_sync() usage count media: sti/bdisp: fix pm_runtime_get_sync() usage count media: exynos-gsc: fix pm_runtime_get_sync() usage count spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() spi: omap-100k: Fix the length judgment problem regulator: uniphier: Add missing MODULE_DEVICE_TABLE hwrng: exynos - Fix runtime PM imbalance on error crypto: nx - add missing MODULE_DEVICE_TABLE media: sti: fix obj-$(config) targets media: cpia2: fix memory leak in cpia2_usb_probe media: cobalt: fix race condition in setting HPD media: pvrusb2: fix warning in pvr2_i2c_core_done media: imx: imx7_mipi_csis: Fix logging of only error event counters crypto: qat - check return code of qat_hal_rd_rel_reg() crypto: qat - remove unused macro in FW loader sched/fair: Fix ascii art by relpacing tabs media: em28xx: Fix possible memory leak of em28xx struct media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release media: bt8xx: Fix a missing check bug in bt878_probe media: st-hva: Fix potential NULL pointer dereferences Makefile: fix GDB warning with CONFIG_RELR media: dvd_usb: memory leak in cinergyt2_fe_attach memstick: rtsx_usb_ms: fix UAF mmc: sdhci-sprd: use sdhci_sprd_writew mmc: via-sdmmc: add a check against NULL pointer dereference crypto: shash - avoid comparing pointers to exported functions under CFI media: dvb_net: avoid speculation from net slot media: siano: fix device register error path media: imx-csi: Skip first few frames from a BT.656 source hwmon: (max31790) Report correct current pwm duty cycles hwmon: (max31790) Fix pwmX_enable attributes drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe() KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors btrfs: fix error handling in __btrfs_update_delayed_inode btrfs: abort transaction if we fail to update the delayed inode btrfs: disable build on platforms having page size 256K locking/lockdep: Fix the dep path printing for backwards BFS lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage() KVM: s390: get rid of register asm usage regulator: mt6358: Fix vdram2 .vsel_mask regulator: da9052: Ensure enough delay time for .set_voltage_time_sel media: Fix Media Controller API config checks HID: do not use down_interruptible() when unbinding devices EDAC/ti: Add missing MODULE_DEVICE_TABLE ACPI: processor idle: Fix up C-state latency if not ordered hv_utils: Fix passing zero to 'PTR_ERR' warning lib: vsprintf: Fix handling of number field widths in vsscanf ACPI: EC: Make more Asus laptops use ECDT _GPE block_dump: remove block_dump feature in mark_inode_dirty() fs: dlm: cancel work sync othercon random32: Fix implicit truncation warning in prandom_seed_state() fs: dlm: fix memory leak when fenced ACPICA: Fix memory leak caused by _CID repair function ACPI: bus: Call kobject_put() in acpi_init() error path ACPI: resources: Add checks for ACPI IRQ override block: fix race between adding/removing rq qos and normal IO platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst() EDAC/Intel: Do not load EDAC driver when running as a guest PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() clocksource: Retry clock read if long delays detected ACPI: tables: Add custom DSDT file as makefile prerequisite HID: wacom: Correct base usage for capacitive ExpressKey status bits cifs: fix missing spinlock around update to ses->status block: fix discard request merge kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() ia64: mca_drv: fix incorrect array size calculation writeback, cgroup: increment isw_nr_in_flight before grabbing an inode media: s5p_cec: decrement usage count if disabled crypto: ixp4xx - dma_unmap the correct address crypto: ux500 - Fix error return code in hash_hw_final() sata_highbank: fix deferred probing pata_rb532_cf: fix deferred probing media: I2C: change 'RST' to "RSET" to fix multiple build errors sched/uclamp: Fix wrong implementation of cpu.uclamp.min sched/uclamp: Fix locking around cpu_util_update_eff() kbuild: run the checker after the compiler kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n' pata_octeon_cf: avoid WARN_ON() in ata_host_activate() evm: fix writing <securityfs>/evm overflow crypto: ccp - Fix a resource leak in an error handling path media: rc: i2c: Fix an error message pata_ep93xx: fix deferred probing media: exynos4-is: Fix a use after free in isp_video_release media: au0828: fix a NULL vs IS_ERR() check media: tc358743: Fix error return code in tc358743_probe_of() media: gspca/gl860: fix zero-length control requests m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() crypto: nitrox - fix unchecked variable in nitrox_register_interrupts crypto: omap-sham - Fix PM reference leak in omap sham ops mmc: usdhi6rol0: fix error return code in usdhi6_probe() arm64: consistently use reserved_pg_dir arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx hwmon: (max31722) Remove non-standard ACPI device IDs hwmon: (max31790) Fix fan speed reporting for fan7..12 KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap regulator: hi655x: Fix pass wrong pointer to config.driver_data btrfs: clear log tree recovering status if starting transaction fails sched/rt: Fix RT utilization tracking during policy change sched/rt: Fix Deadline utilization tracking during policy change sched/uclamp: Fix uclamp_tg_restrict() spi: spi-sun6i: Fix chipselect/clock bug crypto: nx - Fix RCU warning in nx842_OF_upd_status ACPI: sysfs: Fix a buffer overrun problem with description_show() extcon: extcon-max8997: Fix IRQ freeing at error path blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() blk-wbt: make sure throttle is enabled properly ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros ACPI: bgrt: Fix CFI violation cpufreq: Make cpufreq_online() call driver->offline() on errors ocfs2: fix snprintf() checking dax: fix ENOMEM handling in grab_mapping_entry() xfrm: xfrm_state_mtu should return at least 1280 for ipv6 video: fbdev: imxfb: Fix an error message net: mvpp2: Put fwnode in error case during ->probe() net: pch_gbe: Propagate error from devm_gpio_request_one() pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities clk: meson: g12a: fix gp0 and hifi ranges net: ftgmac100: add missing error return code in ftgmac100_probe() drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() drm/rockchip: dsi: move all lane config except LCDC mux to bind() ehea: fix error return code in ehea_restart_qps() net/sched: act_vlan: Fix modify to allow 0 RDMA/core: Sanitize WQ state received from the userspace RDMA/rxe: Fix failure during driver load drm: qxl: ensure surf.data is ininitialized tools/bpftool: Fix error return code in do_batch() ath10k: go to path err_unsupported when chip id is not supported ath10k: add missing error return code in ath10k_pci_probe() wireless: carl9170: fix LEDS build errors & warnings ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others wcn36xx: Move hal_buf allocation to devm_kmalloc in probe ssb: Fix error return code in ssb_bus_scan() brcmfmac: fix setting of station info chains bitmask brcmfmac: correctly report average RSSI in station info brcmsmac: mac80211_if: Fix a resource leak in an error handling path ath10k: Fix an error code in ath10k_add_interface() netlabel: Fix memory leak in netlbl_mgmt_add_common RDMA/mlx5: Don't add slave port to unaffiliated list netfilter: nft_exthdr: check for IPv6 packet before further processing netfilter: nft_osf: check for TCP packet before further processing netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols RDMA/rxe: Fix qp reference counting for atomic ops samples/bpf: Fix the error return code of xdp_redirect's main() net: ethernet: aeroflex: fix UAF in greth_of_remove net: ethernet: ezchip: fix UAF in nps_enet_remove net: ethernet: ezchip: fix error handling vrf: do not push non-ND strict packets with a source LLA through packet taps again net: sched: add barrier to ensure correct ordering for lockless qdisc tls: prevent oversized sendfile() hangs by ignoring MSG_MORE pkt_sched: sch_qfq: fix qfq_change_class() error path vxlan: add missing rcu_read_lock() in neigh_reduce() net/ipv4: swap flow ports when validating source tc-testing: fix list handling ieee802154: hwsim: Fix memory leak in hwsim_add_one ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() mac80211: remove iwlwifi specific workaround NDPs of null_response net: bcmgenet: Fix attaching to PYH failed on RPi 4B ipv6: exthdrs: do not blindly use init_net bpf: Do not change gso_size during bpf_skb_change_proto() i40e: Fix error handling in i40e_vsi_open i40e: Fix autoneg disabling for non-10GBaseT links Revert "ibmvnic: remove duplicate napi_schedule call in open function" ibmvnic: free tx_pool if tso_pool alloc fails ipv6: fix out-of-bound access in ip6_parse_tlv() e1000e: Check the PCIm state bpfilter: Specify the log level for the kmsg message gve: Fix swapped vars when fetching max queues Revert "be2net: disable bh with spin_lock in be_process_mcc" Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event clk: actions: Fix UART clock dividers on Owl S500 SoC clk: actions: Fix SD clocks factor table on Owl S500 SoC clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC clk: si5341: Avoid divide errors due to bogus register contents clk: si5341: Update initialization magic writeback: fix obtain a reference to a freeing memcg css net: lwtunnel: handle MTU calculation in forwading net: sched: fix warning in tcindex_alloc_perfect_hash RDMA/mlx5: Don't access NULL-cleared mpi pointer MIPS: Fix PKMAP with 32-bit MIPS huge page support staging: fbtft: Rectify GPIO handling rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() tty: nozomi: Fix a resource leak in an error handling function mwifiex: re-fix for unaligned accesses iio: adis_buffer: do not return ints in irq handlers iio: adis16400: do not return ints in irq handlers iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio:accel:mxc4005: Drop unnecessary explicit casts in regmap_bulk_read calls iio: accel: mxc4005: Fix overread of data and alignment issue. iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe() ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() backlight: lm3630a_bl: Put fwnode in error case during ->probe() ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() Input: hil_kbd - fix error return code in hil_dev_connect() mtd: partitions: redboot: seek fis-index-block in the right node char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() firmware: stratix10-svc: Fix a resource leak in an error handling path tty: nozomi: Fix the error handling path of 'nozomi_card_init()' leds: lm3532: select regmap I2C API leds: lm36274: cosmetic: rename lm36274_data to chip leds: lm3692x: Put fwnode in any case during ->probe() scsi: FlashPoint: Rename si_flags field fsi: core: Fix return of error values on failures fsi: scom: Reset the FSI2PIB engine for any error fsi: occ: Don't accept response from un-initialized OCC fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE fsi/sbefifo: Fix reset timeout visorbus: fix error return code in visorchipset_init() s390: appldata depends on PROC_SYSCTL iommu/dma: Fix IOVA reserve dma ranges ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' usb: gadget: f_fs: Fix setting of device and driver data cross-references usb: dwc2: Don't reset the core after setting turnaround time eeprom: idt_89hpesx: Put fwnode in matching case during ->probe() eeprom: idt_89hpesx: Restore printing the unsupported fwnode name iio: at91-sama5d2_adc: remove usage of iio_priv_to_dev() helper iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() staging: gdm724x: check for overflow in gdm_lte_netif_rx() staging: rtl8712: remove redundant check in r871xu_drv_init staging: rtl8712: fix memory leak in rtl871x_load_fw_cb staging: mt7621-dts: fix pci address for PCI memory range serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK of: Fix truncation of memory sizes on 32-bit platforms mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() scsi: mpt3sas: Fix error return value in _scsih_expander_add() soundwire: stream: Fix test for DP prepare complete phy: uniphier-pcie: Fix updating phy parameters phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() extcon: sm5502: Drop invalid register write in sm5502_reg_data extcon: max8997: Add missing modalias string ASoC: atmel-i2s: Fix usage of capture and playback at the same time configfs: fix memleak in configfs_release_bin_file leds: as3645a: Fix error return code in as3645a_parse_node() leds: ktd2692: Fix an error handling path powerpc: Offline CPU in stop_this_cpu() serial: mvebu-uart: do not allow changing baudrate when uartclk is not available serial: mvebu-uart: correctly calculate minimal possible baudrate arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART vfio/pci: Handle concurrent vma faults mm/huge_memory.c: don't discard hugepage if other processes are mapping it mm/z3fold: fix potential memory leak in z3fold_destroy_pool() selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random perf llvm: Return -ENOMEM when asprintf() fails scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() block: return the correct bvec when checking for gaps mmc: block: Disable CMDQ on the ioctl path mmc: vub3000: fix control-request direction scsi: core: Retry I/O for Notify (Enable Spinup) Required error iommu/dma: Fix compile warning in 32-bit builds Linux 5.4.132 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I36eef11d7d5fed3388f0c90904a4e9c495327826	2021-07-14 17:12:58 +02:00
Mimi Zohar	4020615bd7	evm: fix writing <securityfs>/evm overflow ... [ Upstream commit 49219d9b8785ba712575c40e48ce0f7461254626 ] EVM_SETUP_COMPLETE is defined as 0x80000000, which is larger than INT_MAX. The "-fno-strict-overflow" compiler option properly prevents signaling EVM that the EVM policy setup is complete. Define and read an unsigned int. Fixes: f00d797507 ("EVM: Allow userspace to signal an RSA key has been loaded") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-14 16:53:21 +02:00
Roberto Sassu	74e9d920f2	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... commit 9acc89d31f0c94c8e573ed61f3e4340bbd526d0c upstream. EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:53:08 +02:00
Roberto Sassu	d7dfaf13d2	evm: Execute evm_inode_init_security() only when an HMAC key is loaded ... commit 9eea2904292c2d8fa98df141d3bf7c41ec9dc1b5 upstream. evm_inode_init_security() requires an HMAC key to calculate the HMAC on initial xattrs provided by LSMs. However, it checks generically whether a key has been loaded, including also public keys, which is not correct as public keys are not suitable to calculate the HMAC. Originally, support for signature verification was introduced to verify a possibly immutable initial ram disk, when no new files are created, and to switch to HMAC for the root filesystem. By that time, an HMAC key should have been loaded and usable to calculate HMACs for new files. More recently support for requiring an HMAC key was removed from the kernel, so that signature verification can be used alone. Since this is a legitimate use case, evm_inode_init_security() should not return an error when no HMAC key has been loaded. This patch fixes this problem by replacing the evm_key_loaded() check with a check of the EVM_INIT_HMAC flag in evm_initialized. Fixes: 26ddabfe96 ("evm: enable EVM when X509 certificate is loaded") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.5.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:53:08 +02:00
Greg Kroah-Hartman	98bb72abc9	Linux 5.4.130 ... -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmDlnnAACgkQ3qZv95d3 LNxq3Q/5AaAtg+YK2+b1bBV/sLq9rmLt/TlxxB4jpDklD+F9ioCqr7AR9/OCX6KG Q9+PUS/gEixC542IjzF/EPlKNjvTmNhIP9V9tWJo7XYyqP0TkZ7VSNhreWv+N51Y SMRoA/T37Fmhy6IMeAp1EvdAEpqlIntjdifJBLnt56fv3cCCy6I1sHenUG8H9iSf oRwGLsfBadEtihP4h+sqcLbMTHVhMBxyn0rKTa+Qt+sCRjVHgMzWs/XMQO3Ou/bZ Zy6BwWkYFXpc78E6HIk5mBj6JBmx4YdFNNjQG2ld6TCNq7P5DrjWQAchVUrSgLyO dz2ntpdBS/9GukByIaD9HbTICuUrf8f5mCpK730IcEOxb3rqVWCIrpJQXhrrYWfi 3xjzxHzu2DH6ZNedHdH59N5il4WpOMAsasBEIRYZTLK2oEkRLah6k2HDS9LSgZ4M wcnmdEeA7vKlYyaYGhkFPePKVoVdFW8yTxGsN6f2kyKR7DjW7zRcFT5/9GH5Hu+n 0jfUbCsIN+VSP7NFPYW5VywwUiVz1uVTdFK0XKpKzKrLTaWztQ+R5cQDatYu/jpq Chq7VTWdZIRsTe2tHetA7SMh32NRbESx9bxXz+OjvAbc7QlOss37YAztBusH0Uup /nBeRZw7z5N5jn8g2tl+mV/pTE+DrH86cDeAba4SqHztG2Y3H0g= =Uo47 -----END PGP SIGNATURE----- Merge 5.4.130 into android11-5.4-lts Changes in 5.4.130 x86/efi: remove unused variables scsi: sr: Return appropriate error code when disk is ejected drm/nouveau: fix dma_address check for CPU/GPU sync gpio: AMD8111 and TQMX86 require HAS_IOPORT_MAP RDMA/mlx5: Block FDB rules when not in switchdev mode Linux 5.4.130 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I81aa4b6d954afeda3fe6971a5611547db6b9fb7a	2021-07-11 21:35:47 +02:00
YueHaibing	a6c85a8433	x86/efi: remove unused variables ... [ Upstream commit 6f090192f8225f52ba95d08785989688cb768cca ] commit ad723674d675 ("x86/efi: move common keyring handler functions to new file") leave this unused. Fixes: ad723674d675 ("x86/efi: move common keyring handler functions to new file") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: YueHaibing <yuehaibing@huawei.com> Link: https://lore.kernel.org/r/20191115130830.13320-1-yuehaibing@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-07 08:22:58 -04:00