A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity
982,005 commits 10 branches 0 tags 2.1 GiB
Commit graph android_kernel_motorola_sm6375/drivers/android
Author SHA1 Message Date
Michael Bestas
350c4ccfe1
 		Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2025-12-01
CVE-2025-48623
CVE-2025-48624
CVE-2025-48637
CVE-2025-48638
CVE-2024-35970
CVE-2025-38236
CVE-2025-38349
CVE-2025-48610
CVE-2025-38500

* tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: crypto: essiv - Check ssize for decryption and in-place encryption
  ANDROID: GKI: fix up build break where timer_delete_sync() was used
  Revert "net: rtnetlink: remove redundant assignment to variable err"
  Revert "net: rtnetlink: add msg kind names"
  Revert "net: rtnetlink: add helper to extract msg type's kind"
  Revert "net: rtnetlink: use BIT for flag values"
  Revert "net: netlink: add NLM_F_BULK delete request modifier"
  Revert "net: rtnetlink: add bulk delete support flag"
  Revert "net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg"
  Revert "net: add ndo_fdb_del_bulk"
  Revert "net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del"
  Revert "rtnetlink: Allow deleting FDB entries in user namespace"
  Linux 5.4.301
  net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
  media: s5p-mfc: remove an unused/uninitialized variable
  NFSD: Fix last write offset handling in layoutcommit
  NFSD: Minor cleanup in layoutcommit processing
  padata: Reset next CPU when reorder sequence wraps around
  KEYS: trusted_tpm1: Compare HMAC values in constant time
  NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  vfs: Don't leak disconnected dentries on umount
  jbd2: ensure that all ongoing I/O complete before freeing blocks
  ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  drm/amdgpu: use atomic functions with memory barriers for vm fault info
  ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
  spi: cadence-quadspi: Flush posted register writes before DAC access
  spi: cadence-quadspi: Flush posted register writes before INDAC access
  memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  memory: samsung: exynos-srom: Correct alignment
  arm64: errata: Apply workarounds for Neoverse-V3AE
  arm64: cputype: Add Neoverse-V3AE definitions
  comedi: fix divide-by-zero in comedi_buf_munge()
  binder: remove "invalid inc weak" check
  xhci: dbc: enable back DbC in resume if it was enabled before suspend
  usb/core/quirks: Add Huawei ME906S to wakeup quirk
  USB: serial: option: add Telit FN920C04 ECM compositions
  USB: serial: option: add Quectel RG255C
  USB: serial: option: add UNISOC UIS7720
  net: ravb: Ensure memory write completes before ringing TX doorbell
  net: usb: rtl8150: Fix frame padding
  ocfs2: clear extent cache after moving/defragmenting extents
  MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  Revert "cpuidle: menu: Avoid discarding useful information"
  net: bonding: fix possible peer notify event loss or dup issue
  sctp: avoid NULL dereference when chunk data buffer is missing
  arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  net: enetc: correct the value of ENETC_RXB_TRUESIZE
  rtnetlink: Allow deleting FDB entries in user namespace
  net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
  net: add ndo_fdb_del_bulk
  net: rtnetlink: add bulk delete support flag
  net: netlink: add NLM_F_BULK delete request modifier
  net: rtnetlink: use BIT for flag values
  net: rtnetlink: add helper to extract msg type's kind
  net: rtnetlink: add msg kind names
  net: rtnetlink: remove redundant assignment to variable err
  m68k: bitops: Fix find_*_bit() signatures
  hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  dlm: check for defined force value in dlm_lockspace_release
  hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  hfs: validate record offset in hfsplus_bmap_alloc
  hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  hfs: make proper initalization of struct hfs_find_data
  hfs: clear offset and space out of valid records in b-tree node
  exec: Fix incorrect type for ret
  hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
  ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
  sched/fair: Fix pelt lost idle time detection
  sched/balancing: Rename newidle_balance() => sched_balance_newidle()
  sched/fair: Trivial correction of the newidle_balance() comment
  sched: Make newidle_balance() static again
  tls: don't rely on tx_work during send()
  tls: always set record_type in tls_process_cmsg
  tg3: prevent use of uninitialized remote_adv and local_adv variables
  tcp: fix tcp_tso_should_defer() vs large RTT
  amd-xgbe: Avoid spurious link down messages during interface toggle
  net/ip6_tunnel: Prevent perpetual tunnel growth
  net: dlink: handle dma_map_single() failure properly
  net: dl2k: switch from 'pci_' to 'dma_' API
  media: pci: ivtv: Add missing check after DMA map
  media: pci/ivtv: switch from 'pci_' to 'dma_' API
  xen/events: Update virq_to_irq on migration
  media: lirc: Fix error handling in lirc_register()
  media: rc: Directly use ida_free()
  drm/exynos: exynos7_drm_decon: remove ctx->suspended
  btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  pwm: berlin: Fix wrong register in suspend/resume
  media: cx18: Add missing check after DMA map
  xen/events: Cleanup find_virq() return codes
  cramfs: Verify inode mode when loading from disk
  fs: Add 'initramfs_options' to set initramfs mount options
  pid: Add a judgment for ns null in pid_nr_ns
  minixfs: Verify inode mode when loading from disk
  tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
  dm: fix NULL pointer dereference in __dm_suspend()
  mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  Squashfs: reject negative file sizes in squashfs_read_inode()
  Squashfs: add additional inode sanity checking
  media: mc: Clear minor number before put device
  mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  fs: udf: fix OOB read in lengthAllocDescs handling
  KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  net/9p: fix double req put in p9_fd_cancelled
  ext4: guard against EA inode refcount underflow in xattr update
  ext4: correctly handle queries for metadata mappings
  ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
  x86/umip: Check that the instruction opcode is at least two bytes
  PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  PCI/AER: Fix missing uevent on recovery when a reset is requested
  PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  rtc: interface: Fix long-standing race when setting alarm
  rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  mmc: core: SPI mode remove cmd7
  mtd: rawnand: fsmc: Default to autodetect buswidth
  sparc: fix error handling in scan_one_device()
  sparc64: fix hugetlb for sun4u
  sctp: Fix MAC comparison to be constant-time
  scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  parisc: don't reference obsolete termio struct for TC* constants
  lib/genalloc: fix device leak in of_gen_pool_get()
  iio: frequency: adf4350: Fix prescaler usage.
  iio: dac: ad5421: use int type to store negative error codes
  iio: dac: ad5360: use int type to store negative error codes
  crypto: atmel - Fix dma_unmap_sg() direction
  cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
  drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  media: i2c: mt9v111: fix incorrect type for ret
  firmware: meson_sm: fix device leak at probe
  xen/manage: Fix suspend error path
  arm64: dts: qcom: msm8916: Add missing MDSS reset
  ACPI: debug: fix signedness issues in read/write helpers
  ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
  tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  tpm, tpm_tis: Claim locality before writing interrupt registers
  crypto: essiv - Check ssize for decryption and in-place encryption
  mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  tools build: Align warning options with perf
  net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
  drm/vmwgfx: Fix Use-after-free in validation
  net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  scsi: mvsas: Use sas_task_find_rq() for tagging
  scsi: mvsas: Delete mvs_tag_init()
  scsi: libsas: Add sas_task_find_rq()
  clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  perf session: Fix handling when buffer exceeds 2 GiB
  rtc: x1205: Fix Xicor X1205 vendor prefix
  perf util: Fix compression checks returning -1 as bool
  iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  clocksource/drivers/clps711x: Fix resource leaks in error paths
  pinctrl: check the return value of pinmux_ops::get_function_name()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  mm: hugetlb: avoid soft lockup when mprotect to large memory area
  uio_hv_generic: Let userspace take care of interrupt mask
  Squashfs: fix uninit-value in squashfs_get_parent
  Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  nfp: fix RSS hash key size when RSS is not supported
  drivers/base/node: fix double free in register_one_node()
  ocfs2: fix double free in user_cluster_connect()
  net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
  RDMA/siw: Always report immediate post SQ errors
  usb: vhci-hcd: Prevent suspending virtually attached devices
  scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  ipvs: Defer ip_vs_ftp unregister during netns cleanup
  NFSv4.1: fix backchannel max_resp_sz verification check
  remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
  IB/sa: Fix sa_local_svc_timeout_ms read race
  RDMA/core: Resolve MAC of next-hop device without ARP support
  wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  drivers/base/node: handle error properly in register_one_node()
  watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  netfilter: ipset: Remove unused htable_bits in macro ahash_region
  iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
  ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  pps: fix warning in pps_register_cdev when register device fail
  misc: genwqe: Fix incorrect cmd field being reported in error
  usb: gadget: configfs: Correctly set use_os_string at bind
  usb: phy: twl6030: Fix incorrect type for ret
  tcp: fix __tcp_close() to only send RST when required
  PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  wifi: mwifiex: send world regulatory domain to driver
  ALSA: lx_core: use int type to store negative error codes
  media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  scsi: myrs: Fix dma_alloc_coherent() error check
  scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
  serial: max310x: Add error checking in probe()
  usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  drm/radeon/r600_cs: clean up of dead code in r600_cs
  i2c: designware: Add disabling clocks when probe fails
  i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  bpf: Explicitly check accesses to bpf_sock_addr
  selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  pwm: tiehrpwm: Fix corner case in clock divisor calculation
  block: use int to store blk_stack_limits() return value
  blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
  pinctrl: meson-gxl: add missing i2c_d pinmux
  soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  ACPI: processor: idle: Fix memory leak when register cpuidle device failed
  regmap: Remove superfluous check for !config in __regmap_init()
  x86/vdso: Fix output operand size of RDPID
  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  driver core/PM: Set power.no_callbacks along with power.no_pm
  staging: axis-fifo: flush RX FIFO on read errors
  staging: axis-fifo: fix maximum TX packet length check
  perf subcmd: avoid crash in exclude_cmds when excludes is empty
  dm-integrity: limit MAX_TAG_SIZE to 255
  wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  USB: serial: option: add SIMCom 8230C compositions
  media: rc: fix races with imon_disconnect()
  media: imon: grab lock earlier in imon_ir_change_protocol()
  media: imon: reorganize serialization
  media: rc: Add support for another iMON 0xffdc device
  media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  media: tuner: xc5000: Fix use-after-free in xc5000_release
  media: tunner: xc5000: Refactor firmware load
  udp: Fix memory accounting leak.
  media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
  scsi: target: target_core_configfs: Add length check to avoid buffer overflow

 Conflicts:
	drivers/soc/qcom/rpmh-rsc.c
	kernel/sched/fair.c

Change-Id: I58ab24a3db8be4c698c41fd47daeb1f1fb7884ee
 2025-12-04 19:21:35 +02:00
Greg Kroah-Hartman
f6520a7c91 This is the 5.4.301 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkCD9kACgkQONu9yGCS
 aT756BAAwEcL3lKO/0QKjMUrvgv7FRoRm9TH9Usq7Nswmiax6YKI3oPgZKfZZL6u
 yLGSnYqV8f+Jo8kALMJAybu+Oc3Z8WbBZJG/dvlAkvR7iN19ZCuKa2NwWmh8BTGd
 5ZP4/nyXlNlg0/IIZ8xJa3067U895y9IhgMDmSvOZoUFGFecqUmJNBoj8bHgJaPL
 /MENYb7D0CcKWbgCwzsqN0EEm9UKb7xgtaaC52sfZD+GHUPF/RLq9QNyUGtyL0m8
 y20HG6zXmBiVP+zdtYpTaaEP6OSNOCmiOweSZOFafnatd2XO1hRdnAoEk7+t2Lj+
 Xa5GowVUuglmBd8bPbeY8cwVihMxr81DxMns+OpQJTiDD8Q6Whcxbaqwv+tVe7z4
 cVDh1xlKG4U2rsDTeiGhbZVNb6gqqy3LnVFqImQE+dcZqlwC0pbqwO2lLdHMa8NF
 f+l1U3ab0k9qYx8HQegYDTufW5Eb0Rki/3YyHk8o3alOYd2Oc3r16lw9rpSw2Nq3
 Rku+VMSy6z8uvmIP7Ywobla6j73SGFrDc61F0nsU1x+Gd/dMIgkn36dfxciBCgPa
 /AmkK1Psx04s7dIPMowx/nXy5Jk8J4k3JlVMeBnMCuFVUNCNp3qzq5WXdeL1G5f5
 GFPJPblaZrfKQNSSlpUAmstl8v5t8aJcjxobmHn28fVliFAJdDI=
 =XPvH
 -----END PGP SIGNATURE-----

Merge 5.4.301 into android11-5.4-lts

Changes in 5.4.301
	scsi: target: target_core_configfs: Add length check to avoid buffer overflow
	media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
	udp: Fix memory accounting leak.
	media: tunner: xc5000: Refactor firmware load
	media: tuner: xc5000: Fix use-after-free in xc5000_release
	media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
	media: rc: Add support for another iMON 0xffdc device
	media: imon: reorganize serialization
	media: imon: grab lock earlier in imon_ir_change_protocol()
	media: rc: fix races with imon_disconnect()
	USB: serial: option: add SIMCom 8230C compositions
	wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
	dm-integrity: limit MAX_TAG_SIZE to 255
	perf subcmd: avoid crash in exclude_cmds when excludes is empty
	staging: axis-fifo: fix maximum TX packet length check
	staging: axis-fifo: flush RX FIFO on read errors
	driver core/PM: Set power.no_callbacks along with power.no_pm
	perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
	x86/vdso: Fix output operand size of RDPID
	regmap: Remove superfluous check for !config in __regmap_init()
	ACPI: processor: idle: Fix memory leak when register cpuidle device failed
	soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
	pinctrl: meson-gxl: add missing i2c_d pinmux
	blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
	block: use int to store blk_stack_limits() return value
	pwm: tiehrpwm: Fix corner case in clock divisor calculation
	selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
	bpf: Explicitly check accesses to bpf_sock_addr
	i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
	i2c: designware: Add disabling clocks when probe fails
	drm/radeon/r600_cs: clean up of dead code in r600_cs
	usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
	serial: max310x: Add error checking in probe()
	scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
	scsi: myrs: Fix dma_alloc_coherent() error check
	media: rj54n1cb0c: Fix memleak in rj54n1_probe()
	ALSA: lx_core: use int type to store negative error codes
	wifi: mwifiex: send world regulatory domain to driver
	PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
	tcp: fix __tcp_close() to only send RST when required
	usb: phy: twl6030: Fix incorrect type for ret
	usb: gadget: configfs: Correctly set use_os_string at bind
	misc: genwqe: Fix incorrect cmd field being reported in error
	pps: fix warning in pps_register_cdev when register device fail
	ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
	iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
	netfilter: ipset: Remove unused htable_bits in macro ahash_region
	watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
	drivers/base/node: handle error properly in register_one_node()
	wifi: mt76: fix potential memory leak in mt76_wmac_probe()
	RDMA/core: Resolve MAC of next-hop device without ARP support
	IB/sa: Fix sa_local_svc_timeout_ms read race
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
	sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
	sparc: fix accurate exception reporting in copy_to_user for Niagara 4
	sparc: fix accurate exception reporting in copy_{from,to}_user for M7
	remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
	NFSv4.1: fix backchannel max_resp_sz verification check
	ipvs: Defer ip_vs_ftp unregister during netns cleanup
	scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
	usb: vhci-hcd: Prevent suspending virtually attached devices
	RDMA/siw: Always report immediate post SQ errors
	net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
	ocfs2: fix double free in user_cluster_connect()
	drivers/base/node: fix double free in register_one_node()
	nfp: fix RSS hash key size when RSS is not supported
	net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
	Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
	Squashfs: fix uninit-value in squashfs_get_parent
	uio_hv_generic: Let userspace take care of interrupt mask
	mm: hugetlb: avoid soft lockup when mprotect to large memory area
	Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
	pinctrl: check the return value of pinmux_ops::get_function_name()
	clocksource/drivers/clps711x: Fix resource leaks in error paths
	iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
	perf util: Fix compression checks returning -1 as bool
	rtc: x1205: Fix Xicor X1205 vendor prefix
	perf session: Fix handling when buffer exceeds 2 GiB
	clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
	clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
	scsi: libsas: Add sas_task_find_rq()
	scsi: mvsas: Delete mvs_tag_init()
	scsi: mvsas: Use sas_task_find_rq() for tagging
	scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
	net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
	drm/vmwgfx: Fix Use-after-free in validation
	net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
	tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
	net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
	tools build: Align warning options with perf
	mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
	mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
	crypto: essiv - Check ssize for decryption and in-place encryption
	tpm, tpm_tis: Claim locality before writing interrupt registers
	tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
	ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
	ACPI: debug: fix signedness issues in read/write helpers
	arm64: dts: qcom: msm8916: Add missing MDSS reset
	xen/manage: Fix suspend error path
	firmware: meson_sm: fix device leak at probe
	media: i2c: mt9v111: fix incorrect type for ret
	drm/nouveau: fix bad ret code in nouveau_bo_move_prep
	cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
	crypto: atmel - Fix dma_unmap_sg() direction
	iio: dac: ad5360: use int type to store negative error codes
	iio: dac: ad5421: use int type to store negative error codes
	iio: frequency: adf4350: Fix prescaler usage.
	lib/genalloc: fix device leak in of_gen_pool_get()
	parisc: don't reference obsolete termio struct for TC* constants
	scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
	sctp: Fix MAC comparison to be constant-time
	sparc64: fix hugetlb for sun4u
	sparc: fix error handling in scan_one_device()
	mtd: rawnand: fsmc: Default to autodetect buswidth
	mmc: core: SPI mode remove cmd7
	rtc: interface: Ensure alarm irq is enabled when UIE is enabled
	rtc: interface: Fix long-standing race when setting alarm
	rseq/selftests: Use weak symbol reference, not definition, to link with glibc
	PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
	PCI/AER: Fix missing uevent on recovery when a reset is requested
	PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
	x86/umip: Check that the instruction opcode is at least two bytes
	x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
	nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
	ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
	ext4: correctly handle queries for metadata mappings
	ext4: guard against EA inode refcount underflow in xattr update
	net/9p: fix double req put in p9_fd_cancelled
	KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
	fs: udf: fix OOB read in lengthAllocDescs handling
	mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
	media: mc: Clear minor number before put device
	Squashfs: add additional inode sanity checking
	Squashfs: reject negative file sizes in squashfs_read_inode()
	mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
	mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
	mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
	dm: fix NULL pointer dereference in __dm_suspend()
	tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
	minixfs: Verify inode mode when loading from disk
	pid: Add a judgment for ns null in pid_nr_ns
	fs: Add 'initramfs_options' to set initramfs mount options
	cramfs: Verify inode mode when loading from disk
	xen/events: Cleanup find_virq() return codes
	media: cx18: Add missing check after DMA map
	pwm: berlin: Fix wrong register in suspend/resume
	btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
	drm/exynos: exynos7_drm_decon: remove ctx->suspended
	media: rc: Directly use ida_free()
	media: lirc: Fix error handling in lirc_register()
	xen/events: Update virq_to_irq on migration
	media: pci/ivtv: switch from 'pci_' to 'dma_' API
	media: pci: ivtv: Add missing check after DMA map
	net: dl2k: switch from 'pci_' to 'dma_' API
	net: dlink: handle dma_map_single() failure properly
	net/ip6_tunnel: Prevent perpetual tunnel growth
	amd-xgbe: Avoid spurious link down messages during interface toggle
	tcp: fix tcp_tso_should_defer() vs large RTT
	tg3: prevent use of uninitialized remote_adv and local_adv variables
	tls: always set record_type in tls_process_cmsg
	tls: don't rely on tx_work during send()
	sched: Make newidle_balance() static again
	sched/fair: Trivial correction of the newidle_balance() comment
	sched/balancing: Rename newidle_balance() => sched_balance_newidle()
	sched/fair: Fix pelt lost idle time detection
	ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
	hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
	exec: Fix incorrect type for ret
	hfs: clear offset and space out of valid records in b-tree node
	hfs: make proper initalization of struct hfs_find_data
	hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
	hfs: validate record offset in hfsplus_bmap_alloc
	hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
	dlm: check for defined force value in dlm_lockspace_release
	hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
	hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
	m68k: bitops: Fix find_*_bit() signatures
	net: rtnetlink: remove redundant assignment to variable err
	net: rtnetlink: add msg kind names
	net: rtnetlink: add helper to extract msg type's kind
	net: rtnetlink: use BIT for flag values
	net: netlink: add NLM_F_BULK delete request modifier
	net: rtnetlink: add bulk delete support flag
	net: add ndo_fdb_del_bulk
	net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
	rtnetlink: Allow deleting FDB entries in user namespace
	net: enetc: correct the value of ENETC_RXB_TRUESIZE
	arm64, mm: avoid always making PTE dirty in pte_mkwrite()
	sctp: avoid NULL dereference when chunk data buffer is missing
	net: bonding: fix possible peer notify event loss or dup issue
	Revert "cpuidle: menu: Avoid discarding useful information"
	MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
	ocfs2: clear extent cache after moving/defragmenting extents
	net: usb: rtl8150: Fix frame padding
	net: ravb: Ensure memory write completes before ringing TX doorbell
	USB: serial: option: add UNISOC UIS7720
	USB: serial: option: add Quectel RG255C
	USB: serial: option: add Telit FN920C04 ECM compositions
	usb/core/quirks: Add Huawei ME906S to wakeup quirk
	xhci: dbc: enable back DbC in resume if it was enabled before suspend
	binder: remove "invalid inc weak" check
	comedi: fix divide-by-zero in comedi_buf_munge()
	arm64: cputype: Add Neoverse-V3AE definitions
	arm64: errata: Apply workarounds for Neoverse-V3AE
	memory: samsung: exynos-srom: Correct alignment
	memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
	spi: cadence-quadspi: Flush posted register writes before INDAC access
	spi: cadence-quadspi: Flush posted register writes before DAC access
	ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
	drm/amdgpu: use atomic functions with memory barriers for vm fault info
	ext4: detect invalid INLINE_DATA + EXTENTS flag combination
	jbd2: ensure that all ongoing I/O complete before freeing blocks
	vfs: Don't leak disconnected dentries on umount
	NFSD: Define a proc_layoutcommit for the FlexFiles layout type
	KEYS: trusted_tpm1: Compare HMAC values in constant time
	padata: Reset next CPU when reorder sequence wraps around
	NFSD: Minor cleanup in layoutcommit processing
	NFSD: Fix last write offset handling in layoutcommit
	media: s5p-mfc: remove an unused/uninitialized variable
	net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
	Linux 5.4.301

Change-Id: Ie2685625a0f630cb01ac8d8c9ddcd68c64ea6ed7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2025-10-30 07:52:10 +00:00
Alice Ryhl
9d053f9856 binder: remove "invalid inc weak" check 
commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream.

There are no scenarios where a weak increment is invalid on binder_node.
The only possible case where it could be invalid is if the kernel
delivers BR_DECREFS to the process that owns the node, and then
increments the weak refcount again, effectively "reviving" a dead node.

However, that is not possible: when the BR_DECREFS command is delivered,
the kernel removes and frees the binder_node. The fact that you were
able to call binder_inc_node_nilocked() implies that the node is not yet
destroyed, which implies that BR_DECREFS has not been delivered to
userspace, so incrementing the weak refcount is valid.

Note that it's currently possible to trigger this condition if the owner
calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
BC_INCREFS on binder_ref instances to fail when they should not.

Cc: stable@vger.kernel.org
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-10-29 14:00:00 +01:00
Michael Bestas
2b9e22c70c
 		Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2025-08-01

* tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: bpf: do not fail to load if log is full
  ANDROID: fix kernelci compressed kernel linking
  ANDROID: GKI: Update symbol list for Zebra
  UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  Linux 5.4.295
  scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  perf: Fix sample vs do_exit()
  s390/pci: Fix __pcilg_mio_inuser() inline assembly
  rtc: test: Fix invalid format specifier.
  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  mm/huge_memory: fix dereferencing invalid pmd migration entry
  rtc: Make rtc_time64_to_tm() support dates before 1970
  rtc: Improve performance of rtc_time64_to_tm(). Add tests.
  xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
  net: atm: fix /proc/net/atm/lec handling
  net: atm: add lec_mutex
  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
  atm: atmtcp: Free invalid length skb in atmtcp_c_send().
  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  wifi: carl9170: do not ping device which has failed to load firmware
  aoe: clean device rq_list in aoedev_downdev()
  hwmon: (occ) fix unaligned accesses
  drm/nouveau/bl: increase buffer size to avoid truncate warning
  erofs: remove unused trace event erofs_destroy_inode
  ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  ALSA: hda/intel: Add Thinkpad E15 to PM deny list
  Input: sparcspkr - avoid unannotated fall-through
  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
  scsi: s390: zfcp: Ensure synchronous unit_add
  scsi: storvsc: Increase the timeouts to storvsc_timeout
  jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  jffs2: check that raw node were preallocated before writing summary
  drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
  powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
  platform/x86: dell_rbu: Stop overwriting data buffer
  platform: Add Surface platform directory
  Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
  tee: Prevent size calculation wraparound on 32-bit kernels
  ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  watchdog: da9052_wdt: respect TWDMIN
  i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  sock: Correct error checking condition for (assign|release)_proto_idx()
  scsi: lpfc: Use memcpy() for BIOS version
  vxlan: Do not treat dst cache initialization errors as fatal
  clk: rockchip: rk3036: mark ddrphy as critical
  wifi: mac80211: do not offer a mesh path if forwarding is disabled
  net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
  tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
  tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
  net: dlink: add synchronization for stats update
  sctp: Do not wake readers in __sctp_write_space()
  emulex/benet: correct command version selection in be_cmd_get_stats()
  i2c: designware: Invoke runtime suspend on quick slave re-registration
  net: macb: Check return value of dma_set_mask_and_coherent()
  cpufreq: Force sync policy boost with global boost on sysfs update
  nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
  media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
  media: tc358743: ignore video while HPD is low
  drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
  jfs: Fix null-ptr-deref in jfs_ioc_trim
  drm/amdgpu/gfx9: fix CSIB handling
  drm/amdgpu/gfx8: fix CSIB handling
  jfs: fix array-index-out-of-bounds read in add_missing_indices
  drm/amdgpu/gfx7: fix CSIB handling
  drm/amdgpu/gfx10: fix CSIB handling
  drm/msm/a6xx: Increase HFI response timeout
  drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
  media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
  drm/msm/hdmi: add runtime PM calls to DDC transfer function
  drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
  sunrpc: update nextcheck time when adding new cache entries
  drm/amdgpu/gfx6: fix CSIB handling
  ACPI: battery: negate current when discharging
  PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
  power: supply: bq27xxx: Retrieve again when busy
  ACPICA: fix acpi parse and parseext cache leaks
  ACPICA: Avoid sequence overread in call to strncmp()
  ACPICA: fix acpi operand cache leak in dswstate.c
  iio: adc: ad7606_spi: fix reg write value mask
  PCI: Fix lock symmetry in pci_slot_unlock()
  PCI: Add ACS quirk for Loongson PCIe
  uio_hv_generic: Use correct size for interrupt and monitor pages
  regulator: max14577: Add error check for max14577_read_reg()
  mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
  staging: iio: ad5933: Correct settling cycles encoding per datasheet
  net: ch9200: fix uninitialised access during mii_nway_restart
  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  dm-mirror: fix a tiny race condition
  mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  mm: fix ratelimit_pages update error in dirty_ratio_handler()
  ipc: fix to protect IPCS lookups using RCU
  parisc: fix building with gcc-15
  vgacon: Add check for vc_origin address range in vgacon_scroll()
  fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  EDAC/altera: Use correct write width with the INTTEST register
  NFC: nci: uart: Set tty->disc_data only in success path
  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  ext4: fix calculation of credits for extent tree modification
  ext4: inline: fix len overflow in ext4_prepare_inline_data
  bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
  ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
  ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
  media: v4l2-dev: fix error handling in __video_register_device()
  media: gspca: Add error handling for stv06xx_read_sensor()
  wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
  nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  gfs2: move msleep to sleepable context
  configfs: Do not override creating attribute file failure in populate_attrs()
  net: usb: aqc111: debug info before sanitation
  calipso: unlock rcu before returning -EAFNOSUPPORT
  xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
  usb: Flush altsetting 0 endpoints before reinitializating them after reset.
  fs/filesystems: Fix potential unsigned integer underflow in fs_name()
  net/mdiobus: Fix potential out-of-bounds read/write access
  drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
  drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
  MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
  x86/boot/compressed: prefer cc-option for CFLAGS additions
  net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  net_sched: tbf: fix a race in tbf_change()
  net_sched: red: fix a race in __red_change()
  net_sched: prio: fix a race in prio_tune()
  net/mlx5: Fix return value when searching for existing flow group
  net/mlx5: Wait for inactive autogroups
  i40e: retry VFLR handling if there is ongoing VF reset
  i40e: return false from i40e_reset_vf if reset is in progress
  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  scsi: iscsi: Fix incorrect error path labels for flashnode operations
  NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
  NFSD: Fix ia_size underflow
  Input: synaptics-rmi - fix crash with unsupported versions of F34
  Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
  pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
  do_change_type(): refuse to operate on unmounted/not ours mounts
  PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
  ice: create new Tx scheduler nodes for new queues only
  Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
  net/mlx4_en: Prevent potential integer overflow calculating Hz
  vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
  serial: Fix potential null-ptr-deref in mlb_usio_probe()
  usb: renesas_usbhs: Reorder clock handling and power management in probe
  rtc: Fix offset calculation for .start_secs < 0
  rtc: sh: assign correct interrupts with DT
  perf record: Fix incorrect --user-regs comments
  perf tests switch-tracking: Fix timestamp comparison
  mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
  mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
  rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
  perf ui browser hists: Set actions->thread before calling do_zoom_thread()
  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  soc: aspeed: lpc: Fix impossible judgment condition
  arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
  ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
  bus: fsl-mc: fix double-free on mc_dev
  nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
  nilfs2: add pointer check for nilfs_direct_propagate()
  Squashfs: check return result of sb_min_blocksize
  ARM: dts: at91: at91sam9263: fix NAND chip selects
  ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
  f2fs: fix to correct check conditions in f2fs_cross_rename
  f2fs: use d_inode(dentry) cleanup dentry->d_inode
  calipso: Don't call calipso functions for AF_INET sk.
  net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
  net: usb: aqc111: fix error handling of usbnet read calls
  netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
  wifi: ath9k_htc: Abort software beacon handling if disabled
  bpf: Fix WARN() in get_bpf_raw_tp_regs
  pinctrl: at91: Fix possible out-of-boundary access
  ktls, sockmap: Fix missing uncharge operation
  netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
  f2fs: clean up w/ fscrypt_is_bounce_page()
  RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
  wifi: rtw88: do not ignore hardware read error during DPK
  net: ncsi: Fix GCPS 64-bit member variables
  f2fs: fix to do sanity check on sbi->total_valid_block_count
  drm/tegra: rgb: Fix the unbound reference count
  drm/vkms: Adjust vkms_state->active_planes allocation type
  drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
  selftests/seccomp: fix syscall_restart test for arm compat
  firmware: psci: Fix refcount leak in psci_dt_init
  m68k: mac: Fix macintosh_config for Mac II
  drm/vmwgfx: Add seqno waiter for sync_files
  spi: sh-msiof: Fix maximum DMA transfer size
  ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
  x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
  PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
  EDAC/skx_common: Fix general protection fault
  crypto: marvell/cesa - Avoid empty transfer descriptor
  crypto: marvell/cesa - Handle zero-length skcipher requests
  x86/cpu: Sanitize CPUID(0x80000000) output
  perf/core: Fix broken throttling when max_samples_per_tick=1
  gfs2: gfs2_create_inode error handling fix
  netfilter: nft_socket: fix sk refcount leaks
  thunderbolt: Do not double dequeue a configuration request
  usb: usbtmc: Fix timeout value in get_stb
  usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
  usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
  pinctrl: armada-37xx: set GPIO output value before setting direction
  pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  tracing: Fix compilation warning on arm32
  BACKPORT: binder: Create safe versions of binder log files
  UPSTREAM: binder: Refactor binder_node print synchronization
  Revert "coredump: hand a pidfd to the usermode coredump helper"
  Linux 5.4.294
  xen/swiotlb: relax alignment requirements
  platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
  platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
  spi: spi-sun4i: fix early activation
  um: let 'make clean' properly clean underlying SUBARCH as well
  platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
  nfs: don't share pNFS DS connections between net namespaces
  HID: quirks: Add ADATA XPG alpha wireless mouse support
  coredump: hand a pidfd to the usermode coredump helper
  fork: use pidfd_prepare()
  pid: add pidfd_prepare()
  pidfd: check pid has attached task in fdinfo
  coredump: fix error handling for replace_fd()
  net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  smb: client: Reset all search buffer pointers when releasing buffer
  smb: client: Fix use-after-free in cifs_fill_dirent
  drm/i915/gvt: fix unterminated-string-initialization warning
  netfilter: nf_tables: do not defer rule destruction via call_rcu
  netfilter: nf_tables: wait for rcu grace period on net_device removal
  netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
  kbuild: Disable -Wdefault-const-init-unsafe
  spi: spi-fsl-dspi: restrict register range for regmap access
  mm/page_alloc.c: avoid infinite retries caused by cpuset race
  memcg: always call cond_resched() after fn()
  drm/edid: fixed the bug that hdr metadata was not reset
  llc: fix data loss when reading from a socket in llc_ui_recvmsg()
  ALSA: pcm: Fix race of buffer access at PCM OSS layer
  can: bcm: add missing rcu read protection for procfs content
  can: bcm: add locking for bcm_op runtime updates
  crypto: algif_hash - fix double free in hash_accept
  sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  net: dwmac-sun8i: Use parsed internal PHY address instead of 1
  bridge: netfilter: Fix forwarding of fragmented packets
  xfrm: Sanitize marks before insert
  __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  xenbus: Allow PVH dom0 a non-local xenstore
  btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  nvmet-tcp: don't restore null sk_state_change
  ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
  pinctrl: meson: define the pull up/down resistor value as 60 kOhm
  drm: Add valid clones check
  drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
  regulator: ad5398: Add device tree support
  wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
  bpftool: Fix readlink usage in get_fd_type
  HID: usbkbd: Fix the bit shift number for LED_KANA
  scsi: st: Restore some drive settings after reset
  scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
  rcu: fix header guard for rcu_all_qs()
  rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
  vxlan: Annotate FDB data races
  hwmon: (xgene-hwmon) use appropriate type for the latency value
  ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
  net/mlx5e: reduce rep rxq depth to 256 for ECPF
  net/mlx5e: set the tx_queue_len for pfifo_fast
  net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
  phy: core: don't require set_mode() callback for phy_get_mode() to work
  net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
  smack: recognize ipv4 CIPSO w/o categories
  pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
  ASoC: ops: Enforce platform maximum on initial value
  net/mlx5: Apply rate-limiting to high temperature warning
  net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
  ACPI: HED: Always initialize before evged
  PCI: Fix old_size lower bound in calculate_iosize() too
  EDAC/ie31200: work around false positive build warning
  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
  scsi: mpt3sas: Send a diag reset if target reset fails
  MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
  MIPS: Use arch specific syscall name match function
  cpuidle: menu: Avoid discarding useful information
  x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
  bonding: report duplicate MAC address in all situations
  net: xgene-v2: remove incorrect ACPI_PTR annotation
  drm/amdkfd: KFD release_work possible circular locking
  net/mlx5: Avoid report two health errors on same syndrome
  fpga: altera-cvp: Increase credit timeout
  drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
  hwmon: (gpio-fan) Add missing mutex locks
  x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
  net: pktgen: fix mpls maximum labels list parsing
  pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
  media: cx231xx: set device_caps for 417
  orangefs: Do not truncate file size
  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
  ieee802154: ca8210: Use proper setters and getters for bitwise types
  rtc: ds1307: stop disabling alarms on probe
  powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
  mmc: sdhci: Disable SD card clock before changing parameters
  netfilter: conntrack: Bound nf_conntrack sysctl writes
  posix-timers: Add cond_resched() to posix_timer_add() search loop
  xen: Add support for XenServer 6.1 platform device
  dm: restrict dm device size to 2^63-512 bytes
  kbuild: fix argument parsing in scripts/config
  scsi: st: ERASE does not change tape location
  scsi: st: Tighten the page format heuristics with MODE SELECT
  ext4: reorder capability check last
  um: Update min_low_pfn to match changes in uml_reserved
  um: Store full CSGSFS and SS register from mcontext
  btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
  btrfs: avoid linker error in btrfs_find_create_tree_block()
  i2c: pxa: fix call balance of i2c->clk handling routines
  mmc: host: Wait for Vdd to settle on card power off
  libnvdimm/labels: Fix divide error in nd_label_data_init()
  pNFS/flexfiles: Report ENETDOWN as a connection error
  tools/build: Don't pass test log files to linker
  dql: Fix dql->limit value when reset.
  SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
  NFSv4: Treat ENETUNREACH errors as fatal for state recovery
  fbdev: core: tileblit: Implement missing margin clearing for tileblit
  fbdev: fsl-diu-fb: add missing device_remove_file()
  mailbox: use error ret code of of_parse_phandle_with_args()
  kconfig: merge_config: use an empty file as initfile
  cgroup: Fix compilation issue due to cgroup_mutex not being exported
  dma-mapping: avoid potential unused data compilation warning
  scsi: target: iscsi: Fix timeout on deleted connection
  openvswitch: Fix unsafe attribute parsing in output_userspace()
  Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
  Input: synaptics - enable SMBus for HP Elitebook 850 G1
  clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  phy: renesas: rcar-gen3-usb2: Set timing registers only once
  phy: Fix error handling in tegra_xusb_port_init
  ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  ACPI: PPTT: Fix processor subtable walk
  dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
  NFSv4/pnfs: Reset the layout state after a layoutreturn
  NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred
  qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  ALSA: sh: SND_AICA should depend on SH_DMA_API
  net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  spi: loopback-test: Do not split 1024-byte hexdumps
  nfs: handle failure of nfs_get_lock_context in unlock path
  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  iio: chemical: sps30: use aligned_s64 for timestamp
  iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
  staging: axis-fifo: avoid parsing ignored device tree properties
  staging: axis-fifo: Remove hardware resets for user errors
  staging: axis-fifo: replace spinlock with mutex
  platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  do_umount(): add missing barrier before refcount checks in sync case
  nvme: unblock ctrl state transition for firmware update
  MIPS: Fix MAX_REG_OFFSET
  iio: adc: dln2: Use aligned_s64 for timestamp
  types: Complement the aligned types with signed 64-bit one
  usb: usbtmc: Fix erroneous generic_read ioctl return
  usb: usbtmc: Fix erroneous wait_srq ioctl return
  usb: usbtmc: Fix erroneous get_stb ioctl error returns
  USB: usbtmc: use interruptible sleep in usbtmc_read
  usb: typec: ucsi: displayport: Fix NULL pointer access
  usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
  ocfs2: stop quota recovery before disabling quotas
  ocfs2: implement handshaking with ocfs2 recovery thread
  ocfs2: switch osb->disable_recovery to enum
  module: ensure that kobject_put() is safe for module type kobjects
  xenbus: Use kref to track req lifetime
  usb: uhci-platform: Make the clock really optional
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
  iio: adis16201: Correct inclinometer channel resolution
  iio: adc: ad7606: fix serial register access
  staging: iio: adc: ad7816: Correct conditional logic for store mode
  Input: synaptics - enable InterTouch on Dell Precision M3800
  Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
  Input: synaptics - enable InterTouch on Dynabook Portege X30-D
  net: dsa: b53: fix learning on VLAN unaware bridges
  netfilter: ipset: fix region locking in hash types
  sch_htb: make htb_deactivate() idempotent
  scsi: target: Fix WRITE_SAME No Data Buffer crash
  dm: fix copying after src array boundaries
  iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
  arm64: dts: rockchip: fix iface clock-name on px30 iommus
  usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
  usb: chipidea: ci_hdrc_imx: use dev_err_probe()
  usb: chipidea: imx: refine the error handling for hsic
  usb: chipidea: imx: change hsic power regulator as optional
  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  irqchip/gic-v2m: Mark a few functions __init
  irqchip/gic-v2m: Add const to of_device_id
  sch_htb: make htb_qlen_notify() idempotent
  of: module: add buffer overflow check in of_modalias()
  PCI: imx6: Skip controller_id generation logic for i.MX7D
  net: fec: ERR007885 Workaround for conventional TX
  net: lan743x: Fix memleak issue when GSO enabled
  lan743x: fix endianness when accessing descriptors
  lan743x: remove redundant initialization of variable current_head_index
  nvme-tcp: fix premature queue removal and I/O failover
  net: dlink: Correct endianness handling of led_mode
  net_sched: qfq: Fix double list add in class with netem as child qdisc
  net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  net_sched: drr: Fix double list add in class with netem as child qdisc
  net/mlx5: E-Switch, Initialize MAC Address for Default GID
  tracing: Fix oob write in trace_seq_to_buffer()
  dm: always update the array size in realloc_argv on success
  dm-integrity: fix a warning on invalid table line
  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
  parisc: Fix double SIGFPE crash
  i2c: imx-lpi2c: Fix clock count when probe defers
  EDAC/altera: Set DDR and SDMMC interrupt mask before registration
  EDAC/altera: Test the correct error reg offset

 Conflicts:
	Makefile
	drivers/platform/Kconfig
	drivers/platform/Makefile
	include/linux/pid.h

Change-Id: Iab0fd96a23cfe218e945cbf71eef0e87dce204db
 2025-09-01 13:17:46 +03:00
Michael Bestas
691948d565
 		Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2025-06-01

* tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: binder: fix minimum node priority comparison
  ANDROID: 16K: Remove ELF padding entry from map_file ranges
  Linux 5.4.293
  MIPS: cm: Fix warning if MIPS_CM is disabled
  crypto: atmel-sha204a - Set hwrng quality to lowest possible
  comedi: jr3_pci: Fix synchronous deletion of timer
  md/raid1: Add check for missing source disk in process_checks()
  scsi: pm80xx: Set phy_attached to zero when device is gone
  x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
  ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
  selftests: ublk: fix test_stripe_04
  udmabuf: fix a buf size overflow issue during udmabuf creation
  KVM: s390: Don't use %pK through tracepoints
  sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
  ntb: reduce stack usage in idt_scan_mws
  qibfs: fix _another_ leak
  usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  dmaengine: dmatest: Fix dmatest waiting less when interrupted
  usb: host: max3421-hcd: Add missing spi_device_id table
  parisc: PDT: Fix missing prototype warning
  clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
  crypto: null - Use spin lock instead of mutex
  MIPS: cm: Detect CM quirks from device tree
  USB: VLI disk crashes if LPM is used
  usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
  usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
  usb: dwc3: gadget: check that event count does not exceed event buffer length
  USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
  usb: cdns3: Fix deadlock when using NCM gadget
  USB: serial: simple: add OWON HDS200 series oscilloscope support
  USB: serial: option: add Sierra Wireless EM9291
  USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
  serial: sifive: lock port in startup()/shutdown() callbacks
  USB: storage: quirk for ADATA Portable HDD CH94
  mcb: fix a double free bug in chameleon_parse_gdd()
  virtio_console: fix missing byte order handling for cols and rows
  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  net_sched: hfsc: Fix a UAF vulnerability in class handling
  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  net: phy: leds: fix memory leak
  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  drm/amd/pm: Prevent division by zero
  misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
  misc: pci_endpoint_test: Use INTX instead of LEGACY
  PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
  iio: adc: ad7768-1: Fix conversion result sign
  iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
  net: dsa: mv88e6xxx: fix VTU methods for 6320 family
  media: vim2m: print device name after registering device
  ext4: fix OOB read when checking dotdot dir
  ext4: optimize __ext4_check_dir_entry()
  ext4: don't over-report free space or inodes in statvfs
  ext4: code cleanup for ext4_statfs_project()
  ext4: simplify checking quota limits in ext4_statfs()
  platform/x86: ISST: Correct command storage data length
  MIPS: ds1287: Match ds1287_set_base_clock() function types
  MIPS: cevt-ds1287: Add missing ds1287.h include
  MIPS: dec: Declare which_prom() as static
  virtio-net: Add validation for used length
  RDMA/srpt: Support specifying the srpt_service_guid parameter
  openvswitch: fix lockup on tx to unregistering netdev with carrier
  net: openvswitch: fix race on port output
  mmc: cqhci: Fix checking of CQHCI_HALT state
  nvmet-fc: Remove unused functions
  usb: dwc3: support continuous runtime PM with dual role
  misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
  misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp
  kbuild: Add '-fno-builtin-wcslen'
  cpufreq: Reference count policy in cpufreq_update_limits()
  drm/sti: remove duplicate object names
  drm/nouveau: prime: fix ttm_bo_delayed_delete oops
  drm/repaper: fix integer overflows in repeat functions
  module: sign with sha512 instead of sha1 by default
  perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
  perf/x86/intel: Allow to update user space GPRs from PEBS records
  virtiofs: add filesystem context source name check
  riscv: Avoid fortify warning in syscall_get_arguments()
  isofs: Prevent the use of too small fid
  i2c: cros-ec-tunnel: defer probe if parent EC is not present
  hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
  btrfs: correctly escape subvol in btrfs_show_options()
  nfs: add missing selections of CONFIG_CRC32
  nfs: move nfs_fhandle_hash to common include file
  NFSD: Constify @fh argument of knfsd_fh_hash()
  asus-laptop: Fix an uninitialized variable
  writeback: fix false warning in inode_to_wb()
  net: b53: enable BPDU reception for management port
  net: openvswitch: fix nested key length validation in the set() action
  Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  Bluetooth: btrtl: Prevent potential NULL dereference
  Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
  RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
  scsi: iscsi: Fix missing scsi_host_put() in error path
  wifi: wl1251: fix memory leak in wl1251_tx_work
  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
  wifi: at76c50x: fix use after free access in at76_disconnect
  HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
  pwm: mediatek: always use bus clock for PWM on MT7622
  Bluetooth: hci_uart: Fix another race during initialization
  x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
  PCI: Fix reference leak in pci_alloc_child_bus()
  of/irq: Fix device node refcount leakages in of_irq_init()
  of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
  of/irq: Fix device node refcount leakages in of_irq_count()
  ntb: use 64-bit arithmetic for the MSI doorbell mask
  gpio: zynq: Fix wakeup source leaks on device unbind
  ftrace: Add cond_resched() to ftrace_graph_set_hash()
  dm-integrity: set ti->error on memory allocation failure
  crypto: ccp - Fix check for the primary ASP device
  thermal/drivers/rockchip: Add missing rk3328 mapping entry
  sctp: detect and prevent references to a freed transport in sendmsg
  mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
  sparc/mm: disable preemption in lazy mmu mode
  arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
  mtd: rawnand: Add status chack in r852_ready()
  mtd: inftlcore: Add error check for inftl_read_oob()
  lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
  locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
  jbd2: remove wrong sb->s_sequence check
  i3c: Add NULL pointer check in i3c_master_queue_ibi()
  ext4: fix off-by-one error in do_split
  wifi: mac80211: fix integer overflow in hwmp_route_info_get()
  net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
  media: venus: hfi_parser: add check to avoid out of bound access
  media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
  media: i2c: ov7251: Set enable GPIO low in probe
  media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
  media: streamzap: prevent processing IR data on URB failure
  mtd: rawnand: brcmnand: fix PM resume warning
  arm64: cputype: Add MIDR_CORTEX_A76AE
  xenfs/xensyms: respect hypervisor's "next" indication
  media: siano: Fix error handling in smsdvb_module_init()
  media: venus: hfi: add check to handle incorrect queue size
  media: venus: hfi: add a check to handle OOB in sfr region
  media: i2c: adv748x: Fix test pattern selection mask
  ext4: don't treat fhandle lookup of ea_inode as FS corruption
  ext4: reject casefold inode flag without casefold feature
  bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
  bpf: Add endian modifiers to fix endian warnings
  pwm: fsl-ftm: Handle clk_get_rate() returning 0
  pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
  pwm: mediatek: Always use bus clock
  fbdev: omapfb: Add 'plane' value check
  drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
  drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
  drm/amdkfd: clamp queue size to minimum
  drm: panel-orientation-quirks: Add new quirk for GPD Win 2
  drm: panel-orientation-quirks: Add support for AYANEO 2S
  drm: allow encoder mode_set even when connectors change for crtc
  Bluetooth: hci_uart: fix race during initialization
  tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
  net: vlan: don't propagate flags on open
  wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
  scsi: st: Fix array overflow in st_setup()
  ext4: ignore xattrs past end
  ext4: protect ext4_release_dquot against freezing
  ahci: add PCI ID for Marvell 88SE9215 SATA Controller
  ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
  jfs: add sanity check for agwidth in dbMount
  jfs: Prevent copying of nlink with value 0 from disk inode
  fs/jfs: Prevent integer overflow in AG size calculation
  fs/jfs: cast inactags to s64 to prevent potential overflow
  page_pool: avoid infinite loop to schedule delayed worker
  ALSA: usb-audio: Fix CME quirk for UF series keyboards
  ALSA: hda: intel: Fix Optimus when GPU has no sound
  HID: pidff: Fix null pointer dereference in pidff_find_fields
  HID: pidff: Do not send effect envelope if it's empty
  HID: pidff: Convert infinite length from Linux API to PID standard
  xen/mcelog: Add __nonstring annotations for unterminated strings
  perf: arm_pmu: Don't disable counter in armpmu_add()
  x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
  pm: cpupower: bench: Prevent NULL dereference on malloc failure
  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  ata: sata_sx4: Add error handling in pdc20621_i2c_read()
  ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
  tipc: fix memory leak in tipc_link_xmit
  ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

 Conflicts:
	arch/arm64/include/asm/cputype.h
	drivers/usb/core/quirks.c
	drivers/usb/dwc3/gadget.c

Change-Id: Ie734fa9555f5cdd3575d8b29f71ab946102b5f84
 2025-06-30 10:49:17 +03:00
Tiffany Y. Yang
45cc71553d BACKPORT: binder: Create safe versions of binder log files 
Binder defines several seq_files that can be accessed via debugfs or
binderfs. Some of these files (e.g., 'state' and 'transactions')
contain more granular information about binder's internal state that
is helpful for debugging, but they also leak userspace address data
through user-defined 'cookie' or 'ptr' values. Consequently, access
to these files must be heavily restricted.

Add two new files, 'state_hashed' and 'transactions_hashed', that
reproduce the information in the original files but use the kernel's
raw pointer obfuscation to hash any potential user addresses. This
approach allows systems to grant broader access to the new files
without having to change the security policy around the existing ones.

In practice, userspace populates these fields with user addresses, but
within the driver, these values only serve as unique identifiers for
their associated binder objects. Consequently, binder logs can
obfuscate these values and still retain meaning. While this strategy
prevents leaking information about the userspace memory layout in the
existing log files, it also decouples log messages about binder
objects from their user-defined identifiers.

Acked-by: Carlos Llamas <cmllamas@google.com>
Tested-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: "Tiffany Y. Yang" <ynaffit@google.com>
Link: https://lore.kernel.org/r/20250510013435.1520671-7-ynaffit@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 316970771
(cherry picked from commit 57483a362741e4f0f3f4d2fc82d48f82fd0986d9)
[Resolve conflicts from node prio and binder log file init structure]
Change-Id: I6a01048c0105a1d6061e95f386e7ee55e2fdc898
Signed-off-by: "Tiffany Yang" <ynaffit@google.com>
 2025-06-10 19:11:56 -07:00
Tiffany Y. Yang
e85fa50159 UPSTREAM: binder: Refactor binder_node print synchronization 
The binder driver outputs information about each dead binder node by
iterating over the dead nodes list, and it prints the state of each live
node in the system by traversing each binder_proc's proc->nodes tree.
Both cases require similar logic to maintain the global lock ordering
while accessing each node.

Create a helper function to synchronize around printing binder nodes in
a list. Opportunistically make minor cosmetic changes to binder print
functions.

Acked-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: "Tiffany Y. Yang" <ynaffit@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20250510013435.1520671-5-ynaffit@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 316970771
(cherry picked from commit 91f1bbaa783d26b379d65ef7b4b2b947c338c749)
Change-Id: Iae546a847ca138ddfffcdc24faf075b325a54640
Signed-off-by: "Tiffany Yang" <ynaffit@google.com>
 2025-06-10 19:11:56 -07:00
zhanghao56
19c222d1fa ANDROID: binder: fix minimum node priority comparison 
The "desired" priority for a transaction can be adjusted depending on
various factors. For instance, it might be set to SCHED_NORMAL 120, when
the caller is RT and the target node has !inherit_rt.

However, instead of using these adjustments, the existing logic compares
the minimum node priority against the original transaction priority.
If the transaction priority is "higher", then the minimum node priority
is ignored. This is particularly a problem when the "desired" priority
has been changed to SCHED_NORMAL.

This patch corrects the logic, comparing the minimum node priority
against the (potentially adjusted) "desired" priority. This guarantees
that the node's minimum priority is honored.

Bug: 417382411
Cc: Martijn Coenen <maco@google.com>
Fixes: c46810c23565 ("ANDROID: binder: add RT inheritance flag to node.")
Change-Id: I813073241b996c1c38c29f20849b247023697102
Signed-off-by: zhanghao56 <zhanghao56@xiaomi.corp-partner.google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2025-05-20 22:29:09 +00:00
Luca Stefani
f567655bdb UPSTREAM: binder: Return EFAULT if we fail BINDER_ENABLE_ONEWAY_SPAM_DETECTION 
All the other ioctl paths return EFAULT in case the
copy_from_user/copy_to_user call fails, make oneway spam detection
follow the same paradigm.

Bug: 254441685
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Luca Stefani <luca.stefani.ge1@gmail.com>
Link: https://lore.kernel.org/r/20210506193726.45118-1-luca.stefani.ge1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ced081a436d21a7d34d4d42acb85058f9cf423f2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5f54cc7505300f106c04ac81da33d8046704f377
 2025-03-10 16:19:26 +00:00
Michael Bestas
0262d4e51f
 		Merge tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2024-12-01

* tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common: (552 commits)
  UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
  ANDROID: add file for recording allowed ABI breaks
  Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
  Revert "spi: fix use-after-free of the add_lock mutex"
  ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER
  BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics
  UPSTREAM: x86/percpu: Clean up percpu_add_op()
  UPSTREAM: x86/percpu: Clean up percpu_from_op()
  UPSTREAM: x86/percpu: Clean up percpu_to_op()
  UPSTREAM: x86/percpu: Introduce size abstraction macros
  BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output
  BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze
  FROMGIT: binder: allow freeze notification for dead nodes
  FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
  FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs
  BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work()
  FROMGIT: binder: fix OOB in binder_add_freeze_work()
  FROMGIT: binder: fix node UAF in binder_add_freeze_work()
  Linux 5.4.286
  mm: avoid leaving partial pfn mappings around in error case
  ...

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.txt
	arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.yaml
	drivers/clk/qcom/clk-rpmh.c
	drivers/usb/dwc3/core.c
	fs/erofs/decompressor.c
	net/qrtr/qrtr.c

Change-Id: Iae3a7502b304d7be66da795411c4f330eef8b693
 2024-12-17 03:24:53 +02:00
Carlos Llamas
fd66950d54 BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output 
Add the pending proc->delivered_freeze work to the debugfs output. This
information was omitted in the original implementation of the freeze
notification and can be valuable for debugging issues.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-9-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit cb2aeb2ec25884133110ffe5a67ff3cf7dee5ceb
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Ifc9a22b52e38c35af661732486fa1f154adb34de
[cmllamas: fix KMI break with proc_wrapper()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:19 +00:00
Carlos Llamas
d7f2e2600f BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze 
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:

  unreferenced object 0xffff38e8cfa36180 (size 64):
    comm "binder-util", pid 655, jiffies 4294936641
    hex dump (first 32 bytes):
      b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff  .....8.......8..
      0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00  ........<.K.....
    backtrace (crc 95983b32):
      [<000000000d0582cf>] kmemleak_alloc+0x34/0x40
      [<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280
      [<00000000313b1704>] binder_thread_write+0xdec/0x439c
      [<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc
      [<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190
      [<00000000b439adee>] invoke_syscall+0x6c/0x254
      [<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230
      [<0000000084f72311>] do_el0_svc+0x40/0x58
      [<000000008b872457>] el0_svc+0x38/0x78
      [<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c
      [<00000000a8ec61bf>] el0t_64_sync+0x190/0x194

This patch fixes the leak by ensuring that any pending entries in
proc->delivered_freeze are freed during binder_deferred_release().

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-8-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 1db76ec2b4b206ff943e292a0b55e68ff3443598
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Iafdec3421c521b4b591b94455deba7ee5102c8ca
[cmllamas: drop BINDER_STAT_FREEZE and use proc_wrapper()]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:19 +00:00
Carlos Llamas
00553a4558 FROMGIT: binder: allow freeze notification for dead nodes 
Alice points out that binder_request_freeze_notification() should not
return EINVAL when the relevant node is dead [1]. The node can die at
any point even if the user input is valid. Instead, allow the request
to be allocated but skip the initial notification for dead nodes. This
avoids propagating unnecessary errors back to userspace.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/all/CAH5fLghapZJ4PbbkC8V5A6Zay-_sgTzwVpwqk6RWWUNKKyJC_Q@mail.gmail.com/ [1]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-7-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit ca63c66935b978441055e3d87d30225267f99329
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I03af1eedfeb194f5a775388cbb4e7487e4a5dfc0
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:19 +00:00
Carlos Llamas
44e90a1218 FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs 
proc 699
context binder-test
  thread 699: l 00 need_return 0 tr 0
  ref 25: desc 1 node 20 s 1 w 0 d 00000000c03e09a3
  unknown work: type 11

proc 640
context binder-test
  thread 640: l 00 need_return 0 tr 0
  ref 8: desc 1 node 3 s 1 w 0 d 000000002bb493e1
  has cleared freeze notification

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-6-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 595ea72efff9fa65bc52b6406e0822f90841f266
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Ic6311aaea2040aaf4534cdaa4cbfa378afe31869
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:19 +00:00
Carlos Llamas
4942a6719a FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs 
The BINDER_WORK_FROZEN_BINDER type is not handled in the binder_logs
entries and it shows up as "unknown work" when logged:

  proc 649
  context binder-test
    thread 649: l 00 need_return 0 tr 0
    ref 13: desc 1 node 8 s 1 w 0 d 0000000053c4c0c3
    unknown work: type 10

This patch add the freeze work type and is now logged as such:

  proc 637
  context binder-test
    thread 637: l 00 need_return 0 tr 0
    ref 8: desc 1 node 3 s 1 w 0 d 00000000dc39e9c6
    has frozen binder

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 830d7db744b42c693bf1db7e94db86d7efd91f0e
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I06f888aa5218db19eeda79e315385506af09d9d5
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:18 +00:00
Carlos Llamas
dd5ff84365 BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() 
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
  Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211

  CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   binder_release_work+0x398/0x3d0
   binder_deferred_func+0xb60/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8

  Allocated by task 703:
   __kmalloc_cache_noprof+0x130/0x280
   binder_thread_write+0xdb4/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190
   invoke_syscall+0x6c/0x254

  Freed by task 211:
   kfree+0xc4/0x230
   binder_deferred_func+0xae8/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8
  ==================================================================

This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@android.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-4-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 7e20434cbca814cb91a0a261ca0106815ef48e5f
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Icc40e7dd6157981f4adbea7243e55be118552321
[cmllamas: drop BINDER_STAT_FREEZE as it's not supported here]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:18 +00:00
Carlos Llamas
6953269824 FROMGIT: binder: fix OOB in binder_add_freeze_work() 
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:

  ==================================================================
  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
  Read of size 8 at addr ffffcb84285f7170 by task freeze/660

  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   rb_next+0xfc/0x124
   binder_add_freeze_work+0x344/0x534
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  The buggy address belongs to the variable:
   binder_dead_nodes+0x10/0x40
  [...]
  ==================================================================

This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:

	struct binder_node {
	[...]
		union {
			struct rb_node rb_node;
			struct hlist_node dead_node;
		};

Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-3-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit 011e69a1b23011c0db3af4b8293fdd4522cc97b0
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I5ec9d49277a23b864862665b52213460750c535e
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:18 +00:00
Carlos Llamas
b6005f2f2c FROMGIT: binder: fix node UAF in binder_add_freeze_work() 
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_add_freeze_work+0x148/0x478
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Allocated by task 637:
   __kmalloc_cache_noprof+0x12c/0x27c
   binder_new_node+0x50/0x700
   binder_transaction+0x35ac/0x6f74
   binder_thread_write+0xfb8/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Freed by task 637:
   kfree+0xf0/0x330
   binder_thread_read+0x1e88/0x3a68
   binder_ioctl+0x16d8/0x25ac
   __arm64_sys_ioctl+0x124/0x190
  ==================================================================

Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.

Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 366003708
(cherry picked from commit dc8aea47b928cc153b591b3558829ce42f685074
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I47b053532dd4cd3424d35d6f254ca4d00c426411
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-11-20 18:24:18 +00:00
Michael Bestas
a421f676d6
 		Merge tag 'ASB-2024-10-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2024-10-01

* tag 'ASB-2024-10-05_11-5.4' of https://android.googlesource.com/kernel/common: (397 commits)
  Linux 5.4.283
  scsi: aacraid: Fix double-free on probe failure
  net: dsa: mv8e6xxx: Fix stub function parameters
  usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
  usb: dwc3: st: add missing depopulate in probe error path
  usb: dwc3: st: fix probed platform device ref count on probe error path
  usb: dwc3: core: Prevent USB core invalid event buffer address access
  usb: dwc3: omap: add missing depopulate in probe error path
  USB: serial: option: add MeiG Smart SRM825L
  cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
  soc: qcom: cmd-db: Map shared memory as WC, not WB
  nfc: pn533: Add poll mod list filling check
  nfc: pn533: Add autopoll capability
  nfc: pn533: Add dev_up/dev_down hooks to phy_ops
  net: busy-poll: use ktime_get_ns() instead of local_clock()
  gtp: fix a potential NULL pointer dereference
  ethtool: check device is present when getting link settings
  r8152: Factor out OOB link list waits
  soundwire: stream: fix programming slave ports for non-continous port maps
  net:rds: Fix possible deadlock in rds_message_put
  ...

Change-Id: Ia6559a770f5db990f2bf6e5a034c63e3d7df4510
 2024-10-09 18:08:17 +00:00
Michael Bestas
123d88374f
 		Merge tag 'ASB-2024-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2024-09-01
CVE-2024-36972

* tag 'ASB-2024-09-05_11-5.4' of https://android.googlesource.com/kernel/common: (59 commits)
  ANDROID: delete tool added by mistake
  ANDROID: fix ENOMEM check of binder_proc_ext
  ANDROID: binder: fix KMI issues due to frozen notification
  BACKPORT: FROMGIT: binder: frozen notification binder_features flag
  BACKPORT: FROMGIT: binder: frozen notification
  BACKPORT: selftests/binderfs: add test for feature files
  UPSTREAM: docs: binderfs: add section about feature files
  BACKPORT: binderfs: add support for feature files
  FROMLIST: binder: fix memory leaks of spam and pending work
  FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn
  BACKPORT: binder: tell userspace to dump current backtrace when detected oneway spamming
  UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  FROMLIST: binder: fix UAF caused by offsets overwrite
  Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"
  Linux 5.4.281
  tap: add missing verification for short frame
  tun: add missing verification for short frame
  filelock: Fix fcntl/close race recovery compat path
  ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
  jfs: don't walk off the end of ealist
  ...

 Conflicts:
	drivers/android/binder.c
	include/uapi/linux/android/binder.h

Change-Id: I0cdb84a8241c0abaf6e5fad140ed19480655d53c
 2024-10-09 18:08:04 +00:00
Greg Kroah-Hartman
b8b210d80a Merge tag 'android11-5.4.283_r00' into android11-5.4 
This merges up to the 5.4.283 LTS release into android11-5.4.  Included
in here are the following commits:

*   ac0b99d778 Merge 5.4.283 into android11-5.4-lts
|\
| * 4826c62faf Linux 5.4.283
| * 564e1986b0 scsi: aacraid: Fix double-free on probe failure
| * 9a2d4f736c net: dsa: mv8e6xxx: Fix stub function parameters
| * 29957da407 usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
| * b1069a3765 usb: dwc3: st: add missing depopulate in probe error path
| * f3498650df usb: dwc3: st: fix probed platform device ref count on probe error path
| * d2afc2bffe usb: dwc3: core: Prevent USB core invalid event buffer address access
| * 1d16ac232f usb: dwc3: omap: add missing depopulate in probe error path
| * d035dd9986 USB: serial: option: add MeiG Smart SRM825L
| * aa06cdd280 cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
| * 0ee9594c97 soc: qcom: cmd-db: Map shared memory as WC, not WB
| * c5e0523744 nfc: pn533: Add poll mod list filling check
| * cd0c823b3f nfc: pn533: Add autopoll capability
| * cb829e3352 nfc: pn533: Add dev_up/dev_down hooks to phy_ops
| * e7d364a5c7 net: busy-poll: use ktime_get_ns() instead of local_clock()
| * bdd99e5f0a gtp: fix a potential NULL pointer dereference
| * ec7b4f7f64 ethtool: check device is present when getting link settings
| * c9fe713b1a r8152: Factor out OOB link list waits
| * 902e15c9d4 soundwire: stream: fix programming slave ports for non-continous port maps
| * f1f77b1164 net:rds: Fix possible deadlock in rds_message_put
| * 10aeaa47e4 cgroup/cpuset: Prevent UAF in proc_cpuset_show()
| * 56e62977ea ata: libata-core: Fix null pointer dereference on error
| * 7aa9456288 media: uvcvideo: Fix integer overflow calculating timestamp
| * 9bb1d48f54 filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64
| * 009c4d78bc drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
| * 29a132d793 ipc: replace costly bailout check in sysvipc_find_ipc()
| * bf44f0e935 wifi: mwifiex: duplicate static structs used in driver instances
| * 2cea369a5c pinctrl: single: fix potential NULL dereference in pcs_get_function()
| * 3b50575944 drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
| * d4bdddda97 tools: move alignment-related macros to new <linux/align.h>
| * 87f610a1a7 Input: MT - limit max slots
| * 7732c54f2b Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
| * 01e07b0567 ALSA: timer: Relax start tick time check for slave timer elements
| * 931274b0c9 mmc: dw_mmc: allow biu and ciu clocks to defer
| * 11aa40b30b cxgb4: add forgotten u64 ivlan cast before shift
| * 2deb4543e9 HID: microsoft: Add rumble support to latest xbox controllers
| * b2c3dd788a HID: wacom: Defer calculation of resolution until resolution_code is known
| * 90e1ff1c15 Bluetooth: MGMT: Add error handling to pair_device()
| * 2b507b0399 mmc: mmc_test: Fix NULL dereference on allocation failure
| * 6590c49e98 drm/msm/dpu: don't play tricks with debug macros
| * bdb2969754 drm/msm: use drm_debug_enabled() to check for debug categories
| * 1573f51ef1 net: xilinx: axienet: Fix dangling multicast addresses
| * c66ed34257 net: xilinx: axienet: Always disable promiscuous mode
| * ce2f6cfab2 ipv6: prevent UAF in ip6_send_skb()
| * 759e3e8c4a netem: fix return value if duplicate enqueue fails
| * d39f5be62f net: dsa: mv88e6xxx: Fix out-of-bound access
| * 2c0f2a5244 net: dsa: mv88e6xxx: replace ATU violation prints with trace points
| * 0d9e6f3630 net: dsa: mv88e6xxx: read FID when handling ATU violations
| * c86fd1b4ce net: dsa: mv88e6xxx: global1_atu: Add helper for get next
| * 4d63207fa6 net: dsa: mv88e6xxx: global2: Expose ATU stats register
| * 963bfa5763 netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
| * 6633b17840 kcm: Serialise kcm_sendmsg() for the same socket.
| * 0d3702c60f tc-testing: don't access non-existent variable on exception
| * 2b3e49f250 Bluetooth: hci_core: Fix LE quote calculation
| * 960d34e61a Bluetooth: hci_core: Fix not handling link timeouts propertly
| * a5ba18e68c Bluetooth: Make use of __check_timeout on hci_sched_le
| * 06a6aebeb0 dm suspend: return -ERESTARTSYS instead of -EINTR
| * c6e3c341cf dm: do not use waitqueue for request-based DM
| * 6a99ee6b99 dm mpath: pass IO start time to path selector
| * 8adc9ab5bd media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
| * 58f5626d1b block: use "unsigned long" for blk_validate_block_size().
| * f5dda8db38 gtp: pull network headers in gtp_dev_xmit()
| * 9d72b629a9 hrtimer: Prevent queuing of hrtimer without a function callback
| * ee440c8312 nvmet-rdma: fix possible bad dereference when freeing rsps
| * e378b7675d ext4: set the type of max_zeroout to unsigned int to avoid overflow
| * f162e1b7d6 irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
| * 31d59a2a81 usb: dwc3: core: Skip setting event buffers for host only controllers
| * 29fdfe9f2a s390/iucv: fix receive buffer virtual vs physical address confusion
| * b4bde02e00 openrisc: Call setup_memory() earlier in the init sequence
| * d8086fbabd NFS: avoid infinite loop in pnfs_update_layout.
| * 6168df74db nvmet-tcp: do not continue for invalid icreq
| * ea213d57f6 Bluetooth: bnep: Fix out-of-bound access
| * d037a1d1f5 nvme: clear caller pointer on identify failure
| * a98c91a49e usb: gadget: fsl: Increase size of name buffer for endpoints
| * 7026ba0a09 f2fs: fix to do sanity check in update_sit_entry
| * fe3f0f9af4 btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
| * ffb87a8829 btrfs: send: handle unexpected data in header buffer in begin_cmd()
| * 76c5fd8dd0 btrfs: handle invalid root reference found in may_destroy_subvol()
| * 36f225da51 btrfs: change BUG_ON to assertion when checking for delayed_node root
| * 3d2598c317 powerpc/boot: Only free if realloc() succeeds
| * d921c88d1b powerpc/boot: Handle allocation failure in simple_realloc()
| * b62f96647b parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
| * 03475167fd x86: Increase brk randomness entropy for 64-bit systems
| * 0f9d267011 md: clean up invalid BUG_ON in md_ioctl
| * 6ca28b54ad virtiofs: forbid newlines in tags
| * 5766a74fe6 drm/lima: set gp bus_stop bit before hard reset
| * 7bdf5df2bf net/sun3_82586: Avoid reading past buffer in debug output
| * 6ef9c38cd0 scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
| * e1c82f74b6 fs: binfmt_elf_efpic: don't use missing interpreter's properties
| * 199a42fc4c media: pci: cx23885: check cx23885_vdev_init() return
| * 1e3ca3ef9f quota: Remove BUG_ON from dqget()
| * 12f8698a84 ext4: do not trim the group with corrupted block bitmap
| * de71b478b2 nvmet-trace: avoid dereferencing pointer too early
| * 240fcfe119 powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
| * 81c479fc35 IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
| * 7b31922f2a wifi: iwlwifi: abort scan when rfkill on but device enabled
| * 0137220b97 gfs2: setattr_chown: Add missing initialization
| * e997548575 scsi: spi: Fix sshdr use
| * 19c348fecf binfmt_misc: cleanup on filesystem umount
| * 11b776e3c9 staging: ks7010: disable bh on tx_dev_lock
| * 8b29a8dc6a media: radio-isa: use dev_name to fill in bus_info
| * 9a732aad7d i2c: riic: avoid potential division by zero
| * 47ff82181e wifi: cw1200: Avoid processing an invalid TIM IE
| * 5b6711094b ssb: Fix division by zero issue in ssb_calc_clock_rate
| * 4e0b0f085f ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
| * 67492d4d10 net: hns3: fix a deadlock problem when config TC during resetting
| * 56bb1b3bf4 net: dsa: vsc73xx: pass value in phy_write operation
| * d7fa0c3582 net: axienet: Fix register defines comment description
| * 8b04b6b7c4 net: axienet: Autodetect 64-bit DMA capability
| * 46a5469f92 net: axienet: Upgrade descriptors to hold 64-bit addresses
| * 67527bcb0f net: axienet: Wrap DMA pointer writes to prepare for 64 bit
| * 2978228525 net: axienet: Drop MDIO interrupt registers from ethtools dump
| * d724554f8f net: axienet: Check for DMA mapping errors
| * 367ca46817 net: axienet: Factor out TX descriptor chain cleanup
| * c6ddc4c57b net: axienet: Improve DMA error handling
| * 8876a2ac1b net: axienet: Fix DMA descriptor cleanup path
| * 09e086a5f7 atm: idt77252: prevent use after free in dequeue_rx()
| * 3b999c528b net/mlx5e: Correctly report errors for ethtool rx flows
| * 37f3dafee1 s390/uv: Panic for set and remove shared access UVC errors
| * cd0aa417b8 btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
| * 2d34304bce s390/cio: rename bitmap_size() -> idset_bitmap_size()
| * 1ab137a90e overflow: Implement size_t saturating arithmetic helpers
| * 60f05081e0 overflow.h: Add flex_array_size() helper
| * 1b37ec85ad memcg_write_event_control(): fix a user-triggerable oops
| * a71a6db101 drm/amdgpu: Actually check flags for all context ops.
| * 374a0f8204 selinux: fix potential counting error in avc_add_xperms_decision()
| * e807487a1d fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
| * 463074c081 bitmap: introduce generic optimized bitmap_size()
| * 3525ad2524 vfs: Don't evict inode under the inode lru traversing context
| * 0f94cd0e02 dm persistent data: fix memory allocation failure
| * f75dec8417 dm resume: don't return EINVAL when signalled
| * 0936c758a2 arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
| * 19f60a55b2 s390/dasd: fix error recovery leading to data corruption on ESE devices
| * a57b0ebabe xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
| * fa69434ecd ALSA: usb-audio: Support Yamaha P-125 quirk entry
| * 33168db352 fuse: Initialize beyond-EOF page contents before setting uptodate
* | f9764dcf97 Revert "genirq: Allow the PM device to originate from irq domain"
* | d131a10522 Revert "genirq: Allow irq_chip registration functions to take a const irq_chip"
* | e11b864e72 Revert "irqchip/imx-irqsteer: Constify irq_chip struct"
* | 8a7102ed4b Revert "irqchip/imx-irqsteer: Add runtime PM support"
* | 31cfc1a256 Revert "irqchip/imx-irqsteer: Handle runtime power management correctly"
* | 147724ba5f Merge 5.4.282 into android11-5.4-lts
|\|
| * 5bb3c84a11 Linux 5.4.282
| * 2f2f3c6a4d media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
| * e7765ad4b4 ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
| * dc1d852277 nvme/pci: Add APST quirk for Lenovo N60z laptop
| * 368f6985d4 exec: Fix ToCToU between perm check and set-uid/gid usage
| * fdf2b10baf media: uvcvideo: Use entity get_cur in uvc_ctrl_set
| * f6a745c558 arm64: cpufeature: Fix the visibility of compat hwcaps
| * a256d019ea drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
| * cd4348e0a5 netfilter: nf_tables: prefer nft_chain_validate
| * eaf1a29ea5 netfilter: nf_tables: use timestamp to check for set element timeout
| * cb56f8f06a netfilter: nf_tables: set element extended ACK reporting support
| * 53174ce02d kbuild: Fix '-S -c' in x86 stack protector scripts
| * af3948929b Fix gcc 4.9 build issue in 5.4.y
| * c7a28cb079 drm/mgag200: Set DDC timeout in milliseconds
| * ca75fa4ff8 drm/bridge: analogix_dp: properly handle zero sized AUX transactions
| * 06c1de44d3 x86/mtrr: Check if fixed MTRRs exist before saving them
| * d3e4dbc285 tracing: Fix overflow in get_free_elt()
| * f8fe71c649 power: supply: axp288_charger: Round constant_charge_voltage writes down
| * 1031a0e7c2 power: supply: axp288_charger: Fix constant_charge_voltage writes
| * da18145e7d genirq/irqdesc: Honor caller provided affinity in alloc_desc()
| * 55b2a5d331 serial: core: check uartclk for zero to avoid divide by zero
| * 881058e07b scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
| * 12608528f5 scsi: mpt3sas: Remove scsi_dma_map() error messages
| * 3f16bc776b ntp: Safeguard against time_constant overflow
| * dd98c9630b driver core: Fix uevent_show() vs driver detach race
| * 5cd98f82ec ntp: Clamp maxerror and esterror to operating range
| * f91fb47eca tick/broadcast: Move per CPU pointer access into the atomic section
| * 8f783731e3 scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
| * df8e734ae5 usb: gadget: core: Check for unset descriptor
| * 55bb086ce9 USB: serial: debug: do not echo input by default
| * 9c3746ce8d usb: vhci-hcd: Do not drop references before new references are gained
| * 85f06d9634 ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
| * 3c540f4200 ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
| * 40f3d5cb0e ALSA: line6: Fix racy access to midibuf
| * 24ddda932c drm/client: fix null pointer dereference in drm_client_modeset_probe
| * 2c99fd5762 spi: spi-fsl-lpspi: Fix scldiv calculation
| * 3a5e84e6e4 spi: fsl-lpspi: remove unneeded array
| * abc71a9915 bpf: kprobe: remove unused declaring of bpf_kprobe_override
| * 6082250cca i2c: smbus: Send alert notifications to all devices if source not found
| * 54abe030df i2c: smbus: Improve handling of stuck alerts
| * 9bd5abd9d3 i2c: smbus: Don't filter out duplicate alerts
| * ba9a332d1e arm64: errata: Expand speculative SSBS workaround (again)
| * 76b4fbb661 arm64: cputype: Add Cortex-A725 definitions
| * 90f49639d4 arm64: cputype: Add Cortex-X1C definitions
| * d19a135ca2 arm64: errata: Expand speculative SSBS workaround
| * 31c04d3f68 arm64: errata: Unify speculative SSBS errata logic
| * 32480850c6 arm64: cputype: Add Cortex-X925 definitions
| * e890465ebf arm64: cputype: Add Cortex-A720 definitions
| * d58774b5f1 arm64: cputype: Add Cortex-X3 definitions
| * 60bb454974 arm64: errata: Add workaround for Arm errata 3194386 and 3312417
| * c4d3c615cf arm64: cputype: Add Neoverse-V3 definitions
| * 7e13067758 arm64: cputype: Add Cortex-X4 definitions
| * 4fecc9ed90 arm64: Add Neoverse-V2 part
| * 762dd597c7 arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
| * a61144525f ext4: fix wrong unit use in ext4_mb_find_by_goal
| * 0860bad4a4 SUNRPC: Fix a race to wake a sync task
| * 1ec5ea9e25 s390/sclp: Prevent release of buffer in I/O
| * 969d683bfe jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
| * 87c2a57fdb media: uvcvideo: Fix the bandwdith quirk on USB 3.x
| * 0463702743 media: uvcvideo: Ignore empty TS packets
| * ff5c4eb71e drm/amdgpu: Fix the null pointer dereference to ras_manager
| * a8ca88d3d9 btrfs: fix bitmap leak when loading free space cache on duplicate entry
| * 4dd406a308 wifi: nl80211: don't give key data to userspace
| * 5def895b42 udf: prevent integer overflow in udf_bitmap_free_blocks()
| * 9d9e96dc56 PCI: Add Edimax Vendor ID to pci_ids.h
| * 0f82fcdc8e selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
| * d3eaa7fe11 ACPI: SBS: manage alarm sysfs attribute through psy core
| * 79b7f33d46 ACPI: battery: create alarm sysfs attribute atomically
| * 4c8f911560 clocksource/drivers/sh_cmt: Address race condition for clock events
| * 6b33c468d5 md/raid5: avoid BUG_ON() while continue reshape after reassembling
| * 6fdd36fba3 net: fec: Stop PPS on driver remove
| * d89b1a9387 Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
| * 96cc343c3f net: linkwatch: use system_unbound_wq
| * 37c0934497 net: usb: qmi_wwan: fix memory leak for not ip packets
| * c9b3fc4f15 sctp: Fix null-ptr-deref in reuseport_add_sock().
| * c2237ce58a sctp: move hlist_node and hashent out of sctp_ep_common
| * 25a727233a x86/mm: Fix pti_clone_pgtable() alignment assumption
| * 8243f41375 irqchip/mbigen: Fix mbigen node address layout
| * f19bf41e73 genirq: Allow irq_chip registration functions to take a const irq_chip
| * 922b824bb7 netfilter: ipset: Add list flush to cancel_gc
| * 869f240a5b net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
| * 479335789d ALSA: usb-audio: Correct surround channels in UAC1 channel map
| * 41a6c31df7 protect the fetch of ->fd[fd] in do_dup2() from mispredictions
| * 04dcab03e6 HID: wacom: Modify pen IDs
| * ba35ce6480 ipv6: fix ndisc_is_useropt() handling for PIO
| * 9f96828b94 net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
| * 37652fbef9 net/iucv: fix use after free in iucv_sock_close()
| * e8e1c9b282 drm/vmwgfx: Fix overlay when using Screen Targets
| * 3bcb8bba72 drm/nouveau: prime: fix refcount underflow
| * 84beb77384 remoteproc: imx_rproc: Skip over memory region when node value is NULL
| * 66b47133bf remoteproc: imx_rproc: Fix ignoring mapping vdev regions
| * 8d1eca34ac remoteproc: imx_rproc: ignore mapping vdev regions
| * a590e8dea3 irqchip/imx-irqsteer: Handle runtime power management correctly
| * 294aa15e79 irqchip/imx-irqsteer: Add runtime PM support
| * ee1e002d17 irqchip/imx-irqsteer: Constify irq_chip struct
| * 9951e76f39 genirq: Allow the PM device to originate from irq domain
| * b044588a16 devres: Fix memory leakage caused by driver API devm_free_percpu()
| * 00d780681e driver core: Cast to (void *) with __force for __percpu pointer
| * 47b3dce100 dev/parport: fix the array out-of-bounds risk
| * fca2fe1670 parport: Standardize use of printmode
| * 92f405a7f1 parport: Convert printk(KERN_<LEVEL> to pr_<level>(
| * bbfcb2a4bc PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
| * c72ddaebcd PCI: rockchip: Make 'ep-gpios' DT property optional
| * 4d3817b64e mm: avoid overflows in dirty throttling logic
| * 3f8ec1d6b0 nvme-pci: add missing condition check for existence of mapped data
| * 035333dddd ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
| * 41aa8b71b5 ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
| * 9dff804bd8 ASoC: Intel: Convert to new X86 CPU match macros
| * d4001bd3b4 powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
| * 0abe35bc48 apparmor: Fix null pointer deref when receiving skb during sock creation
| * d3e4d4a98c mISDN: Fix a use after free in hfcmulti_tx()
| * a689f5eb13 bpf: Fix a segment issue when downgrading gso_size
| * fd06cb4a5f net: nexthop: Initialize all fields in dumped nexthops
| * 253405541b tipc: Return non-zero value from tipc_udp_addr2str() on error
| * 507bf56d42 net: bonding: correctly annotate RCU in bond_should_notify_peers()
| * 8ea16df99d ipv4: Fix incorrect source address in Record Route option
| * f19db930ae MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
| * 2f7bbdc744 dma: fix call order in dmam_free_coherent
| * 6a8a0da4d8 libbpf: Fix no-args func prototype BTF dumping syntax
| * f4eee36072 um: time-travel: fix time-travel-start option
| * 9b3a434595 jfs: Fix array-index-out-of-bounds in diFree
| * c06023caca kdb: Use the passed prompt in kdb_position_cursor()
| * 1280375411 kdb: address -Wformat-security warnings
| * 02b87e6334 nilfs2: handle inconsistent state in nilfs_btnode_create_block()
| * 1729040114 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
| * 3b5bcca858 Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
| * 46c0fa486b rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
| * 0a99aa6ca3 rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
| * 7d8e5712f3 drm/panfrost: Mark simple_ondemand governor as softdep
| * f54a096195 rbd: don't assume rbd_is_lock_owner() for exclusive mappings
| * 796bdd9a9b selftests/sigaltstack: Fix ppc64 GCC build
| * 7f25f296fc RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
| * 8e9e1b4b9d platform: mips: cpu_hwmon: Disable driver on unsupported hardware
| * 6e70fff02f watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
| * 89b7c3d509 rtc: isl1208: Fix return value of nvmem callbacks
| * f6fe92535e perf/x86/intel/pt: Fix a topa_entry base address calculation
| * 8922d66df1 perf/x86/intel/pt: Fix topa_entry base length
| * e1f0108444 scsi: qla2xxx: validate nvme_local_port correctly
| * af46649304 scsi: qla2xxx: Complete command early within lock
| * dae67169cb scsi: qla2xxx: Fix for possible memory corruption
| * 171ac4b495 scsi: qla2xxx: During vport delete send async logout explicitly
| * 67b6d03dca rtc: cmos: Fix return value of nvmem callbacks
| * b59a5e86a3 kobject_uevent: Fix OOB access within zap_modalias_env()
| * 362ded08cc decompress_bunzip2: fix rare decompression failure
| * 8d4fc803ff ubi: eba: properly rollback inside self_check_eba
| * 02a29f6e3b clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
| * 54162974ae f2fs: fix to don't dirty inode for readonly filesystem
| * 5e5801888d scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
| * 46f1dea17b binder: fix hang of unregistered readers
| * 48b5730852 PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
| * 2828b6fd83 hwrng: amd - Convert PCIBIOS_* return codes to errnos
| * 1ca78a7c47 tools/memory-model: Fix bug in lock.cat
| * 13d79c6489 leds: ss4200: Convert PCIBIOS_* return codes to errnos
| * 34293b8c12 wifi: mwifiex: Fix interface type change
| * e02f9941e8 ext4: make sure the first directory block is not a hole
| * 19e13b4d7f ext4: check dot and dotdot of dx_root before making dir indexed
| * ecc258fbdd m68k: amiga: Turn off Warp1260 interrupts during boot
| * cae9e59cc4 udf: Avoid using corrupted block bitmap buffer
| * 71dbf95359 drm/amd/display: Check for NULL pointer
| * d6ad202f73 drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
| * a658ae2173 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
| * 4a52861cd7 hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
| * 72aff31119 media: venus: fix use after free in vdec_close
| * 375ff2a273 char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
| * 2194b6a9bb ipv6: take care of scope when choosing the src addr
| * c77064e76c af_packet: Handle outgoing VLAN packets without hardware offloading
| * 5d7cea681d net: netconsole: Disable target before netpoll cleanup
| * 457a1c87d4 tick/broadcast: Make takeover of broadcast hrtimer reliable
| * 84033790be rtc: interface: Add RTC offset to alarm after fix-up
| * 680c7faee4 nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
| * a4b0c9fd15 fs/nilfs2: remove some unused macros to tame gcc
| * 10ba89c213 pinctrl: freescale: mxs: Fix refcount of child
| * b45432ce84 pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
| * 932813248d pinctrl: ti: ti-iodelay: Drop if block with always false condition
| * 1a8e19cbc3 pinctrl: single: fix possible memory leak when pinctrl_enable() fails
| * 24d78662f1 pinctrl: core: fix possible memory leak when pinctrl_enable() fails
| * 64c0b8e64b netfilter: ctnetlink: use helper function to calculate expect ID
| * 55fa4883aa bnxt_re: Fix imm_data endianness
| * b8f7d8f4d5 macintosh/therm_windtunnel: fix module unload.
| * 38378074fa powerpc/xmon: Fix disassembly CPU feature checks
| * 28c5198369 MIPS: Octeron: remove source file executable bit
| * 8761992069 Input: elan_i2c - do not leave interrupt disabled on suspend failure
| * 6e1d3873ea RDMA/device: Return error earlier if port in not valid
| * 729109a0d5 mtd: make mtd_test.c a separate module
| * 638b75a19a ASoC: max98088: Check for clk_prepare_enable() error
| * 6e17530f5b RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
| * 6607140c18 RDMA/mlx4: Fix truncated output warning in alias_GUID.c
| * 409ca91035 RDMA/mlx4: Fix truncated output warning in mad.c
| * 5e3f7847e6 Input: qt1050 - handle CHIP_ID reading error
| * 3881d0622c PCI: Fix resource double counting on remove & rescan
| * df5a9723b6 SUNRPC: Fixup gss_status tracepoint error output
| * 6922e03463 sparc64: Fix incorrect function signature and add prototype for prom_cif_init
| * 5f20a407ed ext4: avoid writing unitialized memory to disk in EA inodes
| * feed3fcb6f SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
| * 72e06bedd5 mfd: omap-usb-tll: Use struct_size to allocate tll
| * 62ef8d7816 drm/qxl: Add check for drm_cvt_mode
| * 024e357a6f drm/etnaviv: fix DMA direction handling for cached RW buffers
| * 9e43e7212f perf report: Fix condition in sort__sym_cmp()
| * d1415125b7 leds: trigger: Unregister sysfs attributes before calling deactivate()
| * 3a2a9cc47d media: renesas: vsp1: Store RPF partition configuration per RPF instance
| * 4f33ef74ec media: renesas: vsp1: Fix _irqsave and _irq mix
| * 0063a2822d media: uvcvideo: Override default flags
| * c65fe17a49 media: uvcvideo: Allow entity-defined get_info and get_cur
| * f8bcdad286 saa7134: Unchecked i2c_transfer function result fixed
| * 031eda178e media: imon: Fix race getting ictx->lock
| * fce50a628e media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
| * 5f6aeae1e7 USB: move snd_usb_pipe_sanity_check into the USB core
| * db071a63d7 selftests: forwarding: devlink_lib: Wait for udev events after reloading
| * c90b1cd775 bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
| * f071190ec3 wifi: virt_wifi: don't use strlen() in const context
| * 79957e626d gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
| * 994fc2164a wifi: virt_wifi: avoid reporting connection success with wrong SSID
| * 94637e9927 qed: Improve the stack space of filter_config()
| * b54962dc4e perf: Prevent passing zero nr_pages to rb_alloc_aux()
| * 7d87d26bd1 perf: Fix perf_aux_size() for greater-than 32-bit size
| * 818c1f5ff3 perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
| * 4443bd2032 netfilter: nf_tables: rise cap on SELinux secmark context
| * 576d12ba53 ipvs: Avoid unnecessary calls to skb_is_gso_sctp
| * 8541b8ac35 net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
| * c1df19258a net: fec: Refactor: #define magic constants
| * b289ebb051 wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
| * f0e93132c0 wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
| * 4dc09f6f26 mlxsw: spectrum_acl_erp: Fix object nesting warning
| * 8161263362 lib: objagg: Fix general protection fault
| * 32e4baeaae selftests/bpf: Check length of recv in test_sockmap
| * 130a1a9acb net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
| * 33749ad4da net/smc: Allow SMC-D 1MB DMB allocations
| * de9f06b37d wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
| * 5510183266 firmware: turris-mox-rwtm: Initialize completion before mailbox
| * 8ed886fbfb firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
| * 65f083996e m68k: cmpxchg: Fix return value for default case in __arch_xchg()
| * 1b55044749 x86/xen: Convert comma to semicolon
| * c1588a2e51 m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
| * 5bded5a131 arm64: dts: amlogic: gx: correct hdmi clocks
| * 5c6820c5a7 arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
| * b42123aa11 ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
| * 2623585eb5 ARM: dts: imx6qdl-kontron-samx6i: fix board reset
| * 748ee683ae ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
| * a64cd46cc2 ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
| * 3ba50d9233 arm64: dts: rockchip: Increase VOP clk rate on RK3328
| * 3edf65be1f arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
| * ad8c347732 arm64: dts: qcom: sdm845: add power-domain to UFS PHY
| * 5cd6721d78 hwmon: (max6697) Fix swapped temp{1,8} critical alarms
| * 9fe2069a95 hwmon: (max6697) Fix underflow when writing limit attributes
| * 47f4d2600f pwm: stm32: Always do lazy disabling
| * 894e544ba5 hwmon: (adt7475) Fix default duty on fan is disabled
| * 1df94156d9 x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
| * 2ffb9d2d6f x86/pci/xen: Fix PCIBIOS_* return code handling
| * eb8baf546f x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
| * 55942933a2 x86/of: Return consistent error type from x86_of_pci_irq_enable()
| * 2103341aef hfsplus: fix to avoid false alarm of circular locking
| * e4f2b5e6c4 platform/chrome: cros_ec_debugfs: fix wrong EC message version
| * c68d1dbfe3 EDAC, i10nm: make skx_common.o a separate module
| * 5dad7906e7 EDAC/skx_common: Add new ADXL components for 2-level memory
| * 87594d6d0e EDAC, skx: Retrieve and print retry_rd_err_log registers
| * 202f909495 EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode.
* d82959916b Merge branch 'android11-5.4' into branch 'android11-5.4-lts'

Change-Id: Ifd78d1a1a94f7372bd77a260d7c43aaf0575b7b0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-09-12 10:53:01 +00:00
Carlos Llamas
5a32bfd230 binder: fix UAF caused by offsets overwrite 
commit 4df153652cc46545722879415937582028c18af5 upstream.

Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.

Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-09-12 11:03:55 +02:00
Carlos Llamas
a03c6437cf ANDROID: fix ENOMEM check of binder_proc_ext 
The check should be done against 'eproc' before it gets dereferenced.

Fixes: d49297739550 ("BACKPORT: binder: use euid from cred instead of using task")
Change-Id: Ief0c08212c4da8bdfdf628474de9dd30ee5a8db0
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:04:18 +00:00
Carlos Llamas
be02156857 ANDROID: binder: fix KMI issues due to frozen notification 
The patches to support binder's frozen notification feature break the
KMI. This change fixes such issues by (1) moving proc->delivered_freeze
into the existing proc_wrapper struction, (2) dropping the frozen stats
support and (3) amending the STG due to a harmless enum binder_work_type
addition.

These are the reported KMI issues fixed by this patch:

  function symbol 'int __traceiter_binder_transaction_received(void*, struct binder_transaction*)' changed
    CRC changed from 0x74e9c98b to 0xfe0f8640

  type 'struct binder_proc' changed
    byte size changed from 584 to 632
    member 'struct list_head delivered_death' changed
      offset changed by 256
    member 'struct list_head delivered_freeze' was added
    13 members ('u32 max_threads' .. 'u64 android_oem_data1') changed
      offset changed by 384

  type 'struct binder_thread' changed
    byte size changed from 464 to 496
    2 members ('atomic_t tmp_ref' .. 'bool is_dead') changed
      offset changed by 224
    4 members ('struct task_struct* task' .. 'enum binder_prio_state prio_state') changed
      offset changed by 256

  type 'struct binder_stats' changed
    byte size changed from 216 to 244
    member changed from 'atomic_t br[21]' to 'atomic_t br[23]'
      type changed from 'atomic_t[21]' to 'atomic_t[23]'
        number of elements changed from 21 to 23
    member changed from 'atomic_t bc[19]' to 'atomic_t bc[22]'
      offset changed from 672 to 736
      type changed from 'atomic_t[19]' to 'atomic_t[22]'
        number of elements changed from 19 to 22
    member changed from 'atomic_t obj_created[7]' to 'atomic_t obj_created[8]'
      offset changed from 1280 to 1440
      type changed from 'atomic_t[7]' to 'atomic_t[8]'
        number of elements changed from 7 to 8
    member changed from 'atomic_t obj_deleted[7]' to 'atomic_t obj_deleted[8]'
      offset changed from 1504 to 1696
      type changed from 'atomic_t[7]' to 'atomic_t[8]'
        number of elements changed from 7 to 8

  type 'enum binder_work_type' changed
    enumerator 'BINDER_WORK_FROZEN_BINDER' (10) was added
    enumerator 'BINDER_WORK_CLEAR_FREEZE_NOTIFICATION' (11) was added

Bug: 363013421
Change-Id: If9f1f14a2eda215a4c9cb0823c50c8e0e8079ef1
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:04:18 +00:00
Yu-Ting Tseng
1063c2fa62 BACKPORT: FROMGIT: binder: frozen notification binder_features flag 
Add a flag to binder_features to indicate that the freeze notification
feature is available.

Signed-off-by: Yu-Ting Tseng <yutingtseng@google.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240709070047.4055369-6-yutingtseng@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 363013421
(cherry picked from commit 30b968b002a92870325a5c9d1ce78eba0ce386e7
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Ic26c8ae42d27c6fd8f5daed5eecabd1652e29502
[cmllamas: fix trivial conflicts due to missing extended_error]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:04:18 +00:00
Yu-Ting Tseng
d1e87637cd BACKPORT: FROMGIT: binder: frozen notification 
Frozen processes present a significant challenge in binder transactions.
When a process is frozen, it cannot, by design, accept and/or respond to
binder transactions. As a result, the sender needs to adjust its
behavior, such as postponing transactions until the peer process
unfreezes. However, there is currently no way to subscribe to these
state change events, making it impossible to implement frozen-aware
behaviors efficiently.

Introduce a binder API for subscribing to frozen state change events.
This allows programs to react to changes in peer process state,
mitigating issues related to binder transactions sent to frozen
processes.

Implementation details:
For a given binder_ref, the state of frozen notification can be one of
the followings:
1. Userspace doesn't want a notification. binder_ref->freeze is null.
2. Userspace wants a notification but none is in flight.
   list_empty(&binder_ref->freeze->work.entry) = true
3. A notification is in flight and waiting to be read by userspace.
   binder_ref_freeze.sent is false.
4. A notification was read by userspace and kernel is waiting for an ack.
   binder_ref_freeze.sent is true.

When a notification is in flight, new state change events are coalesced into
the existing binder_ref_freeze struct. If userspace hasn't picked up the
notification yet, the driver simply rewrites the state. Otherwise, the
notification is flagged as requiring a resend, which will be performed
once userspace acks the original notification that's inflight.

See https://r.android.com/3070045 for how userspace is going to use this
feature.

Signed-off-by: Yu-Ting Tseng <yutingtseng@google.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240709070047.4055369-4-yutingtseng@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 363013421
(cherry picked from commit d579b04a52a183db47dfcb7a44304d7747d551e1
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I5dd32abba932ca7d03ae58660143e075ed778b81
[cmllamas: fix merge conflicts due to missing 0567461a7a6e]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:04:18 +00:00
Carlos Llamas
460de65538 BACKPORT: binderfs: add support for feature files 
Provide userspace with a mechanism to discover features supported by
the binder driver to refrain from using any unsupported ones in the
first place. Starting with "oneway_spam_detection" only new features
are to be listed under binderfs and all previous ones are assumed to
be supported.

Assuming an instance of binderfs has been mounted at /dev/binderfs,
binder feature files can be found under /dev/binderfs/features/.
Usage example:

  $ mkdir /dev/binderfs
  $ mount -t binder binder /dev/binderfs
  $ cat /dev/binderfs/features/oneway_spam_detection
  1

Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20210715031805.1725878-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit fc470abf54b2bd6e539065e07905e767b443d719)
Bug: 191910201
Signed-off-by: Carlos Llamas <cmllamas@google.com>
[cmllamas: fix merge conflicts due to missing 095cf502b31e]
Change-Id: Ia5c03aa1881981bee26459e741134b83d5b59693
 2024-09-07 22:04:17 +00:00
Carlos Llamas
31f1f4b2aa FROMLIST: binder: fix memory leaks of spam and pending work 
commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream

A transaction complete work is allocated and queued for each
transaction. Under certain conditions the work->type might be marked as
BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about
potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when
the target is currently frozen.

However, these work types are not being handled in binder_release_work()
so they will leak during a cleanup. This was reported by syzkaller with
the following kmemleak dump:

BUG: memory leak
unreferenced object 0xffff88810e2d6de0 (size 32):
  comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s)
  hex dump (first 32 bytes):
    e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff  .m-......m-.....
    04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
    [<ffffffff83d41873>] kmalloc include/linux/slab.h:599 [inline]
    [<ffffffff83d41873>] kzalloc include/linux/slab.h:720 [inline]
    [<ffffffff83d41873>] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152
    [<ffffffff83d45a05>] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010
    [<ffffffff83d486dc>] binder_ioctl_write_read drivers/android/binder.c:5066 [inline]
    [<ffffffff83d486dc>] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352
    [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
    [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
    [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
    [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fix the leaks by kfreeing these work types in binder_release_work() and
handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup.

Cc: stable@vger.kernel.org
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Reported-by: syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f10c1653e35933c0f1e
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20230922175138.230331-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[cmllamas: backport to v5.15 by dropping BINDER_WORK_TRANSACTION_PENDING
 as commit 0567461a7a6e is not present. Remove fixes tag accordingly.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Link: https://lore.kernel.org/all/20231208034842.997899-1-cmllamas@google.com/
Change-Id: I8e1ee7af87ef5706544e4f320e9498b8f4855a6b
[cmllamas: also backport to v5.4 to fix OOT 8a09136176f6]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:03:49 +00:00
Li Li
334fe73bdd FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn 
When the target process is busy, incoming oneway transactions are
queued in the async_todo list. If the clients continue sending extra
oneway transactions while the target process is frozen, this queue can
become too large to accommodate new transactions. That's why binder
driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's
helpful to debug the async binder buffer exhausting issue, but the
issue itself isn't solved directly.

In real cases applications are designed to send oneway transactions
repeatedly, delivering updated inforamtion to the target process.
Typical examples are Wi-Fi signal strength and some real time sensor
data. Even if the apps might only care about the lastet information,
all outdated oneway transactions are still accumulated there until the
frozen process is thawed later. For this kind of situations, there's
no existing method to skip those outdated transactions and deliver the
latest one only.

This patch introduces a new transaction flag TF_UPDATE_TXN. To use it,
use apps can set this new flag along with TF_ONE_WAY. When such an
oneway transaction is to be queued into the async_todo list of a frozen
process, binder driver will check if any previous pending transactions
can be superseded by comparing their code, flags and target node. If
such an outdated pending transaction is found, the latest transaction
will supersede that outdated one. This effectively prevents the async
binder buffer running out and saves unnecessary binder read workloads.

Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 231624308
Test: manually check async binder buffer size of frozen apps
Test: stress test with kernel 4.14/4.19/5.10/5.15
(cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
  char-misc-next)
Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176
 2024-09-07 22:03:08 +00:00
Hang Lu
2bfddf30aa BACKPORT: binder: tell userspace to dump current backtrace when detected oneway spamming 
When async binder buffer got exhausted, some normal oneway transactions
will also be discarded and may cause system or application failures. By
that time, the binder debug information we dump may not be relevant to
the root cause. And this issue is difficult to debug if without the
backtrace of the thread sending spam.

This change will send BR_ONEWAY_SPAM_SUSPECT to userspace when oneway
spamming is detected, request to dump current backtrace. Oneway spamming
will be reported only once when exceeding the threshold (target process
dips below 80% of its oneway space, and current process is responsible
for either more than 50 transactions, or more than 50% of the oneway
space). And the detection will restart when the async buffer has
returned to a healthy state.

Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Hang Lu <hangl@codeaurora.org>
Link: https://lore.kernel.org/r/1617961246-4502-3-git-send-email-hangl@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 181190340
Change-Id: Id3d2526099bc89f04d8ad3ad6e48141b2a8f2515
(cherry picked from commit a7dc1e6f99df59799ab0128d9c4e47bbeceb934d)
Signed-off-by: Hang Lu <hangl@codeaurora.org>
[cmllamas: fix trivial merge issue]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-09-07 22:02:42 +00:00
Greg Kroah-Hartman
147724ba5f This is the 5.4.282 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmbCvnsACgkQONu9yGCS
 aT45Zw/9FM9SGzzJpl0jFgvbKhOufwdtzg/CNBRoqFybE+Zmpy0dJvzuurYQFmJZ
 bh6b9oPRGKBzT6aolOcN2bxjT1IlvTZ950CIbfYHD38qA7bhkeBKK9i8kuz7REUQ
 Bs8H7xMMK9xHrLUWb6gVPfPy2vPiBIE7IMzlhCrKKneInR3OANG70hM3USpt44/1
 BxuA87kjJHMe/He4AL7jVL4AO8EpZYrO5WuYA49aLEtrVFKOtbKQ1HgzhUsDgFI4
 FA5MXTBx7Cw7NKLcYkykbdScPJ7ZZgakY8283F0s+E8BdqcabeH/l1lvK4/EqHGC
 mnz6+9CmSnjyI7pW/X5FCXssmznoxBd9btnLM2ap9610veRqRuolo6VQpv6ONO53
 SYMKEkUs2CjS7adG8uGv2+C0t4nw2jWJjjNkyic72vZwlZL9BTJitiy3q96KFYmD
 OoRK6e7UQYgraRY8FmirMOjicKtBXASLDvfZ3KuZVconbloQTeYO9mRMLVsTt7Qn
 gag021ogc++Ps/75TrmygT5/rv4sV9vXWk/1pFsTdcAdn6kHVTtI+QHACLljrms8
 nEQGI/ZET9fZaCrLz56dfswLZzxjemJ7vLMGoweEXltXCG/e6d1tHGW3prYo2ZXC
 +wR6jw9q8kSoCSahACDkryAeQsnMkoIoDAJEktnRhBSCtGpUbZE=
 =zKyu
 -----END PGP SIGNATURE-----

Merge 5.4.282 into android11-5.4-lts

Changes in 5.4.282
	EDAC, skx_common: Refactor so that we initialize "dev" in result of adxl decode.
	EDAC, skx: Retrieve and print retry_rd_err_log registers
	EDAC/skx_common: Add new ADXL components for 2-level memory
	EDAC, i10nm: make skx_common.o a separate module
	platform/chrome: cros_ec_debugfs: fix wrong EC message version
	hfsplus: fix to avoid false alarm of circular locking
	x86/of: Return consistent error type from x86_of_pci_irq_enable()
	x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
	x86/pci/xen: Fix PCIBIOS_* return code handling
	x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
	hwmon: (adt7475) Fix default duty on fan is disabled
	pwm: stm32: Always do lazy disabling
	hwmon: (max6697) Fix underflow when writing limit attributes
	hwmon: (max6697) Fix swapped temp{1,8} critical alarms
	arm64: dts: qcom: sdm845: add power-domain to UFS PHY
	arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
	arm64: dts: rockchip: Increase VOP clk rate on RK3328
	ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
	ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
	ARM: dts: imx6qdl-kontron-samx6i: fix board reset
	ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
	arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
	arm64: dts: amlogic: gx: correct hdmi clocks
	m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
	x86/xen: Convert comma to semicolon
	m68k: cmpxchg: Fix return value for default case in __arch_xchg()
	firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
	firmware: turris-mox-rwtm: Initialize completion before mailbox
	wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
	net/smc: Allow SMC-D 1MB DMB allocations
	net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
	selftests/bpf: Check length of recv in test_sockmap
	lib: objagg: Fix general protection fault
	mlxsw: spectrum_acl_erp: Fix object nesting warning
	wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
	wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
	net: fec: Refactor: #define magic constants
	net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
	ipvs: Avoid unnecessary calls to skb_is_gso_sctp
	netfilter: nf_tables: rise cap on SELinux secmark context
	perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
	perf: Fix perf_aux_size() for greater-than 32-bit size
	perf: Prevent passing zero nr_pages to rb_alloc_aux()
	qed: Improve the stack space of filter_config()
	wifi: virt_wifi: avoid reporting connection success with wrong SSID
	gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
	wifi: virt_wifi: don't use strlen() in const context
	bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
	selftests: forwarding: devlink_lib: Wait for udev events after reloading
	USB: move snd_usb_pipe_sanity_check into the USB core
	media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
	media: imon: Fix race getting ictx->lock
	saa7134: Unchecked i2c_transfer function result fixed
	media: uvcvideo: Allow entity-defined get_info and get_cur
	media: uvcvideo: Override default flags
	media: renesas: vsp1: Fix _irqsave and _irq mix
	media: renesas: vsp1: Store RPF partition configuration per RPF instance
	leds: trigger: Unregister sysfs attributes before calling deactivate()
	perf report: Fix condition in sort__sym_cmp()
	drm/etnaviv: fix DMA direction handling for cached RW buffers
	drm/qxl: Add check for drm_cvt_mode
	mfd: omap-usb-tll: Use struct_size to allocate tll
	SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
	ext4: avoid writing unitialized memory to disk in EA inodes
	sparc64: Fix incorrect function signature and add prototype for prom_cif_init
	SUNRPC: Fixup gss_status tracepoint error output
	PCI: Fix resource double counting on remove & rescan
	Input: qt1050 - handle CHIP_ID reading error
	RDMA/mlx4: Fix truncated output warning in mad.c
	RDMA/mlx4: Fix truncated output warning in alias_GUID.c
	RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
	ASoC: max98088: Check for clk_prepare_enable() error
	mtd: make mtd_test.c a separate module
	RDMA/device: Return error earlier if port in not valid
	Input: elan_i2c - do not leave interrupt disabled on suspend failure
	MIPS: Octeron: remove source file executable bit
	powerpc/xmon: Fix disassembly CPU feature checks
	macintosh/therm_windtunnel: fix module unload.
	bnxt_re: Fix imm_data endianness
	netfilter: ctnetlink: use helper function to calculate expect ID
	pinctrl: core: fix possible memory leak when pinctrl_enable() fails
	pinctrl: single: fix possible memory leak when pinctrl_enable() fails
	pinctrl: ti: ti-iodelay: Drop if block with always false condition
	pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
	pinctrl: freescale: mxs: Fix refcount of child
	fs/nilfs2: remove some unused macros to tame gcc
	nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
	rtc: interface: Add RTC offset to alarm after fix-up
	tick/broadcast: Make takeover of broadcast hrtimer reliable
	net: netconsole: Disable target before netpoll cleanup
	af_packet: Handle outgoing VLAN packets without hardware offloading
	ipv6: take care of scope when choosing the src addr
	char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
	media: venus: fix use after free in vdec_close
	hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
	drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
	drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
	drm/amd/display: Check for NULL pointer
	udf: Avoid using corrupted block bitmap buffer
	m68k: amiga: Turn off Warp1260 interrupts during boot
	ext4: check dot and dotdot of dx_root before making dir indexed
	ext4: make sure the first directory block is not a hole
	wifi: mwifiex: Fix interface type change
	leds: ss4200: Convert PCIBIOS_* return codes to errnos
	tools/memory-model: Fix bug in lock.cat
	hwrng: amd - Convert PCIBIOS_* return codes to errnos
	PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
	binder: fix hang of unregistered readers
	scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
	f2fs: fix to don't dirty inode for readonly filesystem
	clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
	ubi: eba: properly rollback inside self_check_eba
	decompress_bunzip2: fix rare decompression failure
	kobject_uevent: Fix OOB access within zap_modalias_env()
	rtc: cmos: Fix return value of nvmem callbacks
	scsi: qla2xxx: During vport delete send async logout explicitly
	scsi: qla2xxx: Fix for possible memory corruption
	scsi: qla2xxx: Complete command early within lock
	scsi: qla2xxx: validate nvme_local_port correctly
	perf/x86/intel/pt: Fix topa_entry base length
	perf/x86/intel/pt: Fix a topa_entry base address calculation
	rtc: isl1208: Fix return value of nvmem callbacks
	watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
	platform: mips: cpu_hwmon: Disable driver on unsupported hardware
	RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
	selftests/sigaltstack: Fix ppc64 GCC build
	rbd: don't assume rbd_is_lock_owner() for exclusive mappings
	drm/panfrost: Mark simple_ondemand governor as softdep
	rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
	rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
	Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
	Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
	nilfs2: handle inconsistent state in nilfs_btnode_create_block()
	kdb: address -Wformat-security warnings
	kdb: Use the passed prompt in kdb_position_cursor()
	jfs: Fix array-index-out-of-bounds in diFree
	um: time-travel: fix time-travel-start option
	libbpf: Fix no-args func prototype BTF dumping syntax
	dma: fix call order in dmam_free_coherent
	MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
	ipv4: Fix incorrect source address in Record Route option
	net: bonding: correctly annotate RCU in bond_should_notify_peers()
	tipc: Return non-zero value from tipc_udp_addr2str() on error
	net: nexthop: Initialize all fields in dumped nexthops
	bpf: Fix a segment issue when downgrading gso_size
	mISDN: Fix a use after free in hfcmulti_tx()
	apparmor: Fix null pointer deref when receiving skb during sock creation
	powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
	ASoC: Intel: Convert to new X86 CPU match macros
	ASoC: Intel: Move soc_intel_is_foo() helpers to a generic header
	ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
	nvme-pci: add missing condition check for existence of mapped data
	mm: avoid overflows in dirty throttling logic
	PCI: rockchip: Make 'ep-gpios' DT property optional
	PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
	parport: Convert printk(KERN_<LEVEL> to pr_<level>(
	parport: Standardize use of printmode
	dev/parport: fix the array out-of-bounds risk
	driver core: Cast to (void *) with __force for __percpu pointer
	devres: Fix memory leakage caused by driver API devm_free_percpu()
	genirq: Allow the PM device to originate from irq domain
	irqchip/imx-irqsteer: Constify irq_chip struct
	irqchip/imx-irqsteer: Add runtime PM support
	irqchip/imx-irqsteer: Handle runtime power management correctly
	remoteproc: imx_rproc: ignore mapping vdev regions
	remoteproc: imx_rproc: Fix ignoring mapping vdev regions
	remoteproc: imx_rproc: Skip over memory region when node value is NULL
	drm/nouveau: prime: fix refcount underflow
	drm/vmwgfx: Fix overlay when using Screen Targets
	net/iucv: fix use after free in iucv_sock_close()
	net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
	ipv6: fix ndisc_is_useropt() handling for PIO
	HID: wacom: Modify pen IDs
	protect the fetch of ->fd[fd] in do_dup2() from mispredictions
	ALSA: usb-audio: Correct surround channels in UAC1 channel map
	net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
	netfilter: ipset: Add list flush to cancel_gc
	genirq: Allow irq_chip registration functions to take a const irq_chip
	irqchip/mbigen: Fix mbigen node address layout
	x86/mm: Fix pti_clone_pgtable() alignment assumption
	sctp: move hlist_node and hashent out of sctp_ep_common
	sctp: Fix null-ptr-deref in reuseport_add_sock().
	net: usb: qmi_wwan: fix memory leak for not ip packets
	net: linkwatch: use system_unbound_wq
	Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
	net: fec: Stop PPS on driver remove
	md/raid5: avoid BUG_ON() while continue reshape after reassembling
	clocksource/drivers/sh_cmt: Address race condition for clock events
	ACPI: battery: create alarm sysfs attribute atomically
	ACPI: SBS: manage alarm sysfs attribute through psy core
	selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
	PCI: Add Edimax Vendor ID to pci_ids.h
	udf: prevent integer overflow in udf_bitmap_free_blocks()
	wifi: nl80211: don't give key data to userspace
	btrfs: fix bitmap leak when loading free space cache on duplicate entry
	drm/amdgpu: Fix the null pointer dereference to ras_manager
	media: uvcvideo: Ignore empty TS packets
	media: uvcvideo: Fix the bandwdith quirk on USB 3.x
	jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
	s390/sclp: Prevent release of buffer in I/O
	SUNRPC: Fix a race to wake a sync task
	ext4: fix wrong unit use in ext4_mb_find_by_goal
	arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
	arm64: Add Neoverse-V2 part
	arm64: cputype: Add Cortex-X4 definitions
	arm64: cputype: Add Neoverse-V3 definitions
	arm64: errata: Add workaround for Arm errata 3194386 and 3312417
	arm64: cputype: Add Cortex-X3 definitions
	arm64: cputype: Add Cortex-A720 definitions
	arm64: cputype: Add Cortex-X925 definitions
	arm64: errata: Unify speculative SSBS errata logic
	arm64: errata: Expand speculative SSBS workaround
	arm64: cputype: Add Cortex-X1C definitions
	arm64: cputype: Add Cortex-A725 definitions
	arm64: errata: Expand speculative SSBS workaround (again)
	i2c: smbus: Don't filter out duplicate alerts
	i2c: smbus: Improve handling of stuck alerts
	i2c: smbus: Send alert notifications to all devices if source not found
	bpf: kprobe: remove unused declaring of bpf_kprobe_override
	spi: fsl-lpspi: remove unneeded array
	spi: spi-fsl-lpspi: Fix scldiv calculation
	drm/client: fix null pointer dereference in drm_client_modeset_probe
	ALSA: line6: Fix racy access to midibuf
	ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
	ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
	usb: vhci-hcd: Do not drop references before new references are gained
	USB: serial: debug: do not echo input by default
	usb: gadget: core: Check for unset descriptor
	scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
	tick/broadcast: Move per CPU pointer access into the atomic section
	ntp: Clamp maxerror and esterror to operating range
	driver core: Fix uevent_show() vs driver detach race
	ntp: Safeguard against time_constant overflow
	scsi: mpt3sas: Remove scsi_dma_map() error messages
	scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
	serial: core: check uartclk for zero to avoid divide by zero
	genirq/irqdesc: Honor caller provided affinity in alloc_desc()
	power: supply: axp288_charger: Fix constant_charge_voltage writes
	power: supply: axp288_charger: Round constant_charge_voltage writes down
	tracing: Fix overflow in get_free_elt()
	x86/mtrr: Check if fixed MTRRs exist before saving them
	drm/bridge: analogix_dp: properly handle zero sized AUX transactions
	drm/mgag200: Set DDC timeout in milliseconds
	Fix gcc 4.9 build issue in 5.4.y
	kbuild: Fix '-S -c' in x86 stack protector scripts
	netfilter: nf_tables: set element extended ACK reporting support
	netfilter: nf_tables: use timestamp to check for set element timeout
	netfilter: nf_tables: prefer nft_chain_validate
	drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
	arm64: cpufeature: Fix the visibility of compat hwcaps
	media: uvcvideo: Use entity get_cur in uvc_ctrl_set
	exec: Fix ToCToU between perm check and set-uid/gid usage
	nvme/pci: Add APST quirk for Lenovo N60z laptop
	ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
	media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
	Linux 5.4.282

Change-Id: I6d0e4d26021c20136cefafa63b138db47b4069b8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-08-28 08:50:45 +00:00
Carlos Llamas
f4e5b5151e FROMLIST: binder: fix UAF caused by offsets overwrite 
Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.

Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 352520660
Link: https://lore.kernel.org/all/20240822182353.2129600-1-cmllamas@google.com/
Change-Id: I1b2dd8403b63e5eeb58904558b7b542141c83fc2
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-08-23 16:47:50 +00:00
Carlos Llamas
46f1dea17b binder: fix hang of unregistered readers 
commit 31643d84b8c3d9c846aa0e20bc033e46c68c7e7d upstream.

With the introduction of binder_available_for_proc_work_ilocked() in
commit 1b77e9dcc3 ("ANDROID: binder: remove proc waitqueue") a binder
thread can only "wait_for_proc_work" after its thread->looper has been
marked as BINDER_LOOPER_STATE_{ENTERED|REGISTERED}.

This means an unregistered reader risks waiting indefinitely for work
since it never gets added to the proc->waiting_threads. If there are no
further references to its waitqueue either the task will hang. The same
applies to readers using the (e)poll interface.

I couldn't find the rationale behind this restriction. So this patch
restores the previous behavior of allowing unregistered threads to
"wait_for_proc_work". Note that an error message for this scenario,
which had previously become unreachable, is now re-enabled.

Fixes: 1b77e9dcc3 ("ANDROID: binder: remove proc waitqueue")
Cc: stable@vger.kernel.org
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240711201452.2017543-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-08-19 05:33:37 +02:00
Michael Bestas
df44b16b4f
 		Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: (482 commits)
  ANDROID: GKI: refresh ABI to include kimage_vaddr
  ANDROID: preserve CRC for struct tcp_sock
  ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
  Linux 5.4.280
  i2c: rcar: bring hardware to known state when probing
  nilfs2: fix kernel bug on rename operation of broken directory
  tcp: avoid too many retransmit packets
  tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
  net: tcp: fix unexcepted socket die when snd_wnd is 0
  tcp: refactor tcp_retransmit_timer()
  SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  libceph: fix race between delayed_work() and ceph_monc_stop()
  ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
  nvmem: meson-efuse: Fix return value of nvmem callbacks
  hpet: Support 32-bit userspace
  USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
  usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
  USB: serial: option: add Rolling RW350-GL variants
  USB: serial: option: add Netprisma LCUK54 series modules
  ...

 Conflicts:
	kernel/gen_kheaders.sh

Change-Id: Ib57235b05d1bd369b3852565eabea8e658b59aed
 2024-08-05 21:50:23 +03:00
Michael Bestas
73abf253d5
 		Merge tag 'ASB-2024-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2024-06-01
CVE-2024-26926

* tag 'ASB-2024-06-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: ABI fixup for abi break in struct dst_ops
  BACKPORT: net: fix __dst_negative_advice() race
  UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
  Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
  Reapply "media: ttpci: fix two memleaks in budget_av_attach"
  Revert "media: rename VFL_TYPE_GRABBER to _VIDEO"
  Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO"
  Revert "media: ttpci: fix two memleaks in budget_av_attach"
  Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
  Revert "regmap: allow to define reg_update_bits for no bus configuration"
  Revert "regmap: Add bulk read/write callbacks into regmap_config"
  Revert "serial: max310x: fix IO data corruption in batched operations"
  Revert "geneve: make sure to pull inner header in geneve_rx()"
  Linux 5.4.274
  firmware: meson_sm: fix to avoid potential NULL pointer dereference
  ip_gre: do not report erspan version on GRE interface
  erspan: Check IFLA_GRE_ERSPAN_VER is set.
  VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
  Bluetooth: btintel: Fixe build regression
  x86/alternative: Don't call text_poke() in lazy TLB mode
  drm/i915/gt: Reset queue_priority_hint on parking
  x86/mm/pat: fix VM_PAT handling in COW mappings
  virtio: reenable config if freezing device failed
  drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  netfilter: nf_tables: discard table flag update with pending basechain deletion
  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  netfilter: nf_tables: release batch on table validation from abort path
  netfilter: nf_tables: reject new basechain after table flag update
  fbmon: prevent division by zero in fb_videomode_from_videomode()
  fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
  usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
  usb: typec: tcpci: add generic tcpci fallback compatible
  tools: iio: replace seekdir() in iio_generic_buffer
  ktest: force $buildonly = 1 for 'make_warnings_file' test type
  Input: allocate keycode for Display refresh rate toggle
  block: prevent division by zero in blk_rq_stat_sum()
  Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
  SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
  drm/amd/display: Fix nanosec stat overflow
  media: sta2x11: fix irq handler cast
  isofs: handle CDs with bad root inode but good Joliet root directory
  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  sysv: don't call sb_bread() with pointers_lock held
  Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
  Bluetooth: btintel: Fix null ptr deref in btintel_read_version
  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
  btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
  ionic: set adminq irq affinity
  arm64: dts: rockchip: fix rk3399 hdmi ports node
  arm64: dts: rockchip: fix rk3328 hdmi ports node
  panic: Flush kernel log buffer at the end
  VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
  wifi: ath9k: fix LNA selection in ath_ant_try_scan()
  s390/entry: align system call table on 8 bytes
  x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
  ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
  ata: sata_mv: Fix PCI device ID table declaration compilation warning
  scsi: mylex: Fix sysfs buffer lengths
  ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
  ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
  net: ravb: Always process TX descriptor ring
  erspan: make sure erspan_base_hdr is present in skb->head
  erspan: Add type I version 0 support.
  init: open /initrd.image with O_LARGEFILE
  initramfs: switch initramfs unpacking to struct file based APIs
  fs: add a vfs_fchmod helper
  fs: add a vfs_fchown helper
  staging: vc04_services: fix information leak in create_component()
  staging: vc04_services: changen strncpy() to strscpy_pad()
  staging: mmal-vchiq: Fix client_component for 64 bit kernel
  staging: mmal-vchiq: Allocate and free components as required
  i40e: fix vf may be used uninitialized in this function warning
  ipv6: Fix infinite recursion in fib6_dump_done().
  selftests: reuseaddr_conflict: add missing new line at the end of the output
  net: stmmac: fix rx queue priority assignment
  net/sched: act_skbmod: prevent kernel-infoleak
  bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  netfilter: nf_tables: flush pending destroy work before exit_net release
  mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
  Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
  vfio/platform: Create persistent IRQ handlers
  vfio/pci: Create persistent INTx handler
  vfio: Introduce interface to flush virqfd inject workqueue
  vfio/pci: Lock external INTx masking ops
  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  net/rds: fix possible cp null dereference
  netfilter: nf_tables: disallow timeout for anonymous sets
  Bluetooth: Fix TOCTOU in HCI debugfs implementation
  Bluetooth: hci_event: set the conn encrypted before conn establishes
  x86/cpufeatures: Add new word for scattered features
  r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
  dm integrity: fix out-of-range warning
  tcp: properly terminate timers for kernel sockets
  ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
  nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  USB: core: Fix deadlock in usb_deauthorize_interface()
  scsi: lpfc: Correct size for wqe for memset()
  x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
  scsi: qla2xxx: Fix command flush on cable pull
  usb: udc: remove warning when queue disabled ep
  usb: dwc2: gadget: LPM flow fix
  usb: dwc2: host: Fix ISOC flow in DDMA mode
  usb: dwc2: host: Fix hibernation flow
  usb: dwc2: host: Fix remote wakeup from hibernation
  scsi: core: Fix unremoved procfs host directory regression
  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  usb: cdc-wdm: close race between read and workqueue
  mmc: core: Avoid negative index with array access
  mmc: core: Initialize mmc_blk_ioc_data
  exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  mm/migrate: set swap entry values of THP tail pages properly.
  mm/memory-failure: fix an incorrect use of tail pages
  vt: fix memory overlapping when deleting chars in the buffer
  bounds: support non-power-of-two CONFIG_NR_CPUS
  powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
  efivarfs: Request at most 512 bytes for variable names
  perf/core: Fix reentry problem in perf_output_read_group()
  loop: loop_set_status_from_info() check before assignment
  loop: Check for overflow while configuring loop
  loop: Factor out configuring loop from status
  loop: Refactor loop_set_status() size calculation
  loop: Factor out setting loop device size
  loop: Remove sector_t truncation checks
  loop: Call loop_config_discard() only after new config is applied
  Revert "loop: Check for overflow while configuring loop"
  btrfs: allocate btrfs_ioctl_defrag_range_args on stack
  printk: Update @console_may_schedule in console_trylock_spinning()
  xen/events: close evtchn after mapping cleanup
  x86/speculation: Support intra-function call validation
  objtool: Add support for intra-function calls
  objtool: is_fentry_call() crashes if call has no destination
  fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  vt: fix unicode buffer corruption when deleting characters
  tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
  usb: port: Don't try to peer unused USB ports based on location
  usb: gadget: ncm: Fix handling of zero block length packets
  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
  xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
  netfilter: nf_tables: reject constant set with timeout
  netfilter: nf_tables: disallow anonymous set with timeout flag
  netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  comedi: comedi_test: Prevent timers rescheduling during deletion
  dm snapshot: fix lockup in dm_exception_table_exit
  ahci: asm1064: asm1166: don't limit reported ports
  ahci: asm1064: correct count of reported ports
  x86/CPU/AMD: Update the Zenbleed microcode revisions
  nilfs2: prevent kernel bug at submit_bh_wbc()
  nilfs2: use a more common logging style
  nilfs2: fix failure to detect DAT corruption in btree and direct mappings
  memtest: use {READ,WRITE}_ONCE in memory scanning
  drm/vc4: hdmi: do not return negative values from .get_modes()
  drm/imx/ipuv3: do not return negative values from .get_modes()
  drm/exynos: do not return negative values from .get_modes()
  s390/zcrypt: fix reference counting on zcrypt card objects
  soc: fsl: qbman: Use raw spinlock for cgr_lock
  soc: fsl: qbman: Add CGR update function
  soc: fsl: qbman: Add helper for sanity checking cgr ops
  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  ring-buffer: Fix full_waiters_pending in poll
  ring-buffer: Fix resetting of shortest_full
  vfio/platform: Disable virqfds on cleanup
  kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
  speakup: Fix 8bit characters from direct synth
  slimbus: core: Remove usage of the deprecated ida_simple_xx() API
  nvmem: meson-efuse: fix function pointer type mismatch
  firmware: meson_sm: Rework driver as a proper platform driver
  ext4: fix corruption during on-line resize
  hwmon: (amc6821) add of_match table
  mmc: core: Fix switch on gp3 partition
  dm-raid: fix lockdep waring in "pers->hot_add_disk"
  Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
  PCI/PM: Drain runtime-idle callbacks before driver removal
  PCI: Drop pci_device_remove() test of pci_dev->driver
  btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
  fuse: don't unhash root
  mmc: tmio: avoid concurrent runs of mmc_request_done()
  PM: sleep: wakeirq: fix wake irq warning in system suspend
  USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
  USB: serial: option: add MeiG Smart SLM320 product
  USB: serial: cp210x: add ID for MGP Instruments PDS100
  USB: serial: add device ID for VeriFone adapter
  USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
  powerpc/fsl: Fix mfpmr build errors with newer binutils
  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
  clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
  PM: suspend: Set mem_sleep_current during kernel command line setup
  parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
  parisc: Fix csum_ipv6_magic on 64-bit systems
  parisc: Fix csum_ipv6_magic on 32-bit systems
  parisc: Fix ip_fast_csum
  parisc: Do not hardcode registers in checksum functions
  mtd: rawnand: meson: fix scrambling mode value in command macro
  ubi: correct the calculation of fastmap size
  ubi: Check for too small LEB size in VTBL code
  ubifs: Set page uptodate in the correct place
  fat: fix uninitialized field in nostale filehandles
  ext4: correct best extent lstart adjustment logic
  selftests/mqueue: Set timeout to 180 seconds
  crypto: qat - resolve race condition during AER recovery
  crypto: qat - fix double free during reset
  sparc: vDSO: fix return value of __setup handler
  sparc64: NMI watchdog: fix return value of __setup handler
  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  media: xc4000: Fix atomicity violation in xc4000_get_frequency
  serial: max310x: fix NULL pointer dereference in I2C instantiation
  arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
  ARM: dts: mmp2-brownstone: Don't redeclare phandle references
  smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
  smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
  clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
  media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  timers: Rename del_timer_sync() to timer_delete_sync()
  timers: Use del_timer_sync() even on UP
  timers: Update kernel-doc for various functions
  x86/bugs: Use sysfs_emit()
  x86/cpu: Support AMD Automatic IBRS
  Documentation/hw-vuln: Update spectre doc
  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  Linux 5.4.273
  regmap: Add missing map->bus check
  spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
  bpf: report RCU QS in cpumap kthread
  rcu: add a helper to report consolidated flavor QS
  netfilter: nf_tables: do not compare internal table flags on updates
  ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
  octeontx2-af: Use separate handlers for interrupts
  net/bnx2x: Prevent access to a freed page in page_pool
  hsr: Handle failures in module init
  rds: introduce acquire/release ordering in acquire/release_in_xmit()
  packet: annotate data-races around ignore_outgoing
  hsr: Fix uninit-value access in hsr_get_node()
  s390/vtime: fix average steal time calculation
  octeontx2-af: Use matching wake_up API variant in CGX command interface
  usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
  staging: greybus: fix get_channel_from_mode() failure path
  serial: 8250_exar: Don't remove GPIO device on suspend
  rtc: mt6397: select IRQ_DOMAIN instead of depending on it
  kconfig: fix infinite loop when expanding a macro at the end of file
  tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
  serial: max310x: fix syntax error in IRQ error message
  tty: vt: fix 20 vs 0x20 typo in EScsiignore
  afs: Revert "afs: Hide silly-rename files from userspace"
  NFS: Fix an off by one in root_nfs_cat()
  watchdog: stm32_iwdg: initialize default timeout
  net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
  scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
  RDMA/device: Fix a race between mad_client and cm_client init
  scsi: csiostor: Avoid function pointer casts
  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  clk: Fix clk_core_get NULL dereference
  sparc32: Fix section mismatch in leon_pci_grpci
  backlight: lp8788: Fully initialize backlight_properties during probe
  backlight: lm3639: Fully initialize backlight_properties during probe
  backlight: da9052: Fully initialize backlight_properties during probe
  backlight: lm3630a: Don't set bl->props.brightness in get_brightness
  backlight: lm3630a: Initialize backlight_properties on init
  powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
  drm/msm/dpu: add division of drm_display_mode's hskew parameter
  powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  media: ttpci: fix two memleaks in budget_av_attach
  media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
  media: rename VFL_TYPE_GRABBER to _VIDEO
  media: v4l2-core: correctly validate video and metadata ioctls
  media: go7007: fix a memleak in go7007_load_encoder
  media: dvb-frontends: avoid stack overflow warnings with clang
  media: pvrusb2: fix uaf in pvr2_context_set_notify
  drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
  ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
  mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
  mtd: maps: physmap-core: fix flash size larger than 32-bit
  crypto: arm/sha - fix function cast warnings
  mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
  mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
  drm/tegra: put drm_gem_object ref on error in tegra_fb_create
  clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
  PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
  drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
  clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
  media: pvrusb2: fix pvr2_stream_callback casts
  media: pvrusb2: remove redundant NULL check
  media: go7007: add check of return value of go7007_read_addr()
  media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
  perf stat: Avoid metric-only segv
  ALSA: seq: fix function cast warnings
  drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
  perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
  PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  quota: Fix rcu annotations of inode dquot pointers
  quota: Fix potential NULL pointer dereference
  quota: simplify drop_dquot_ref()
  clk: qcom: reset: Ensure write completion on reset de/assertion
  clk: qcom: reset: Commonize the de/assert functions
  clk: qcom: reset: support resetting multiple bits
  clk: qcom: reset: Allow specifying custom reset delay
  media: edia: dvbdev: fix a use-after-free
  media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
  media: v4l2-tpg: fix some memleaks in tpg_alloc
  media: em28xx: annotate unchecked call to media_device_register()
  perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  perf record: Fix possible incorrect free in record__switch_output()
  PCI/DPC: Print all TLP Prefixes, not just the first
  media: tc358743: register v4l2 async device only after successful setup
  dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
  drm/rockchip: lvds: do not overwrite error code
  drm: Don't treat 0 as -1 in drm_fixp2int_ceil
  drm/rockchip: inno_hdmi: Fix video timing
  drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
  drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
  drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
  drm/tegra: dsi: Make use of the helper function dev_err_probe()
  gpu: host1x: mipi: Update tegra_mipi_request() to be node based
  drm/tegra: dsi: Add missing check for of_find_device_by_node
  dm: call the resume method on internal suspend
  dm raid: fix false positive for requeue needed during reshape
  nfp: flower: handle acti_netdevs allocation failure
  net/x25: fix incorrect parameter validation in the x25_getsockopt() function
  net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
  udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
  l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
  tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
  net: hns3: fix port duplex configure error in IMP reset
  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  ipv6: fib6_rules: flush route cache when rule is changed
  bpf: Fix stackmap overflow check on 32-bit arches
  bpf: Fix hashtab overflow check on 32-bit arches
  sr9800: Add check for usbnet_get_endpoints
  Bluetooth: hci_core: Fix possible buffer overflow
  Bluetooth: Remove superfluous call to hci_conn_check_pending()
  igb: Fix missing time sync events
  igb: move PEROUT and EXTTS isr logic to separate functions
  mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
  SUNRPC: fix some memleaks in gssx_dec_option_array
  x86, relocs: Ignore relocations in .notes section
  ACPI: scan: Fix device check notification handling
  ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
  ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
  ARM: dts: imx6dl-yapp4: Move phy reset into switch node
  ARM: dts: arm: realview: Fix development chip ROM compatible value
  net: ena: Remove ena_select_queue
  net: ena: cosmetic: fix line break issues
  wifi: brcmsmac: avoid function pointer casts
  iommu/amd: Mark interrupt as managed
  bus: tegra-aconnect: Update dependency to ARCH_TEGRA
  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  arm64: dts: qcom: msm8996: Pad addresses
  arm64: dts: qcom: msm8996: Move regulator consumers to db820c
  arm64: dts: qcom: msm8996: Use node references in db820c
  arm64: dts: qcom: db820c: Move non-soc entries out of /soc
  bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
  bpf: Factor out bpf_spin_lock into helpers.
  bpf: Add typecast to bpf helpers to help BTF generation
  arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  net: blackhole_dev: fix build warning for ethh set but not used
  af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
  sock_diag: annotate data-races around sock_diag_handlers[family]
  wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
  wifi: wilc1000: fix RCU usage in connect path
  wifi: wilc1000: fix declarations ordering
  wifi: b43: Disable QoS for bcm4331
  wifi: b43: Stop correct queue in DMA worker when QoS is disabled
  b43: main: Fix use true/false for bool type
  wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  b43: dma: Fix use true/false for bool type variable
  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  timekeeping: Fix cross-timestamp interpolation for non-x86
  timekeeping: Fix cross-timestamp interpolation corner case decision
  timekeeping: Fix cross-timestamp interpolation on counter wrap
  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  fs/select: rework stack allocation hack for clang
  nbd: null check for nla_nest_start
  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
  ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
  ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
  Input: gpio_keys_polled - suppress deferred probe error for gpio
  ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
  firewire: core: use long bus reset on gap count error
  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  dm-verity, dm-crypt: align "struct bvec_iter" correctly
  block: sed-opal: handle empty atoms when parsing response
  parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
  net/iucv: fix the allocation size of iucv_path_table array
  RDMA/mlx5: Relax DEVX access upon modify commands
  HID: multitouch: Add required quirk for Synaptics 0xcddc device
  MIPS: Clear Cause.BD in instruction_pointer_set
  x86/xen: Add some null pointer checking to smp.c
  ASoC: rt5645: Make LattePanda board DMI match more precise
  selftests: tls: use exact comparison in recv_partial
  io_uring: drop any code related to SCM_RIGHTS
  io_uring/unix: drop usage of io_uring socket
  UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845
  Linux 5.4.272
  arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  arm64: dts: qcom: add PDC interrupt controller for SDM845
  serial: max310x: fix IO data corruption in batched operations
  serial: max310x: implement I2C support
  serial: max310x: make accessing revision id interface-agnostic
  regmap: Add bulk read/write callbacks into regmap_config
  regmap: allow to define reg_update_bits for no bus configuration
  serial: max310x: Unprepare and disable clock in error path
  getrusage: use sig->stats_lock rather than lock_task_sighand()
  getrusage: use __for_each_thread()
  getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  getrusage: add the "signal_struct *sig" local variable
  y2038: rusage: use __kernel_old_timeval
  hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
  hv_netvsc: use netif_is_bond_master() instead of open code
  hv_netvsc: Make netvsc/VF binding check both MAC and serial number
  Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
  serial: max310x: prevent infinite while() loop in port startup
  serial: max310x: use a separate regmap for each port
  serial: max310x: use regmap methods for SPI batch operations
  serial: max310x: Make use of device properties
  serial: max310x: fail probe if clock crystal is unstable
  serial: max310x: Try to get crystal clock rate from property
  serial: max310x: Use devm_clk_get_optional() to get the input clock
  um: allow not setting extra rpaths in the linux binary
  selftests: mm: fix map_hugetlb failure on 64K page size systems
  netrom: Fix data-races around sysctl_net_busy_read
  netrom: Fix a data-race around sysctl_netrom_link_fails_count
  netrom: Fix a data-race around sysctl_netrom_routing_control
  netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
  netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
  netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
  netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
  netrom: Fix a data-race around sysctl_netrom_default_path_quality
  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  netfilter: nft_ct: fix l3num expectations with inet pseudo family
  net/rds: fix WARNING in rds_conn_connect_if_down
  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  geneve: make sure to pull inner header in geneve_rx()
  ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
  net: lan78xx: fix runtime PM count underflow on link stop
  lan78xx: Fix race conditions in suspend/resume handling
  lan78xx: Fix partial packet errors on suspend/resume
  lan78xx: Add missing return code checks
  lan78xx: Fix white space and style issues
  Linux 5.4.271
  gpio: 74x164: Enable output pins after registers are reset
  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  cachefiles: fix memory leak in cachefiles_add_cache()
  x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
  mmc: core: Fix eMMC initialization with 1-bit bus connection
  dmaengine: fsl-qdma: init irq after reg initialization
  dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
  btrfs: dev-replace: properly validate device names
  wifi: nl80211: reject iftype change with mesh ID change
  gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  afs: Fix endless loop in directory parsing
  ALSA: Drop leftover snd-rtctimer stuff from Makefile
  power: supply: bq27xxx-i2c: Do not free non existing IRQ
  efi/capsule-loader: fix incorrect allocation size
  rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
  Bluetooth: Enforce validation on max value of connection interval
  Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
  Bluetooth: Avoid potential use-after-free in hci_error_reset
  net: usb: dm9601: fix wrong return value in dm9601_mdio_read
  lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  tun: Fix xdp_rxq_info's queue_index when detaching
  net: ip_tunnel: prevent perpetual headroom growth
  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  ANDROID: GKI: update .xml file due to USB changes in 5.4.270
  Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
  Revert "hrtimer: Report offline hrtimer enqueue"
  Revert "drm/mipi-dsi: Fix detach call without attach"
  Linux 5.4.270
  scripts/bpf: Fix xdp_md forward declaration typo
  fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
  drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
  netfilter: nf_tables: set dormant flag on hook register failure
  tls: stop recv() if initial process_rx_list gave us non-DATA
  tls: rx: drop pointless else after goto
  tls: rx: jump to a more appropriate label
  s390: use the correct count for __iowrite64_copy()
  packet: move from strlcpy with unused retval to strscpy
  ipv6: sr: fix possible use-after-free and null-ptr-deref
  afs: Increase buffer size in afs_update_volume_status()
  ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
  ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
  nouveau: fix function cast warnings
  scsi: jazz_esp: Only build if SCSI core is builtin
  bpf, scripts: Correct GPL license name
  scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
  RDMA/srpt: fix function pointer cast warnings
  RDMA/srpt: Make debug output more detailed
  RDMA/bnxt_re: Return error for SRQ resize
  IB/hfi1: Fix a memleak in init_credit_return
  usb: roles: don't get/set_role() when usb_role_switch is unregistered
  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  usb: cdns3: fix memory double free when handle zero packet
  usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
  ARM: ep93xx: Add terminator to gpiod_lookup_table
  l2tp: pass correct message length to ip6_append_data
  PCI/MSI: Prevent MSI hardware interrupt number truncation
  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  dm-crypt: don't modify the data when using authenticated encryption
  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  PCI: tegra: Fix OF node reference leak
  PCI: tegra: Fix reporting GPIO error value
  arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
  drm/amdgpu: Fix type of second parameter in trans_msg() callback
  iomap: Set all uptodate bits for an Uptodate page
  dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  x86/alternatives: Disable KASAN in apply_alternatives()
  drm/amdgpu: Check for valid number of registers to read
  Revert "drm/sun4i: dsi: Change the start delay calculation"
  ALSA: hda/realtek - Enable micmute LED on and HP system
  selftests/bpf: Avoid running unprivileged tests with alignment requirements
  net: bridge: clear bridge's private skb space on xmit
  spi: mt7621: Fix an error message in mt7621_spi_probe()
  pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
  pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
  tcp: add annotations around sk->sk_shutdown accesses
  tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
  tcp: factor out __tcp_close() helper
  pmdomain: renesas: r8a77980-sysc: CR7 must be always on
  s390/qeth: Fix potential loss of L3-IP@ in case of network issues
  virtio-blk: Ensure no requests in virtqueues before deleting vqs.
  firewire: core: send bus reset promptly on gap count error
  scsi: lpfc: Use unsigned type for num_sge
  hwmon: (coretemp) Enlarge per package core count limit
  nvmet-fc: abort command when there is no binding
  netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
  ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
  nvmet-tcp: fix nvme tcp ida memory leak
  regulator: pwm-regulator: Add validity checks in continuous .get_voltage
  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  ahci: asm1166: correct count of reported ports
  fbdev: sis: Error out if pixclock equals zero
  fbdev: savage: Error out if pixclock equals zero
  wifi: mac80211: fix race condition on enabling fast-xmit
  wifi: cfg80211: fix missing interfaces when dumping
  dmaengine: fsl-qdma: increase size of 'irq_name'
  dmaengine: shdma: increase size of 'dev_id'
  scsi: target: core: Add TMF to tmr_list handling
  sched/rt: Disallow writing invalid values to sched_rt_period_us
  sched/rt: Fix sysctl_sched_rr_timeslice intial value
  userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
  nilfs2: replace WARN_ONs for invalid DAT metadata block requests
  memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
  sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  net/sched: Retire dsmark qdisc
  net/sched: Retire ATM qdisc
  net/sched: Retire CBQ qdisc
  KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
  KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
  Linux 5.4.269
  of: gpio unittest kfree() wrong object
  of: unittest: fix EXPECT text for gpio hog errors
  net: bcmgenet: Fix EEE implementation
  Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  lsm: new security_file_ioctl_compat() hook
  drm/msm/dsi: Enable runtime PM
  PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
  PM: runtime: add devm_pm_runtime_enable helper
  nilfs2: fix potential bug in end_buffer_async_write
  sched/membarrier: reduce the ability to hammer on sys_membarrier
  net: prevent mss overflow in skb_segment()
  netfilter: ipset: Missing gc cancellations fixed
  netfilter: ipset: fix performance regression in swap operation
  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  mips: Fix max_mapnr being uninitialized on early stages
  arch, mm: remove stale mentions of DISCONIGMEM
  bus: moxtet: Add spi device table
  Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
  tracing: Inform kmemleak of saved_cmdlines allocation
  pmdomain: core: Move the unused cleanup to a _sync initcall
  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  irqchip/irq-brcmstb-l2: Add write memory barrier before exit
  nfp: flower: prevent re-adding mac index for bonded port
  nfp: use correct macro for LengthSelect in BAR config
  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  nilfs2: fix data corruption in dsync block recovery for small block sizes
  ALSA: hda/conexant: Add quirk for SWS JS201D
  mmc: slot-gpio: Allow non-sleeping GPIO ro
  x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
  x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
  serial: max310x: improve crystal stable clock detection
  serial: max310x: set default value when reading clock ready bit
  ring-buffer: Clean ring_buffer_poll_wait() error return
  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  staging: iio: ad5933: fix type mismatch regression
  tracing: Fix wasted memory in saved_cmdlines logic
  ext4: fix double-free of blocks due to wrong extents moved_len
  misc: fastrpc: Mark all sessions as invalid in cb_remove
  binder: signal epoll threads of self-work
  ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
  xen-netback: properly sync TX responses
  nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  kbuild: Fix changing ELF file type for output of gen_btf for big endian
  firewire: core: correct documentation of fw_csr_string() kernel API
  scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
  i2c: i801: Fix block process call transactions
  i2c: i801: Remove i801_set_block_buffer_mode
  usb: f_mass_storage: forbid async queue when shutdown happen
  USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
  HID: wacom: Do not register input devices until after hid_hw_start
  HID: wacom: generic: Avoid reporting a serial of '0' to userspace
  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  tracing/trigger: Fix to return error if failed to alloc snapshot
  i40e: Fix waiting for queues of all VSIs to be disabled
  MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
  ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
  spi: ppc4xx: Drop write-only variable
  of: unittest: Fix compile in the non-dynamic case
  of: unittest: add overlay gpio test to catch gpio hog problem
  btrfs: send: return EOPNOTSUPP on unknown flags
  btrfs: forbid deleting live subvol qgroup
  btrfs: forbid creating subvol qgroups
  netfilter: nft_set_rbtree: skip end interval element from gc
  net: stmmac: xgmac: fix a typo of register name in DPP safety handling
  net: stmmac: xgmac: use #define for string constants
  vhost: use kzalloc() instead of kmalloc() followed by memset()
  Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
  hrtimer: Report offline hrtimer enqueue
  USB: serial: cp210x: add ID for IMST iM871A-USB
  USB: serial: option: add Fibocom FM101-GL variant
  USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
  net/af_iucv: clean up a try_then_request_module()
  netfilter: nft_ct: reject direction for ct id
  netfilter: nft_compat: restrict match/target protocol to u16
  netfilter: nft_compat: reject unused compat flag
  ppp_async: limit MRU to 64K
  tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  rxrpc: Fix response to PING RESPONSE ACKs to a dead call
  inet: read sk->sk_family once in inet_recv_error()
  hwmon: (coretemp) Fix bogus core_id to attr name mapping
  hwmon: (coretemp) Fix out-of-bounds memory access
  hwmon: (aspeed-pwm-tacho) mutex for tach reading
  atm: idt77252: fix a memleak in open_card_ubr0
  selftests: net: avoid just another constant wait
  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
  phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
  bonding: remove print in bond_verify_device_path
  HID: apple: Add 2021 magic keyboard FN key mapping
  HID: apple: Swap the Fn and Left Control keys on Apple keyboards
  HID: apple: Add support for the 2021 Magic Keyboard
  net: sysfs: Fix /sys/class/net/<iface> path
  af_unix: fix lockdep positive in sk_diag_dump_icons()
  net: ipv4: fix a memleak in ip_setup_cork
  netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
  netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
  llc: call sock_orphan() at release time
  ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
  ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
  ixgbe: Refactor overtemp event handling
  ixgbe: Refactor returning internal error codes
  ixgbe: Remove non-inclusive language
  net: remove unneeded break
  scsi: isci: Fix an error code problem in isci_io_request_build()
  wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
  perf: Fix the nr_addr_filters fix
  drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
  ceph: fix deadlock or deadcode of misusing dget()
  blk-mq: fix IO hang from sbitmap wakeup race
  virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
  libsubcmd: Fix memory leak in uniq()
  PCI/AER: Decode Requester ID when no error info found
  fs/kernfs/dir: obey S_ISGID
  usb: hub: Replace hardcoded quirk value with BIT() macro
  PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  PCI: Only override AMD USB controller if required
  mfd: ti_am335x_tscadc: Fix TI SoC dependencies
  i3c: master: cdns: Update maximum prescaler value for i2c clock
  um: net: Fix return type of uml_net_start_xmit()
  um: Don't use vfprintf() for os_info()
  um: Fix naming clash between UML and scheduler
  leds: trigger: panic: Don't register panic notifier if creating the trigger failed
  drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
  drm/amdgpu: Let KFD sync with VM fences
  clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
  clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
  drm/msm/dpu: Ratelimit framedone timeout msgs
  media: ddbridge: fix an error code problem in ddb_probe
  IB/ipoib: Fix mcast list locking
  drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
  ALSA: hda: Intel: add HDA_ARL PCI ID support
  PCI: add INTEL_HDA_ARL to pci_ids.h
  media: rockchip: rga: fix swizzling for RGB formats
  media: stk1160: Fixed high volume of stk1160_dbg messages
  drm/mipi-dsi: Fix detach call without attach
  drm/framebuffer: Fix use of uninitialized variable
  drm/drm_file: fix use of uninitialized variable
  RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  fast_dput(): handle underflows gracefully
  ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
  f2fs: fix to check return value of f2fs_reserve_new_block()
  wifi: cfg80211: free beacon_ies when overridden from hidden BSS
  wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
  wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
  arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
  arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
  md: Whenassemble the array, consult the superblock of the freshest device
  block: prevent an integer overflow in bvec_try_merge_hw_page
  ARM: dts: imx23/28: Fix the DMA controller node name
  ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
  ARM: dts: imx27-apf27dev: Fix LED name
  ARM: dts: imx25/27: Pass timing0
  ARM: dts: imx1: Fix sram node
  ARM: dts: imx27: Fix sram node
  ARM: dts: imx: Use flash@0,0 pattern
  ARM: dts: imx25/27-eukrea: Fix RTC node name
  ARM: dts: rockchip: fix rk3036 hdmi ports node
  scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
  scsi: libfc: Don't schedule abort twice
  bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  ARM: dts: imx7s: Fix nand-controller #size-cells
  ARM: dts: imx7s: Fix lcdif compatible
  ARM: dts: imx7d: Fix coresight funnel ports
  bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
  PCI: Add no PM reset quirk for NVIDIA Spectrum devices
  scsi: lpfc: Fix possible file string name overflow when updating firmware
  selftests/bpf: Fix pyperf180 compilation failure with clang18
  selftests/bpf: satisfy compiler by having explicit return in btf test
  wifi: rt2x00: restart beacon queue when hardware reset
  ext4: avoid online resizing failures due to oversized flex bg
  ext4: remove unnecessary check from alloc_flex_gd()
  ext4: unify the type of flexbg_size to unsigned int
  ext4: fix inconsistent between segment fstrim and full fstrim
  ecryptfs: Reject casefold directory inodes
  SUNRPC: Fix a suspicious RCU usage warning
  KVM: s390: fix setting of fpc register
  s390/ptrace: handle setting of fpc register correctly
  jfs: fix array-index-out-of-bounds in diNewExt
  rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
  afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
  crypto: stm32/crc32 - fix parsing list of devices
  pstore/ram: Fix crash when setting number of cpus to an odd number
  jfs: fix uaf in jfs_evict_inode
  jfs: fix array-index-out-of-bounds in dbAdjTree
  jfs: fix slab-out-of-bounds Read in dtSearch
  UBSAN: array-index-out-of-bounds in dtSplitRoot
  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  ACPI: extlog: fix NULL pointer dereference check
  PNP: ACPI: fix fortify warning
  ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
  audit: Send netlink ACK before setting connection in auditd_set
  regulator: core: Only increment use_count when enable_count changes
  perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
  x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
  powerpc/lib: Validate size for vector operations
  powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
  powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
  powerpc: Fix build error due to is_valid_bugaddr()
  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  x86/entry/ia32: Ensure s32 is sign extended to s64
  tick/sched: Preserve number of idle sleeps across CPU hotplug events
  mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
  spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
  gpio: eic-sprd: Clear interrupt after set the interrupt type
  drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
  drm/exynos: fix accidental on-stack copy of exynos_drm_plane
  drm/bridge: nxp-ptn3460: simplify some error checking
  drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
  drm: Don't unref the same fb many times by mistake due to deadlock handling
  gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  rbd: don't move requests to the running list on errors
  btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
  btrfs: don't warn if discard range is not aligned to sector
  btrfs: tree-checker: fix inline ref size in error messages
  btrfs: ref-verify: free ref cache before clearing mount opt
  net: fec: fix the unhandled context fault from smmu
  fjes: fix memleaks in fjes_hw_setup
  netfilter: nf_tables: validate NFPROTO_* family
  netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
  net/mlx5e: fix a double-free in arfs_create_groups
  net/mlx5: Use kfree(ft->g) in arfs_create_groups()
  net/mlx5: DR, Use the right GVMI number for drop action
  netlink: fix potential sleeping issue in mqueue_flush_file
  tcp: Add memory barrier to tcp_push()
  afs: Hide silly-rename files from userspace
  tracing: Ensure visibility when inserting an element into tracing_map
  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  llc: Drop support for ETH_P_TR_802_2.
  llc: make llc_ui_sendmsg() more robust against bonding changes
  vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
  powerpc: Use always instead of always-y in for crtsavres.o
  fs: move S_ISGID stripping into the vfs_*() helpers
  fs: add mode_strip_sgid() helper
  mtd: spinand: macronix: Fix MX35LFxGE4AD page size
  block: Remove special-casing of compound pages
  rename(): fix the locking of subdirectories
  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  nouveau/vmm: don't set addr on the fail path to avoid warning
  mmc: core: Use mrq.sbc in close-ended ffu
  arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
  parisc/firmware: Fix F-extend for PDC addresses
  rpmsg: virtio: Free driver_override when rpmsg_remove()
  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  PM: hibernate: Enforce ordering during image compression/decompression
  crypto: api - Disallow identical driver names
  ext4: allow for the last group to be marked as trimmed
  serial: sc16is7xx: add check for unsupported SPI modes during probe
  spi: introduce SPI_MODE_X_MASK macro
  serial: sc16is7xx: set safe default SPI clock frequency
  units: add the HZ macros
  units: change from 'L' to 'UL'
  units: Add Watt units
  include/linux/units.h: add helpers for kelvin to/from Celsius conversion
  PCI: mediatek: Clear interrupt status before dispatching handler

 Conflicts:
	include/linux/timer.h
	mm/memory-failure.c

Change-Id: I4974903c79ecddc3d9225b0b723a30b6c83ef572
 2024-06-22 17:58:09 +03:00
Greg Kroah-Hartman
eb1a0358d1 This is the 5.4.278 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmZuzHwACgkQONu9yGCS
 aT6M7xAAuCGja5JhZ7ciWjhdxIFxACHrSVm3l/i+bqNAXoDh2rJDKgOize1OTLGR
 R1Fq2qBEtfMsoKNa+3DyMCB8D1IsMUrhr8hdM56+AqDBbmaTsDmw+L6vzepwJKVV
 ksX2onT5tXdydH95IjqnM7vbadxnU9cLkHZIpckXkb2dDA2kjhMksWSfA+GJfRsY
 XReqFYfeQhLWv4c0OWZ//ssSmGWztSVaRCX22jemUJ5MYpQHt3TYQXVpFYkaQLYH
 FZHDxBFEr48Gt9bQtnBZ2fyurKX9NdzZF+WwNDuo0DShlEpJB99vYHQ/dIxzxl9R
 7VOs3Cj7vvUBSIRPY9DhuhBm7tQrpCvf4w3qUBc0TD+IdPPIIf0ZqDsVUvZGM9JE
 T54rnXppxNKlbW8HmYqefc2FBgjrZn08NprrAVqIVhNwFyq+8/ADqdSTTKlD9z1i
 S/3Pur7ES2e15YsrjOrDJIpGl3klMrEBbz9XyEHwrTY2vrDjdqOF0NHYUaugnjSd
 B+qmUtZxwSjzRok5wgQaf/EbrW78e9q1lTj97QRJfBr0A7MUpDMuQCvmsMoe2HUA
 vANx7ty/ubNk/9PLTGyBHUw4/F58Bk5osibAKRmulvlO5g80FsJXEU9WWqQmIkzp
 3df+cOL8ipqh0fg/PaUOBCoeVs2HqPHnewOlYRegN41FokQndsE=
 =XU0g
 -----END PGP SIGNATURE-----

Merge 5.4.278 into android11-5.4-lts

Changes in 5.4.278
	x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
	tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
	speakup: Fix sizeof() vs ARRAY_SIZE() bug
	ring-buffer: Fix a race between readers and resize checks
	net: smc91x: Fix m68k kernel compilation for ColdFire CPU
	nilfs2: fix unexpected freezing of nilfs_segctor_sync()
	nilfs2: fix potential hang in nilfs_detach_log_writer()
	wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
	net: usb: qmi_wwan: add Telit FN920C04 compositions
	drm/amd/display: Set color_mgmt_changed to true on unsuspend
	ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
	ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
	ASoC: da7219-aad: fix usage of device_get_named_child_node()
	drm/amdkfd: Flush the process wq before creating a kfd_process
	nvme: find numa distance only if controller has valid numa id
	openpromfs: finish conversion to the new mount API
	crypto: bcm - Fix pointer arithmetic
	firmware: raspberrypi: Use correct device for DMA mappings
	ecryptfs: Fix buffer size for tag 66 packet
	nilfs2: fix out-of-range warning
	parisc: add missing export of __cmpxchg_u8()
	crypto: ccp - drop platform ifdef checks
	s390/cio: fix tracepoint subchannel type field
	jffs2: prevent xattr node from overflowing the eraseblock
	null_blk: Fix missing mutex_destroy() at module removal
	md: fix resync softlockup when bitmap size is less than array size
	wifi: ath10k: poll service ready message before failing
	x86/boot: Ignore relocations in .notes sections in walk_relocs() too
	qed: avoid truncating work queue length
	scsi: ufs: qcom: Perform read back after writing reset bit
	scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
	scsi: ufs: core: Perform read back after disabling interrupts
	scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
	irqchip/alpine-msi: Fix off-by-one in allocation error path
	ACPI: disable -Wstringop-truncation
	cpufreq: Reorganize checks in cpufreq_offline()
	cpufreq: Split cpufreq_offline()
	cpufreq: Rearrange locking in cpufreq_remove_dev()
	cpufreq: exit() callback is optional
	scsi: libsas: Fix the failure of adding phy with zero-address to port
	scsi: hpsa: Fix allocation size for Scsi_Host private data
	x86/purgatory: Switch to the position-independent small code model
	wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
	wifi: ath10k: populate board data for WCN3990
	tcp: minor optimization in tcp_add_backlog()
	tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
	tcp: avoid premature drops in tcp_add_backlog()
	macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
	wifi: carl9170: add a proper sanity check for endpoints
	wifi: ar5523: enable proper endpoint verification
	sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
	Revert "sh: Handle calling csum_partial with misaligned data"
	HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
	scsi: bfa: Ensure the copied buf is NUL terminated
	scsi: qedf: Ensure the copied buf is NUL terminated
	wifi: mwl8k: initialize cmd->addr[] properly
	usb: aqc111: stop lying about skb->truesize
	net: usb: sr9700: stop lying about skb->truesize
	m68k: Fix spinlock race in kernel thread creation
	m68k: mac: Fix reboot hang on Mac IIci
	net: ethernet: cortina: Locking fixes
	af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
	net: usb: smsc95xx: stop lying about skb->truesize
	net: openvswitch: fix overwriting ct original tuple for ICMPv6
	ipv6: sr: add missing seg6_local_exit
	ipv6: sr: fix incorrect unregister order
	ipv6: sr: fix invalid unregister error path
	drm/amd/display: Fix potential index out of bounds in color transformation function
	mtd: rawnand: hynix: fixed typo
	fbdev: shmobile: fix snprintf truncation
	drm/mediatek: Add 0 size check to mtk_drm_gem_obj
	powerpc/fsl-soc: hide unused const variable
	fbdev: sisfb: hide unused variables
	media: ngene: Add dvb_ca_en50221_init return value check
	media: radio-shark2: Avoid led_names truncations
	platform/x86: wmi: Make two functions static
	fbdev: sh7760fb: allow modular build
	drm/arm/malidp: fix a possible null pointer dereference
	ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
	drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
	RDMA/hns: Use complete parentheses in macros
	x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
	ext4: avoid excessive credit estimate in ext4_tmpfile()
	sunrpc: removed redundant procp check
	SUNRPC: Fix gss_free_in_token_pages()
	selftests/kcmp: Make the test output consistent and clear
	selftests/kcmp: remove unused open mode
	RDMA/IPoIB: Fix format truncation compilation errors
	netrom: fix possible dead-lock in nr_rt_ioctl()
	af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
	sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax
	sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
	greybus: lights: check return of get_channel_from_mode
	soundwire: cadence/intel: simplify PDI/port mapping
	soundwire: intel: don't filter out PDI0/1
	soundwire: cadence_master: improve PDI allocation
	soundwire: cadence: fix invalid PDI offset
	dmaengine: idma64: Add check for dma_set_max_seg_size
	firmware: dmi-id: add a release callback function
	serial: max3100: Lock port->lock when calling uart_handle_cts_change()
	serial: max3100: Update uart_driver_registered on driver removal
	serial: max3100: Fix bitwise types
	greybus: arche-ctrl: move device table to its right location
	iio: pressure: dps310: support negative temperature values
	microblaze: Remove gcc flag for non existing early_printk.c file
	microblaze: Remove early printk call from cpuinfo-static.c
	usb: gadget: u_audio: Clear uac pointer when freed.
	stm class: Fix a double free in stm_register_device()
	ppdev: Remove usage of the deprecated ida_simple_xx() API
	ppdev: Add an error check in register_device
	extcon: max8997: select IRQ_DOMAIN instead of depending on it
	f2fs: fix to release node block count in error path of f2fs_new_node_page()
	serial: sh-sci: protect invalidating RXDMA on shutdown
	libsubcmd: Fix parse-options memory leak
	Input: ims-pcu - fix printf string overflow
	Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
	drm/msm/dpu: Always flush the slave INTF on the CTL
	um: Fix return value in ubd_init()
	um: Add winch to winch_handlers before registering winch IRQ
	media: stk1160: fix bounds checking in stk1160_copy_video()
	scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
	powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
	um: Fix the -Wmissing-prototypes warning for __switch_mm
	media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
	media: cec: cec-api: add locking in cec_release()
	null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
	x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
	nfc: nci: Fix uninit-value in nci_rx_work
	sunrpc: fix NFSACL RPC retry on soft mount
	ipv6: sr: fix memleak in seg6_hmac_init_algo
	params: lift param_set_uint_minmax to common code
	tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
	openvswitch: Set the skbuff pkt_type for proper pmtud support.
	arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
	virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
	net: fec: avoid lock evasion when reading pps_enable
	nfc: nci: Fix kcov check in nci_rx_work()
	nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
	netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
	spi: Don't mark message DMA mapped when no transfer in it is
	nvmet: fix ns enable/disable possible hang
	net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
	dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
	enic: Validate length of nl attributes in enic_set_vf_port
	smsc95xx: remove redundant function arguments
	smsc95xx: use usbnet->driver_priv
	net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
	net:fec: Add fec_enet_deinit()
	netfilter: tproxy: bail out if IP has been disabled on the device
	kconfig: fix comparison to constant symbols, 'm', 'n'
	spi: stm32: Don't warn about spurious interrupts
	ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
	ALSA: timer: Set lower bound of start tick time
	genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
	SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
	binder: fix max_thread type inconsistency
	mmc: core: Do not force a retune before RPMB switch
	io_uring: fail NOP if non-zero op flags is passed in
	afs: Don't cross .backup mountpoint from backup volume
	nilfs2: fix use-after-free of timer for log writer thread
	vxlan: Fix regression when dropping packets due to invalid src addresses
	x86/mm: Remove broken vsyscall emulation code from the page fault code
	f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
	media: lgdt3306a: Add a check against null-pointer-def
	drm/amdgpu: add error handle to avoid out-of-bounds
	ata: pata_legacy: make legacy_exit() work again
	ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
	arm64: tegra: Correct Tegra132 I2C alias
	md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
	wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
	arm64: dts: hi3798cv200: fix the size of GICR
	media: mc: mark the media devnode as registered from the, start
	media: mxl5xx: Move xpt structures off stack
	media: v4l2-core: hold videodev_lock until dev reg, finishes
	fbdev: savage: Handle err return when savagefb_check_var failed
	KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
	crypto: ecrdsa - Fix module auto-load on add_key
	crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
	net/ipv6: Fix route deleting failure when metric equals 0
	net/9p: fix uninit-value in p9_client_rpc()
	intel_th: pci: Add Meteor Lake-S CPU support
	sparc64: Fix number of online CPUs
	kdb: Fix buffer overflow during tab-complete
	kdb: Use format-strings rather than '\0' injection in kdb_read()
	kdb: Fix console handling when editing and tab-completing commands
	kdb: Merge identical case statements in kdb_read()
	kdb: Use format-specifiers rather than memset() for padding in kdb_read()
	net: fix __dst_negative_advice() race
	xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
	sparc: move struct termio to asm/termios.h
	ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
	s390/ap: Fix crash in AP internal function modify_bitmap()
	nfs: fix undefined behavior in nfs_block_bits()
	Linux 5.4.278

Change-Id: I0cdcfac77f01b25b5790752b68d92f1eafaa9ddd
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-06-18 14:18:49 +00:00
Carlos Llamas
e4daa1a1ff binder: fix max_thread type inconsistency 
commit 42316941335644a98335f209daafa4c122f28983 upstream.

The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from
size_t to __u32 in order to avoid incompatibility issues between 32 and
64-bit kernels. However, the internal types used to copy from user and
store the value were never updated. Use u32 to fix the inconsistency.

Fixes: a9350fc859 ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration")
Reported-by: Arve Hjønnevåg <arve@android.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com
[cmllamas: resolve minor conflicts due to missing commit 421518a2740f]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-06-16 13:28:48 +02:00
Greg Kroah-Hartman
85547bc085 Merge tag 'android11-5.4.274_r00' into branch 'android11-5.4' 
This is the merge of the upstream 5.4.274 relelease into the
android11-5.4 branch.  Included in here are the following commits:

* 181edea14a Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
*   46cf330263 Merge 5.4.274 into android11-5.4-lts
|\
| * 0dbd436fb9 Linux 5.4.274
| * fba9c24c19 firmware: meson_sm: fix to avoid potential NULL pointer dereference
| * 35a5acfa7a ip_gre: do not report erspan version on GRE interface
| * 61206032d6 erspan: Check IFLA_GRE_ERSPAN_VER is set.
| * 7f12ecf453 VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
| * d006b709db Bluetooth: btintel: Fixe build regression
| * 0bf9fd89ba x86/alternative: Don't call text_poke() in lazy TLB mode
| * 67944e6db6 drm/i915/gt: Reset queue_priority_hint on parking
| * 09e6bb5321 x86/mm/pat: fix VM_PAT handling in COW mappings
| * 6e5da7d65b virtio: reenable config if freezing device failed
| * e7bda8f58b drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
| * 7a529c9023 tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
| * 9a3b90904d netfilter: nf_tables: discard table flag update with pending basechain deletion
| * 61ac728434 netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
| * 0a14e16239 netfilter: nf_tables: release batch on table validation from abort path
| * 41bad13c0e netfilter: nf_tables: reject new basechain after table flag update
| * 72d091b751 fbmon: prevent division by zero in fb_videomode_from_videomode()
| * 77f34b9af3 fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
| * 0eab73ffb6 usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
| * 261a831427 usb: typec: tcpci: add generic tcpci fallback compatible
| * fcc68c952c tools: iio: replace seekdir() in iio_generic_buffer
| * 97832659b1 ktest: force $buildonly = 1 for 'make_warnings_file' test type
| * 71de605098 Input: allocate keycode for Display refresh rate toggle
| * edd073c78d block: prevent division by zero in blk_rq_stat_sum()
| * 73daab5b8c Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
| * 4256e1460e SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
| * 08a07d5a20 drm/amd/display: Fix nanosec stat overflow
| * 4a35b778d0 media: sta2x11: fix irq handler cast
| * 2c1f840469 isofs: handle CDs with bad root inode but good Joliet root directory
| * e2cd32435b scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
| * 1b4fe801b5 sysv: don't call sb_bread() with pointers_lock held
| * e04cae532a Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
| * 68a69bb2ec Bluetooth: btintel: Fix null ptr deref in btintel_read_version
| * 024529c27c btrfs: send: handle path ref underflow in header iterate_inode_ref()
| * a9252c8cfa btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
| * 576164bd01 btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
| * 41aff62bf1 tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
| * 97ad3fc426 ionic: set adminq irq affinity
| * 67611c11d7 arm64: dts: rockchip: fix rk3399 hdmi ports node
| * 223145f838 arm64: dts: rockchip: fix rk3328 hdmi ports node
| * 60d417f3e4 panic: Flush kernel log buffer at the end
| * f15eca9513 VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
| * dec0f1b008 wifi: ath9k: fix LNA selection in ath_ant_try_scan()
| * 485b5d1d6a s390/entry: align system call table on 8 bytes
| * 976b1b2680 x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
| * 039458c058 ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
| * fc4387dce4 ata: sata_mv: Fix PCI device ID table declaration compilation warning
| * 0e9207b054 scsi: mylex: Fix sysfs buffer lengths
| * d887674f09 ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
| * 517884404e ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
| * 9c11271714 net: ravb: Always process TX descriptor ring
| * e54a0c79cd erspan: make sure erspan_base_hdr is present in skb->head
| * 959fe471f1 erspan: Add type I version 0 support.
| * 19d7e7c1ee init: open /initrd.image with O_LARGEFILE
| * 32e34d96b3 initramfs: switch initramfs unpacking to struct file based APIs
| * 13b2d81505 fs: add a vfs_fchmod helper
| * 8eba8d1145 fs: add a vfs_fchown helper
| * 9550632ba9 staging: vc04_services: fix information leak in create_component()
| * bbd974d444 staging: vc04_services: changen strncpy() to strscpy_pad()
| * d07aab3ca7 staging: mmal-vchiq: Fix client_component for 64 bit kernel
| * 50bc5a96f8 staging: mmal-vchiq: Allocate and free components as required
| * 9dcf0fcb80 i40e: fix vf may be used uninitialized in this function warning
| * 9c52581961 ipv6: Fix infinite recursion in fib6_dump_done().
| * 73fac254ec selftests: reuseaddr_conflict: add missing new line at the end of the output
| * 2882bb3b91 net: stmmac: fix rx queue priority assignment
| * f356eb2fb5 net/sched: act_skbmod: prevent kernel-infoleak
| * f7990498b0 bpf, sockmap: Prevent lock inversion deadlock in map delete elem
| * a347bc8e62 netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
| * f4e14695fe netfilter: nf_tables: flush pending destroy work before exit_net release
| * ab81b3d2f3 mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
| * 144c56d5dd Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
| * 07afdfd8a6 vfio/platform: Create persistent IRQ handlers
| * b18fa894d6 vfio/pci: Create persistent INTx handler
| * 3777fa4c8f vfio: Introduce interface to flush virqfd inject workqueue
| * 1e71b6449d vfio/pci: Lock external INTx masking ops
| * 26389925d6 vfio/pci: Disable auto-enable of exclusive INTx IRQ
| * bcd46782e2 net/rds: fix possible cp null dereference
| * 49ce99ae43 netfilter: nf_tables: disallow timeout for anonymous sets
| * f5450973eb Bluetooth: Fix TOCTOU in HCI debugfs implementation
| * 5c8b927293 Bluetooth: hci_event: set the conn encrypted before conn establishes
| * 9d161e8af4 x86/cpufeatures: Add new word for scattered features
| * ff7a4adbd7 r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
| * e78f604693 dm integrity: fix out-of-range warning
| * 44e62f5d35 tcp: properly terminate timers for kernel sockets
| * a4bb81d890 ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
| * 03fe259649 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
| * 12d6a5681a USB: core: Fix deadlock in usb_deauthorize_interface()
| * ea9a4fce2e scsi: lpfc: Correct size for wqe for memset()
| * fa24c1a49d x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
| * d7a68eee87 scsi: qla2xxx: Fix command flush on cable pull
| * 68d951880d usb: udc: remove warning when queue disabled ep
| * a79ac9f3da usb: dwc2: gadget: LPM flow fix
| * 693bbbccd9 usb: dwc2: host: Fix ISOC flow in DDMA mode
| * eb97df08c3 usb: dwc2: host: Fix hibernation flow
| * 4cf44c9fa0 usb: dwc2: host: Fix remote wakeup from hibernation
| * 0053f15d50 scsi: core: Fix unremoved procfs host directory regression
| * 4206ad65a0 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
| * 3afdcc4e1a usb: cdc-wdm: close race between read and workqueue
| * b9a7339ae4 mmc: core: Avoid negative index with array access
| * fd20d84bae mmc: core: Initialize mmc_blk_ioc_data
| * c7a9b1b777 exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
| * be1dd9254f wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
| * 747d4ee747 mm/migrate: set swap entry values of THP tail pages properly.
| * 7f75e937ec mm/memory-failure: fix an incorrect use of tail pages
| * 815be99d93 vt: fix memory overlapping when deleting chars in the buffer
| * d6077e0d38 bounds: support non-power-of-two CONFIG_NR_CPUS
| * 282e4deafe powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
| * 34b5d2ff9e efivarfs: Request at most 512 bytes for variable names
| * 37a65df6a9 perf/core: Fix reentry problem in perf_output_read_group()
| * 861021710b loop: loop_set_status_from_info() check before assignment
| * b40877b856 loop: Check for overflow while configuring loop
| * f4476da8ea loop: Factor out configuring loop from status
| * 7423a124fa loop: Refactor loop_set_status() size calculation
| * 3c9e7e8cb6 loop: Factor out setting loop device size
| * e08b2e4176 loop: Remove sector_t truncation checks
| * ea3bec644a loop: Call loop_config_discard() only after new config is applied
| * 2ea7077748 Revert "loop: Check for overflow while configuring loop"
| * 735e525d8c btrfs: allocate btrfs_ioctl_defrag_range_args on stack
| * 501561d808 printk: Update @console_may_schedule in console_trylock_spinning()
| * 9470f5b250 xen/events: close evtchn after mapping cleanup
| * 03b19c7fa1 x86/speculation: Support intra-function call validation
| * f8f25fde0c objtool: Add support for intra-function calls
| * eafb29361a objtool: is_fentry_call() crashes if call has no destination
| * 396dbbc189 fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
| * ff7342090c vt: fix unicode buffer corruption when deleting characters
| * 741dee500f tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
| * d79cd5c29a usb: port: Don't try to peer unused USB ports based on location
| * a766761d20 usb: gadget: ncm: Fix handling of zero block length packets
| * eb7b01ca77 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
| * 9e93b41109 ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
| * 57ae281a67 xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
| * 0920c618d2 netfilter: nf_tables: reject constant set with timeout
| * e9a0d3f376 netfilter: nf_tables: disallow anonymous set with timeout flag
| * edcf1a3f18 netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
| * 1ba8fdef88 comedi: comedi_test: Prevent timers rescheduling during deletion
| * e7d4cff57c dm snapshot: fix lockup in dm_exception_table_exit
| * 35ff8175d9 ahci: asm1064: asm1166: don't limit reported ports
| * 86e248c2d6 ahci: asm1064: correct count of reported ports
| * 89c4357725 x86/CPU/AMD: Update the Zenbleed microcode revisions
| * 32eaee72e9 nilfs2: prevent kernel bug at submit_bh_wbc()
| * 6503d76d91 nilfs2: use a more common logging style
| * 9cbe1ad5f4 nilfs2: fix failure to detect DAT corruption in btree and direct mappings
| * f2cee08a69 memtest: use {READ,WRITE}_ONCE in memory scanning
| * 673fb93c92 drm/vc4: hdmi: do not return negative values from .get_modes()
| * 7ecbec89e4 drm/imx/ipuv3: do not return negative values from .get_modes()
| * 348aa3d47e drm/exynos: do not return negative values from .get_modes()
| * 9daddee03d s390/zcrypt: fix reference counting on zcrypt card objects
| * ff50716b7d soc: fsl: qbman: Use raw spinlock for cgr_lock
| * f248ecc186 soc: fsl: qbman: Add CGR update function
| * 6e9629518c soc: fsl: qbman: Add helper for sanity checking cgr ops
| * 62c3ecd283 soc: fsl: qbman: Always disable interrupts when taking cgr_lock
| * 3f91ba9653 ring-buffer: Fix full_waiters_pending in poll
| * f7578a3b7c ring-buffer: Fix resetting of shortest_full
| * b0beb669a8 vfio/platform: Disable virqfds on cleanup
| * b046ab1642 kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
| * 31722ed2c3 speakup: Fix 8bit characters from direct synth
| * b2b93a38d6 slimbus: core: Remove usage of the deprecated ida_simple_xx() API
| * aec74a14d1 nvmem: meson-efuse: fix function pointer type mismatch
| * 525ae72d9f firmware: meson_sm: Rework driver as a proper platform driver
| * ee4e9c1976 ext4: fix corruption during on-line resize
| * 1a560f1969 hwmon: (amc6821) add of_match table
| * d7bc1877c1 mmc: core: Fix switch on gp3 partition
| * 24019e5ac6 dm-raid: fix lockdep waring in "pers->hot_add_disk"
| * 0b949dc225 Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
| * 47d8aafcfe PCI/PM: Drain runtime-idle callbacks before driver removal
| * ec6f7c0807 PCI: Drop pci_device_remove() test of pci_dev->driver
| * 287a9a9b6e btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
| * ab95a42020 fuse: don't unhash root
| * c180d65df8 mmc: tmio: avoid concurrent runs of mmc_request_done()
| * 2e94147e20 PM: sleep: wakeirq: fix wake irq warning in system suspend
| * bd140aef69 USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
| * b11cd74c31 USB: serial: option: add MeiG Smart SLM320 product
| * f5167c50af USB: serial: cp210x: add ID for MGP Instruments PDS100
| * 4fda3ad19d USB: serial: add device ID for VeriFone adapter
| * 3f01bf964e USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
| * 4fc30a31e1 powerpc/fsl: Fix mfpmr build errors with newer binutils
| * 86bf75d915 clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
| * b2dfb216f3 clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
| * 83fe1bbd9e clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
| * ddcd5ea7b2 PM: suspend: Set mem_sleep_current during kernel command line setup
| * 42dcb0a374 parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
| * 10e031fbe5 parisc: Fix csum_ipv6_magic on 64-bit systems
| * 4dc4793c9d parisc: Fix csum_ipv6_magic on 32-bit systems
| * 89cb6c7169 parisc: Fix ip_fast_csum
| * 331b43d79a parisc: Do not hardcode registers in checksum functions
| * 64a1ccfa9a mtd: rawnand: meson: fix scrambling mode value in command macro
| * a1d549aec8 ubi: correct the calculation of fastmap size
| * 4e09d5210b ubi: Check for too small LEB size in VTBL code
| * 778c6ad402 ubifs: Set page uptodate in the correct place
| * f52d7663a1 fat: fix uninitialized field in nostale filehandles
| * b224a3b8d3 ext4: correct best extent lstart adjustment logic
| * e8b25c7bae selftests/mqueue: Set timeout to 180 seconds
| * 8e81cd58ae crypto: qat - resolve race condition during AER recovery
| * 5a9f7e9123 crypto: qat - fix double free during reset
| * fca0c42c34 sparc: vDSO: fix return value of __setup handler
| * 75159bcec2 sparc64: NMI watchdog: fix return value of __setup handler
| * 82e25cc1c2 KVM: Always flush async #PF workqueue when vCPU is being destroyed
| * ce6e52cade media: xc4000: Fix atomicity violation in xc4000_get_frequency
| * 7d271b798a serial: max310x: fix NULL pointer dereference in I2C instantiation
| * d453dd485e arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
| * 36f6b76341 ARM: dts: mmp2-brownstone: Don't redeclare phandle references
| * 60f9cecf6a smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
| * cec55e30e3 smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
| * 9a353d80ba clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
| * a7923ecece media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
| * 8e3f03f4ef wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
| * df4209170b timers: Rename del_timer_sync() to timer_delete_sync()
| * ef5f71db1e timers: Use del_timer_sync() even on UP
| * 9ec9c420db timers: Update kernel-doc for various functions
| * c513b79129 x86/bugs: Use sysfs_emit()
| * 922bc61d8c x86/cpu: Support AMD Automatic IBRS
| * d9caea5f1b Documentation/hw-vuln: Update spectre doc
| * 8b05647042 amdkfd: use calloc instead of kzalloc to avoid integer overflow
* | ff7463a1e9 Reapply "media: ttpci: fix two memleaks in budget_av_attach"
* | 7cc7098648 Revert "media: rename VFL_TYPE_GRABBER to _VIDEO"
* | b8c488bb24 Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO"
* | be024bb2cd Revert "media: ttpci: fix two memleaks in budget_av_attach"
* | d873f54a70 Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
* | 960240ce53 Merge 5.4.273 into android11-5.4-lts
|\|
| * 24489321d0 Linux 5.4.273
| * b37f030486 regmap: Add missing map->bus check
| * 55f8ea6731 spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
| * 59426454b8 bpf: report RCU QS in cpumap kthread
| * 3ffe591b27 rcu: add a helper to report consolidated flavor QS
| * 2531f907d3 netfilter: nf_tables: do not compare internal table flags on updates
| * 71002d9eb1 ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
| * 94cb17e5cf octeontx2-af: Use separate handlers for interrupts
| * 4f37d3a7e0 net/bnx2x: Prevent access to a freed page in page_pool
| * 69f9f55891 hsr: Handle failures in module init
| * f781fb5177 rds: introduce acquire/release ordering in acquire/release_in_xmit()
| * 84c510411e packet: annotate data-races around ignore_outgoing
| * 889ed056ea hsr: Fix uninit-value access in hsr_get_node()
| * 48cef94b69 s390/vtime: fix average steal time calculation
| * 305c31b970 octeontx2-af: Use matching wake_up API variant in CGX command interface
| * b63362b317 usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
| * 254b27c4ae staging: greybus: fix get_channel_from_mode() failure path
| * f6bf49e76f serial: 8250_exar: Don't remove GPIO device on suspend
| * 8dd52ab78f rtc: mt6397: select IRQ_DOMAIN instead of depending on it
| * ca6279d1a1 kconfig: fix infinite loop when expanding a macro at the end of file
| * a8cc354a81 tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
| * f1c9a0c338 serial: max310x: fix syntax error in IRQ error message
| * bd2f4df259 tty: vt: fix 20 vs 0x20 typo in EScsiignore
| * 854ebf45a4 afs: Revert "afs: Hide silly-rename files from userspace"
| * afcbba70bf NFS: Fix an off by one in root_nfs_cat()
| * bcc3ec2bdb watchdog: stm32_iwdg: initialize default timeout
| * e95eeb7f7d net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
| * 3b8415daaa scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
| * 2b38dbd7fa RDMA/device: Fix a race between mad_client and cm_client init
| * 39b1af7bc9 scsi: csiostor: Avoid function pointer casts
| * 6d5dc96b15 ALSA: usb-audio: Stop parsing channels bits when all channels are found.
| * d7ae7d1265 clk: Fix clk_core_get NULL dereference
| * a1129b0922 sparc32: Fix section mismatch in leon_pci_grpci
| * c8c038beb4 backlight: lp8788: Fully initialize backlight_properties during probe
| * 8c351a9ef5 backlight: lm3639: Fully initialize backlight_properties during probe
| * 12a0153f78 backlight: da9052: Fully initialize backlight_properties during probe
| * 1c8d8c6b4e backlight: lm3630a: Don't set bl->props.brightness in get_brightness
| * 40a89f1bc4 backlight: lm3630a: Initialize backlight_properties on init
| * bb9981f915 powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
| * a6e96cc265 drm/msm/dpu: add division of drm_display_mode's hskew parameter
| * 41eec45c71 powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
| * dfde84cc6c drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
| * af37aed049 media: ttpci: fix two memleaks in budget_av_attach
| * 353f980a5d media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
| * fa83fca55c media: rename VFL_TYPE_GRABBER to _VIDEO
| * 25f5765521 media: v4l2-core: correctly validate video and metadata ioctls
| * 291cda0b80 media: go7007: fix a memleak in go7007_load_encoder
| * fa8b472952 media: dvb-frontends: avoid stack overflow warnings with clang
| * d29ed08964 media: pvrusb2: fix uaf in pvr2_context_set_notify
| * 86c10c56f2 drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
| * 23d57b99ca ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
| * 8df143c608 mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
| * d9d4d1363b mtd: maps: physmap-core: fix flash size larger than 32-bit
| * a8c73f0439 crypto: arm/sha - fix function cast warnings
| * 4b6569e142 mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
| * ac1170674d mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
| * 3472fa83d9 drm/tegra: put drm_gem_object ref on error in tegra_fb_create
| * f27aaaecf7 clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
| * 44163c73b0 PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
| * 9b074f2ed1 drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
| * 2e1120e480 clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
| * d2f3c762ba media: pvrusb2: fix pvr2_stream_callback casts
| * e9d391cc70 media: pvrusb2: remove redundant NULL check
| * 013fb50518 media: go7007: add check of return value of go7007_read_addr()
| * 8c2e4efe12 media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
| * cf95808632 perf stat: Avoid metric-only segv
| * 9e411c40bd ALSA: seq: fix function cast warnings
| * a0ae3335b3 drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
| * 9df9108a91 perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
| * 79ab819393 PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
| * 00b07b4962 quota: Fix rcu annotations of inode dquot pointers
| * 49669f8e7e quota: Fix potential NULL pointer dereference
| * ff29b5f9f0 quota: simplify drop_dquot_ref()
| * 68435ffc1c clk: qcom: reset: Ensure write completion on reset de/assertion
| * 026d3984a1 clk: qcom: reset: Commonize the de/assert functions
| * 48846ddc71 clk: qcom: reset: support resetting multiple bits
| * 7f82802d47 clk: qcom: reset: Allow specifying custom reset delay
| * f20c3270f3 media: edia: dvbdev: fix a use-after-free
| * 0175f2d34c media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
| * 8269ab1641 media: v4l2-tpg: fix some memleaks in tpg_alloc
| * 2e6892b2be media: em28xx: annotate unchecked call to media_device_register()
| * 639155da9b perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
| * e019d87e02 drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
| * 1d4d674173 perf record: Fix possible incorrect free in record__switch_output()
| * adc8a91676 PCI/DPC: Print all TLP Prefixes, not just the first
| * daf21394f9 media: tc358743: register v4l2 async device only after successful setup
| * ba34d8a5aa dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
| * cc31a90eb7 drm/rockchip: lvds: do not overwrite error code
| * f1dfd026cd drm: Don't treat 0 as -1 in drm_fixp2int_ceil
| * b061b28b66 drm/rockchip: inno_hdmi: Fix video timing
| * 91dc47cd72 drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
| * 030d46f859 drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
| * b4cb57ec2c drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
| * e04e773fb8 drm/tegra: dsi: Make use of the helper function dev_err_probe()
| * 85f28e98c5 gpu: host1x: mipi: Update tegra_mipi_request() to be node based
| * f05631a852 drm/tegra: dsi: Add missing check for of_find_device_by_node
| * da7ece2197 dm: call the resume method on internal suspend
| * 6070692ea3 dm raid: fix false positive for requeue needed during reshape
| * 3b1e8a617e nfp: flower: handle acti_netdevs allocation failure
| * e06f0d3f66 net/x25: fix incorrect parameter validation in the x25_getsockopt() function
| * 26843eefcf net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
| * b9979cae62 udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
| * 1bd08e5314 l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
| * 2e7f3cabc6 tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
| * fb6639c748 net: hns3: fix port duplex configure error in IMP reset
| * ec6bb01e02 net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
| * a9f5faf28e ipv6: fib6_rules: flush route cache when rule is changed
| * 21e5fa4688 bpf: Fix stackmap overflow check on 32-bit arches
| * 92c81fbb3e bpf: Fix hashtab overflow check on 32-bit arches
| * 8a8b6a2468 sr9800: Add check for usbnet_get_endpoints
| * 54a03e4ac1 Bluetooth: hci_core: Fix possible buffer overflow
| * f6177a1723 Bluetooth: Remove superfluous call to hci_conn_check_pending()
| * 03df15b579 igb: Fix missing time sync events
| * 141897c5b0 igb: move PEROUT and EXTTS isr logic to separate functions
| * 8081d80a92 mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
| * bfa9d86d39 SUNRPC: fix some memleaks in gssx_dec_option_array
| * 52018aa146 x86, relocs: Ignore relocations in .notes section
| * 450ac90ed4 ACPI: scan: Fix device check notification handling
| * 33b498a123 ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
| * 0655698da8 ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
| * 8deafa61fb ARM: dts: imx6dl-yapp4: Move phy reset into switch node
| * 174e3c8ee7 ARM: dts: arm: realview: Fix development chip ROM compatible value
| * de8abc894b net: ena: Remove ena_select_queue
| * f434eacad6 net: ena: cosmetic: fix line break issues
| * a4fc14a662 wifi: brcmsmac: avoid function pointer casts
| * 6234e09e69 iommu/amd: Mark interrupt as managed
| * 073b5bbb13 bus: tegra-aconnect: Update dependency to ARCH_TEGRA
| * ea96bf3f80 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
| * 2eb2a5d6f5 arm64: dts: qcom: msm8996: Pad addresses
| * a8f3650656 arm64: dts: qcom: msm8996: Move regulator consumers to db820c
| * 1f685fa06c arm64: dts: qcom: msm8996: Use node references in db820c
| * adcf4eeb34 arm64: dts: qcom: db820c: Move non-soc entries out of /soc
| * 6bbbd2fd08 bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
| * 6f51d61a43 bpf: Factor out bpf_spin_lock into helpers.
| * cf0d888ea7 bpf: Add typecast to bpf helpers to help BTF generation
| * e1f7fef6e2 arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
| * bea9573c79 wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
| * 6fd9061497 net: blackhole_dev: fix build warning for ethh set but not used
| * ef036a0598 af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
| * 4bdfc38a98 sock_diag: annotate data-races around sock_diag_handlers[family]
| * 76ac9c141e wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
| * e556006de4 wifi: wilc1000: fix RCU usage in connect path
| * 1bda3ff1fd wifi: wilc1000: fix declarations ordering
| * 8c6210d175 wifi: b43: Disable QoS for bcm4331
| * 12062b149f wifi: b43: Stop correct queue in DMA worker when QoS is disabled
| * c668f0f825 b43: main: Fix use true/false for bool type
| * 47ec637b11 wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
| * 31aaf17200 wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
| * 801be44049 b43: dma: Fix use true/false for bool type variable
| * 88a9dffaec wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
| * be26970980 timekeeping: Fix cross-timestamp interpolation for non-x86
| * fee4e84c4e timekeeping: Fix cross-timestamp interpolation corner case decision
| * 7cec7d8388 timekeeping: Fix cross-timestamp interpolation on counter wrap
| * 1a54aa506b aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
| * 72dacc72b2 fs/select: rework stack allocation hack for clang
| * 44214d744b nbd: null check for nla_nest_start
| * 772a7def98 do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
| * 3f6186cc65 ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
| * 9f27f4d5d1 ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
| * f1d3be9eb9 ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
| * 5f3c13930b Input: gpio_keys_polled - suppress deferred probe error for gpio
| * fa14a15373 ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
| * da17f556ad firewire: core: use long bus reset on gap count error
| * 5f369efd9d Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
| * 6e9c113992 scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
| * 2daa2a8e89 btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
| * 890a1b31fa dm-verity, dm-crypt: align "struct bvec_iter" correctly
| * 5d8afc25c7 block: sed-opal: handle empty atoms when parsing response
| * 745718d00f parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
| * b43b1a7062 net/iucv: fix the allocation size of iucv_path_table array
| * c411a3c828 RDMA/mlx5: Relax DEVX access upon modify commands
| * 69dd0a99da HID: multitouch: Add required quirk for Synaptics 0xcddc device
| * 7d7fa0bea3 MIPS: Clear Cause.BD in instruction_pointer_set
| * 025a8a96c7 x86/xen: Add some null pointer checking to smp.c
| * 4c00abb52a ASoC: rt5645: Make LattePanda board DMI match more precise
| * ef5de5d505 selftests: tls: use exact comparison in recv_partial
| * cfb24022bb io_uring: drop any code related to SCM_RIGHTS
| * 2692b8a016 io_uring/unix: drop usage of io_uring socket
* | f509fa9b09 Revert "regmap: allow to define reg_update_bits for no bus configuration"
* | 012b5eceed Revert "regmap: Add bulk read/write callbacks into regmap_config"
* | 0efa1aa851 Revert "serial: max310x: fix IO data corruption in batched operations"
* | 43bbe91c9f Revert "geneve: make sure to pull inner header in geneve_rx()"
* | ee2f1c68f1 Merge 5.4.272 into android11-5.4-lts
|\|
| * 8407582630 Linux 5.4.272
| * 345ced4052 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
| * 1b3d8cbd1c arm64: dts: qcom: add PDC interrupt controller for SDM845
| * 59b3583da1 serial: max310x: fix IO data corruption in batched operations
| * f5c252aaa1 serial: max310x: implement I2C support
| * 112094efd6 serial: max310x: make accessing revision id interface-agnostic
| * b96b017919 regmap: Add bulk read/write callbacks into regmap_config
| * 758c6799da regmap: allow to define reg_update_bits for no bus configuration
| * 9a7bbea266 serial: max310x: Unprepare and disable clock in error path
| * 664a6a904a getrusage: use sig->stats_lock rather than lock_task_sighand()
| * 2b34f60383 getrusage: use __for_each_thread()
| * c50a059431 getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
| * ef8a8b36a1 getrusage: add the "signal_struct *sig" local variable
| * f184f21978 y2038: rusage: use __kernel_old_timeval
| * c7441c77c9 hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
| * f2ab3eaa64 hv_netvsc: use netif_is_bond_master() instead of open code
| * 9b5ef7a528 hv_netvsc: Make netvsc/VF binding check both MAC and serial number
| * 5402ec577f Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
| * bf6bb3612e serial: max310x: prevent infinite while() loop in port startup
| * 7e30e5c143 serial: max310x: use a separate regmap for each port
| * 3fb7c9bcd0 serial: max310x: use regmap methods for SPI batch operations
| * 2c9c830d74 serial: max310x: Make use of device properties
| * b765176ae1 serial: max310x: fail probe if clock crystal is unstable
| * 816700131e serial: max310x: Try to get crystal clock rate from property
| * c76dcad53b serial: max310x: Use devm_clk_get_optional() to get the input clock
| * b569d91e51 um: allow not setting extra rpaths in the linux binary
| * 47c68edecc selftests: mm: fix map_hugetlb failure on 64K page size systems
| * f9055fa2b2 netrom: Fix data-races around sysctl_net_busy_read
| * 07bbccd1ad netrom: Fix a data-race around sysctl_netrom_link_fails_count
| * c4309e5f8e netrom: Fix a data-race around sysctl_netrom_routing_control
| * cbba77abb4 netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
| * 89aa78a343 netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
| * 1f60795dca netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
| * 80578681ea netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
| * f716a68234 netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
| * eadec8da44 netrom: Fix a data-race around sysctl_netrom_transport_timeout
| * eda02a0bed netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
| * 1e84b108f2 netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
| * 7f61523255 netrom: Fix a data-race around sysctl_netrom_default_path_quality
| * 4bafcc43ba netfilter: nf_conntrack_h323: Add protection for bmp length out of range
| * 6ec3032022 netfilter: nft_ct: fix l3num expectations with inet pseudo family
| * 997efea2bf net/rds: fix WARNING in rds_conn_connect_if_down
| * 664f9c6472 net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
| * d9fefc5113 net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
| * 59d2a40769 geneve: make sure to pull inner header in geneve_rx()
| * a248b1f58a ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
| * 7f08778469 net: lan78xx: fix runtime PM count underflow on link stop
| * 81934a2ab5 lan78xx: Fix race conditions in suspend/resume handling
| * 57b9c48cd5 lan78xx: Fix partial packet errors on suspend/resume
| * e68b46e9aa lan78xx: Add missing return code checks
| * b1cc23ffe1 lan78xx: Fix white space and style issues
* | 79ed7de671 Merge branch 'android11-5.4' into branch 'android11-5.4-lts'
* | 26385fa150 UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
* | e1dfe2d3de UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845
* | 40df6b551d Merge 5.4.271 into android11-5.4-lts
|\|
| * 3fec063b05 Linux 5.4.271
| * 9162730a83 gpio: 74x164: Enable output pins after registers are reset
| * 1dde8ef4b7 fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
| * 037d5a949b cachefiles: fix memory leak in cachefiles_add_cache()
| * ace0fdf796 x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
| * 9d660e5adf mmc: core: Fix eMMC initialization with 1-bit bus connection
| * 3cc5fb824c dmaengine: fsl-qdma: init irq after reg initialization
| * 518d78b4fa dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
| * c6652e20d7 btrfs: dev-replace: properly validate device names
| * 0cfbb26ee5 wifi: nl80211: reject iftype change with mesh ID change
| * ec92aa2cab gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
| * 5c78be006e afs: Fix endless loop in directory parsing
| * 26dda65b09 ALSA: Drop leftover snd-rtctimer stuff from Makefile
| * 7394abc892 power: supply: bq27xxx-i2c: Do not free non existing IRQ
| * 950d4d74d3 efi/capsule-loader: fix incorrect allocation size
| * b9fbc44159 rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
| * 260410c589 netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
| * 20f6f150e1 Bluetooth: Enforce validation on max value of connection interval
| * 79820a7e1e Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
| * 98fb98fd37 Bluetooth: Avoid potential use-after-free in hci_error_reset
| * 6e0000a432 net: usb: dm9601: fix wrong return value in dm9601_mdio_read
| * 69624e28d6 lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
| * 9d4ffb5b9d ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
| * f5f11f7e28 tun: Fix xdp_rxq_info's queue_index when detaching
| * f81e94d2dc net: ip_tunnel: prevent perpetual headroom growth
| * 9ae51361da netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
* | 7dde2bcd3f ANDROID: GKI: update .xml file due to USB changes in 5.4.270
* | 1ac7c39f24 Merge 5.4.270 into android11-5.4-lts
|\|
| * e133c1ee6d Linux 5.4.270
| * 7a54338219 scripts/bpf: Fix xdp_md forward declaration typo
| * b4eea7a05e fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
| * c28fc1aa6f drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
| * 29db9725f2 drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
| * ae4360cbd3 netfilter: nf_tables: set dormant flag on hook register failure
| * f310143961 tls: stop recv() if initial process_rx_list gave us non-DATA
| * a26742ada7 tls: rx: drop pointless else after goto
| * c1287c1d6b tls: rx: jump to a more appropriate label
| * 06de230254 s390: use the correct count for __iowrite64_copy()
| * 7eee00feb6 packet: move from strlcpy with unused retval to strscpy
| * 82831e3ff7 ipv6: sr: fix possible use-after-free and null-ptr-deref
| * 5c27d85a69 afs: Increase buffer size in afs_update_volume_status()
| * 799a4afaa5 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
| * 5888f34249 ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
| * a50cb1d6f3 nouveau: fix function cast warnings
| * fe031dfcea scsi: jazz_esp: Only build if SCSI core is builtin
| * dd90af71fa bpf, scripts: Correct GPL license name
| * 1f18b5bb45 scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
| * 48ebca0a11 RDMA/srpt: fix function pointer cast warnings
| * 3107633774 RDMA/srpt: Make debug output more detailed
| * 6e461952df RDMA/bnxt_re: Return error for SRQ resize
| * cecfb90cf7 IB/hfi1: Fix a memleak in init_credit_return
| * bbcf72333b usb: roles: don't get/set_role() when usb_role_switch is unregistered
| * a31cf46d10 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
| * aad6132ae6 usb: cdns3: fix memory double free when handle zero packet
| * cfa9abb557 usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
| * 999a8bb70d ARM: ep93xx: Add terminator to gpiod_lookup_table
| * c1d3a84a67 l2tp: pass correct message length to ip6_append_data
| * caf4a67c01 PCI/MSI: Prevent MSI hardware interrupt number truncation
| * f8cbd17919 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
| * 0dccbb9353 dm-crypt: don't modify the data when using authenticated encryption
| * 5833024a98 IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
| * 6ede985c6b PCI: tegra: Fix OF node reference leak
| * e04a2afd08 PCI: tegra: Fix reporting GPIO error value
| * e3fc080911 arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
| * efd63c23a4 drm/amdgpu: Fix type of second parameter in trans_msg() callback
| * f691ab24cf iomap: Set all uptodate bits for an Uptodate page
| * 45227ae32f dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
| * 3770c38cd6 x86/alternatives: Disable KASAN in apply_alternatives()
| * f45dc10a3c drm/amdgpu: Check for valid number of registers to read
| * 90aa9135a4 Revert "drm/sun4i: dsi: Change the start delay calculation"
| * 7000efb6d8 ALSA: hda/realtek - Enable micmute LED on and HP system
| * 82c53047fe selftests/bpf: Avoid running unprivileged tests with alignment requirements
| * 81e03f638d net: bridge: clear bridge's private skb space on xmit
| * 82174d6bd7 spi: mt7621: Fix an error message in mt7621_spi_probe()
| * 954a7a0011 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
| * 759756e2cf pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
| * 99dc568545 tcp: add annotations around sk->sk_shutdown accesses
| * 41ca938616 tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
| * 5a9dc14df2 tcp: factor out __tcp_close() helper
| * d428676420 pmdomain: renesas: r8a77980-sysc: CR7 must be always on
| * 3bc35da667 s390/qeth: Fix potential loss of L3-IP@ in case of network issues
| * b7bfaea8f5 virtio-blk: Ensure no requests in virtqueues before deleting vqs.
| * d124ab01fc firewire: core: send bus reset promptly on gap count error
| * b5854f923d scsi: lpfc: Use unsigned type for num_sge
| * 60635f8a05 hwmon: (coretemp) Enlarge per package core count limit
| * 6d338fb1a1 nvmet-fc: abort command when there is no binding
| * ac524b7b3f netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
| * 6f5015ce25 ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
| * c3a25d4fdd nvmet-tcp: fix nvme tcp ida memory leak
| * 5068cb91ed regulator: pwm-regulator: Add validity checks in continuous .get_voltage
| * 6b92b1bc16 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
| * 260fc96283 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
| * bccb418eba ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
| * e896bf4878 ahci: asm1166: correct count of reported ports
| * 6db07619d1 fbdev: sis: Error out if pixclock equals zero
| * 84dce0f6a4 fbdev: savage: Error out if pixclock equals zero
| * 85720b69ae wifi: mac80211: fix race condition on enabling fast-xmit
| * d3032de2c8 wifi: cfg80211: fix missing interfaces when dumping
| * bb3813a6a7 dmaengine: fsl-qdma: increase size of 'irq_name'
| * a7229c75c3 dmaengine: shdma: increase size of 'dev_id'
| * 11f3fe5001 scsi: target: core: Add TMF to tmr_list handling
| * d2fc4134aa sched/rt: Disallow writing invalid values to sched_rt_period_us
| * b69677bfd7 sched/rt: Fix sysctl_sched_rr_timeslice intial value
| * 429aaf144b userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
| * b0911b8d37 nilfs2: replace WARN_ONs for invalid DAT metadata block requests
| * febd743200 memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
| * d7b5bdb52d sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
| * 010dc505ea net/sched: Retire dsmark qdisc
| * 40e8abb86d net/sched: Retire ATM qdisc
| * 493685f3dd net/sched: Retire CBQ qdisc
| * 9d17e73504 KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
| * 68799371c9 KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
* | 3298a76a41 Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
* | 241e0d860f Revert "hrtimer: Report offline hrtimer enqueue"
* | ce97b1b6bc Revert "drm/mipi-dsi: Fix detach call without attach"
* | 806fb883ea Merge 5.4.269 into android11-5.4-lts
|/
* 6e1f54a498 Linux 5.4.269
* e9aa8e5a72 of: gpio unittest kfree() wrong object
* 6ac8965955 of: unittest: fix EXPECT text for gpio hog errors
* 7dd275ce3b net: bcmgenet: Fix EEE implementation
* 10c586da9f Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
* 25b42be4e0 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
* 3dd76bebcd lsm: new security_file_ioctl_compat() hook
* efdf644062 drm/msm/dsi: Enable runtime PM
* fef59ee6c0 PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
* 835ed5effb PM: runtime: add devm_pm_runtime_enable helper
* d31c8721e8 nilfs2: fix potential bug in end_buffer_async_write
* 2441a64070 sched/membarrier: reduce the ability to hammer on sys_membarrier
* cd1022eaf8 net: prevent mss overflow in skb_segment()
* 6587af96ef netfilter: ipset: Missing gc cancellations fixed
* c7f2733e50 netfilter: ipset: fix performance regression in swap operation
* d04acadb64 KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
* 4705a9fc50 mips: Fix max_mapnr being uninitialized on early stages
* 5e0854b60a arch, mm: remove stale mentions of DISCONIGMEM
* c324e2716d bus: moxtet: Add spi device table
* 7f71d9817c Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
* 60e092289c tracing: Inform kmemleak of saved_cmdlines allocation
* fbe86124b7 pmdomain: core: Move the unused cleanup to a _sync initcall
* 08de58abed can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
* a257ffde37 irqchip/irq-brcmstb-l2: Add write memory barrier before exit
* 91a7c00235 nfp: flower: prevent re-adding mac index for bonded port
* b22c9a37c7 nfp: use correct macro for LengthSelect in BAR config
* 862ee4422c nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
* a6efe6dbaa nilfs2: fix data corruption in dsync block recovery for small block sizes
* 6ce7d5e6d2 ALSA: hda/conexant: Add quirk for SWS JS201D
* 6b8bdc509e mmc: slot-gpio: Allow non-sleeping GPIO ro
* 4f2fde5051 x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
* 4c7b1d08ad x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
* ed14ab2611 serial: max310x: improve crystal stable clock detection
* 5814a9045c serial: max310x: set default value when reading clock ready bit
* ef60665ea9 ring-buffer: Clean ring_buffer_poll_wait() error return
* 7200170e88 iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
* 720d0112b3 staging: iio: ad5933: fix type mismatch regression
* 77e7a316cd tracing: Fix wasted memory in saved_cmdlines logic
* afbcad9ae7 ext4: fix double-free of blocks due to wrong extents moved_len
* 15238f4b21 misc: fastrpc: Mark all sessions as invalid in cb_remove
* 42beab162d binder: signal epoll threads of self-work
* 93a52449fe ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
* 9086b27eac xen-netback: properly sync TX responses
* 71349abe3a nfc: nci: free rx_data_reassembly skb on NCI device cleanup
* 4ae191effb kbuild: Fix changing ELF file type for output of gen_btf for big endian
* 750a4e5999 firewire: core: correct documentation of fw_csr_string() kernel API
* 2209fc6e3d scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
* d074d5ff5a i2c: i801: Fix block process call transactions
* 4de1489d80 i2c: i801: Remove i801_set_block_buffer_mode
* df112ccb9b usb: f_mass_storage: forbid async queue when shutdown happen
* addaa8627f USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
* dbaca8fa9e HID: wacom: Do not register input devices until after hid_hw_start
* e13bed5cfe HID: wacom: generic: Avoid reporting a serial of '0' to userspace
* 1f12e4b328 mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
* 8ffd5590f4 tracing/trigger: Fix to return error if failed to alloc snapshot
* a67f1f83f3 i40e: Fix waiting for queues of all VSIs to be disabled
* 9a3a82affa MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
* 422d5243b9 ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
* 91b48c6339 spi: ppc4xx: Drop write-only variable
* 61da1f41d0 of: unittest: Fix compile in the non-dynamic case
* f6997a2416 of: unittest: add overlay gpio test to catch gpio hog problem
* 89485251f6 btrfs: send: return EOPNOTSUPP on unknown flags
* 863837df8a btrfs: forbid deleting live subvol qgroup
* d25031ba2a btrfs: forbid creating subvol qgroups
* 10e9cb3931 netfilter: nft_set_rbtree: skip end interval element from gc
* 7fde2acc6d net: stmmac: xgmac: fix a typo of register name in DPP safety handling
* b9ff931f00 net: stmmac: xgmac: use #define for string constants
* 88c7e1e7a6 vhost: use kzalloc() instead of kmalloc() followed by memset()
* 09e77c7d67 Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
* a012efe0df hrtimer: Report offline hrtimer enqueue
* 4a589de93c USB: serial: cp210x: add ID for IMST iM871A-USB
* cd0ab7f2a8 USB: serial: option: add Fibocom FM101-GL variant
* 896695af51 USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
* 11ca9624cc net/af_iucv: clean up a try_then_request_module()
* 1c7488156e netfilter: nft_ct: reject direction for ct id
* 8e2a84c6da netfilter: nft_compat: restrict match/target protocol to u16
* f139a4c6d2 netfilter: nft_compat: reject unused compat flag
* 56fae81633 ppp_async: limit MRU to 64K
* 6f70f0b412 tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
* ef1f56f2cd rxrpc: Fix response to PING RESPONSE ACKs to a dead call
* 5993f121fb inet: read sk->sk_family once in inet_recv_error()
* 7c96975c24 hwmon: (coretemp) Fix bogus core_id to attr name mapping
* 1eb74c00c9 hwmon: (coretemp) Fix out-of-bounds memory access
* 51d76b7230 hwmon: (aspeed-pwm-tacho) mutex for tach reading
* df0965935a atm: idt77252: fix a memleak in open_card_ubr0
* a0ac20fd53 selftests: net: avoid just another constant wait
* e9837c83be net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
* 8398d8d735 phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
* 0cb90f27a3 dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
* 6ff4827315 phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
* 1c75fe450b dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
* c263609416 dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
* 817bedcd7f bonding: remove print in bond_verify_device_path
* e95120698b HID: apple: Add 2021 magic keyboard FN key mapping
* 5991ab8940 HID: apple: Swap the Fn and Left Control keys on Apple keyboards
* 6d4771ab2d HID: apple: Add support for the 2021 Magic Keyboard
* 67f56ef9e1 net: sysfs: Fix /sys/class/net/<iface> path
* b169ffde73 af_unix: fix lockdep positive in sk_diag_dump_icons()
* b3dace37f1 net: ipv4: fix a memleak in ip_setup_cork
* f549f340c9 netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
* 06608603fa netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
* 64babb17e8 llc: call sock_orphan() at release time
* 2a09d1784c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
* 7f1a24914b ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
* a10e95d6cf ixgbe: Refactor overtemp event handling
* 2d533ddca2 ixgbe: Refactor returning internal error codes
* 980c806f67 ixgbe: Remove non-inclusive language
* 7c03b74865 net: remove unneeded break
* b81f679ac5 scsi: isci: Fix an error code problem in isci_io_request_build()
* 12f58dce48 wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
* ad2bd6cd17 perf: Fix the nr_addr_filters fix
* 34da3b9fa5 drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
* 6ab4fd508f ceph: fix deadlock or deadcode of misusing dget()
* ecd7744a14 blk-mq: fix IO hang from sbitmap wakeup race
* 977105472f virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
* 884b746209 libsubcmd: Fix memory leak in uniq()
* 3e06e9b906 PCI/AER: Decode Requester ID when no error info found
* 133bf750d7 fs/kernfs/dir: obey S_ISGID
* 17c252f192 usb: hub: Replace hardcoded quirk value with BIT() macro
* d8c2935499 PCI: switchtec: Fix stdev_release() crash after surprise hot remove
* a32a24da0e PCI: Only override AMD USB controller if required
* e2048eb3cb mfd: ti_am335x_tscadc: Fix TI SoC dependencies
* 838cbe01db i3c: master: cdns: Update maximum prescaler value for i2c clock
* a6946682dd um: net: Fix return type of uml_net_start_xmit()
* c8115f2bd8 um: Don't use vfprintf() for os_info()
* 735a29ce08 um: Fix naming clash between UML and scheduler
* ddd1f258f0 leds: trigger: panic: Don't register panic notifier if creating the trigger failed
* 9052b3e0e7 drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
* 548f9a37d7 drm/amdgpu: Let KFD sync with VM fences
* 15d674571a clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
* 105444e207 clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
* 8a96f1caf1 drm/msm/dpu: Ratelimit framedone timeout msgs
* 4d181fe966 media: ddbridge: fix an error code problem in ddb_probe
* 615e3adc20 IB/ipoib: Fix mcast list locking
* fb703d31fd drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
* c1b2e5e837 ALSA: hda: Intel: add HDA_ARL PCI ID support
* c91bda92fb PCI: add INTEL_HDA_ARL to pci_ids.h
* fbbee078cf media: rockchip: rga: fix swizzling for RGB formats
* acb1bffe5f media: stk1160: Fixed high volume of stk1160_dbg messages
* 67997250d3 drm/mipi-dsi: Fix detach call without attach
* d778e10dde drm/framebuffer: Fix use of uninitialized variable
* da980f8db0 drm/drm_file: fix use of uninitialized variable
* 00a5feb060 RDMA/IPoIB: Fix error code return in ipoib_mcast_join
* b0f907a4ef fast_dput(): handle underflows gracefully
* 12ba5b9cf8 ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
* 9fceaf8182 f2fs: fix to check return value of f2fs_reserve_new_block()
* 52240224e7 wifi: cfg80211: free beacon_ies when overridden from hidden BSS
* 18c2989c30 wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
* 8ec36f2d0c wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
* f3b7a31bf1 arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
* c3f22192a2 arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
* 351b37b88e md: Whenassemble the array, consult the superblock of the freshest device
* 6f2cd02ff5 block: prevent an integer overflow in bvec_try_merge_hw_page
* fb9c25ea0a ARM: dts: imx23/28: Fix the DMA controller node name
* c48e75a7ee ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
* 83b1cceca9 ARM: dts: imx27-apf27dev: Fix LED name
* 06c3f5920f ARM: dts: imx25/27: Pass timing0
* 826e8fa48e ARM: dts: imx1: Fix sram node
* 05f309a3fa ARM: dts: imx27: Fix sram node
* 1e35a4cf5a ARM: dts: imx: Use flash@0,0 pattern
* 30cfab1c8c ARM: dts: imx25/27-eukrea: Fix RTC node name
* ca14da9a1e ARM: dts: rockchip: fix rk3036 hdmi ports node
* e9ac3e3398 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
* f5a875051e scsi: libfc: Don't schedule abort twice
* eb6f68ec92 bpf: Add map and need_defer parameters to .map_fd_put_ptr()
* f11f0fd1ad wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
* 53dd674b32 ARM: dts: imx7s: Fix nand-controller #size-cells
* a86ce3671d ARM: dts: imx7s: Fix lcdif compatible
* 183edc0ad2 ARM: dts: imx7d: Fix coresight funnel ports
* 6c50e561ce bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
* 4d981d9224 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
* 0e8c8aa8e3 scsi: lpfc: Fix possible file string name overflow when updating firmware
* cbd0b6268a selftests/bpf: Fix pyperf180 compilation failure with clang18
* 982bdaa0fc selftests/bpf: satisfy compiler by having explicit return in btf test
* e1f113b57d wifi: rt2x00: restart beacon queue when hardware reset
* b183fe8702 ext4: avoid online resizing failures due to oversized flex bg
* 92c3c5cfed ext4: remove unnecessary check from alloc_flex_gd()
* 7cb19e1336 ext4: unify the type of flexbg_size to unsigned int
* 360c28a2fd ext4: fix inconsistent between segment fstrim and full fstrim
* ec10755496 ecryptfs: Reject casefold directory inodes
* 7a96d85bf1 SUNRPC: Fix a suspicious RCU usage warning
* 5e63c9ae80 KVM: s390: fix setting of fpc register
* 6d0822f2cc s390/ptrace: handle setting of fpc register correctly
* de6a91aed1 jfs: fix array-index-out-of-bounds in diNewExt
* 592d29eb6b rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
* f4a0b57632 afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
* 3f4cba4cf8 crypto: stm32/crc32 - fix parsing list of devices
* e9f6ac5089 pstore/ram: Fix crash when setting number of cpus to an odd number
* 93df0a2a0b jfs: fix uaf in jfs_evict_inode
* 3f8217c323 jfs: fix array-index-out-of-bounds in dbAdjTree
* 1b9d682858 jfs: fix slab-out-of-bounds Read in dtSearch
* fd3486a893 UBSAN: array-index-out-of-bounds in dtSplitRoot
* 98f9537fe6 FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
* d2049af7dd ACPI: extlog: fix NULL pointer dereference check
* 0d2adafba9 PNP: ACPI: fix fortify warning
* b0b96859ab ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
* 20277842d9 audit: Send netlink ACK before setting connection in auditd_set
* 27756ae366 regulator: core: Only increment use_count when enable_count changes
* aed181fbc2 perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
* 980d5fe989 x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
* 0580f4403a powerpc/lib: Validate size for vector operations
* 7cd81d2358 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
* 9bf6c6f097 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
* 171468044b powerpc: Fix build error due to is_valid_bugaddr()
* f6781add1c powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
* 3cdbfac106 x86/entry/ia32: Ensure s32 is sign extended to s64
* aa8bd0d9b2 tick/sched: Preserve number of idle sleeps across CPU hotplug events
* 200d17b226 mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
* b2b0d40775 spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
* 344e8f3392 gpio: eic-sprd: Clear interrupt after set the interrupt type
* f81d67832c drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
* 83d86b4a77 drm/exynos: fix accidental on-stack copy of exynos_drm_plane
* 3e835d6e65 drm/bridge: nxp-ptn3460: simplify some error checking
* 021e214947 drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
* 9dd334a824 drm: Don't unref the same fb many times by mistake due to deadlock handling
* 5624d628a1 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
* 4e66422f1b netfilter: nf_tables: reject QUEUE/DROP verdict parameters
* bd517df3bd rbd: don't move requests to the running list on errors
* 69a0876252 btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
* d0bf04c965 btrfs: don't warn if discard range is not aligned to sector
* 927d1a3d32 btrfs: tree-checker: fix inline ref size in error messages
* 5c9e576bfd btrfs: ref-verify: free ref cache before clearing mount opt
* d3d6162eb1 net: fec: fix the unhandled context fault from smmu
* 3422bfda92 fjes: fix memleaks in fjes_hw_setup
* 07bcc3cd3d netfilter: nf_tables: validate NFPROTO_* family
* b55e492f06 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
* 2501afe6c4 net/mlx5e: fix a double-free in arfs_create_groups
* bca555e8a2 net/mlx5: Use kfree(ft->g) in arfs_create_groups()
* 0917d771f6 net/mlx5: DR, Use the right GVMI number for drop action
* 4f4dc7098b netlink: fix potential sleeping issue in mqueue_flush_file
* da70948068 tcp: Add memory barrier to tcp_push()
* 01d15b68f0 afs: Hide silly-rename files from userspace
* dad9b28f67 tracing: Ensure visibility when inserting an element into tracing_map
* a37ae111db net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
* b8e8838f82 llc: Drop support for ETH_P_TR_802_2.
* b643d0defc llc: make llc_ui_sendmsg() more robust against bonding changes
* 06f30fdbc4 vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
* 1fea9969b8 net/smc: fix illegal rmb_desc access in SMC-D connection dump
* 5c6183f3c7 x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
* 7e180b702a powerpc: Use always instead of always-y in for crtsavres.o
* 457ef4fe54 fs: move S_ISGID stripping into the vfs_*() helpers
* 0cb0093fd6 fs: add mode_strip_sgid() helper
* 635a0039e8 mtd: spinand: macronix: Fix MX35LFxGE4AD page size
* 3f4e660144 block: Remove special-casing of compound pages
* 0785e29899 rename(): fix the locking of subdirectories
* f0824ca283 ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
* a1e80a33bf nouveau/vmm: don't set addr on the fail path to avoid warning
* f49f9e8027 mmc: core: Use mrq.sbc in close-ended ffu
* e15b1553d0 arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
* 830c99794b parisc/firmware: Fix F-extend for PDC addresses
* dd50fe18c2 rpmsg: virtio: Free driver_override when rpmsg_remove()
* 5030d4c798 hwrng: core - Fix page fault dead lock on mmap-ed hwrng
* 5bc17b4fc2 PM: hibernate: Enforce ordering during image compression/decompression
* cf6889bb8b crypto: api - Disallow identical driver names
* a7edaf40fc ext4: allow for the last group to be marked as trimmed
* e2ecfd5565 serial: sc16is7xx: add check for unsupported SPI modes during probe
* 120b65f80b spi: introduce SPI_MODE_X_MASK macro
* 2b708e6b28 serial: sc16is7xx: set safe default SPI clock frequency
* e53321b341 units: add the HZ macros
* 34d74cf3c7 units: change from 'L' to 'UL'
* 7478445a45 units: Add Watt units
* b617974548 include/linux/units.h: add helpers for kelvin to/from Celsius conversion
* 2ed05a8cc9 PCI: mediatek: Clear interrupt status before dispatching handler

Change-Id: I1ddbcc9d61402546e16694894da56199a22ec74d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-06-01 07:06:09 +00:00
Greg Kroah-Hartman
65d8957031 This is the 5.4.275 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmYzoYAACgkQONu9yGCS
 aT5Gog/8DiBn13NgIqTvlQucOpiKcQrFS6ghuLjWUj+H+toaBPCoiAaSNzDgk3a6
 Vc7aW+/H6035Wpt6qmA9nr9VljS4JgHRlxPbp442zcXoaQabxXstt80s05EgC+ue
 MamCnirQwtkSaHYTQDHwumyr+J73b/EM6w0MHinmKJKbmLOpF6ejt87bBN8i1i4N
 0/atD79jq6l3wOIwNpJI5hIdc/OwNKnCd0M1lQL60XQgN+4Yc5Gup/BazSnVzTHN
 PvkyqJOPSHcOcTkaDsS6t6RRJ5fQcHDihEPILwQuyqDbasyVULaNWxuZjVUeXbIS
 rcgrlPTsJB1KjtZuGSkSCmj3FrmBBhs9Fd2HBEGE2UfShJa1c4O/Hbmq3sHvijUQ
 i8Oaakkx0Z4XKiXf5djwG0QNm4vT8M+nBDNTxw+/pzWg2L0uzlpVh87YwODsrtT2
 /WHQ0B1MFXncCDebweXqlxTWKRCoqR183MjMedDJt25smCKp1RZZR7pJb9c065Mn
 bg2benOfKUr/+Us5oiQboV3XZkZiPc39V/E6J9NjYE62EPht6Gb/yoblFKp9t+/f
 8MYPXqyAjGGXIzkqD7e1+YyOH6N/96EOZ2TrLhZiMb/3W6+dCjc1YeFtquNmaN9b
 pdYhzG3qlneflRNTz/30YKIyMQE5Zv+1DMR2mpBSD4hvSEYCmE4=
 =yaox
 -----END PGP SIGNATURE-----

Merge 5.4.275 into android11-5.4-lts

Changes in 5.4.275
	batman-adv: Avoid infinite loop trying to resize local TT
	Bluetooth: Fix memory leak in hci_req_sync_complete()
	nouveau: fix function cast warning
	net: openvswitch: fix unwanted error log on timeout policy probing
	u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
	geneve: fix header validation in geneve[6]_xmit_skb
	ipv6: fib: hide unused 'pn' variable
	ipv4/route: avoid unused-but-set-variable warning
	ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
	net/mlx5: Properly link new fs rules into the tree
	af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
	af_unix: Fix garbage collector racing against connect()
	net: ena: Fix potential sign extension issue
	btrfs: qgroup: correctly model root qgroup rsv in convert
	drm/client: Fully protect modes[] with dev->mode_config.mutex
	vhost: Add smp_rmb() in vhost_vq_avail_empty()
	selftests: timers: Fix abs() warning in posix_timers test
	x86/apic: Force native_apic_mem_read() to use the MOV instruction
	btrfs: record delayed inode root in transaction
	selftests/ftrace: Limit length in subsystem-enable tests
	kprobes: Fix possible use-after-free issue on kprobe registration
	Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
	netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
	tun: limit printing rate when illegal packet received by tun dev
	RDMA/rxe: Fix the problem "mutex_destroy missing"
	RDMA/mlx5: Fix port number for counter query in multi-port configuration
	drm: nv04: Fix out of bounds access
	clk: Remove prepare_lock hold assertion in __clk_release()
	clk: Mark 'all_lists' as const
	clk: remove extra empty line
	clk: Print an info line before disabling unused clocks
	clk: Initialize struct clk_core kref earlier
	clk: Get runtime PM before walking tree during disable_unused
	x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
	binder: check offset alignment in binder_get_object()
	comedi: vmk80xx: fix incomplete endpoint checking
	serial/pmac_zilog: Remove flawed mitigation for rx irq flood
	USB: serial: option: add Fibocom FM135-GL variants
	USB: serial: option: add support for Fibocom FM650/FG650
	USB: serial: option: add Lonsung U8300/U9300 product
	USB: serial: option: support Quectel EM060K sub-models
	USB: serial: option: add Rolling RW101-GL and RW135-GL support
	USB: serial: option: add Telit FN920C04 rmnet compositions
	Revert "usb: cdc-wdm: close race between read and workqueue"
	usb: dwc2: host: Fix dereference issue in DDMA completion flow.
	usb: Disable USB3 LPM at shutdown
	speakup: Avoid crash on very long word
	fs: sysfs: Fix reference leak in sysfs_break_active_protection()
	nouveau: fix instmem race condition around ptr stores
	nilfs2: fix OOB in nilfs_set_de_type
	KVM: async_pf: Cleanup kvm_setup_async_pf()
	arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
	arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
	arm64: dts: mediatek: mt7622: fix IR nodename
	arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
	arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
	arm64: dts: mt2712: add ethernet device node
	arm64: dts: mediatek: mt2712: fix validation errors
	ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
	vxlan: drop packets from invalid src-address
	mlxsw: core: Unregister EMAD trap using FORWARD action
	NFC: trf7970a: disable all regulators on removal
	net: usb: ax88179_178a: stop lying about skb->truesize
	net: gtp: Fix Use-After-Free in gtp_dellink
	ipvs: Fix checksumming on GSO of SCTP packets
	net: openvswitch: Fix Use-After-Free in ovs_ct_exit
	mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
	mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
	mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
	mlxsw: spectrum_acl_tcam: Rate limit error message
	mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
	mlxsw: spectrum_acl_tcam: Fix warning during rehash
	mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
	mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
	i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
	iavf: Fix TC config comparison with existing adapter TC config
	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
	serial: core: Provide port lock wrappers
	serial: mxs-auart: add spinlock around changing cts state
	drm/amdgpu: restrict bo mapping within gpu address limits
	amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
	drm/amdgpu: validate the parameters of bo mapping operations more clearly
	Revert "crypto: api - Disallow identical driver names"
	net/mlx5e: Fix a race in command alloc flow
	tracing: Show size of requested perf buffer
	tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
	Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
	Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
	btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
	arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
	drm/amdgpu: Fix leak when GPU memory allocation fails
	irqchip/gic-v3-its: Prevent double free on error
	ethernet: Add helper for assigning packet type when dest address does not match device address
	net: b44: set pause params only when interface is up
	stackdepot: respect __GFP_NOLOCKDEP allocation flag
	mtd: diskonchip: work around ubsan link failure
	tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
	tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
	dmaengine: owl: fix register access functions
	idma64: Don't try to serve interrupts when device is powered off
	i2c: smbus: fix NULL function pointer dereference
	HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
	bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
	dm: limit the number of targets and parameter size area
	udp: preserve the connected status if only UDP cmsg
	serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
	Linux 5.4.275

Change-Id: I0ebcbc604c4ef7fb2b1ce4d7a530f57e27a74cb6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-05-15 16:00:38 +00:00
Carlos Llamas
68a28f551e binder: check offset alignment in binder_get_object() 
commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream.

Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().

These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.

It is worth noting this check existed prior to commit 7a67a39320
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.

Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240330190115.1877819-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-05-02 16:18:31 +02:00
Michael Bestas
6120cc56e9
 		Merge tag 'ASB-2024-04-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
https://source.android.com/docs/security/bulletin/2024-04-01

* tag 'ASB-2024-04-05_11-5.4' of https://android.googlesource.com/kernel/common:
  FROMLIST: binder: check offset alignment in binder_get_object()
  BACKPORT: f2fs: expose # of overprivision segments
  ANDROID: GKI: Update symbol list for Zebra
  ANDROID: GKI: db845c: Update symbols list and ABI
  UPSTREAM: drm/msm/dsi: Enable runtime PM
  UPSTREAM: PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
  UPSTREAM: PM: runtime: add devm_pm_runtime_enable helper

Change-Id: Ie646a1c4ae01dacb93625c5ef26283c0d9f5df33
 2024-04-19 23:55:43 +03:00
Carlos Llamas
66f4b04cb0 FROMLIST: binder: check offset alignment in binder_get_object() 
Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying
txn") introduced changes to how binder objects are copied. In doing so,
it unintentionally removed an offset alignment check done through calls
to binder_alloc_copy_from_buffer() -> check_buffer().

These calls were replaced in binder_get_object() with copy_from_user(),
so now an explicit offset alignment check is needed here. This avoids
later complications when unwinding the objects gets harder.

It is worth noting this check existed prior to commit 7a67a39320
("binder: add function to copy binder object from buffer"), likely
removed due to redundancy at the time.

Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn")
Cc:  <stable@vger.kernel.org>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>

Bug: 320661088
Link: https://lore.kernel.org/all/20240330190115.1877819-1-cmllamas@google.com/
Change-Id: Iaddabaa28de7ba7b7d35dbb639d38ca79dbc5077
Signed-off-by: Carlos Llamas <cmllamas@google.com>
 2024-04-01 16:16:30 +00:00
Greg Kroah-Hartman
806fb883ea This is the 5.4.269 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmXYSHgACgkQONu9yGCS
 aT74ag/6AqWJBzK/2xvUCYjfBU5+4ApFWQt47Ly9MKFhFX7YBjQGXS6av1YFA9Kw
 i01R9SCpIv2eaDrM7/J0wvXGybemfvQ8VyNngG30QC/0jTc4ZAj0PEbtyHpUaz4F
 HWOFfAlHAYcLQWhmjhXitoGUfeyhchWnQZpn45mkT0i3DSAEFc5gsiMlO+jaM8No
 hOaAHEpGsd7zlH32NYpWrFI0i54HSCwlaHlQFJ7U+rbWyG935RdLjMAX+488R8oc
 KccOj+xb4zQyASdC7qdgPz02U7Tm3UB5s0lLrviDiBrYVxSe77vw2TBEeejF+7ZE
 oYqjsygRYmRbKuI55rxyxph7cT93ZctL48DZJ4fT4zVIT9kak3S/NtFs0Hyr3TkY
 N6ZlDnd10cj8QsnXXtTd9QgT7Ind+3KySv7sr4a/gLO/N39EYpztrMCc/lKfG/Bu
 MPDMXBrEtKkjMelcnISwac9QcOb/MAJaepCWtYgcXbEcaBP+/Or8OM0yZPOEk7SA
 3CamE+ou0Ds/c6gnsBw6WDMTJd+sX6sw6+4cMEaWzaWiE12Ryc0gscCDJXjEAYzc
 +47PiPijNJ+iPjsos8ZaNnTQHALemgJ4cjolHivsEvAYU1s5cyKjVEgMB1MJN8ib
 y19D9L8T9BtG2ukWBxtIXMIt51VZ7B8fXodcYXbyqtV25JZj/k8=
 =cJfu
 -----END PGP SIGNATURE-----

Merge 5.4.269 into android11-5.4-lts

Changes in 5.4.269
	PCI: mediatek: Clear interrupt status before dispatching handler
	include/linux/units.h: add helpers for kelvin to/from Celsius conversion
	units: Add Watt units
	units: change from 'L' to 'UL'
	units: add the HZ macros
	serial: sc16is7xx: set safe default SPI clock frequency
	spi: introduce SPI_MODE_X_MASK macro
	serial: sc16is7xx: add check for unsupported SPI modes during probe
	ext4: allow for the last group to be marked as trimmed
	crypto: api - Disallow identical driver names
	PM: hibernate: Enforce ordering during image compression/decompression
	hwrng: core - Fix page fault dead lock on mmap-ed hwrng
	rpmsg: virtio: Free driver_override when rpmsg_remove()
	parisc/firmware: Fix F-extend for PDC addresses
	arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
	mmc: core: Use mrq.sbc in close-ended ffu
	nouveau/vmm: don't set addr on the fail path to avoid warning
	ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
	rename(): fix the locking of subdirectories
	block: Remove special-casing of compound pages
	mtd: spinand: macronix: Fix MX35LFxGE4AD page size
	fs: add mode_strip_sgid() helper
	fs: move S_ISGID stripping into the vfs_*() helpers
	powerpc: Use always instead of always-y in for crtsavres.o
	x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
	net/smc: fix illegal rmb_desc access in SMC-D connection dump
	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
	llc: make llc_ui_sendmsg() more robust against bonding changes
	llc: Drop support for ETH_P_TR_802_2.
	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
	tracing: Ensure visibility when inserting an element into tracing_map
	afs: Hide silly-rename files from userspace
	tcp: Add memory barrier to tcp_push()
	netlink: fix potential sleeping issue in mqueue_flush_file
	net/mlx5: DR, Use the right GVMI number for drop action
	net/mlx5: Use kfree(ft->g) in arfs_create_groups()
	net/mlx5e: fix a double-free in arfs_create_groups
	netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
	netfilter: nf_tables: validate NFPROTO_* family
	fjes: fix memleaks in fjes_hw_setup
	net: fec: fix the unhandled context fault from smmu
	btrfs: ref-verify: free ref cache before clearing mount opt
	btrfs: tree-checker: fix inline ref size in error messages
	btrfs: don't warn if discard range is not aligned to sector
	btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
	rbd: don't move requests to the running list on errors
	netfilter: nf_tables: reject QUEUE/DROP verdict parameters
	gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
	drm: Don't unref the same fb many times by mistake due to deadlock handling
	drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
	drm/bridge: nxp-ptn3460: simplify some error checking
	drm/exynos: fix accidental on-stack copy of exynos_drm_plane
	drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
	gpio: eic-sprd: Clear interrupt after set the interrupt type
	spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
	mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
	tick/sched: Preserve number of idle sleeps across CPU hotplug events
	x86/entry/ia32: Ensure s32 is sign extended to s64
	powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
	powerpc: Fix build error due to is_valid_bugaddr()
	powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
	powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
	powerpc/lib: Validate size for vector operations
	x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
	perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
	regulator: core: Only increment use_count when enable_count changes
	audit: Send netlink ACK before setting connection in auditd_set
	ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
	PNP: ACPI: fix fortify warning
	ACPI: extlog: fix NULL pointer dereference check
	FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
	UBSAN: array-index-out-of-bounds in dtSplitRoot
	jfs: fix slab-out-of-bounds Read in dtSearch
	jfs: fix array-index-out-of-bounds in dbAdjTree
	jfs: fix uaf in jfs_evict_inode
	pstore/ram: Fix crash when setting number of cpus to an odd number
	crypto: stm32/crc32 - fix parsing list of devices
	afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
	rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
	jfs: fix array-index-out-of-bounds in diNewExt
	s390/ptrace: handle setting of fpc register correctly
	KVM: s390: fix setting of fpc register
	SUNRPC: Fix a suspicious RCU usage warning
	ecryptfs: Reject casefold directory inodes
	ext4: fix inconsistent between segment fstrim and full fstrim
	ext4: unify the type of flexbg_size to unsigned int
	ext4: remove unnecessary check from alloc_flex_gd()
	ext4: avoid online resizing failures due to oversized flex bg
	wifi: rt2x00: restart beacon queue when hardware reset
	selftests/bpf: satisfy compiler by having explicit return in btf test
	selftests/bpf: Fix pyperf180 compilation failure with clang18
	scsi: lpfc: Fix possible file string name overflow when updating firmware
	PCI: Add no PM reset quirk for NVIDIA Spectrum devices
	bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
	ARM: dts: imx7d: Fix coresight funnel ports
	ARM: dts: imx7s: Fix lcdif compatible
	ARM: dts: imx7s: Fix nand-controller #size-cells
	wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
	bpf: Add map and need_defer parameters to .map_fd_put_ptr()
	scsi: libfc: Don't schedule abort twice
	scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
	ARM: dts: rockchip: fix rk3036 hdmi ports node
	ARM: dts: imx25/27-eukrea: Fix RTC node name
	ARM: dts: imx: Use flash@0,0 pattern
	ARM: dts: imx27: Fix sram node
	ARM: dts: imx1: Fix sram node
	ARM: dts: imx25/27: Pass timing0
	ARM: dts: imx27-apf27dev: Fix LED name
	ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
	ARM: dts: imx23/28: Fix the DMA controller node name
	block: prevent an integer overflow in bvec_try_merge_hw_page
	md: Whenassemble the array, consult the superblock of the freshest device
	arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
	arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
	wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
	wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
	wifi: cfg80211: free beacon_ies when overridden from hidden BSS
	f2fs: fix to check return value of f2fs_reserve_new_block()
	ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
	fast_dput(): handle underflows gracefully
	RDMA/IPoIB: Fix error code return in ipoib_mcast_join
	drm/drm_file: fix use of uninitialized variable
	drm/framebuffer: Fix use of uninitialized variable
	drm/mipi-dsi: Fix detach call without attach
	media: stk1160: Fixed high volume of stk1160_dbg messages
	media: rockchip: rga: fix swizzling for RGB formats
	PCI: add INTEL_HDA_ARL to pci_ids.h
	ALSA: hda: Intel: add HDA_ARL PCI ID support
	drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
	IB/ipoib: Fix mcast list locking
	media: ddbridge: fix an error code problem in ddb_probe
	drm/msm/dpu: Ratelimit framedone timeout msgs
	clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
	clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
	drm/amdgpu: Let KFD sync with VM fences
	drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
	leds: trigger: panic: Don't register panic notifier if creating the trigger failed
	um: Fix naming clash between UML and scheduler
	um: Don't use vfprintf() for os_info()
	um: net: Fix return type of uml_net_start_xmit()
	i3c: master: cdns: Update maximum prescaler value for i2c clock
	mfd: ti_am335x_tscadc: Fix TI SoC dependencies
	PCI: Only override AMD USB controller if required
	PCI: switchtec: Fix stdev_release() crash after surprise hot remove
	usb: hub: Replace hardcoded quirk value with BIT() macro
	fs/kernfs/dir: obey S_ISGID
	PCI/AER: Decode Requester ID when no error info found
	libsubcmd: Fix memory leak in uniq()
	virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
	blk-mq: fix IO hang from sbitmap wakeup race
	ceph: fix deadlock or deadcode of misusing dget()
	drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
	perf: Fix the nr_addr_filters fix
	wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
	scsi: isci: Fix an error code problem in isci_io_request_build()
	net: remove unneeded break
	ixgbe: Remove non-inclusive language
	ixgbe: Refactor returning internal error codes
	ixgbe: Refactor overtemp event handling
	ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
	ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
	llc: call sock_orphan() at release time
	netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
	netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
	net: ipv4: fix a memleak in ip_setup_cork
	af_unix: fix lockdep positive in sk_diag_dump_icons()
	net: sysfs: Fix /sys/class/net/<iface> path
	HID: apple: Add support for the 2021 Magic Keyboard
	HID: apple: Swap the Fn and Left Control keys on Apple keyboards
	HID: apple: Add 2021 magic keyboard FN key mapping
	bonding: remove print in bond_verify_device_path
	dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
	dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
	phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
	dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
	phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
	net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
	selftests: net: avoid just another constant wait
	atm: idt77252: fix a memleak in open_card_ubr0
	hwmon: (aspeed-pwm-tacho) mutex for tach reading
	hwmon: (coretemp) Fix out-of-bounds memory access
	hwmon: (coretemp) Fix bogus core_id to attr name mapping
	inet: read sk->sk_family once in inet_recv_error()
	rxrpc: Fix response to PING RESPONSE ACKs to a dead call
	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
	ppp_async: limit MRU to 64K
	netfilter: nft_compat: reject unused compat flag
	netfilter: nft_compat: restrict match/target protocol to u16
	netfilter: nft_ct: reject direction for ct id
	net/af_iucv: clean up a try_then_request_module()
	USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
	USB: serial: option: add Fibocom FM101-GL variant
	USB: serial: cp210x: add ID for IMST iM871A-USB
	hrtimer: Report offline hrtimer enqueue
	Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
	vhost: use kzalloc() instead of kmalloc() followed by memset()
	net: stmmac: xgmac: use #define for string constants
	net: stmmac: xgmac: fix a typo of register name in DPP safety handling
	netfilter: nft_set_rbtree: skip end interval element from gc
	btrfs: forbid creating subvol qgroups
	btrfs: forbid deleting live subvol qgroup
	btrfs: send: return EOPNOTSUPP on unknown flags
	of: unittest: add overlay gpio test to catch gpio hog problem
	of: unittest: Fix compile in the non-dynamic case
	spi: ppc4xx: Drop write-only variable
	ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
	MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
	i40e: Fix waiting for queues of all VSIs to be disabled
	tracing/trigger: Fix to return error if failed to alloc snapshot
	mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
	HID: wacom: generic: Avoid reporting a serial of '0' to userspace
	HID: wacom: Do not register input devices until after hid_hw_start
	USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
	usb: f_mass_storage: forbid async queue when shutdown happen
	i2c: i801: Remove i801_set_block_buffer_mode
	i2c: i801: Fix block process call transactions
	scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
	firewire: core: correct documentation of fw_csr_string() kernel API
	kbuild: Fix changing ELF file type for output of gen_btf for big endian
	nfc: nci: free rx_data_reassembly skb on NCI device cleanup
	xen-netback: properly sync TX responses
	ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
	binder: signal epoll threads of self-work
	misc: fastrpc: Mark all sessions as invalid in cb_remove
	ext4: fix double-free of blocks due to wrong extents moved_len
	tracing: Fix wasted memory in saved_cmdlines logic
	staging: iio: ad5933: fix type mismatch regression
	iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
	ring-buffer: Clean ring_buffer_poll_wait() error return
	serial: max310x: set default value when reading clock ready bit
	serial: max310x: improve crystal stable clock detection
	x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
	x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
	mmc: slot-gpio: Allow non-sleeping GPIO ro
	ALSA: hda/conexant: Add quirk for SWS JS201D
	nilfs2: fix data corruption in dsync block recovery for small block sizes
	nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
	nfp: use correct macro for LengthSelect in BAR config
	nfp: flower: prevent re-adding mac index for bonded port
	irqchip/irq-brcmstb-l2: Add write memory barrier before exit
	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
	pmdomain: core: Move the unused cleanup to a _sync initcall
	tracing: Inform kmemleak of saved_cmdlines allocation
	Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
	bus: moxtet: Add spi device table
	arch, mm: remove stale mentions of DISCONIGMEM
	mips: Fix max_mapnr being uninitialized on early stages
	KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
	netfilter: ipset: fix performance regression in swap operation
	netfilter: ipset: Missing gc cancellations fixed
	net: prevent mss overflow in skb_segment()
	sched/membarrier: reduce the ability to hammer on sys_membarrier
	nilfs2: fix potential bug in end_buffer_async_write
	PM: runtime: add devm_pm_runtime_enable helper
	PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
	drm/msm/dsi: Enable runtime PM
	lsm: new security_file_ioctl_compat() hook
	netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
	Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
	net: bcmgenet: Fix EEE implementation
	of: unittest: fix EXPECT text for gpio hog errors
	of: gpio unittest kfree() wrong object
	Linux 5.4.269

Change-Id: Iedabcdbe95a83593f102e237f2a80d2fc7206669
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-02-24 15:47:08 +00:00
Carlos Llamas
42beab162d binder: signal epoll threads of self-work 
commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream.

In (e)poll mode, threads often depend on I/O events to determine when
data is ready for consumption. Within binder, a thread may initiate a
command via BINDER_WRITE_READ without a read buffer and then make use
of epoll_wait() or similar to consume any responses afterwards.

It is then crucial that epoll threads are signaled via wakeup when they
queue their own work. Otherwise, they risk waiting indefinitely for an
event leaving their work unhandled. What is worse, subsequent commands
won't trigger a wakeup either as the thread has pending work.

Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Martijn Coenen <maco@android.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Steven Moreland <smoreland@google.com>
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-02-23 08:25:11 +01:00
Bruno Martins
2f84185dd7 Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina 
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common:
  FROMGIT: clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
  Linux 5.4.268
  arm64: dts: armada-3720-turris-mox: set irq type for RTC
  perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
  i2c: s3c24xx: fix transferring more than one message in polling mode
  i2c: s3c24xx: fix read transfers in polling mode
  mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
  kdb: Fix a potential buffer overflow in kdb_local()
  kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ
  ipvs: avoid stat macros calls from preemptible context
  netfilter: nf_tables: skip dead set elements in netlink dump
  net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
  net: ravb: Fix dma_addr_t truncation in error case
  net: phy: micrel: populate .soft_reset for KSZ9131
  net: qualcomm: rmnet: fix global oob in rmnet_policy
  s390/pci: fix max size calculation in zpci_memcpy_toio()
  PCI: keystone: Fix race condition when initializing PHYs
  nvmet-tcp: Fix the H2C expected PDU len calculation
  serial: imx: Correct clock error message in function probe()
  apparmor: avoid crash when parsed profile name is empty
  perf env: Avoid recursively taking env->bpf_progs.lock
  perf bpf: Decouple creating the evlist from adding the SB event
  perf top: Move sb_evlist to 'struct perf_top'
  perf record: Move sb_evlist to 'struct record'
  perf env: Add perf_env__numa_node()
  nvmet-tcp: fix a crash in nvmet_req_complete()
  nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
  perf genelf: Set ELF program header addresses properly
  software node: Let args be NULL in software_node_get_reference_args
  acpi: property: Let args be NULL in __acpi_node_get_property_reference
  serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
  MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
  MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
  mips: Fix incorrect max_low_pfn adjustment
  HID: wacom: Correct behavior when processing some confidence == false touches
  x86/kvm: Do not try to disable kvmclock if it was not enabled
  wifi: mwifiex: configure BSSID consistently when starting AP
  wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
  wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
  rootfs: Fix support for rootfstype= when root= is given
  fbdev: flush deferred work in fb_deferred_io_fsync()
  ALSA: oxygen: Fix right channel of capture volume mixer
  usb: mon: Fix atomicity violation in mon_bin_vma_fault
  usb: typec: class: fix typec_altmode_put_partner to put plugs
  Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
  usb: chipidea: wait controller resume finished for wakeup irq
  Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
  Revert "usb: dwc3: Soft reset phy on probe for host"
  usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
  usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
  tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
  binder: fix unused alloc->free_async_space
  binder: fix race between mmput() and do_exit()
  xen-netback: don't produce zero-size SKB frags
  Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
  Input: atkbd - use ab83 as id when skipping the getid command
  binder: fix use-after-free in shinker's callback
  binder: fix async space check for 0-sized buffers
  of: unittest: Fix of_count_phandle_with_args() expected value message
  of: Fix double free in of_parse_phandle_with_args_map
  mmc: sdhci_omap: Fix TI SoC dependencies
  clk: si5341: fix an error code problem in si5341_output_clk_set_rate
  watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
  watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
  watchdog: set cdev owner before adding
  drivers: clk: zynqmp: calculate closest mux rate
  gpu/drm/radeon: fix two memleaks in radeon_vm_init
  drivers/amd/pm: fix a use-after-free in kv_parse_power_table
  drm/amd/pm: fix a double-free in si_dpm_init
  drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
  media: dvbdev: drop refcount on error path in dvb_device_open()
  media: cx231xx: fix a memleak in cx231xx_init_isoc
  drm/bridge: tc358767: Fix return value on error case
  drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
  drm/radeon/dpm: fix a memleak in sumo_parse_power_table
  drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
  drm/drv: propagate errors from drm_modeset_register_all()
  drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
  drm/msm/mdp4: flush vblank event on disable
  ASoC: cs35l34: Fix GPIO name and drop legacy include
  ASoC: cs35l33: Fix GPIO name and drop legacy include
  drm/radeon: check return value of radeon_ring_lock()
  drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
  drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
  f2fs: fix to avoid dirent corruption
  drm/bridge: Fix typo in post_disable() description
  media: pvrusb2: fix use after free on context disconnection
  RDMA/usnic: Silence uninitialized symbol smatch warnings
  ARM: davinci: always select CONFIG_CPU_ARM926T
  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
  Bluetooth: btmtkuart: fix recv_buf() return value
  Bluetooth: Fix bogus check for re-auth no supported with non-ssp
  netfilter: nf_tables: mark newset as dead on transaction abort
  wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
  wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
  wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
  rtlwifi: rtl8192de: make arrays static const, makes object smaller
  wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
  wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
  wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
  wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
  wifi: rtlwifi: add calculate_bit_shift()
  dma-mapping: clear dev->dma_mem to NULL after freeing it
  virtio/vsock: fix logic which reduces credit update messages
  selftests/net: fix grep checking for fib_nexthop_multiprefix
  scsi: hisi_sas: Replace with standard error code return value
  arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
  scsi: fnic: Return error if vmalloc() failed
  wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
  rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift
  firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
  net/ncsi: Fix netlink major/minor version numbers
  ncsi: internal.h: Fix a spello
  ARM: dts: qcom: apq8064: correct XOADC register address
  wifi: libertas: stop selecting wext
  bpf, lpm: Fix check prefixlen before walking trie
  wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
  NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
  blocklayoutdriver: Fix reference leak of pnfs_device_node
  crypto: scomp - fix req->dst buffer overflow
  crypto: sahara - do not resize req->src when doing hash operations
  crypto: sahara - fix processing hash requests with req->nbytes < sg->length
  crypto: sahara - improve error handling in sahara_sha_process()
  crypto: sahara - fix wait_for_completion_timeout() error handling
  crypto: sahara - fix ahash reqsize
  crypto: virtio - Wait for tasklet to complete on device remove
  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
  pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
  crypto: sahara - fix error handling in sahara_hw_descriptor_create()
  crypto: sahara - fix processing requests with cryptlen < sg->length
  crypto: sahara - fix ahash selftest failure
  crypto: sahara - remove FLAGS_NEW_KEY logic
  crypto: af_alg - Disallow multiple in-flight AIO requests
  crypto: ccp - fix memleak in ccp_init_dm_workarea
  virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
  crypto: virtio - don't use 'default m'
  crypto: virtio - Handle dataq logic with tasklet
  selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
  mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
  spi: sh-msiof: Enforce fixed DTDL for R-Car H3
  calipso: fix memory leak in netlbl_calipso_add_pass()
  netlabel: remove unused parameter in netlbl_netlink_auditinfo()
  net: netlabel: Fix kerneldoc warnings
  ACPI: LPIT: Avoid u32 multiplication overflow
  ACPI: video: check for error while searching for backlight device parent
  mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
  powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
  powerpc/powernv: Add a null pointer check in opal_powercap_init()
  powerpc/powernv: Add a null pointer check in opal_event_init()
  powerpc/powernv: Add a null pointer check to scom_debug_init_one()
  selftests/powerpc: Fix error handling in FPU/VMX preemption tests
  powerpc/pseries/memhp: Fix access beyond end of drmem array
  powerpc/pseries/memhotplug: Quieten some DLPAR operations
  powerpc/44x: select I2C for CURRITUCK
  powerpc: add crtsavres.o to always-y instead of extra-y
  EDAC/thunderx: Fix possible out-of-bounds string access
  x86/lib: Fix overflow when counting digits
  coresight: etm4x: Fix width of CCITMIN field
  parport: parport_serial: Add Brainboxes device IDs and geometry
  parport: parport_serial: Add Brainboxes BAR details
  uio: Fix use-after-free in uio_open
  binder: fix comment on binder_alloc_new_buf() return value
  binder: fix trivial typo of binder_free_buf_locked()
  binder: use EPOLLERR from eventpoll.h
  ACPI: resource: Add another DMI match for the TongFang GMxXGxx
  drm/crtc: fix uninitialized variable use
  ARM: sun9i: smp: fix return code check of of_property_match_string
  ida: Fix crash in ida_free when the bitmap is empty
  Input: xpad - add Razer Wolverine V2 support
  ARC: fix spare error
  s390/scm: fix virtual vs physical address confusion
  Input: i8042 - add nomux quirk for Acer P459-G2-M
  Input: atkbd - skip ATKBD_CMD_GETID in translated mode
  reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
  ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
  tracing: Add size check when printing trace_marker output
  tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
  neighbour: Don't let neigh_forced_gc() disable preemption for long
  drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
  jbd2: correct the printing of write_flags in jbd2_write_superblock()
  clk: rockchip: rk3128: Fix HCLK_OTG gate register
  drm/exynos: fix a wrong error checking
  drm/exynos: fix a potential error pointer dereference
  nvme: introduce helper function to get ctrl state
  ASoC: da7219: Support low DC impedance headset
  net/tg3: fix race condition in tg3_reset_task()
  nouveau/tu102: flush all pdbs on vmm flush
  ASoC: rt5650: add mutex to avoid the jack detection failure
  ASoC: cs43130: Fix incorrect frame delay configuration
  ASoC: cs43130: Fix the position of const qualifier
  ASoC: Intel: Skylake: mem leak in skl register function
  ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
  ASoC: Intel: Skylake: Fix mem leak in few functions
  ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
  pinctrl: lochnagar: Don't build on MIPS
  f2fs: explicitly null-terminate the xattr list
  Revert "ipv6: make ip6_rt_gc_expire an atomic_t"
  Revert "ipv6: remove max_size check inline with ipv4"
  Linux 5.4.267
  ASoC: meson: codec-glue: fix pcm format cast warning
  ipv6: remove max_size check inline with ipv4
  ipv6: make ip6_rt_gc_expire an atomic_t
  net/dst: use a smaller percpu_counter batch for dst entries accounting
  PCI: Disable ATS for specific Intel IPU E2000 devices
  PCI: Extract ATS disabling to a helper function
  netfilter: nf_tables: Reject tables of unsupported family
  net: tls, update curr on splice as well
  ath10k: Get rid of "per_ce_irq" hw param
  ath10k: Keep track of which interrupts fired, don't poll them
  ath10k: Add interrupt summary based CE processing
  ath10k: Wait until copy complete is actually done before completing
  mmc: sdhci-sprd: Fix eMMC init failure after hw reset
  mmc: core: Cancel delayed work before releasing host
  mmc: rpmb: fixes pause retune on all RPMB partitions.
  mm: fix unmap_mapping_range high bits shift bug
  i2c: core: Fix atomic xfer check for non-preempt config
  firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
  mm/memory-failure: check the mapcount of the precise page
  net: Implement missing SO_TIMESTAMPING_NEW cmsg support
  bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters()
  asix: Add check for usbnet_get_endpoints
  net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues
  net/qla3xxx: switch from 'pci_' to 'dma_' API
  i40e: Restore VF MSI-X state during PCI reset
  ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux
  ASoC: meson: g12a-tohdmitx: Validate written enum values
  ASoC: meson: g12a: extract codec-to-codec utils
  i40e: fix use-after-free in i40e_aqc_add_filters()
  net: Save and restore msg_namelen in sock_sendmsg
  net: bcmgenet: Fix FCS generation for fragmented skbuffs
  ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init
  net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps
  can: raw: add support for SO_MARK
  can: raw: add support for SO_TXTIME/SCM_TXTIME
  net: sched: em_text: fix possible memory leak in em_text_destroy()
  i40e: Fix filter input checks to prevent config with invalid values
  nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local
  ANDROID: db845c: Enable device tree overlay support
  Linux 5.4.266
  block: Don't invalidate pagecache for invalid falloc modes
  ring-buffer: Fix wake ups when buffer_percent is set to 100
  smb: client: fix OOB in smbCalcSize()
  usb: fotg210-hcd: delete an incorrect bounds test
  x86/alternatives: Sync core before enabling interrupts
  net: rfkill: gpio: set GPIO direction
  net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  wifi: cfg80211: fix certs build to not depend on file order
  wifi: cfg80211: Add my certificate
  iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
  iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
  Input: ipaq-micro-keys - add error handling for devm_kmemdup
  iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  interconnect: Treat xlate() returning NULL node as an error
  btrfs: do not allow non subvolume root targets for snapshot
  smb: client: fix NULL deref in asn1_ber_decoder()
  ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
  ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
  pinctrl: at91-pio4: use dedicated lock class for IRQ
  i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
  afs: Fix overwriting of result of DNS query
  net: check dev->gso_max_size in gso_features_check()
  net: warn if gso_type isn't set for a GSO SKB
  afs: Fix dynamic root lookup DNS check
  afs: Fix the dynamic root's d_delete to always delete unused dentries
  net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  net/rose: fix races in rose_kill_by_device()
  ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
  net: sched: ife: fix potential use-after-free
  net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
  net/mlx5: Fix fw tracer first block check
  net/mlx5: improve some comments
  Revert "net/mlx5e: fix double free of encap_header"
  wifi: mac80211: mesh_plink: fix matches_local logic
  s390/vx: fix save/restore of fpu kernel context
  reset: Fix crash when freeing non-existent optional resets
  ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
  ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
  ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
  ANDROID: GKI: fix crc issue in include/net/addrconf.h
  Revert "cred: switch to using atomic_long_t"
  Linux 5.4.265
  powerpc/ftrace: Fix stack teardown in ftrace_no_trace
  powerpc/ftrace: Create a dummy stackframe to fix stack unwind
  mmc: block: Be sure to wait while busy in CQE error recovery
  ring-buffer: Fix memory leak of free page
  team: Fix use-after-free when an option instance allocation fails
  arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
  soundwire: stream: fix NULL pointer dereference for multi_link
  perf: Fix perf_event_validate_size() lockdep splat
  HID: hid-asus: add const to read-only outgoing usb buffer
  net: usb: qmi_wwan: claim interface 4 for ZTE MF290
  asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
  HID: hid-asus: reset the backlight brightness level on resume
  HID: add ALWAYS_POLL quirk for Apple kb
  platform/x86: intel_telemetry: Fix kernel doc descriptions
  bcache: avoid NULL checking to c->root in run_cache_set()
  bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
  bcache: avoid oversize memory allocation by small stripe_size
  blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
  usb: aqc111: check packet for fixup for true limit
  Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants
  cred: switch to using atomic_long_t
  appletalk: Fix Use-After-Free in atalk_ioctl
  net: stmmac: Handle disabled MDIO busses from devicetree
  net: stmmac: use dev_err_probe() for reporting mdio bus registration failure
  vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
  sign-file: Fix incorrect return values check
  net: Remove acked SYN flag from packet in the transmit queue correctly
  qed: Fix a potential use-after-free in qed_cxt_tables_alloc
  net/rose: Fix Use-After-Free in rose_ioctl
  atm: Fix Use-After-Free in do_vcc_ioctl
  atm: solos-pci: Fix potential deadlock on &tx_queue_lock
  atm: solos-pci: Fix potential deadlock on &cli_queue_lock
  qca_spi: Fix reset behavior
  qca_debug: Fix ethtool -G iface tx behavior
  qca_debug: Prevent crash on TX ring changes
  net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
  afs: Fix refcount underflow from error handling race
  Revert "psample: Require 'CAP_NET_ADMIN' when joining "packets" group"
  Revert "mmc: core: add helpers mmc_regulator_enable/disable_vqmmc"
  Revert "mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled"
  Revert "genetlink: add CAP_NET_ADMIN test for multicast bind"
  Revert "drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group"
  Revert "perf/core: Add a new read format to get a number of lost samples"
  Revert "perf: Fix perf_event_validate_size()"
  Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  Linux 5.4.264
  devcoredump: Send uevent once devcd is ready
  devcoredump : Serialize devcd_del work
  smb: client: fix potential NULL deref in parse_dfs_referrals()
  cifs: Fix non-availability of dedup breaking generic/304
  Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem"
  tools headers UAPI: Sync linux/perf_event.h with the kernel sources
  drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
  psample: Require 'CAP_NET_ADMIN' when joining "packets" group
  genetlink: add CAP_NET_ADMIN test for multicast bind
  netlink: don't call ->netlink_bind with table lock held
  io_uring/af_unix: disable sending io_uring over sockets
  nilfs2: fix missing error check for sb_set_blocksize call
  KVM: s390/mm: Properly reset no-dat
  x86/CPU/AMD: Check vendor in the AMD microcode callback
  serial: 8250_omap: Add earlycon support for the AM654 UART controller
  serial: sc16is7xx: address RX timeout interrupt errata
  ARM: PL011: Fix DMA support
  usb: typec: class: fix typec_altmode_put_partner to put plugs
  parport: Add support for Brainboxes IX/UC/PX parallel cards
  usb: gadget: f_hid: fix report descriptor allocation
  mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled
  mmc: core: add helpers mmc_regulator_enable/disable_vqmmc
  gpiolib: sysfs: Fix error handling on failed export
  perf: Fix perf_event_validate_size()
  perf/core: Add a new read format to get a number of lost samples
  arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
  arm64: dts: mediatek: mt7622: fix memory node warning check
  packet: Move reference count in packet_sock to atomic_long_t
  tracing: Fix a possible race when disabling buffered events
  tracing: Fix incomplete locking when disabling buffered events
  tracing: Always update snapshot buffer size
  nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
  ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
  ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
  ARM: dts: imx: make gpt node name generic
  ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
  scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
  tracing: Fix a warning when allocating buffered events fails
  ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
  hwmon: (acpi_power_meter) Fix 4.29 MW bug
  RDMA/bnxt_re: Correct module description string
  bpf: sockmap, updating the sg structure should also update curr
  tcp: do not accept ACK of bytes we never sent
  netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
  net: hns: fix fake link up on xge port
  ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  arcnet: restoring support for multiple Sohard Arcnet cards
  net: arcnet: com20020 fix error handling
  net: arcnet: Fix RESET flag handling
  hv_netvsc: rndis_filter needs to select NLS
  ipv6: fix potential NULL deref in fib6_add()
  of: dynamic: Fix of_reconfig_get_state_change() return value documentation
  of: Add missing 'Return' section in kerneldoc comments
  of: Fix kerneldoc output formatting
  of: base: Fix some formatting issues and provide missing descriptions
  of/irq: Make of_msi_map_rid() PCI bus agnostic
  of/irq: make of_msi_map_get_device_domain() bus agnostic
  of/iommu: Make of_map_rid() PCI agnostic
  ACPI/IORT: Make iort_msi_map_rid() PCI agnostic
  ACPI/IORT: Make iort_get_device_domain IRQ domain agnostic
  of: base: Add of_get_cpu_state_node() to get idle states for a CPU node
  drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  kconfig: fix memory leak from range properties
  tg3: Increment tx_dropped in tg3_tso_bug()
  tg3: Move the [rt]x_dropped counters to tg3_napi
  netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
  hrtimers: Push pending hrtimers away from outgoing CPU earlier
  Revert "HID: core: store the unique system identifier in hid_device"
  Revert "HID: fix HID device resource race between HID core and debugging support"
  Linux 5.4.263
  mmc: block: Retry commands in CQE error recovery
  mmc: core: convert comma to semicolon
  mmc: cqhci: Fix task clearing in CQE error recovery
  mmc: cqhci: Warn of halt or task clear failure
  mmc: cqhci: Increase recovery halt timeout
  cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
  cpufreq: imx6q: don't warn for disabling a non-existing frequency
  scsi: qla2xxx: Fix system crash due to bad pointer access
  scsi: qla2xxx: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  scsi: core: Introduce the scsi_cmd_to_rq() function
  scsi: qla2xxx: Simplify the code for aborting SCSI commands
  ima: detect changes to the backing overlay file
  ovl: skip overlayfs superblocks at global sync
  ima: annotate iint mutex to avoid lockdep false positive warnings
  fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
  mtd: cfi_cmdset_0001: Byte swap OTP info
  mtd: cfi_cmdset_0001: Support the absence of protection registers
  s390/cmma: fix detection of DAT pages
  s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
  smb3: fix touch -h of symlink
  net: ravb: Start TX queues after HW initialization succeeded
  net: ravb: Use pm_runtime_resume_and_get()
  ravb: Fix races between ravb_tx_timeout_work() and net related ops
  net: stmmac: xgmac: Disable FPE MMC interrupts
  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  Input: xpad - add HyperX Clutch Gladiate Support
  btrfs: make error messages more clear when getting a chunk map
  btrfs: send: ensure send_fd is writable
  btrfs: fix off-by-one when checking chunk map includes logical address
  btrfs: add dmesg output for first mount and last unmount of a filesystem
  powerpc: Don't clobber f0/vs0 during fp|altivec register save
  bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
  dm verity: don't perform FEC for failed readahead IO
  dm-verity: align struct dm_verity_fec_io properly
  ALSA: hda/realtek: Add supported ALC257 for ChromeOS
  ALSA: hda/realtek: Headset Mic VREF to 100%
  ALSA: hda: Disable power-save on KONTRON SinglePC
  mmc: block: Do not lose cache flush during CQE error recovery
  firewire: core: fix possible memory leak in create_units()
  pinctrl: avoid reload of p state in list iteration
  io_uring: fix off-by one bvec index
  USB: dwc3: qcom: fix wakeup after probe deferral
  USB: dwc3: qcom: fix resource leaks on probe deferral
  usb: dwc3: set the dma max_seg_size
  USB: dwc2: write HCINT with INTMASK applied
  USB: serial: option: don't claim interface 4 for ZTE MF290
  USB: serial: option: fix FM101R-GL defines
  USB: serial: option: add Fibocom L7xx modules
  bcache: prevent potential division by zero error
  bcache: check return value from btree_node_alloc_replacement()
  dm-delay: fix a race between delay_presuspend and delay_bio
  hv_netvsc: Mark VF as slave before exposing it to user-mode
  hv_netvsc: Fix race of register_netdevice_notifier and VF register
  USB: serial: option: add Luat Air72*U series products
  s390/dasd: protect device queue against concurrent access
  bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
  ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA
  KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
  arm64: cpufeature: Extract capped perfmon fields
  ext4: make sure allocate pending entry not fail
  ext4: fix slab-use-after-free in ext4_es_insert_extent()
  ext4: using nofail preallocation in ext4_es_insert_extent()
  ext4: using nofail preallocation in ext4_es_insert_delayed_block()
  ext4: using nofail preallocation in ext4_es_remove_extent()
  ext4: use pre-allocated es in __es_remove_extent()
  ext4: use pre-allocated es in __es_insert_extent()
  ext4: factor out __es_alloc_extent() and __es_free_extent()
  ext4: add a new helper to check if es must be kept
  MIPS: KVM: Fix a build warning about variable set but not used
  nvmet: nul-terminate the NQNs passed in the connect command
  nvmet: remove unnecessary ctrl parameter
  afs: Fix file locking on R/O volumes to operate in local mode
  afs: Return ENOENT if no cell DNS record can be found
  net: axienet: Fix check for partial TX checksum
  amd-xgbe: propagate the correct speed and duplex status
  amd-xgbe: handle the corner-case during tx completion
  amd-xgbe: handle corner-case during sfp hotplug
  arm/xen: fix xen_vcpu_info allocation alignment
  net: usb: ax88179_178a: fix failed operations during ax88179_reset
  ipv4: Correct/silence an endian warning in __ip_do_redirect
  HID: fix HID device resource race between HID core and debugging support
  HID: core: store the unique system identifier in hid_device
  drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
  ata: pata_isapnp: Add missing error check for devm_ioport_map()
  drm/panel: simple: Fix Innolux G101ICE-L01 timings
  drm/panel: simple: Fix Innolux G101ICE-L01 bus flags
  afs: Make error on cell lookup failure consistent with OpenAFS
  PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
  RDMA/irdma: Prevent zero-length STAG registration
  driver core: Release all resources during unbind before updating device links
  ANDROID: GKI: db845c: Update symbols list and ABI on rpmsg_register_device_override
  Revert "tracing: Have trace_event_file have ref counters"
  Linux 5.4.262
  netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 5.4)
  netfilter: nf_tables: disable toggling dormant table state more than once
  netfilter: nf_tables: fix table flag updates
  netfilter: nftables: update table flags from the commit phase
  netfilter: nf_tables: double hook unregistration in netns path
  netfilter: nf_tables: unregister flowtable hooks on netns exit
  netfilter: nf_tables: fix memleak when more than 255 elements expired
  netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
  netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
  netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
  netfilter: nf_tables: defer gc run if previous batch is still pending
  netfilter: nf_tables: use correct lock to protect gc_list
  netfilter: nf_tables: GC transaction race with abort path
  netfilter: nf_tables: GC transaction race with netns dismantle
  netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
  netfilter: nf_tables: remove busy mark and gc batch API
  netfilter: nft_set_hash: mark set element as dead when deleting from packet path
  netfilter: nf_tables: adapt set backend to use GC transaction API
  netfilter: nf_tables: GC transaction API to avoid race with control plane
  netfilter: nf_tables: don't skip expired elements during walk
  netfilter: nft_set_rbtree: fix overlap expiration walk
  netfilter: nft_set_rbtree: fix null deref on element insertion
  netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
  netfilter: nf_tables: drop map element references from preparation phase
  netfilter: nftables: rename set element data activation/deactivation functions
  netfilter: nf_tables: pass context to nft_set_destroy()
  tracing: Have trace_event_file have ref counters
  drm/amdgpu: fix error handling in amdgpu_bo_list_get()
  ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
  ext4: correct the start block of counting reserved clusters
  ext4: correct return value of ext4_convert_meta_bg
  ext4: correct offset of gdb backup in non meta_bg group to update_backups
  ext4: apply umask if ACL support is disabled
  Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
  nfsd: fix file memleak on client_opens_release
  media: venus: hfi: add checks to handle capabilities from firmware
  media: venus: hfi: fix the check to handle session buffer requirement
  media: venus: hfi_parser: Add check to keep the number of codecs within range
  media: sharp: fix sharp encoding
  media: lirc: drop trailing space from scancode transmit
  i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
  net: dsa: lan9303: consequently nested-lock physical MDIO
  Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
  Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
  Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
  bluetooth: Add device 13d3:3571 to device tables
  bluetooth: Add device 0bda:887b to device tables
  Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
  Bluetooth: btusb: add Realtek 8822CE to usb_device_id table
  Bluetooth: btusb: Add flag to define wideband speech capability
  tty: serial: meson: fix hard LOCKUP on crtscts mode
  serial: meson: Use platform_get_irq() to get the interrupt
  tty: serial: meson: retrieve port FIFO size from DT
  serial: meson: remove redundant initialization of variable id
  ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
  ALSA: info: Fix potential deadlock at disconnection
  parisc/pgtable: Do not drop upper 5 address bits of physical address
  parisc: Prevent booting 64-bit kernels on PA1.x machines
  i3c: master: cdns: Fix reading status register
  mm/cma: use nth_page() in place of direct struct page manipulation
  dmaengine: stm32-mdma: correct desc prep when channel running
  mcb: fix error handling for different scenarios when parsing
  i2c: core: Run atomic i2c xfer when !preemptible
  kernel/reboot: emergency_restart: Set correct system_state
  quota: explicitly forbid quota files from being encrypted
  jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
  btrfs: don't arbitrarily slow down delalloc if we're committing
  PM: hibernate: Clean up sync_read handling in snapshot_write_next()
  PM: hibernate: Use __get_safe_page() rather than touching the list
  mmc: vub300: fix an error code
  clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
  parisc/pdc: Add width field to struct pdc_model
  PCI: keystone: Don't discard .probe() callback
  PCI: keystone: Don't discard .remove() callback
  genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
  mmc: meson-gx: Remove setting of CMD_CFG_ERROR
  ACPI: resource: Do IRQ override on TongFang GMxXGxx
  PCI/sysfs: Protect driver's D3cold preference from user space
  hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
  audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
  audit: don't take task_lock() in audit_exe_compare() code path
  KVM: x86: Ignore MSR_AMD64_TW_CFG access
  KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
  x86/cpu/hygon: Fix the CPU topology evaluation for real
  scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
  bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
  randstruct: Fix gcc-plugin performance mode to stay in group
  media: venus: hfi: add checks to perform sanity on queue pointers
  cifs: spnego: add ';' in HOST_KEY_LEN
  tools/power/turbostat: Fix a knl bug
  macvlan: Don't propagate promisc change to lower dev in passthru
  net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
  net/mlx5_core: Clean driver version and name
  net/mlx5e: fix double free of encap_header
  net: stmmac: fix rx budget limit check
  net: stmmac: Rework stmmac_rx()
  netfilter: nf_conntrack_bridge: initialize err to 0
  net: ethernet: cortina: Fix MTU max setting
  net: ethernet: cortina: Handle large frames
  net: ethernet: cortina: Fix max RX frame define
  bonding: stop the device in bond_setup_by_slave()
  ptp: annotate data-race around q->head and q->tail
  xen/events: fix delayed eoi list handling
  ppp: limit MRU to 64K
  tipc: Fix kernel-infoleak due to uninitialized TLV value
  net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
  tty: Fix uninit-value access in ppp_sync_receive()
  ipvlan: add ipvlan_route_v6_outbound() helper
  NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
  wifi: iwlwifi: Use FW rate for non-data frames
  pwm: Fix double shift bug
  ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
  kgdb: Flush console before entering kgdb on panic
  drm/amd/display: Avoid NULL dereference of timing generator
  media: cobalt: Use FIELD_GET() to extract Link Width
  gfs2: ignore negated quota changes
  media: vivid: avoid integer overflow
  media: gspca: cpia1: shift-out-of-bounds in set_flicker
  i2c: sun6i-p2wi: Prevent potential division by zero
  usb: gadget: f_ncm: Always set current gadget in ncm_bind()
  tty: vcc: Add check for kstrdup() in vcc_probe()
  HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
  scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
  atm: iphase: Do PCI error checks on own line
  PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
  ALSA: hda: Fix possible null-ptr-deref when assigning a stream
  ARM: 9320/1: fix stack depot IRQ stack filter
  jfs: fix array-index-out-of-bounds in diAlloc
  jfs: fix array-index-out-of-bounds in dbFindLeaf
  fs/jfs: Add validity check for db_maxag and db_agpref
  fs/jfs: Add check for negative db_l2nbperpage
  RDMA/hfi1: Use FIELD_GET() to extract Link Width
  crypto: pcrypt - Fix hungtask for PADATA_RESET
  selftests/efivarfs: create-read: fix a resource leak
  drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
  drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
  drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
  drm/komeda: drop all currently held locks if deadlock happens
  platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
  Bluetooth: Fix double free in hci_conn_cleanup
  wifi: ath10k: Don't touch the CE interrupt registers after power up
  net: annotate data-races around sk->sk_dst_pending_confirm
  net: annotate data-races around sk->sk_tx_queue_mapping
  wifi: ath10k: fix clang-specific fortify warning
  wifi: ath9k: fix clang-specific fortify warnings
  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
  wifi: mac80211_hwsim: fix clang-specific fortify warning
  x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
  clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
  clocksource/drivers/timer-imx-gpt: Fix potential memory leak
  perf/core: Bail out early if the request AUX area is out of bound
  locking/ww_mutex/test: Fix potential workqueue corruption
  Revert "inet: shrink struct flowi_common"
  Revert "ipvlan: properly track tx_errors"
  ANDROID: fix up rpmsg_device ABI break
  ANDROID: fix up platform_device ABI break
  Linux 5.4.261
  btrfs: use u64 for buffer sizes in the tree search ioctls
  Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
  fbdev: fsl-diu-fb: mark wr_reg_wa() static
  fbdev: imsttfb: fix a resource leak in probe
  fbdev: imsttfb: Fix error path of imsttfb_probe()
  spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
  drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
  netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
  netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs
  netfilter: xt_recent: fix (increase) ipv6 literal buffer length
  r8169: respect userspace disabling IFF_MULTICAST
  tg3: power down device only on SYSTEM_POWER_OFF
  net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
  net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
  Fix termination state for idr_for_each_entry_ul()
  net: r8169: Disable multicast filter for RTL8168H and RTL8107E
  dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
  dccp: Call security_inet_conn_request() after setting IPv4 addresses.
  inet: shrink struct flowi_common
  tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
  llc: verify mac len before reading mac header
  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
  pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
  pwm: sti: Reduce number of allocations and drop usage of chip_data
  pwm: sti: Avoid conditional gotos
  regmap: prevent noinc writes from clobbering cache
  media: dvb-usb-v2: af9035: fix missing unlock
  media: s3c-camif: Avoid inappropriate kfree()
  media: bttv: fix use after free error due to btv->timeout timer
  pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
  pcmcia: ds: fix refcount leak in pcmcia_device_add()
  pcmcia: cs: fix possible hung task and memory leak pccardd()
  rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
  i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
  powerpc/pseries: fix potential memory leak in init_cpu_associativity()
  powerpc/imc-pmu: Use the correct spinlock initializer.
  powerpc/xive: Fix endian conversion size
  modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
  f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
  dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
  USB: usbip: fix stub_dev hub disconnect
  tools: iio: iio_generic_buffer ensure alignment
  tools: iio: iio_generic_buffer: Fix some integer type and calculation
  tools: iio: privatize globals and functions in iio_generic_buffer.c file
  misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
  dmaengine: ti: edma: handle irq_of_parse_and_map() errors
  usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
  tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
  leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
  ledtrig-cpu: Limit to 8 CPUs
  leds: pwm: Don't disable the PWM when the LED should be off
  leds: pwm: convert to atomic PWM API
  leds: pwm: simplify if condition
  mfd: dln2: Fix double put in dln2_probe
  ASoC: ams-delta.c: use component after check
  ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
  sh: bios: Revive earlyprintk support
  RDMA/hfi1: Workaround truncation compilation error
  scsi: ufs: core: Leave space for '\0' in utf8 desc string
  ext4: move 'ix' sanity check to corrent position
  ARM: 9321/1: memset: cast the constant byte to unsigned char
  hid: cp2112: Fix duplicate workqueue initialization
  HID: cp2112: Use irqchip template
  crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
  crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
  nd_btt: Make BTT lanes preemptible
  sched/rt: Provide migrate_disable/enable() inlines
  libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value
  hwrng: geode - fix accessing registers
  clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped
  firmware: ti_sci: Mark driver as non removable
  firmware: ti_sci: Replace HTTP links with HTTPS ones
  soc: qcom: llcc: Handle a second device without data corruption
  soc: qcom: Rename llcc-slice to llcc-qcom
  soc: qcom: llcc cleanup to get rid of sdm845 specific driver file
  ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
  arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
  drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
  drm/radeon: possible buffer overflow
  drm/rockchip: vop: Fix call to crtc reset helper
  drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
  hwmon: (coretemp) Fix potentially truncated sysfs attribute name
  platform/x86: wmi: Fix opening of char device
  platform/x86: wmi: remove unnecessary initializations
  platform/x86: wmi: Fix probe failure when failing to register WMI devices
  clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
  clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
  clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
  clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
  clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
  clk: npcm7xx: Fix incorrect kfree
  clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
  clk: imx: Select MXC_CLK for CLK_IMX8QXP
  clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
  clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents
  clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
  regmap: debugfs: Fix a erroneous check after snprintf()
  ipvlan: properly track tx_errors
  net: add DEV_STATS_READ() helper
  ipv6: avoid atomic fragment on GSO packets
  ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
  tcp: fix cookie_init_timestamp() overflows
  tcp: Remove one extra ktime_get_ns() from cookie_init_timestamp
  chtls: fix tp->rcv_tstamp initialization
  r8169: fix rare issue with broken rx after link-down on RTL8125
  r8169: use tp_to_dev instead of open code
  thermal: core: prevent potential string overflow
  can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
  can: dev: can_restart(): don't crash kernel if carrier is OK
  wifi: rtlwifi: fix EDCA limit set by BT coexistence
  tcp_metrics: do not create an entry from tcp_init_metrics()
  tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
  tcp_metrics: add missing barriers on delete
  wifi: mt76: mt7603: rework/fix rx pse hang check
  wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
  tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
  i40e: fix potential memory leaks in i40e_remove()
  genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
  vfs: fix readahead(2) on block devices
  Linux 5.4.260
  tty: 8250: Add support for Intashield IS-100
  tty: 8250: Add support for Brainboxes UP cards
  tty: 8250: Add support for additional Brainboxes UC cards
  tty: 8250: Remove UC-257 and UC-431
  usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
  PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
  Revert "ARM: dts: Move am33xx and am43xx mmc nodes to sdhci-omap driver"
  nvmet-tcp: Fix a possible UAF in queue intialization setup
  nvmet-tcp: move send/recv error handling in the send/recv methods instead of call-sites
  remove the sx8 block driver
  ata: ahci: fix enum constants for gcc-13
  net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
  platform/mellanox: mlxbf-tmfifo: Fix a warning message
  platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
  scsi: mpt3sas: Fix in error path
  fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
  ASoC: rt5650: fix the wrong result of key button
  netfilter: nfnetlink_log: silence bogus compiler warning
  spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
  fbdev: atyfb: only use ioremap_uc() on i386 and ia64
  Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
  dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
  irqchip/stm32-exti: add missing DT IRQ flag translation
  Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
  x86: Fix .brk attribute in linker script
  rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
  rpmsg: glink: Release driver_override
  rpmsg: Fix calling device_lock() on non-initialized device
  rpmsg: Fix kfree() of static memory on setting driver_override
  rpmsg: Constify local variable in field store macro
  driver: platform: Add helper for safer setting of driver_override
  ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
  ext4: avoid overlapping preallocations due to overflow
  ext4: add two helper functions extent_logical_end() and pa_logical_end()
  x86/mm: Fix RESERVE_BRK() for older binutils
  x86/mm: Simplify RESERVE_BRK()
  nfsd: lock_rename() needs both directories to live on the same fs
  f2fs: fix to do sanity check on inode type during garbage collection
  smbdirect: missing rc checks while waiting for rdma events
  kobject: Fix slab-out-of-bounds in fill_kobj_path()
  arm64: fix a concurrency issue in emulation_proc_handler()
  drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()
  x86/i8259: Skip probing when ACPI/MADT advertises PCAT compatibility
  i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR
  clk: Sanitize possible_parent_show to Handle Return Value of of_clk_get_parent_name
  perf/core: Fix potential NULL deref
  nvmem: imx: correct nregs for i.MX6UL
  nvmem: imx: correct nregs for i.MX6SLL
  nvmem: imx: correct nregs for i.MX6ULL
  i2c: aspeed: Fix i2c bus hang in slave read
  i2c: stm32f7: Fix PEC handling in case of SMBUS transfers
  i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node()
  i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node()
  iio: exynos-adc: request second interupt only when touchscreen mode is used
  gtp: fix fragmentation needed check with gso
  gtp: uapi: fix GTPA_MAX
  tcp: fix wrong RTO timeout when received SACK reneging
  r8152: Cancel hw_phy_work if we have an error in probe
  r8152: Run the unload routine if we have errors during probe
  r8152: Increase USB control msg timeout to 5000ms as per spec
  net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show()
  igc: Fix ambiguity in the ethtool advertising
  neighbour: fix various data-races
  igb: Fix potential memory leak in igb_add_ethtool_nfc_entry
  treewide: Spelling fix in comment
  r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
  r8169: fix the KCSAN reported data-race in rtl_tx while reading TxDescArray[entry].opts1
  virtio-mmio: fix memory leak of vm_dev
  virtio_balloon: Fix endless deflation and inflation on arm64
  mcb-lpc: Reallocate memory region to avoid memory overlapping
  mcb: Return actual parsed size when reading chameleon table
  selftests/ftrace: Add new test case which checks non unique symbol
  mtd: rawnand: marvell: Ensure program page operations are successful

 Conflicts:
	drivers/clk/qcom/gcc-sm8150.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	drivers/soc/qcom/Kconfig
	drivers/soc/qcom/Makefile
	drivers/soc/qcom/llcc-qcom.c
	drivers/usb/dwc3/core.c
	drivers/usb/gadget/function/f_ncm.c
	include/linux/soc/qcom/llcc-qcom.h
	include/net/netfilter/nf_tables.h
	mm/memory-failure.c
	net/netfilter/nf_tables_api.c
	net/netfilter/nft_set_hash.c
	net/netfilter/nft_set_rbtree.c

 Notes:

   * Dropped the following upstream commits:
	813fddd | AOSP soc: qcom: Rename llcc-slice to llcc-qcom
	0770107 | AOSP soc: qcom: llcc cleanup to get rid of sdm845 specific driver file

Change-Id: Id31af0559be59eccc0cd242940754292baed09f7
 2024-02-08 19:02:48 +00:00
Greg Kroah-Hartman
74299cb130 This is the 5.4.268 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWy4hYACgkQONu9yGCS
 aT7SVBAAyx1DlSyJWcqzpESH0+VfqyWHxXlKS6Ip5wT0/+t0gglIKkwU/O0FsRXw
 pLO24wL0+MuIzgfZZj7wieAOPlGLOonKAvvUHGEMlpfAzyKjmZuW93WLKQlA/Oec
 uaT2ooQevRQcgXzbuV1yN/CeCnhbtmiQdcwy6OU5QACfzguQYtDbNGpbVHJEyEIW
 khlr+tj1KgRMzh/Sx76RPg4C/hkZBHun3tPcE0lTg+5QZDSkUj5gEdhVOSG2qmSh
 Lj9zt/isY3v6Whixel9YoTLr9SukI7ZlKzMrH1kSbGtTW3uZqgqB+7wCi1tWoNE1
 Zwu9/kUe1dU1kfwYW8AA5OwupjBjADVnZZx1cKN3nQZG2J8bSKHwHmuZPx3DGhJ1
 sxlaQ0nGvcEbCKljlIqsHzx2U22YKk939mVz5Y+MZYT5uwWRHI+iH4yRW97putSP
 t8tb3uX69Gsl6B+gLu38Mr7kkwyY06xmMnc5dfNCPwh8SxLj3dG7Gft90CNq1JKT
 q2cwlMEcDZRlC08kwzD7pRehZ6hYLRlTOv8yhQsQefcfzrtsT18Cec5TI2k72NOe
 fbIY8us3Qsr8JVSYuObGqT8LmkX9pkmRozEXgENvwltijEsWULoO2Hs+Z/yD07z8
 RYqtxWxVxFVeHTkrXbbMUTZWhFx5LE+rtxCySpfeFkv0WgRRwa8=
 =vkKq
 -----END PGP SIGNATURE-----

Merge 5.4.268 into android11-5.4-lts

Changes in 5.4.268
	f2fs: explicitly null-terminate the xattr list
	pinctrl: lochnagar: Don't build on MIPS
	ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
	ASoC: Intel: Skylake: Fix mem leak in few functions
	ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
	ASoC: Intel: Skylake: mem leak in skl register function
	ASoC: cs43130: Fix the position of const qualifier
	ASoC: cs43130: Fix incorrect frame delay configuration
	ASoC: rt5650: add mutex to avoid the jack detection failure
	nouveau/tu102: flush all pdbs on vmm flush
	net/tg3: fix race condition in tg3_reset_task()
	ASoC: da7219: Support low DC impedance headset
	nvme: introduce helper function to get ctrl state
	drm/exynos: fix a potential error pointer dereference
	drm/exynos: fix a wrong error checking
	clk: rockchip: rk3128: Fix HCLK_OTG gate register
	jbd2: correct the printing of write_flags in jbd2_write_superblock()
	drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
	neighbour: Don't let neigh_forced_gc() disable preemption for long
	tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
	tracing: Add size check when printing trace_marker output
	ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
	reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
	Input: atkbd - skip ATKBD_CMD_GETID in translated mode
	Input: i8042 - add nomux quirk for Acer P459-G2-M
	s390/scm: fix virtual vs physical address confusion
	ARC: fix spare error
	Input: xpad - add Razer Wolverine V2 support
	ida: Fix crash in ida_free when the bitmap is empty
	ARM: sun9i: smp: fix return code check of of_property_match_string
	drm/crtc: fix uninitialized variable use
	ACPI: resource: Add another DMI match for the TongFang GMxXGxx
	binder: use EPOLLERR from eventpoll.h
	binder: fix trivial typo of binder_free_buf_locked()
	binder: fix comment on binder_alloc_new_buf() return value
	uio: Fix use-after-free in uio_open
	parport: parport_serial: Add Brainboxes BAR details
	parport: parport_serial: Add Brainboxes device IDs and geometry
	coresight: etm4x: Fix width of CCITMIN field
	x86/lib: Fix overflow when counting digits
	EDAC/thunderx: Fix possible out-of-bounds string access
	powerpc: add crtsavres.o to always-y instead of extra-y
	powerpc/44x: select I2C for CURRITUCK
	powerpc/pseries/memhotplug: Quieten some DLPAR operations
	powerpc/pseries/memhp: Fix access beyond end of drmem array
	selftests/powerpc: Fix error handling in FPU/VMX preemption tests
	powerpc/powernv: Add a null pointer check to scom_debug_init_one()
	powerpc/powernv: Add a null pointer check in opal_event_init()
	powerpc/powernv: Add a null pointer check in opal_powercap_init()
	powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
	mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
	ACPI: video: check for error while searching for backlight device parent
	ACPI: LPIT: Avoid u32 multiplication overflow
	net: netlabel: Fix kerneldoc warnings
	netlabel: remove unused parameter in netlbl_netlink_auditinfo()
	calipso: fix memory leak in netlbl_calipso_add_pass()
	spi: sh-msiof: Enforce fixed DTDL for R-Car H3
	mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
	selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
	crypto: virtio - Handle dataq logic with tasklet
	crypto: virtio - don't use 'default m'
	virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
	crypto: ccp - fix memleak in ccp_init_dm_workarea
	crypto: af_alg - Disallow multiple in-flight AIO requests
	crypto: sahara - remove FLAGS_NEW_KEY logic
	crypto: sahara - fix ahash selftest failure
	crypto: sahara - fix processing requests with cryptlen < sg->length
	crypto: sahara - fix error handling in sahara_hw_descriptor_create()
	pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
	gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
	crypto: virtio - Wait for tasklet to complete on device remove
	crypto: sahara - fix ahash reqsize
	crypto: sahara - fix wait_for_completion_timeout() error handling
	crypto: sahara - improve error handling in sahara_sha_process()
	crypto: sahara - fix processing hash requests with req->nbytes < sg->length
	crypto: sahara - do not resize req->src when doing hash operations
	crypto: scomp - fix req->dst buffer overflow
	blocklayoutdriver: Fix reference leak of pnfs_device_node
	NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
	wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
	bpf, lpm: Fix check prefixlen before walking trie
	wifi: libertas: stop selecting wext
	ARM: dts: qcom: apq8064: correct XOADC register address
	ncsi: internal.h: Fix a spello
	net/ncsi: Fix netlink major/minor version numbers
	firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
	rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift
	wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
	scsi: fnic: Return error if vmalloc() failed
	arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
	scsi: hisi_sas: Replace with standard error code return value
	selftests/net: fix grep checking for fib_nexthop_multiprefix
	virtio/vsock: fix logic which reduces credit update messages
	dma-mapping: clear dev->dma_mem to NULL after freeing it
	wifi: rtlwifi: add calculate_bit_shift()
	wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
	rtlwifi: rtl8192de: make arrays static const, makes object smaller
	wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
	netfilter: nf_tables: mark newset as dead on transaction abort
	Bluetooth: Fix bogus check for re-auth no supported with non-ssp
	Bluetooth: btmtkuart: fix recv_buf() return value
	ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
	ARM: davinci: always select CONFIG_CPU_ARM926T
	RDMA/usnic: Silence uninitialized symbol smatch warnings
	media: pvrusb2: fix use after free on context disconnection
	drm/bridge: Fix typo in post_disable() description
	f2fs: fix to avoid dirent corruption
	drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
	drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
	drm/radeon: check return value of radeon_ring_lock()
	ASoC: cs35l33: Fix GPIO name and drop legacy include
	ASoC: cs35l34: Fix GPIO name and drop legacy include
	drm/msm/mdp4: flush vblank event on disable
	drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
	drm/drv: propagate errors from drm_modeset_register_all()
	drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
	drm/radeon/dpm: fix a memleak in sumo_parse_power_table
	drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
	drm/bridge: tc358767: Fix return value on error case
	media: cx231xx: fix a memleak in cx231xx_init_isoc
	media: dvbdev: drop refcount on error path in dvb_device_open()
	drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
	drm/amd/pm: fix a double-free in si_dpm_init
	drivers/amd/pm: fix a use-after-free in kv_parse_power_table
	gpu/drm/radeon: fix two memleaks in radeon_vm_init
	drivers: clk: zynqmp: calculate closest mux rate
	watchdog: set cdev owner before adding
	watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
	watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
	clk: si5341: fix an error code problem in si5341_output_clk_set_rate
	mmc: sdhci_omap: Fix TI SoC dependencies
	of: Fix double free in of_parse_phandle_with_args_map
	of: unittest: Fix of_count_phandle_with_args() expected value message
	binder: fix async space check for 0-sized buffers
	binder: fix use-after-free in shinker's callback
	Input: atkbd - use ab83 as id when skipping the getid command
	Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
	xen-netback: don't produce zero-size SKB frags
	binder: fix race between mmput() and do_exit()
	binder: fix unused alloc->free_async_space
	tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
	usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
	usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
	Revert "usb: dwc3: Soft reset phy on probe for host"
	Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
	usb: chipidea: wait controller resume finished for wakeup irq
	Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
	usb: typec: class: fix typec_altmode_put_partner to put plugs
	usb: mon: Fix atomicity violation in mon_bin_vma_fault
	ALSA: oxygen: Fix right channel of capture volume mixer
	fbdev: flush deferred work in fb_deferred_io_fsync()
	rootfs: Fix support for rootfstype= when root= is given
	wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
	wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
	wifi: mwifiex: configure BSSID consistently when starting AP
	x86/kvm: Do not try to disable kvmclock if it was not enabled
	HID: wacom: Correct behavior when processing some confidence == false touches
	mips: Fix incorrect max_low_pfn adjustment
	MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
	MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
	serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
	acpi: property: Let args be NULL in __acpi_node_get_property_reference
	software node: Let args be NULL in software_node_get_reference_args
	perf genelf: Set ELF program header addresses properly
	nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
	nvmet-tcp: fix a crash in nvmet_req_complete()
	perf env: Add perf_env__numa_node()
	perf record: Move sb_evlist to 'struct record'
	perf top: Move sb_evlist to 'struct perf_top'
	perf bpf: Decouple creating the evlist from adding the SB event
	perf env: Avoid recursively taking env->bpf_progs.lock
	apparmor: avoid crash when parsed profile name is empty
	serial: imx: Correct clock error message in function probe()
	nvmet-tcp: Fix the H2C expected PDU len calculation
	PCI: keystone: Fix race condition when initializing PHYs
	s390/pci: fix max size calculation in zpci_memcpy_toio()
	net: qualcomm: rmnet: fix global oob in rmnet_policy
	net: phy: micrel: populate .soft_reset for KSZ9131
	net: ravb: Fix dma_addr_t truncation in error case
	net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
	netfilter: nf_tables: skip dead set elements in netlink dump
	ipvs: avoid stat macros calls from preemptible context
	kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ
	kdb: Fix a potential buffer overflow in kdb_local()
	mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
	i2c: s3c24xx: fix read transfers in polling mode
	i2c: s3c24xx: fix transferring more than one message in polling mode
	perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
	arm64: dts: armada-3720-turris-mox: set irq type for RTC
	Linux 5.4.268

Change-Id: I347fc44c3a9947e2b7cb476d622adca58677f78a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-01-26 02:15:05 +00:00
Carlos Llamas
5c3d4930c7 binder: fix unused alloc->free_async_space 
commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream.

Each transaction is associated with a 'struct binder_buffer' that stores
the metadata about its buffer area. Since commit 74310e06be ("android:
binder: Move buffer out of area shared with user space") this struct is
no longer embedded within the buffer itself but is instead allocated on
the heap to prevent userspace access to this driver-exclusive info.

Unfortunately, the space of this struct is still being accounted for in
the total buffer size calculation, specifically for async transactions.
This results in an additional 104 bytes added to every async buffer
request, and this area is never used.

This wasted space can be substantial. If we consider the maximum mmap
buffer space of SZ_4M, the driver will reserve half of it for async
transactions, or 0x200000. This area should, in theory, accommodate up
to 262,144 buffers of the minimum 8-byte size. However, after adding
the extra 'sizeof(struct binder_buffer)', the total number of buffers
drops to only 18,724, which is a sad 7.14% of the actual capacity.

This patch fixes the buffer size calculation to enable the utilization
of the entire async buffer space. This is expected to reduce the number
of -ENOSPC errors that are seen on the field.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@google.com
[cmllamas: fix trivial conflict with missing 261e7818f06e.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-01-25 14:34:29 -08:00
Carlos Llamas
252a2a5569 binder: fix race between mmput() and do_exit() 
commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream.

Task A calls binder_update_page_range() to allocate and insert pages on
a remote address space from Task B. For this, Task A pins the remote mm
via mmget_not_zero() first. This can race with Task B do_exit() and the
final mmput() refcount decrement will come from Task A.

  Task A            | Task B
  ------------------+------------------
  mmget_not_zero()  |
                    |  do_exit()
                    |    exit_mm()
                    |      mmput()
  mmput()           |
    exit_mmap()     |
      remove_vma()  |
        fput()      |

In this case, the work of ____fput() from Task B is queued up in Task A
as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup
work gets executed. However, Task A instead sleep, waiting for a reply
from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated
binder event forces Task A to go back to userspace. All the associated
death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in
the corresponding mm->async_put_work WQ instead of Task A.

Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com
[cmllamas: fix trivial conflict with missing d8ed45c5dcd4.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-01-25 14:34:29 -08:00
Carlos Llamas
a53e15e592 binder: fix use-after-free in shinker's callback 
commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream.

The mmap read lock is used during the shrinker's callback, which means
that using alloc->vma pointer isn't safe as it can race with munmap().
As of commit dd2283f260 ("mm: mmap: zap pages with read mmap_sem in
munmap") the mmap lock is downgraded after the vma has been isolated.

I was able to reproduce this issue by manually adding some delays and
triggering page reclaiming through the shrinker's debug sysfs. The
following KASAN report confirms the UAF:

  ==================================================================
  BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8
  Read of size 8 at addr ffff356ed50e50f0 by task bash/478

  CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   zap_page_range_single+0x470/0x4b8
   binder_alloc_free_page+0x608/0xadc
   __list_lru_walk_one+0x130/0x3b0
   list_lru_walk_node+0xc4/0x22c
   binder_shrink_scan+0x108/0x1dc
   shrinker_debugfs_scan_write+0x2b4/0x500
   full_proxy_write+0xd4/0x140
   vfs_write+0x1ac/0x758
   ksys_write+0xf0/0x1dc
   __arm64_sys_write+0x6c/0x9c

  Allocated by task 492:
   kmem_cache_alloc+0x130/0x368
   vm_area_alloc+0x2c/0x190
   mmap_region+0x258/0x18bc
   do_mmap+0x694/0xa60
   vm_mmap_pgoff+0x170/0x29c
   ksys_mmap_pgoff+0x290/0x3a0
   __arm64_sys_mmap+0xcc/0x144

  Freed by task 491:
   kmem_cache_free+0x17c/0x3c8
   vm_area_free_rcu_cb+0x74/0x98
   rcu_core+0xa38/0x26d4
   rcu_core_si+0x10/0x1c
   __do_softirq+0x2fc/0xd24

  Last potentially related work creation:
   __call_rcu_common.constprop.0+0x6c/0xba0
   call_rcu+0x10/0x1c
   vm_area_free+0x18/0x24
   remove_vma+0xe4/0x118
   do_vmi_align_munmap.isra.0+0x718/0xb5c
   do_vmi_munmap+0xdc/0x1fc
   __vm_munmap+0x10c/0x278
   __arm64_sys_munmap+0x58/0x7c

Fix this issue by performing instead a vma_lookup() which will fail to
find the vma that was isolated before the mmap lock downgrade. Note that
this option has better performance than upgrading to a mmap write lock
which would increase contention. Plus, mmap_write_trylock() has been
recently removed anyway.

Fixes: dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap")
Cc: stable@vger.kernel.org
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com
[cmllamas: use find_vma() instead of vma_lookup() as commit ce6d42f2e4a2
 is missing in v5.4. This only works because we check the vma against
 our cached alloc->vma pointer. Also, unlock via up_read() instead of
 mmap_read_unlock() as commit d8ed45c5dcd4 is also missing in v5.4.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-01-25 14:34:29 -08:00
Carlos Llamas
fc1119a3c6 binder: fix async space check for 0-sized buffers 
commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream.

Move the padding of 0-sized buffers to an earlier stage to account for
this round up during the alloc->free_async_space check.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-01-25 14:34:29 -08:00