Memory allocation is happening without checking the overflow.
This could lead to an unexpected results. Check for overflow
before allocating memory.
Change-Id: Icb513ebd8030976e3f0970e9542596f9c5917843
Signed-off-by: Murali Nalajala <quic_mnalajal@quicinc.com>
Commit e186eb0c0c seperated
the qcom,cpus node into qcom,cluster0/1.
Update accordingly to enable cpu voltage cooling device.
Change-Id: I92fc40e4904cb7c1d31557a2ae6a79aed5451eec
https://source.android.com/docs/security/bulletin/2023-03-01
CVE-2021-33655
* tag 'ASB-2023-03-05_11-5.4' of https://android.googlesource.com/kernel/common:
ANDROID: fs/f2fs: fixup __f2fs_cluster_blocks with F2FS_FS_COMPRESSION
UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
UPSTREAM: KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
UPSTREAM: ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
UPSTREAM: net_sched: reject TCF_EM_SIMPLE case for complex ematch module
UPSTREAM: ipv6: ensure sane device mtu in tunnels
BACKPORT: iommu: Avoid races around device probe
BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses
FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio
Change-Id: I225e03054221dc7eae34b5e2b282265951cdcbee
Commit 3cf0f8245d introduced `inode` as
a parameter to F2FS_I_SB() but never declared from where it was
supposed to be accessed from.
This leads to a compile error with CONFIG_F2FS_FS_COMPRESSION enabled:
In file included from fs/f2fs/compress.c:17:
fs/f2fs/compress.c: In function '__f2fs_cluster_blocks':
fs/f2fs/compress.c:813:39: error: 'inode' undeclared (first use in this function)
813 | f2fs_bug_on(F2FS_I_SB(inode),
| ^~~~~
fs/f2fs/f2fs.h:38:38: note: in definition of macro 'f2fs_bug_on'
38 | set_sbi_flag(sbi, SBI_NEED_FSCK); \
| ^~~
fs/f2fs/compress.c:813:39: note: each undeclared identifier is reported only once for each function it appears in
813 | f2fs_bug_on(F2FS_I_SB(inode),
| ^~~~~
fs/f2fs/f2fs.h:38:38: note: in definition of macro 'f2fs_bug_on'
38 | set_sbi_flag(sbi, SBI_NEED_FSCK); \
|
Test: Enable CONFIG_F2FS_FS_COMPRESSION, check compile.
Fixes: 3cf0f8245d ("BACKPORT: f2fs: compress: remove unneeded preallocation")
Change-Id: I40015a66b8b872c86ff782b30581b24f752bb19a
Signed-off-by: Vaisakh Murali <vaisakhmurali@gmail.com>
As per the documentation, function usb_ep_free_request guarantees
the request will not be queued or no longer be re-queued (or
otherwise used). However, with the current implementation it
doesn't make sure that the request in ep0 isn't reused.
Fix this by dequeuing the ep0req on functionfs_unbind before
freeing the request to align with the definition.
Fixes: ddf8abd259 ("USB: f_fs: the FunctionFS driver")
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Tested-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Link: https://lore.kernel.org/r/20221215052906.8993-3-quic_ugoswami@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 265837309
Bug: 266213784
(cherry picked from commit ce405d561b020e5a46340eb5146805a625dcacee https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-linus)
Change-Id: Idbc5f13cedac59cbc893d229383b01662f4e4a03
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Signed-off-by: Lee Jones <joneslee@google.com>
[ Upstream commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 ]
According to Intel's document on Indirect Branch Restricted
Speculation, "Enabling IBRS does not prevent software from controlling
the predicted targets of indirect branches of unrelated software
executed later at the same predictor mode (for example, between two
different user applications, or two different virtual machines). Such
isolation can be ensured through use of the Indirect Branch Predictor
Barrier (IBPB) command." This applies to both basic and enhanced IBRS.
Since L1 and L2 VMs share hardware predictor modes (guest-user and
guest-kernel), hardware IBRS is not sufficient to virtualize
IBRS. (The way that basic IBRS is implemented on pre-eIBRS parts,
hardware IBRS is actually sufficient in practice, even though it isn't
sufficient architecturally.)
For virtual CPUs that support IBRS, add an indirect branch prediction
barrier on emulated VM-exit, to ensure that the predicted targets of
indirect branches executed in L1 cannot be controlled by software that
was executed in L2.
Since we typically don't intercept guest writes to IA32_SPEC_CTRL,
perform the IBPB at emulated VM-exit regardless of the current
IA32_SPEC_CTRL.IBRS value, even though the IBPB could technically be
deferred until L1 sets IA32_SPEC_CTRL.IBRS, if IA32_SPEC_CTRL.IBRS is
clear at emulated VM-exit.
This is CVE-2022-2196.
Bug: 265479180
Fixes: 5c911beff20a ("KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02")
Cc: Sean Christopherson <seanjc@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221019213620.1953281-3-jmattson@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic3ac006d834719d41f8a84c7a557d60b82e05197
commit eee22187b53611e173161e38f61de1c7ecbeb876 upstream.
In do_writepages, if the value returned by ext4_writepages is "-ENOMEM"
and "wbc->sync_mode == WB_SYNC_ALL", retry until the condition is not met.
In __ext4_get_inode_loc, if the bh returned by sb_getblk is NULL,
the function returns -ENOMEM.
In __getblk_slow, if the return value of grow_buffers is less than 0,
the function returns NULL.
When the three processes are connected in series like the following stack,
an infinite loop may occur:
do_writepages <--- keep retrying
ext4_writepages
mpage_map_and_submit_extent
mpage_map_one_extent
ext4_map_blocks
ext4_ext_map_blocks
ext4_ext_handle_unwritten_extents
ext4_ext_convert_to_initialized
ext4_split_extent
ext4_split_extent_at
__ext4_ext_dirty
__ext4_mark_inode_dirty
ext4_reserve_inode_write
ext4_get_inode_loc
__ext4_get_inode_loc <--- return -ENOMEM
sb_getblk
__getblk_gfp
__getblk_slow <--- return NULL
grow_buffers
grow_dev_page <--- return -ENXIO
ret = (block < end_block) ? 1 : -ENXIO;
In this issue, bg_inode_table_hi is overwritten as an incorrect value.
As a result, `block < end_block` cannot be met in grow_dev_page.
Therefore, __ext4_get_inode_loc always returns '-ENOMEM' and do_writepages
keeps retrying. As a result, the writeback process is in the D state due
to an infinite loop.
Add a check on inode table block in the __ext4_get_inode_loc function by
referring to ext4_read_inode_bitmap to avoid this infinite loop.
Cc: stable@kernel.org
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20220817132701.3015912-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 264629802
Bug: 264632463
Change-Id: Id3bb71336059cac33f16fca383e783add3a01295
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
[ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ]
When TCF_EM_SIMPLE was introduced, it is supposed to be convenient
for ematch implementation:
https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/
"You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE
set will simply result in allocating & copy. It's an optimization,
nothing more."
So if an ematch module provides ops->datalen that means it wants a
complex data structure (saved in its em->data) instead of a simple u32
value. We should simply reject such a combination, otherwise this u32
could be misinterpreted as a pointer.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com
Reported-by: Jun Nie <jun.nie@linaro.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Bug: 262113355
Bug: 262114215
Change-Id: I03be57351f76f699d4635cf31178e0f3a19e61a5
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
We currently have 3 different ways that __iommu_probe_device() may be
called, but no real guarantee that multiple callers can't tread on each
other, especially once asynchronous driver probe gets involved. It would
likely have taken a fair bit of luck to hit this previously, but commit
57365a04c921 ("iommu: Move bus setup to IOMMU device registration") ups
the odds since now it's not just omap-iommu that may trigger multiple
bus_iommu_probe() calls in parallel if probing asynchronously.
Add a lock to ensure we can't try to double-probe a device, and also
close some possible race windows to make sure we're truly robust against
trying to double-initialise a group via two different member devices.
Reported-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Brian Norris <briannorris@chromium.org>
Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration")
Link: https://lore.kernel.org/r/1946ef9f774851732eed78760a78ec40dbc6d178.1667591503.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Bug: 269232600
(cherry picked from commit 01657bc14a3990c665375f77978631fee77b1fce)
Change-Id: Ie87f8f7a7b90431c3a2682923961885ce7b239f3
Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>
https://source.android.com/docs/security/bulletin/2023-02-01
CVE-2022-39189
CVE-2022-39842
CVE-2022-41222
CVE-2023-20937
CVE-2023-20938
CVE-2022-0850
* tag 'ASB-2023-02-05_11-5.4' of https://android.googlesource.com/kernel/common:
ANDROID: ABI: Cuttlefish Symbol update
UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing
ANDROID: abi_gki_aarch64_qcom: Add hrtimer_sleeper_start_expires
UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark"
UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev
UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode
ANDROID: add TEST_MAPPING for net/, include/net
UPSTREAM: nfp: fix use-after-free in area_cache_get()
UPSTREAM: proc: avoid integer type confusion in get_proc_long
UPSTREAM: proc: proc_skip_spaces() shouldn't think it is working on C strings
ANDROID: usb: f_accessory: Check buffer size when initialised via composite
BACKPORT: mm: don't be stuck to rmap lock on reclaim path
ANDROID: Add more hvc devices for virtio-console.
Revert "mmc: sdhci: Fix voltage switch delay"
ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
Linux 5.4.226
ipc/sem: Fix dangling sem_array access in semtimedop race
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
proc: proc_skip_spaces() shouldn't think it is working on C strings
proc: avoid integer type confusion in get_proc_long
mmc: sdhci: Fix voltage switch delay
mmc: sdhci: use FIELD_GET for preset value bit masks
char: tpm: Protect tpm_pm_suspend with locks
Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
nvme: ensure subsystem reset is single threaded
nvme: restrict management ioctls to admin
epoll: check for events when removing a timed out thread from the wait queue
epoll: call final ep_events_available() check under the lock
tracing/ring-buffer: Have polling block on watermark
ipv4: Fix route deletion when nexthop info is not specified
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
selftests: net: fix nexthop warning cleanup double ip typo
selftests: net: add delete nexthop route warning test
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
parisc: Increase FRAME_WARN to 2048 bytes on parisc
xtensa: increase size of gcc stack frame check
parisc: Increase size of gcc stack frame check
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
pinctrl: single: Fix potential division by zero
ASoC: ops: Fix bounds check for _sx controls
mm: Fix '.data.once' orphan section warning
arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
tracing: Free buffers when a used dynamic event is removed
mmc: sdhci-sprd: Fix no reset data and command after voltage switch
mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
mmc: core: Fix ambiguous TRIM and DISCARD arg
mmc: mmc_test: Fix removal of debugfs file
pinctrl: intel: Save and restore pins in "direct IRQ" mode
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
error-injection: Add prompt for function error injection
net/mlx5: DR, Fix uninitialized var warning
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
sctp: fix memory leak in sctp_stream_outq_migrate()
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net: tun: Fix use-after-free in tun_detach()
afs: Fix fileserver probe RTT handling
net: hsr: Fix potential use-after-free
dsa: lan9303: Correct stat name
net: ethernet: nixge: fix NULL dereference
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net: phy: fix null-ptr-deref while probe() failed
wifi: cfg80211: fix buffer overflow in elem comparison
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5e: Fix use-after-free when reverting termination table
net/mlx5: Fix uninitialized variable bug in outlen_write()
of: property: decrement node refcount in of_fwnode_get_reference_args()
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
scripts/faddr2line: Fix regression in name resolution on ppc64le
iio: light: rpr0521: add missing Kconfig dependencies
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: health: afe4403: Fix oob read in afe4403_read_raw
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
drm/amdgpu: update drm_display_info correctly when the edid is read
btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
btrfs: free btrfs_path before copying inodes to userspace
fuse: lock inode unconditionally in fuse_fallocate()
drm/i915: fix TLB invalidation for Gen12 video and compute engines
drm/amdgpu: always register an MMU notifier for userptr
drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
btrfs: free btrfs_path before copying subvol info to userspace
btrfs: free btrfs_path before copying fspath to userspace
btrfs: free btrfs_path before copying root refs to userspace
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
binder: Address corner cases in deferred copy and fixup
binder: fix pointer cast warning
binder: defer copies of pre-patched txn data
binder: read pre-translated fds from sender buffer
binder: avoid potential data leakage when copying txn
dm integrity: flush the journal on suspend
net: usb: qmi_wwan: add Telit 0x103a composition
tcp: configurable source port perturb table size
platform/x86: hp-wmi: Ignore Smart Experience App event
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
xen/platform-pci: add missing free_irq() in error path
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
gcov: clang: fix the buffer overflow issue
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
firmware: coreboot: Register bus in module init
firmware: google: Release devices before unregistering the bus
ceph: avoid putting the realm twice when decoding snaps fails
ceph: do not update snapshot context when there is no new snapshot
iio: pressure: ms5611: fixed value compensation bug
iio: ms5611: Simplify IO callback parameters
nios2: add FORCE for vmlinuz.gz
init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
iio: light: apds9960: fix wrong register for gesture gain
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
usb: dwc3: exynos: Fix remove() function
lib/vdso: use "grep -E" instead of "egrep"
s390/crashdump: fix TOD programmable field size
net: thunderx: Fix the ACPI memory leak
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
s390/dasd: fix no record found for raw_track_access
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
regulator: twl6030: re-add TWL6032_SUBCLASS
NFC: nci: fix memory leak in nci_rx_data_packet()
xfrm: Fix ignored return value in xfrm6_init()
tipc: check skb_linearize() return value in tipc_disc_rcv()
tipc: add an extra conn_get in tipc_conn_alloc
tipc: set con sock in tipc_conn_alloc
net/mlx5: Fix FW tracer timestamp calculation
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
nfp: add port from netdev validation for EEPROM access
net: pch_gbe: fix pci device refcount leak while module exiting
net/qla3xxx: fix potential memleak in ql3xxx_send()
net/mlx4: Check retval of mlx4_bitmap_init
ARM: mxs: fix memory leak in mxs_machine_init()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
nfc/nci: fix race with opening and closing
net: liquidio: simplify if expression
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
tee: optee: fix possible memory leak in optee_register_device()
bus: sunxi-rsb: Support atomic transfers
regulator: core: fix UAF in destroy_regulator()
regulator: core: fix kobject release warning and memory leak in regulator_register()
ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
af_key: Fix send_acquire race with pfkey_register
MIPS: pic32: treat port as signed integer
RISC-V: vdso: Do not add missing symbols to version section in linker script
arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
block, bfq: fix null pointer dereference in bfq_bio_bfqg()
drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
wifi: mac80211: Fix ack frame idr leak when mesh has no route
audit: fix undefined behavior in bit shift for AUDIT_BIT
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
wifi: mac80211: fix memory free error when registering wiphy fail
Revert "can: af_can: fix NULL pointer dereference in can_rx_register()"
Linux 5.4.225
ntfs: check overflow when iterating ATTR_RECORDs
ntfs: fix out-of-bounds read in ntfs_attr_find()
ntfs: fix use-after-free in ntfs_attr_find()
mm: fs: initialize fsdata passed to write_begin/write_end interface
9p/trans_fd: always use O_NONBLOCK read/write
gfs2: Switch from strlcpy to strscpy
gfs2: Check sb_bsize_shift after reading superblock
9p: trans_fd/p9_conn_cancel: drop client lock earlier
kcm: close race conditions on sk_receive_queue
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
kcm: avoid potential race in kcm_tx_work
tcp: cdg: allow tcp_cdg_release() to be called multiple times
macvlan: enforce a consistent minimal mtu
Input: i8042 - fix leaking of platform device on module removal
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
ring-buffer: Include dropped pages in counting dirty patches
serial: 8250: Flush DMA Rx on RLSI
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
docs: update mediator contact information in CoC doc
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout
mmc: core: properly select voltage range without power cycle
scsi: zfcp: Fix double free of FSF request when qdio send fails
Input: iforce - invert valid length check when fetching device IDs
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
dm ioctl: fix misbehavior if list_versions races with module loading
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
usb: chipidea: fix deadlock in ci_otg_del_timer
usb: add NO_LPM quirk for Realforce 87U Keyboard
USB: serial: option: add Fibocom FM160 0x0111 composition
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Sierra Wireless EM9191
speakup: fix a segfault caused by switching consoles
slimbus: stream: correct presence rate frequencies
Revert "usb: dwc3: disable USB core PHY management"
ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
ring_buffer: Do not deactivate non-existant pages
ftrace: Fix null pointer dereference in ftrace_add_mod()
ftrace: Optimize the allocation for mcount entries
ftrace: Fix the possible incorrect kernel message
cifs: add check for returning value of SMB2_set_info_init
net: thunderbolt: Fix error handling in tbnet_init()
cifs: Fix wrong return value checking when GETFLAGS
net/x25: Fix skb leak in x25_lapb_receive_frame()
platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
drbd: use after free in drbd_create_device()
xen/pcpu: fix possible memory leak in register_pcpu()
bnxt_en: Remove debugfs when pci_register_driver failed
net: caif: fix double disconnect client in chnl_net_open()
net: macvlan: Use built-in RCU list checking
mISDN: fix misuse of put_device() in mISDN_register_device()
net: liquidio: release resources when liquidio driver open failed
mISDN: fix possible memory leak in mISDN_dsp_element_register()
net: bgmac: Drop free_netdev() from bgmac_enet_remove()
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
arm64: dts: imx8mn: Fix NAND controller size-cells
arm64: dts: imx8mm: Fix NAND controller size-cells
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
parport_pc: Avoid FIFO port location truncation
siox: fix possible memory leak in siox_device_add()
block: sed-opal: kmalloc the cmd/resp buffers
ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
serial: imx: Add missing .thaw_noirq hook
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
serial: 8250_omap: remove wait loop from Errata i202 workaround
ASoC: core: Fix use-after-free in snd_soc_exit()
spi: stm32: Print summary 'callbacks suppressed' message
ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route"
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
btrfs: remove pointless and double ulist frees in error paths of qgroup tests
drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
i2c: i801: add lis3lv02d's I2C address for Vostro 5568
NFSv4: Retry LOCK on OLD_STATEID during delegation return
selftests/intel_pstate: fix build for ARCH=x86_64
selftests/futex: fix build for clang
ASoC: codecs: jz4725b: fix capture selector naming
ASoC: codecs: jz4725b: use right control for Capture Volume
ASoC: codecs: jz4725b: fix reported volume for Master ctl
ASoC: codecs: jz4725b: add missed Line In power control bit
spi: intel: Fix the offset to get the 64K erase opcode
ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK
ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe"
ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe"
ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe"
x86/cpu: Restore AMD's DE_CFG MSR after resume
net: tun: call napi_schedule_prep() to ensure we own a napi
dmaengine: at_hdmac: Check return code of dma_async_device_register
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Fix at_lli struct definition
cert host tools: Stop complaining about deprecated OpenSSL functions
can: j1939: j1939_send_one(): fix missing CAN header initialization
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
nilfs2: fix use-after-free bug of ns_writer on remount
nilfs2: fix deadlock in nilfs_count_free_blocks()
vmlinux.lds.h: Fix placement of '.data..decrypted' section
ALSA: usb-audio: Add DSD support for Accuphase DAC-60
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: hda: fix potential memleak in 'add_widget_node'
ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
MIPS: jump_label: Fix compat branch range check
arm64: efi: Fix handling of misaligned runtime regions and drop warning
riscv: process: fix kernel info leakage
net: macvlan: fix memory leaks of macvlan_common_newlink
ethernet: tundra: free irq when alloc ring failed in tsi108_open()
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
net: cpsw: disable napi in cpsw_ndo_open()
net/mlx5: Allow async trigger completion execution on single CPU systems
net: nixge: disable napi when enable interrupts failed in nixge_open()
perf stat: Fix printing os->prefix in CSV metrics output
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
dmaengine: pxa_dma: use platform_get_irq_optional
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
can: af_can: fix NULL pointer dereference in can_rx_register()
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
net: fman: Unregister ethernet device on removal
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
net: tun: Fix memory leaks of napi_get_frags
net: gso: fix panic on frag_list with mixed head alloc types
HID: hyperv: fix possible memory leak in mousevsc_probe()
bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
wifi: cfg80211: fix memory leak in query_regdb_file()
wifi: cfg80211: silence a sparse RCU warning
phy: stm32: fix an error code in probe
xfs: drain the buf delwri queue before xfsaild idles
xfs: preserve inode versioning across remounts
xfs: use MMAPLOCK around filemap_map_pages()
xfs: redesign the reflink remap loop to fix blkres depletion crash
xfs: rename xfs_bmap_is_real_extent to is_written_extent
xfs: preserve rmapbt swapext block reservation from freed blocks
ANDROID: properly copy the scm_io_uring field in struct sk_buff
Linux 5.4.224
ipc: remove memcg accounting for sops objects in do_semtimedop()
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
drm/i915/sdvo: Setup DDC fully before output init
drm/i915/sdvo: Filter out invalid outputs more sensibly
drm/rockchip: dsi: Force synchronous probe
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
KVM: x86: emulator: update the emulation mode after CR0 write
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: Mask off reserved bits in CPUID.80000008H
KVM: x86: Mask off reserved bits in CPUID.8000001AH
ext4: fix BUG_ON() when directory entry has invalid rec_len
ext4: fix warning in 'ext4_da_release_space'
parisc: Avoid printing the hardware path twice
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
perf/x86/intel: Fix pebs event constraints for ICL
efi: random: reduce seed size to 32 bytes
fuse: add file_modified() to fallocate
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
tracing/histogram: Update document for KEYS_MAX size
tools/nolibc/string: Fix memcmp() implementation
kprobe: reverse kp->flags when arm_kprobe failed
tcp/udp: Make early_demux back namespacified.
btrfs: fix type of parameter generation in btrfs_get_dentry
binder: fix UAF of alloc->vma in race with munmap()
memcg: enable accounting of ipc resources
tcp/udp: Fix memory leak in ipv6_renew_options().
block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()
xfs: don't fail unwritten extent conversion on writeback due to edquot
xfs: group quota should return EDQUOT when prj quota enabled
xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
xfs: use ordered buffers to initialize dquot buffers during quotacheck
xfs: don't fail verifier on empty attr3 leaf block
i2c: xiic: Add platform module alias
HID: saitek: add madcatz variant of MMO7 mouse device ID
scsi: core: Restrict legal sdev_state transitions via sysfs
media: meson: vdec: fix possible refcount leak in vdec_probe()
media: dvb-frontends/drxk: initialize err to 0
media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
ipv6: fix WARNING in ip6_route_net_exit_late()
net, neigh: Fix null-ptr-deref in neigh_table_clear()
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
btrfs: fix ulist leaks in error paths of qgroup self tests
btrfs: fix inode list leak during backref walking at find_parent_nodes()
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
isdn: mISDN: netjet: fix wrong check of device registration
mISDN: fix possible memory leak in mISDN_register_device()
rose: Fix NULL pointer dereference in rose_send_frame()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: use explicitly signed chars
netfilter: nf_tables: release flow rule object from commit path
net: tun: fix bugs for oversize packet when napi frags enabled
net: sched: Fix use after free in red_enqueue()
ata: pata_legacy: fix pdc20230_set_piomode()
net: fec: fix improper use of NETDEV_TX_BUSY
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
net: dsa: Fix possible memory leaks in dsa_loop_init()
nfs4: Fix kmemleak when allocate slot failed
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
IB/hfi1: Correctly move list in sc_disable()
RDMA/cma: Use output interface for net_dev check
Linux 5.4.223
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
net: enetc: survive memory pressure without crashing
net/mlx5: Fix possible use-after-free in async command interface
net/mlx5e: Do not increment ESN when updating IPsec ESN state
nh: fix scope used to find saddr when adding non gw nh
net: ehea: fix possible memory leak in ehea_register_port()
openvswitch: switch from WARN to pr_warn
ALSA: aoa: Fix I2S device accounting
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
PM: domains: Fix handling of unavailable/disabled idle states
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
i40e: Fix flow-type by setting GL_HASH_INSET registers
i40e: Fix VF hang when reset is triggered on another VF
i40e: Fix ethtool rx-flow-hash setting for X722
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
media: v4l2-dv-timings: add sanity checks for blanking values
media: vivid: dev->bitmap_cap wasn't freed in all cases
media: vivid: s_fbuf: add more sanity checks
PM: hibernate: Allow hybrid sleep to work with s2idle
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
tcp: fix indefinite deferral of RTO with SACK reneging
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
kcm: annotate data-races around kcm->rx_wait
kcm: annotate data-races around kcm->rx_psock
amd-xgbe: add the bit rate quirk for Molex cables
amd-xgbe: fix the SFP compliance codes check for DAC cables
x86/unwind/orc: Fix unreliable stack dump with gcov
net: netsec: fix error handling in netsec_register_mdio()
tipc: fix a null-ptr-deref in tipc_topsrv_accept
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
arc: iounmap() arg is volatile
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
net: ieee802154: fix error return code in dgram_bind()
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
cgroup-v1: add disabled controller check in cgroup1_parse_param()
xen/gntdev: Prevent leaking grants
Xen/gntdev: don't ignore kernel unmapping error
xfs: force the log after remapping a synchronous-writes file
xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
xfs: finish dfops on every insert range shift iteration
s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
perf auxtrace: Fix address filter symbol name match for modules
kernfs: fix use-after-free in __kernfs_remove
mmc: core: Fix kernel panic when remove non-standard SDIO card
drm/msm/hdmi: fix memory corruption with too many bridges
drm/msm/dsi: fix memory corruption with too many bridges
mac802154: Fix LQI recording
fbdev: smscufx: Fix several use-after-free bugs
iio: light: tsl2583: Fix module unloading
tools: iio: iio_utils: fix digit calculation
xhci: Remove device endpoints from bandwidth list when freeing the device
mtd: rawnand: marvell: Use correct logic for nand-keep-config
usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
usb: bdc: change state when port disconnected
usb: dwc3: gadget: Don't set IMI for no_interrupt
usb: dwc3: gadget: Stop processing more requests on IMI
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
ALSA: au88x0: use explicitly signed char
ALSA: Use del_timer_sync() before freeing timer
can: kvaser_usb: Fix possible completions during init_completion
can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
UPSTREAM: once: fix section mismatch on clang builds
ANDROID: fix up struct sk_buf ABI breakage
ANDROID: fix up CRC issue with struct tcp_sock
Linux 5.4.222
once: fix section mismatch on clang builds
ANDROID: fix up 131287ff83 ("once: add DO_ONCE_SLOW() for sleepable contexts")
Revert "serial: 8250: Fix restoring termios speed after suspend"
Linux 5.4.221
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
hv_netvsc: Fix race between VF offering and VF association message from host
Makefile.debug: re-enable debug info for .S files
ACPI: video: Force backlight native for more TongFang devices
riscv: topology: fix default topology reporting
arm64: topology: move store_cpu_topology() to shared code
iommu/vt-d: Clean up si_domain in the init_dmars() error path
net: hns: fix possible memory leak in hnae_ae_register()
net: sched: cake: fix null pointer access issue when cake_init() fails
net: phy: dp83867: Extend RX strap quirk for SGMII mode
net/atm: fix proc_mpc_write incorrect return value
HID: magicmouse: Do not set BTN_MOUSE on double report
tipc: fix an information leak in tipc_topsrv_kern_subscr
tipc: Fix recognition of trial period
ACPI: extlog: Handle multiple records
btrfs: fix processing of delayed tree block refs during backref walking
btrfs: fix processing of delayed data refs during backref walking
r8152: add PID for the Lenovo OneLink+ Dock
arm64: errata: Remove AES hwcap for COMPAT tasks
media: venus: dec: Handle the case where find_format fails
KVM: arm64: vgic: Fix exit condition in scan_its_table()
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
ata: ahci-imx: Fix MODULE_ALIAS
hwmon/coretemp: Handle large core ID value
x86/microcode/AMD: Apply the patch early on every logical thread
ocfs2: fix BUG when iput after ocfs2_mknod fails
ocfs2: clear dinode links count in case of error
xfs: fix use-after-free on CIL context on shutdown
xfs: move inode flush to the sync workqueue
xfs: reflink should force the log out if mounted with wsync
xfs: factor out a new xfs_log_force_inode helper
xfs: trylock underlying buffer on dquot flush
xfs: don't write a corrupt unmount record to force summary counter recalc
xfs: tail updates only need to occur when LSN changes
xfs: factor common AIL item deletion code
xfs: Throttle commits on delayed background CIL push
xfs: Lower CIL flush limit for large logs
xfs: preserve default grace interval during quotacheck
xfs: fix unmount hang and memory leak on shutdown during quotaoff
xfs: factor out quotaoff intent AIL removal and memory free
xfs: Replace function declaration by actual definition
xfs: remove the xfs_qoff_logitem_t typedef
xfs: remove the xfs_dq_logitem_t typedef
xfs: remove the xfs_disk_dquot_t and xfs_dquot_t
xfs: Use scnprintf() for avoiding potential buffer overflow
xfs: check owner of dir3 blocks
xfs: check owner of dir3 data blocks
xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails
xfs: xfs_buf_corruption_error should take __this_address
xfs: add a function to deal with corrupt buffers post-verifiers
xfs: rework collapse range into an atomic operation
xfs: rework insert range into an atomic operation
xfs: open code insert range extent split helper
Linux 5.4.220
thermal: intel_powerclamp: Use first online CPU as control_cpu
inet: fully convert sk->sk_rx_dst to RCU rules
efi: libstub: drop pointless get_memory_map() call
md: Replace snprintf with scnprintf
ext4: continue to expand file system when the target size doesn't reach
net/ieee802154: don't warn zero-sized raw_sendmsg()
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
net: ieee802154: return -EINVAL for unknown addr type
io_uring/af_unix: defer registered files gc to io_uring release
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
clk: bcm2835: Make peripheral PLLC critical
usb: idmouse: fix an uninit-value in idmouse_open
nvmet-tcp: add bounds check on Transfer Tag
nvme: copy firmware_rev on each init
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
Revert "usb: storage: Add quirk for Samsung Fit flash"
usb: musb: Fix musb_gadget.c rxstate overflow bug
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
HID: roccat: Fix use-after-free in roccat_read()
bcache: fix set_at_max_writeback_rate() for multiple attached devices
ata: libahci_platform: Sanity check the DT child nodes number
staging: vt6655: fix potential memory leak
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
btrfs: scrub: try to fix super block errors
ARM: dts: imx6sx: add missing properties for sram
ARM: dts: imx6sll: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
mmc: sdhci-msm: add compatible string check for sdm670
drm/amdgpu: fix initial connector audio value
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
drm/vc4: vec: Fix timings for VEC modes
drm/amd/display: fix overflow on MIN_I64 definition
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
drm: Use size_t type for len variable in drm_copy_field()
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
r8152: Rate limit overflow messages
Bluetooth: L2CAP: Fix user-after-free
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
wifi: rt2x00: correctly set BBP register 86 for MT7620
wifi: rt2x00: set SoC wmac clock register
wifi: rt2x00: set VGC gain for both chains of MT7620
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
can: bcm: check the result of can_send() in bcm_can_tx()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
xfrm: Update ipcomp_scratches with NULL when freed
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
tcp: annotate data-race around tcp_md5sig_pool_populated
openvswitch: Fix overreporting of drops in dropwatch
openvswitch: Fix double reporting of drops in dropwatch
bpftool: Clear errno after libcap's checks
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
MIPS: BCM47XX: Cast memcmp() of function to (void *)
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
f2fs: fix race condition on setting FI_NO_EXTENT flag
crypto: cavium - prevent integer overflow loading firmware
kbuild: remove the target in signal traps when interrupted
iommu/iova: Fix module config properly
crypto: ccp - Release dma channels before dmaengine unrgister
crypto: akcipher - default implementation for setting a private key
iommu/omap: Fix buffer overflow in debugfs
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
powerpc: Fix SPE Power ISA properties for e500v1 platforms
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
powerpc/pci_dn: Add missing of_node_put()
powerpc/sysdev/fsl_msi: Add missing of_node_put()
powerpc/math_emu/efp: Include module.h
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
clk: ast2600: BCLK comes from EPLL
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
mfd: sm501: Add check for platform_driver_register()
mfd: fsl-imx25: Fix check for platform_get_irq() errors
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
fsi: core: Check error number after calling ida_simple_get
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
serial: 8250: Fix restoring termios speed after suspend
firmware: google: Test spinlock on panic path to avoid lockups
staging: vt6655: fix some erroneous memory clean-up loops
phy: qualcomm: call clk_disable_unprepare in the error handling
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
drivers: serial: jsm: fix some leaks in probe
usb: gadget: function: fix dangling pnp_string in f_printer.c
xhci: Don't show warning for reinit on known broken suspend
md/raid5: Ensure stripe_fill happens on non-read IO with journal
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
ata: fix ata_id_has_dipm()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_devslp()
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
dyndbg: let query-modname override actual module name
dyndbg: fix module.dyndbg handling
misc: ocxl: fix possible refcount leak in afu_ioctl()
RDMA/rxe: Fix the error caused by qp->sk
RDMA/rxe: Fix "kernel NULL pointer dereference" error
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
tty: xilinx_uartps: Fix the ignore_status
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
HSI: omap_ssi_port: Fix dma_map_sg error check
HSI: omap_ssi: Fix refcount leak in ssi_probe
clk: tegra20: Fix refcount leak in tegra20_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: berlin: Add of_node_put() for of_get_parent()
clk: oxnas: Hold reference returned by of_get_parent()
clk: meson: Hold reference returned by of_get_parent()
iio: ABI: Fix wrong format of differential capacitance channel ABI.
iio: inkern: only release the device node when done with it
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
ARM: Drop CMDLINE_* dependency on ATAGS
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
ARM: dts: kirkwood: lsxl: remove first ethernet port
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
ALSA: hda/hdmi: Don't skip notification handling during PM operation
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
ALSA: dmaengine: increment buffer pointer atomically
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
drm/omap: dss: Fix refcount leak bugs
ALSA: hda: beep: Simplify keep-power-at-enable behavior
ASoC: rsnd: Add check for rsnd_mod_power_on
drm/bridge: megachips: Fix a null pointer dereference bug
drm: fix drm_mipi_dbi build errors
platform/x86: msi-laptop: Fix resource cleanup
platform/x86: msi-laptop: Fix old-ec check for backlight registering
platform/chrome: fix memory corruption in ioctl
platform/chrome: fix double-free in chromeos_laptop_prepare()
drm/mipi-dsi: Detach devices when removing the host
drm: bridge: adv7511: fix CEC power down control register offset
net: mvpp2: fix mvpp2 debugfs leak
once: add DO_ONCE_SLOW() for sleepable contexts
net/ieee802154: reject zero-sized raw_sendmsg()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
sctp: handle the error returned from sctp_auth_asoc_init_active_key
mISDN: fix use-after-free bugs in l1oip timer handlers
vhost/vsock: Use kvmalloc/kvfree for larger packets.
spi: s3c64xx: Fix large transfers with DMA
netfilter: nft_fib: Fix for rpath check with VRF devices
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
x86/microcode/AMD: Track patch allocation size explicitly
bpf: Ensure correct locking around vulnerable function find_vpid()
net: fs_enet: Fix wrong check in do_pd_setup
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
bpftool: Fix a wrong type cast in btf_dumper_int
wifi: mac80211: allow bw change during channel switch in mesh
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
nfsd: Fix a memory leak in an error handling path
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
sh: machvec: Use char[] for section boundaries
userfaultfd: open userfaultfds with O_RDONLY
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
selinux: use "grep -E" instead of "egrep"
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
gcov: support GCC 12.1 and newer compilers
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
media: cedrus: Set the platform driver data earlier
ring-buffer: Fix race between reset page and reading page
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Have the shortest_full queue be the shortest not longest
ring-buffer: Allow splice to read previous partially read pages
ftrace: Properly unset FTRACE_HASH_FL_MOD
livepatch: fix race between fork and KLP transition
ext4: place buffer head allocation before handle start
ext4: make ext4_lazyinit_thread freezable
ext4: fix null-ptr-deref in ext4_write_info
ext4: avoid crash when inline data creation follows DIO write
jbd2: wake up journal waiters in FIFO order, not LIFO
nilfs2: fix use-after-free bug of struct nilfs_root
f2fs: fix to do sanity check on summary info
f2fs: fix to do sanity check on destination blkaddr during recovery
f2fs: increase the limit for reserve_root
btrfs: fix race between quota enable and quota rescan ioctl
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
powerpc/boot: Explicitly disable usage of SPE instructions
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
riscv: Pass -mno-relax only on lld < 15.0.0
riscv: Allow PROT_WRITE-only mmap()
parisc: fbdev/stifb: Align graphics memory size to 4MB
RISC-V: Make port I/O string accessors actually work
regulator: qcom_rpm: Fix circular deferral regression
ASoC: wcd9335: fix order of Slimbus unprepare/disable
quota: Check next/prev free block number after reading from quota file
HID: multitouch: Add memory barriers
fs: dlm: handle -EBUSY first in lock arg validation
fs: dlm: fix race between test_bit() and queue_work()
mmc: sdhci-sprd: Fix minimum clock limit
can: kvaser_usb_leaf: Fix CAN state after restart
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
can: kvaser_usb_leaf: Fix overread with an invalid command
can: kvaser_usb: Fix use of uninitialized completion
usb: add quirks for Lenovo OneLink+ Dock
iio: pressure: dps310: Reset chip after timeout
iio: pressure: dps310: Refactor startup procedure
iio: dac: ad5593r: Fix i2c read protocol requirements
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
cifs: destage dirty pages before re-reading them for cache=none
mtd: rawnand: atmel: Unmap streaming DMA mappings
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: usb-audio: Fix potential memory leaks
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: oss: Fix potential deadlock at unregistration
Conflicts:
drivers/android/binder.c
include/linux/rmap.h
kernel/cgroup/cpuset.c
mm/rmap.c
Change-Id: I34fe2d5c9b0d5844560de9c983867511b5d57265
Currently, wmediumd requires each used MAC address to be configured
as a station in the virtual air, but that doesn't make sense as any
station could have multiple MAC addresses, and even have randomized
ones in scanning, etc.
Add some code here to tell wmediumd of used MAC addresses, binding
them to the hardware address. Combined with a wmediumd patch that
makes it track the addresses this allows configuring just the radio
address (42:00:00:00:nn:00 unless the radio was manually created)
in wmediumd as a station, and all addresses that the station uses
are added/removed dynamically.
Tested with random scan, which without this and the corresponding
wmediumd change doesn't get anything through as the sender doesn't
exist as far as wmediumd is concerned (it's random).
Link: https://lore.kernel.org/r/20200323162358.b397b1a1acef.Ice0536e34e5d96c51f97c374ea8af9551347c7e8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 5cc58a9ecfa1bbf5fb587ec65e42f15dd5051238)
Signed-off-by: Jeongik Cha <jeongik@google.com>
Bug: 238124637
Change-Id: I973948f65a6303ffff7aa8998b68cc8e6ce98930
(cherry picked from commit cc9d67ff745c7e47893a9724824882c1e7b25764)
Some android userspace is sending BINDER_TYPE_FDA objects with
num_fds=0. Like the previous patch, this is reproducible when
playing a video.
Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0
were 'correctly handled', as in no fixup was performed.
After commit 09184ae9b575 we aggregate fixup and skip regions in
binder_ptr_fixup structs and distinguish between the two by using
the skip_size field: if it's 0, then it's a fixup, otherwise skip.
When processing BINDER_TYPE_FDA objects with num_fds=0 we add a
skip region of skip_size=0, and this causes issues because now
binder_do_deferred_txn_copies will think this was a fixup region.
To address that, return early from binder_translate_fd_array to
avoid adding an empty skip region.
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit ef38de9217a04c9077629a24652689d8fdb4c6c6)
Change-Id: I34fab41c0c1beee366a5df4724b263e4385ad13b
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When handling BINDER_TYPE_FDA object we are pushing a parent fixup
with a certain skip_size but no scatter-gather copy object, since
the copy is handled standalone.
If BINDER_TYPE_FDA is the last children the scatter-gather copy
loop will never stop to skip it, thus we are left with an item in
the parent fixup list. This will trigger the BUG_ON().
This is reproducible in android when playing a video.
We receive a transaction that looks like this:
obj[0] BINDER_TYPE_PTR, parent
obj[1] BINDER_TYPE_PTR, child
obj[2] BINDER_TYPE_PTR, child
obj[3] BINDER_TYPE_FDA, child
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23)
Change-Id: I3963a98dfc48b01d7bb8166aaa90341818bf6416
Signed-off-by: Carlos Llamas <cmllamas@google.com>
binder_uintptr_t is not the same as uintptr_t, so converting it into a
pointer requires a second cast:
drivers/android/binder.c: In function 'binder_translate_fd_array':
drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset;
| ^
Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009)
Change-Id: I1c9b86a90bcf2be81012e59e0c472869f551e61a
Signed-off-by: Carlos Llamas <cmllamas@google.com>
BINDER_TYPE_PTR objects point to memory areas in the
source process to be copied into the target buffer
as part of a transaction. This implements a scatter-
gather model where non-contiguous memory in a source
process is "gathered" into a contiguous region in
the target buffer.
The data can include pointers that must be fixed up
to correctly point to the copied data. To avoid making
source process pointers visible to the target process,
this patch defers the copy until the fixups are known
and then copies and fixeups are done together.
There is a special case of BINDER_TYPE_FDA which applies
the fixup later in the target process context. In this
case the user data is skipped (so no untranslated fds
become visible to the target).
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d)
[cmllamas: fix trivial merge conflict]
Change-Id: I6de75b192d1e3b2cc73c8d91077d97b608e8c5a9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This patch is to prepare for an up coming patch where we read
pre-translated fds from the sender buffer and translate them before
copying them to the target. It does not change run time.
The patch adds two new parameters to binder_translate_fd_array() to
hold the sender buffer and sender buffer parent. These parameters let
us call copy_from_user() directly from the sender instead of using
binder_alloc_copy_from_buffer() to copy from the target. Also the patch
adds some new alignment checks. Previously the alignment checks would
have been done in a different place, but this lets us print more
useful error messages.
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 656e01f3ab54afe71bed066996fc2640881e1220)
Change-Id: Ib786020e49bd33e35aec88d43965f9d98021fa53
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Transactions are copied from the sender to the target
first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA
are then fixed up. This means there is a short period where
the sender's version of these objects are visible to the
target prior to the fixups.
Instead of copying all of the data first, copy data only
after any needed fixups have been applied.
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c)
[cmllamas: fix trivial merge conflict]
Change-Id: I8c14a03a2ee23c5f060c82e1626686f72eff33d9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When the target process is busy, incoming oneway transactions are
queued in the async_todo list. If the clients continue sending extra
oneway transactions while the target process is frozen, this queue can
become too large to accommodate new transactions. That's why binder
driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's
helpful to debug the async binder buffer exhausting issue, but the
issue itself isn't solved directly.
In real cases applications are designed to send oneway transactions
repeatedly, delivering updated inforamtion to the target process.
Typical examples are Wi-Fi signal strength and some real time sensor
data. Even if the apps might only care about the lastet information,
all outdated oneway transactions are still accumulated there until the
frozen process is thawed later. For this kind of situations, there's
no existing method to skip those outdated transactions and deliver the
latest one only.
This patch introduces a new transaction flag TF_UPDATE_TXN. To use it,
use apps can set this new flag along with TF_ONE_WAY. When such an
oneway transaction is to be queued into the async_todo list of a frozen
process, binder driver will check if any previous pending transactions
can be superseded by comparing their code, flags and target node. If
such an outdated pending transaction is found, the latest transaction
will supersede that outdated one. This effectively prevents the async
binder buffer running out and saves unnecessary binder read workloads.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 231624308
Test: manually check async binder buffer size of frozen apps
Test: stress test with kernel 4.14/4.19/5.10/5.15
(cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-next)
Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176
All the other ioctl paths return EFAULT in case the
copy_from_user/copy_to_user call fails, make oneway spam detection
follow the same paradigm.
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Luca Stefani <luca.stefani.ge1@gmail.com>
Link: https://lore.kernel.org/r/20210506193726.45118-1-luca.stefani.ge1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ced081a436d21a7d34d4d42acb85058f9cf423f2)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I7c5e6ec7108c42721de6c82f4c1e9ff3d4f0e88d
When async binder buffer got exhausted, some normal oneway transactions
will also be discarded and may cause system or application failures. By
that time, the binder debug information we dump may not be relevant to
the root cause. And this issue is difficult to debug if without the
backtrace of the thread sending spam.
This change will send BR_ONEWAY_SPAM_SUSPECT to userspace when oneway
spamming is detected, request to dump current backtrace. Oneway spamming
will be reported only once when exceeding the threshold (target process
dips below 80% of its oneway space, and current process is responsible
for either more than 50 transactions, or more than 50% of the oneway
space). And the detection will restart when the async buffer has
returned to a healthy state.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Hang Lu <hangl@codeaurora.org>
Link: https://lore.kernel.org/r/1617961246-4502-3-git-send-email-hangl@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 181190340
Change-Id: Id3d2526099bc89f04d8ad3ad6e48141b2a8f2515
(cherry picked from commit a7dc1e6f99df59799ab0128d9c4e47bbeceb934d)
Signed-off-by: Hang Lu <hangl@codeaurora.org>
security_secid_to_secctx() can fail because of a GFP_ATOMIC allocation
This needs to be retried from userspace. However, binder driver doesn't
propagate specific enough error codes just yet (WIP b/28321379). We'll
retry on the binder driver as a temporary work around until userspace
can do this instead.
Bug: 174806915
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ifebddeb7adf9707613512952b97ab702f0d2d592
(cherry picked from commit 3bca0b53448b28938cf4282caaa98f6233f0399c)
This fixed the crash when setting channels to 2 or more when
communicating over virtio.
Signed-off-by: Weilun Du <wdu@google.com>
Link: https://lore.kernel.org/r/20210506180530.3418576-1-wdu@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 626c30f9e77354301ff9162c3bdddaf92d9b5cf3 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=626c30f9e77354301ff9162c3bdddaf92d9b5cf3)
Bug: 182576217
Signed-off-by: Weilun Du <wdu@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia9be6c1d962b941a92f4e1be41e874dbe08024e5
(cherry picked from commit 2e289f3641a9c37ad054f9e84398533ccd930c8f)
(cherry picked from commit 085ebe864e396d3df82d06761bb1ddb97d8ce4d9)
The cuttlefish symbol list has bitrotted preventing this kernel's startup. Updating it with the following steps.
$ BUILD_CONFIG=common/build.config.gki.aarch64 build/build.sh
$ BUILD_CONFIG=common-modules/virtual-\
device/build.config.cuttlefish.aarch64 build/build.sh
$ build/abi/extract_symbols out/android11-5.4/dist/ --whitelist \
common/android/abi_gki_aarch64_cuttlefish --additions-only
$ BUILD_CONFIG=common/build.config.gki.aarch64 build/build_abi.sh \
--update --print-report
Bug: 267474419
Bug: 254392308
Test: Local boot on cuttlefish arm64 android11-gsi
Signed-off-by: Ram Muthiah <rammuthiah@google.com>
Change-Id: I45b54bed9584c8669d1e277a0ffbed2e5026eeb8
commit fd3d91ab1c6ab0628fe642dd570b56302c30a792 upstream.
The dvb-core tries to sync the releases of opened files at
dvb_dmxdev_release() with two refcounts: dvbdev->users and
dvr_dvbdev->users. A problem is present in those two syncs: when yet
another dvb_demux_open() is called during those sync waits,
dvb_demux_open() continues to process even if the device is being
closed. This includes the increment of the former refcount, resulting
in the leftover refcount after the sync of the latter refcount at
dvb_dmxdev_release(). It ends up with use-after-free, since the
function believes that all usages were gone and releases the
resources.
This patch addresses the problem by adding the check of dmxdev->exit
flag at dvb_demux_open(), just like dvb_dvr_open() already does. With
the exit flag check, the second call of dvb_demux_open() fails, hence
the further corruption can be avoided.
Also for avoiding the races of the dmxdev->exit flag reference, this
patch serializes the dmxdev->exit set up and the sync waits with the
dmxdev->mutex lock at dvb_dmxdev_release(). Without the mutex lock,
dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
dvb_dmxdev_release(), which allows to skip the exit flag check and
continue the open process that is being closed.
CVE-2022-41218 is assigned to those bugs above.
Bug: 248356119
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/20220908132754.30532-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5a0dd4444ca25d07a050dcb07609c7c7ccf658af
[ Note: this is a fix that works around the bug equivalently as the
two upstream commits:
1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper")
56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF")
but in a simpler way to fit with older stable trees -- tiwai ]
Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be
easily triggered and turned into an use-after-free.
Example code paths with SNDRV_CTL_IOCTL_ELEM_READ:
64-bits:
snd_ctl_ioctl
snd_ctl_elem_read_user
[takes controls_rwsem]
snd_ctl_elem_read [lock properly held, all good]
[drops controls_rwsem]
32-bits (compat):
snd_ctl_ioctl_compat
snd_ctl_elem_write_read_compat
ctl_elem_write_read
snd_ctl_elem_read [missing lock, not good]
CVE-2023-0266 was assigned for this issue.
Bug: 265303544
Signed-off-by: Clement Lecigne <clecigne@google.com>
Cc: stable@kernel.org # 5.12 and older
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit df02234e6b87d2a9a82acd3198e44bdeff8488c7)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ibe891cdcb9eaf0dfc7bd771689c85c32b5c0d1f7
[ Upstream commit 89ff3dfac604614287ad5aad9370c3f984ea3f4b ]
The embedded struct cdev does not have its lifetime correctly tied to
the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN
is held open while the gadget is deleted.
This can readily be replicated with libusbgx's example programs (for
conciseness - operating directly via configfs is equivalent):
gadget-hid
exec 3<> /dev/hidg0
gadget-vid-pid-remove
exec 3<&-
Pull the existing device up in to struct f_hidg and make use of the
cdev_device_{add,del}() helpers. This changes the lifetime of the
device object to match struct f_hidg, but note that it is still added
and deleted at the same time.
Bug: 176850153
Fixes: 71adf11894 ("USB: gadget: add HID gadget driver")
Tested-by: Lee Jones <lee@kernel.org>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: John Keeping <john@metanate.com>
Link: https://lore.kernel.org/r/20221122123523.3068034-2-john@metanate.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5d37ca47c5f087d5b1b303b4e8a1614ea3f50159
Signed-off-by: Lee Jones <joneslee@google.com>
[ Upstream commit d7428bc26fc767942c38d74b80299bcd4f01e7cb ]
f_hid provides the OUT Endpoint as only way for receiving reports
from the host. SETUP/SET_REPORT method is not supported, and this causes
a number of compatibility problems with various host drivers, especially
in the case of keyboard emulation using f_hid.
- Some hosts do not support the OUT Endpoint and ignore it,
so it becomes impossible for the gadget to receive a report
from the host. In the case of a keyboard, the gadget loses
the ability to receive the status of the LEDs.
- Some BIOSes/UEFIs can't work with HID devices with the OUT Endpoint
at all. This may be due to their bugs or incomplete implementation
of the HID standard.
For example, absolutely all Apple UEFIs can't handle the OUT Endpoint
if it goes after IN Endpoint in the descriptor and require the reverse
order (OUT, IN) which is a violation of the standard.
Other hosts either do not initialize gadgets with a descriptor
containing the OUT Endpoint completely (like some HP and DELL BIOSes
and embedded firmwares like on KVM switches), or initialize them,
but will not poll the IN Endpoint.
This patch adds configfs option no_out_endpoint=1 to disable
the OUT Endpoint and allows f_hid to receive reports from the host
via SETUP/SET_REPORT.
Previously, there was such a feature in f_hid, but it was replaced
by the OUT Endpoint [1] in the commit 99c5150058 ("usb: gadget: hidg:
register OUT INT endpoint for SET_REPORT"). So this patch actually
returns the removed functionality while making it optional.
For backward compatibility reasons, the OUT Endpoint mode remains
the default behaviour.
- The OUT Endpoint mode provides the report queue and reduces
USB overhead (eliminating SETUP routine) on transmitting a report
from the host.
- If the SETUP/SET_REPORT mode is used, there is no report queue,
so the userspace will only read last report. For classic HID devices
like keyboards this is not a problem, since it's intended to transmit
the status of the LEDs and only the last report is important.
This mode provides better compatibility with strange and buggy
host drivers.
Both modes passed USBCV tests. Checking with the USB protocol analyzer
also confirmed that everything is working as it should and the new mode
ensures operability in all of the described cases.
Bug: 176850153
Link: https://www.spinics.net/lists/linux-usb/msg65494.html [1]
Reviewed-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Maxim Devaev <mdevaev@gmail.com>
Link: https://lore.kernel.org/r/20210821134004.363217-1-mdevaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0f5759015f17661fe4fe23a1216f1047978c79b1
Signed-off-by: Lee Jones <joneslee@google.com>
Run CtsNetTestCases in presubmit for changes in net/ and
include/net/.
Bug: 186664401
Change-Id: I3cf942bd0418ad55a6559d6933927b0da86da595
Signed-off-by: Steve Muckle <smuckle@google.com>
(cherry picked from commit 55415d7022a8835d8979e09a74da3df29c9091ec)
commit 02e1a114fdb71e59ee6770294166c30d437bf86a upstream.
area_cache_get() is used to distribute cache->area and set cache->id,
and if cache->id is not 0 and cache->area->kref refcount is 0, it will
release the cache->area by nfp_cpp_area_release(). area_cache_get()
set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire().
But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is
is already set but the refcount is not increased as expected. At this
time, calling the nfp_cpp_area_release() will cause use-after-free.
To avoid the use-after-free, set cache->id after area_init() and
nfp_cpp_area_acquire() complete successfully.
Note: This vulnerability is triggerable by providing emulated device
equipped with specified configuration.
BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760)
Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1
Call Trace:
<TASK>
nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760)
area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884)
Allocated by task 1:
nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303)
nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802)
nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230)
nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215)
nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744)
Freed by task 1:
kfree (mm/slub.c:4562)
area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873)
nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973)
nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48)
Bug: 254471126
Signed-off-by: Jialiang Wang <wangjialiang0806@163.com>
Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com>
Acked-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iad626deee45edc6bdf7a095d3de1defc5c6ad996
Signed-off-by: Lee Jones <joneslee@google.com>
commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c upstream.
proc_get_long() is passed a size_t, but then assigns it to an 'int'
variable for the length. Let's not do that, even if our IO paths are
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).
So do the proper test in the rigth type.
Bug: 261488859
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I75a06fe777c638b82ef3fbd1346e985065ab17f2
Signed-off-by: Lee Jones <joneslee@google.com>
commit bce9332220bd677d83b19d21502776ad555a0e73 upstream.
proc_skip_spaces() seems to think it is working on C strings, and ends
up being just a wrapper around skip_spaces() with a really odd calling
convention.
Instead of basing it on skip_spaces(), it should have looked more like
proc_skip_char(), which really is the exact same function (except it
skips a particular character, rather than whitespace). So use that as
inspiration, odd coding and all.
Now the calling convention actually makes sense and works for the
intended purpose.
Bug: 261488859
Reported-and-tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie21bf20f3b92b78c5f31093b354a77b4133810e7
Signed-off-by: Lee Jones <joneslee@google.com>
When communicating with accessory devices via USBFS, the initialisation
call-stack looks like:
ConfigFS > Gadget ConfigFS > UDC > Gadget ConfigFS > Composite
Eventually ending up in composite_dev_prepare() where memory for the
data buffer is allocated and initialised. The default size used for the
allocation is USB_COMP_EP0_BUFSIZ (4k). When handling bulk transfers,
acc_ctrlrequest() needs to be able to handle buffers up to
BULK_BUFFER_SIZE (16k). Instead of adding new generic attributes to
'struct usb_request' to track the size of the allocated buffer, we can
simply split off the affected thread of execution to travel via a
knowledgeable abstracted function acc_ctrlrequest_composite() where we
can complete the necessary specific checks.
Bug: 264029575
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ia1280f85499621d3fa57f7262b4a2c80f4be7773
Signed-off-by: Lee Jones <joneslee@google.com>
This is the merge of the upstream LTS release of 5.4.226 into the
android11-5.4 branch.
It contains the following commits:
94bdbb0042 Revert "mmc: sdhci: Fix voltage switch delay"
b0e3bda187 ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
39c4c9c65c Merge 5.4.226 into android11-5.4-lts
316cdfc48d Linux 5.4.226
3ab84e8913 ipc/sem: Fix dangling sem_array access in semtimedop race
210f96fb7e v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
0390da0565 proc: proc_skip_spaces() shouldn't think it is working on C strings
dd3124a051 proc: avoid integer type confusion in get_proc_long
1061bf5d01 mmc: sdhci: Fix voltage switch delay
9a5f49c0f5 mmc: sdhci: use FIELD_GET for preset value bit masks
d699373ac5 char: tpm: Protect tpm_pm_suspend with locks
9decec2993 Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
e67e119adf x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
0d87bb6070 Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
b5041a3daa x86/pm: Add enumeration check before spec MSRs save/restore setup
3b28594576 x86/tsx: Add a feature bit for TSX control MSR support
99c59256ea nvme: ensure subsystem reset is single threaded
dc85ff0a5f nvme: restrict management ioctls to admin
c41a89af7b epoll: check for events when removing a timed out thread from the wait queue
b8e803cda5 epoll: call final ep_events_available() check under the lock
e65ac2bdda tracing/ring-buffer: Have polling block on watermark
899e148171 ipv4: Fix route deletion when nexthop info is not specified
cc3cd130ec ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
a14f1a9c53 selftests: net: fix nexthop warning cleanup double ip typo
8aefb93295 selftests: net: add delete nexthop route warning test
dd6d2d82f0 Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
7da3a10f39 parisc: Increase FRAME_WARN to 2048 bytes on parisc
15568cdbe5 xtensa: increase size of gcc stack frame check
76f48511a1 parisc: Increase size of gcc stack frame check
cbdd83bd2f iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
0090231df2 pinctrl: single: Fix potential division by zero
73dce3c1d4 ASoC: ops: Fix bounds check for _sx controls
ced17a55a8 mm: Fix '.data.once' orphan section warning
c9ecc42094 arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
44ccd8c52f arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
1603feac15 tracing: Free buffers when a used dynamic event is removed
dcd1daad31 mmc: sdhci-sprd: Fix no reset data and command after voltage switch
9e5581c772 mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
bfdfe86d83 mmc: core: Fix ambiguous TRIM and DISCARD arg
040d08c996 mmc: mmc_test: Fix removal of debugfs file
eb5001ecfb pinctrl: intel: Save and restore pins in "direct IRQ" mode
ae34a4f4a2 x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
9a130b72e6 nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
3ae3bb33c4 tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
cf1c12bc5c error-injection: Add prompt for function error injection
2f6fd2de72 net/mlx5: DR, Fix uninitialized var warning
ea5844f946 hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
89eecabe6a hwmon: (coretemp) Check for null before removing sysfs attrs
0aacac75b8 net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
a7555681e5 sctp: fix memory leak in sctp_stream_outq_migrate()
168de4096b packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
16c244bc65 net: tun: Fix use-after-free in tun_detach()
1c1d4830a9 afs: Fix fileserver probe RTT handling
53a62c5efe net: hsr: Fix potential use-after-free
ae633816dd dsa: lan9303: Correct stat name
910c0264b6 net: ethernet: nixge: fix NULL dereference
2d24d91b9f net/9p: Fix a potential socket leak in p9_socket_open
4720725e22 net: net_netdev: Fix error handling in ntb_netdev_init_module()
3e21f85d87 net: phy: fix null-ptr-deref while probe() failed
f5c2ec288a wifi: cfg80211: fix buffer overflow in elem comparison
06785845e1 qlcnic: fix sleep-in-atomic-context bugs caused by msleep
78f8a34b37 can: cc770: cc770_isa_probe(): add missing free_cc770dev()
e4b474fa78 can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
0a2d73a770 net/mlx5e: Fix use-after-free when reverting termination table
093ccc2f84 net/mlx5: Fix uninitialized variable bug in outlen_write()
b10dd3bd14 of: property: decrement node refcount in of_fwnode_get_reference_args()
7b2b67fe13 hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
45a6437834 hwmon: (i5500_temp) fix missing pci_disable_device()
dbcc339001 scripts/faddr2line: Fix regression in name resolution on ppc64le
2b916ee1d3 iio: light: rpr0521: add missing Kconfig dependencies
3f566b6260 iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
2d6a437064 iio: health: afe4403: Fix oob read in afe4403_read_raw
8eb912af52 btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
7e88a416ed drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
41f0abeadc drm/amdgpu: update drm_display_info correctly when the edid is read
787138e4b9 btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
255289adce spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
83aae3204e btrfs: free btrfs_path before copying inodes to userspace
9fd11e2de7 fuse: lock inode unconditionally in fuse_fallocate()
3659e33c1e drm/i915: fix TLB invalidation for Gen12 video and compute engines
0d1cad5971 drm/amdgpu: always register an MMU notifier for userptr
d4e9bab771 drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
a541f1f0ce btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
d037681515 btrfs: free btrfs_path before copying subvol info to userspace
69e2f1dd93 btrfs: free btrfs_path before copying fspath to userspace
3cde2bc708 btrfs: free btrfs_path before copying root refs to userspace
4741b00cac binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
4e682ce560 binder: Address corner cases in deferred copy and fixup
15e098ab1d binder: fix pointer cast warning
74e7f1828a binder: defer copies of pre-patched txn data
7b31ab0d9e binder: read pre-translated fds from sender buffer
c056a6ba35 binder: avoid potential data leakage when copying txn
f8fee36515 dm integrity: flush the journal on suspend
096e1bd659 net: usb: qmi_wwan: add Telit 0x103a composition
86136bf623 tcp: configurable source port perturb table size
07da8fca30 platform/x86: hp-wmi: Ignore Smart Experience App event
82d758c9da platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
846c0f9cd0 platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
6579436fd1 xen/platform-pci: add missing free_irq() in error path
375e79c571 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
e3a2211fe1 ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
3e2452cbc6 Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
47b4949335 gcov: clang: fix the buffer overflow issue
ecbde4222e nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
7d08b4eba1 firmware: coreboot: Register bus in module init
a2012335aa firmware: google: Release devices before unregistering the bus
cb7495fe95 ceph: avoid putting the realm twice when decoding snaps fails
12a93545b2 ceph: do not update snapshot context when there is no new snapshot
0528b19d57 iio: pressure: ms5611: fixed value compensation bug
562f415bb3 iio: ms5611: Simplify IO callback parameters
def48fbbac nios2: add FORCE for vmlinuz.gz
da849abded init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
03949acb58 iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
f8a76c28e9 iio: light: apds9960: fix wrong register for gesture gain
d3ad47426a arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
ae6bcb2698 usb: dwc3: exynos: Fix remove() function
15f8b52523 lib/vdso: use "grep -E" instead of "egrep"
960cf3c7ff s390/crashdump: fix TOD programmable field size
fabd3ab6a1 net: thunderx: Fix the ACPI memory leak
1633e6d6aa nfc: st-nci: fix memory leaks in EVT_TRANSACTION
0e2a4560db nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
420b21235d s390/dasd: fix no record found for raw_track_access
9d1264c914 dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
08f25427d8 bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
59612acf6b regulator: twl6030: re-add TWL6032_SUBCLASS
1c12909a78 NFC: nci: fix memory leak in nci_rx_data_packet()
23b83a3c76 xfrm: Fix ignored return value in xfrm6_init()
23ba1997eb tipc: check skb_linearize() return value in tipc_disc_rcv()
59f9aad22f tipc: add an extra conn_get in tipc_conn_alloc
30f91687fa tipc: set con sock in tipc_conn_alloc
5c12136c00 net/mlx5: Fix FW tracer timestamp calculation
00492f823f Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
e0d5becab1 Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
ec3d7202e9 nfp: add port from netdev validation for EEPROM access
9b8061a6db net: pch_gbe: fix pci device refcount leak while module exiting
9a39ea43f1 net/qla3xxx: fix potential memleak in ql3xxx_send()
a07149c10b net/mlx4: Check retval of mlx4_bitmap_init
bbf6d1bc07 ARM: mxs: fix memory leak in mxs_machine_init()
3afa86449e 9p/fd: fix issue of list_del corruption in p9_fd_cancel()
bfadcbf5ba net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
e00b42cbec nfc/nci: fix race with opening and closing
04ffa53ab7 net: liquidio: simplify if expression
79c55e66ca ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
897f6a3091 tee: optee: fix possible memory leak in optee_register_device()
9c1fbac623 bus: sunxi-rsb: Support atomic transfers
347875ff9a regulator: core: fix UAF in destroy_regulator()
5561211031 regulator: core: fix kobject release warning and memory leak in regulator_register()
c062676528 ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
168d59f7f7 ARM: dts: am335x-pcm-953: Define fixed regulators in root node
dd56c671cc af_key: Fix send_acquire race with pfkey_register
9221a53bfc MIPS: pic32: treat port as signed integer
dff9b25cb9 RISC-V: vdso: Do not add missing symbols to version section in linker script
b0e025dd87 arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
0ba7c091f7 block, bfq: fix null pointer dereference in bfq_bio_bfqg()
b848811655 drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
5dfbb54fe1 spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
9029aee874 wifi: mac80211: Fix ack frame idr leak when mesh has no route
1f75f9c1af audit: fix undefined behavior in bit shift for AUDIT_BIT
3129cec05f wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
b4cb3dc111 wifi: mac80211: fix memory free error when registering wiphy fail
b1dfc3f888 Revert "can: af_can: fix NULL pointer dereference in can_rx_register()"
17d66a1fd0 Merge 5.4.225 into android11-5.4-lts
d3df1dbcb2 Merge branch 'android11-5.4' into branch 'android11-5.4-lts'
4d2a309b5c Linux 5.4.225
b612f924f2 ntfs: check overflow when iterating ATTR_RECORDs
0e2ce0954b ntfs: fix out-of-bounds read in ntfs_attr_find()
266bd53062 ntfs: fix use-after-free in ntfs_attr_find()
ed8b990e89 mm: fs: initialize fsdata passed to write_begin/write_end interface
b1ad04da7f 9p/trans_fd: always use O_NONBLOCK read/write
179236a122 gfs2: Switch from strlcpy to strscpy
8b6534c9ae gfs2: Check sb_bsize_shift after reading superblock
96760723aa 9p: trans_fd/p9_conn_cancel: drop client lock earlier
ce57d6474a kcm: close race conditions on sk_receive_queue
7a704dbfd3 bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
ad39d09190 kcm: avoid potential race in kcm_tx_work
78be2ee011 tcp: cdg: allow tcp_cdg_release() to be called multiple times
a62aa84fe1 macvlan: enforce a consistent minimal mtu
4f348b60c7 Input: i8042 - fix leaking of platform device on module removal
7b0007b28d kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
28f7ff5e75 scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
ec59a13252 ring-buffer: Include dropped pages in counting dirty patches
32a7f06451 serial: 8250: Flush DMA Rx on RLSI
e7061dd1fe misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
3da7098e8f docs: update mediator contact information in CoC doc
27f712cd47 mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
616c6695dd mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout
076712ff50 mmc: core: properly select voltage range without power cycle
1bf8ed5855 scsi: zfcp: Fix double free of FSF request when qdio send fails
5d53797ce7 Input: iforce - invert valid length check when fetching device IDs
89c0c27ab3 serial: 8250_lpss: Configure DMA also w/o DMA filter
d6ebe11ad3 serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
b545c0e1e4 dm ioctl: fix misbehavior if list_versions races with module loading
1c5866b4dd iio: pressure: ms5611: changed hardcoded SPI speed to value limited
0dd52e141a iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
7b75515728 iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
c025c4505f usb: chipidea: fix deadlock in ci_otg_del_timer
8c8039ede2 usb: add NO_LPM quirk for Realforce 87U Keyboard
bec9f91f7b USB: serial: option: add Fibocom FM160 0x0111 composition
1972f20f36 USB: serial: option: add u-blox LARA-L6 modem
089839cccf USB: serial: option: add u-blox LARA-R6 00B modem
31e6aba26b USB: serial: option: remove old LARA-R6 PID
5ee0a017e5 USB: serial: option: add Sierra Wireless EM9191
0410c2ae21 speakup: fix a segfault caused by switching consoles
6ed6a5dfa3 slimbus: stream: correct presence rate frequencies
56607f0bfc Revert "usb: dwc3: disable USB core PHY management"
e7dc436aea ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
72c2ea34fa ring_buffer: Do not deactivate non-existant pages
f715f31559 ftrace: Fix null pointer dereference in ftrace_add_mod()
c50e0bcf4a ftrace: Optimize the allocation for mcount entries
3041feeedb ftrace: Fix the possible incorrect kernel message
04e9e5eb45 cifs: add check for returning value of SMB2_set_info_init
293c0d7182 net: thunderbolt: Fix error handling in tbnet_init()
e6546d5412 cifs: Fix wrong return value checking when GETFLAGS
e109b41870 net/x25: Fix skb leak in x25_lapb_receive_frame()
e313efddce platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
813a8dd9c4 drbd: use after free in drbd_create_device()
0199bf0a8f xen/pcpu: fix possible memory leak in register_pcpu()
aa2ba35650 bnxt_en: Remove debugfs when pci_register_driver failed
6134357f56 net: caif: fix double disconnect client in chnl_net_open()
90638373f1 net: macvlan: Use built-in RCU list checking
83672c1b83 mISDN: fix misuse of put_device() in mISDN_register_device()
8c85770d1a net: liquidio: release resources when liquidio driver open failed
0f2c681900 mISDN: fix possible memory leak in mISDN_dsp_element_register()
d697f78cab net: bgmac: Drop free_netdev() from bgmac_enet_remove()
bec9ded540 ata: libata-transport: fix double ata_host_put() in ata_tport_add()
2ff7e852bd arm64: dts: imx8mn: Fix NAND controller size-cells
bb4a2f898e arm64: dts: imx8mm: Fix NAND controller size-cells
040f726fec pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
5b3d6d510b parport_pc: Avoid FIFO port location truncation
f9fe7ba4ea siox: fix possible memory leak in siox_device_add()
6bb50c14c9 block: sed-opal: kmalloc the cmd/resp buffers
8555c6c112 ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
b768afc68b tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
476b09e07b serial: imx: Add missing .thaw_noirq hook
b7c6033a8f serial: 8250: omap: Flush PM QOS work on remove
2d66412563 serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
747e76f4cc serial: 8250_omap: remove wait loop from Errata i202 workaround
2ec3f558db ASoC: core: Fix use-after-free in snd_soc_exit()
ee31abd047 spi: stm32: Print summary 'callbacks suppressed' message
a39357b4ec ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route"
1a5f13b0c5 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
6fa082ad96 btrfs: remove pointless and double ulist frees in error paths of qgroup tests
741bded210 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
761976a617 i2c: i801: add lis3lv02d's I2C address for Vostro 5568
18a501e5c7 NFSv4: Retry LOCK on OLD_STATEID during delegation return
281b93e42e selftests/intel_pstate: fix build for ARCH=x86_64
2cce0a36ce selftests/futex: fix build for clang
c81ab3d7d1 ASoC: codecs: jz4725b: fix capture selector naming
5b94d1bb1e ASoC: codecs: jz4725b: use right control for Capture Volume
21b6fbb934 ASoC: codecs: jz4725b: fix reported volume for Master ctl
c9fb6a0311 ASoC: codecs: jz4725b: add missed Line In power control bit
1719b9c0fb spi: intel: Fix the offset to get the 64K erase opcode
af93d7c9d9 ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK
a3b07bb0b3 ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe"
4d487873ba ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe"
f0901e1551 ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe"
1fd66e3b02 x86/cpu: Restore AMD's DE_CFG MSR after resume
30b0263d03 net: tun: call napi_schedule_prep() to ensure we own a napi
7a6e564ff2 dmaengine: at_hdmac: Check return code of dma_async_device_register
966dd087de dmaengine: at_hdmac: Fix impossible condition
d6ce23165c dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
a535247029 dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
77b97ef490 dmaengine: at_hdmac: Don't start transactions at tx_submit level
3d35e36d7a dmaengine: at_hdmac: Fix at_lli struct definition
ab390c532e cert host tools: Stop complaining about deprecated OpenSSL functions
d0513b095e can: j1939: j1939_send_one(): fix missing CAN header initialization
d8971f4107 udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
c914c56ac0 btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
aa05252ab4 platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
431b70544b drm/i915/dmabuf: fix sg_table handling in map_dma_buf
9b162e8104 nilfs2: fix use-after-free bug of ns_writer on remount
36ff974b03 nilfs2: fix deadlock in nilfs_count_free_blocks()
b4421e6d9a vmlinux.lds.h: Fix placement of '.data..decrypted' section
022d8696a7 ALSA: usb-audio: Add DSD support for Accuphase DAC-60
ded2d51b85 ALSA: usb-audio: Add quirk entry for M-Audio Micro
02dea987ec ALSA: hda: fix potential memleak in 'add_widget_node'
9ab40b1df6 ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
d51861d291 mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
d2cf28caf5 mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
ae2aeee895 mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
9fbe020829 MIPS: jump_label: Fix compat branch range check
f967bbc72f arm64: efi: Fix handling of misaligned runtime regions and drop warning
c5c0b31675 riscv: process: fix kernel info leakage
685e73e3f7 net: macvlan: fix memory leaks of macvlan_common_newlink
d1dddadf4c ethernet: tundra: free irq when alloc ring failed in tsi108_open()
1b7a565143 net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ec8a47afc5 ethernet: s2io: disable napi when start nic failed in s2io_card_up()
b03f505c5d cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
834d2da28f net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
8344451681 net: cpsw: disable napi in cpsw_ndo_open()
3892c2d335 net/mlx5: Allow async trigger completion execution on single CPU systems
5b72cf7a40 net: nixge: disable napi when enable interrupts failed in nixge_open()
a8aade318d perf stat: Fix printing os->prefix in CSV metrics output
da4daa36ea drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
1d84887327 dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
7c77e272b4 dmaengine: pxa_dma: use platform_get_irq_optional
36769b9477 tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
afab465575 can: af_can: fix NULL pointer dereference in can_rx_register()
58cd7fdc8c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
3ad3414591 drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
831ea56c34 hamradio: fix issue of dev reference count leakage in bpq_device_event()
c7e0024852 net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
5661f111a1 capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
08c3d22f10 net: fman: Unregister ethernet device on removal
aa94d1a607 bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
a5a05fbef4 bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
a4f73f6adc net: tun: Fix memory leaks of napi_get_frags
65ad047fd8 net: gso: fix panic on frag_list with mixed head alloc types
e29289d0d8 HID: hyperv: fix possible memory leak in mousevsc_probe()
d975bec1ea bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
0ede1a9882 wifi: cfg80211: fix memory leak in query_regdb_file()
1c8d066317 wifi: cfg80211: silence a sparse RCU warning
c38ea83169 phy: stm32: fix an error code in probe
45a841719f xfs: drain the buf delwri queue before xfsaild idles
e107e953d2 xfs: preserve inode versioning across remounts
7d57979052 xfs: use MMAPLOCK around filemap_map_pages()
8b27e684a6 xfs: redesign the reflink remap loop to fix blkres depletion crash
ece1eb9957 xfs: rename xfs_bmap_is_real_extent to is_written_extent
d304fafb97 xfs: preserve rmapbt swapext block reservation from freed blocks
0bd6dcc07a Merge 5.4.224 into android11-5.4-lts
644fd1c691 Merge 5.4.223 into android11-5.4-lts
e05ac131e9 Merge 5.4.222 into android11-5.4-lts
3fc02367ac Merge 5.4.221 into android11-5.4-lts
f134fec530 ANDROID: properly copy the scm_io_uring field in struct sk_buff
771a8acbb8 Linux 5.4.224
3e0c1ab197 ipc: remove memcg accounting for sops objects in do_semtimedop()
a16415c8f1 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
a24bf3c317 drm/i915/sdvo: Setup DDC fully before output init
4dadd4b161 drm/i915/sdvo: Filter out invalid outputs more sensibly
57306fef4d drm/rockchip: dsi: Force synchronous probe
e09ff743e3 mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
8b1174d058 KVM: x86: emulator: update the emulation mode after CR0 write
ac3bc06c9a KVM: x86: emulator: introduce emulator_recalc_and_set_mode
f159cd915d KVM: x86: emulator: em_sysexit should update ctxt->mode
ef3094c4e9 KVM: x86: Mask off reserved bits in CPUID.80000008H
da1bf3732d KVM: x86: Mask off reserved bits in CPUID.8000001AH
2fa24d0274 ext4: fix BUG_ON() when directory entry has invalid rec_len
72743d5598 ext4: fix warning in 'ext4_da_release_space'
eed040fd35 parisc: Avoid printing the hardware path twice
9e902284ee parisc: Export iosapic_serial_irq() symbol for serial port driver
506ae30167 parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
c586068aad ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
4e8ee3cf74 perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
6ffa48150b perf/x86/intel: Fix pebs event constraints for ICL
fee896d453 efi: random: reduce seed size to 32 bytes
0c72757434 fuse: add file_modified() to fallocate
0c3e6288da capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
4bc52ddf63 tracing/histogram: Update document for KEYS_MAX size
c8938263e6 tools/nolibc/string: Fix memcmp() implementation
993bd0de8b kprobe: reverse kp->flags when arm_kprobe failed
fe3da74428 tcp/udp: Make early_demux back namespacified.
4ae03c869c btrfs: fix type of parameter generation in btrfs_get_dentry
27a594bc7a binder: fix UAF of alloc->vma in race with munmap()
bad83d5513 memcg: enable accounting of ipc resources
92aaa5e8fe tcp/udp: Fix memory leak in ipv6_renew_options().
c494ae1498 block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
6949400ec9 Bluetooth: L2CAP: Fix attempting to access uninitialized memory
ad18f624e3 xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()
0802130a4d xfs: don't fail unwritten extent conversion on writeback due to edquot
fef141f9e4 xfs: group quota should return EDQUOT when prj quota enabled
4267433dd3 xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
24e7e39353 xfs: use ordered buffers to initialize dquot buffers during quotacheck
52802e9a03 xfs: don't fail verifier on empty attr3 leaf block
71d487a82d i2c: xiic: Add platform module alias
cdd19e559a HID: saitek: add madcatz variant of MMO7 mouse device ID
efdcd1e32c scsi: core: Restrict legal sdev_state transitions via sysfs
7011975631 media: meson: vdec: fix possible refcount leak in vdec_probe()
bfa8ccf705 media: dvb-frontends/drxk: initialize err to 0
11c8f19e0f media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
4a449430ec media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
381453770f ipv6: fix WARNING in ip6_route_net_exit_late()
b49f6b2f21 net, neigh: Fix null-ptr-deref in neigh_table_clear()
4954b5359e net: mdio: fix undefined behavior in bit shift for __mdiobus_register
c1f594dddd Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
4cd094fd5d Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
5d1a47ebf8 btrfs: fix ulist leaks in error paths of qgroup self tests
6a6731a0df btrfs: fix inode list leak during backref walking at find_parent_nodes()
2c0329406b btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
3d74329d8c isdn: mISDN: netjet: fix wrong check of device registration
2ff6b66952 mISDN: fix possible memory leak in mISDN_register_device()
b13be5e852 rose: Fix NULL pointer dereference in rose_send_frame()
8457a00c98 ipvs: fix WARNING in ip_vs_app_net_cleanup()
7effc4ce3d ipvs: fix WARNING in __ip_vs_cleanup_batch()
2cc523978f ipvs: use explicitly signed chars
74fd583946 netfilter: nf_tables: release flow rule object from commit path
ca791952d4 net: tun: fix bugs for oversize packet when napi frags enabled
52e0429471 net: sched: Fix use after free in red_enqueue()
d605da3e5f ata: pata_legacy: fix pdc20230_set_piomode()
704b92c51b net: fec: fix improper use of NETDEV_TX_BUSY
f30060efcf nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
aef89b91c7 nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
875082ae83 RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
af8fb5a060 RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
bbc5d7b46a net: dsa: Fix possible memory leaks in dsa_loop_init()
925cb538bd nfs4: Fix kmemleak when allocate slot failed
0bc335d010 NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
405309d860 NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
25760a41e3 IB/hfi1: Correctly move list in sc_disable()
6b5c87f9b3 RDMA/cma: Use output interface for net_dev check
a0d9384967 Linux 5.4.223
a0a2a4bdd1 can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
fc0eecb8b4 net: enetc: survive memory pressure without crashing
69dd3ad406 net/mlx5: Fix possible use-after-free in async command interface
827e36a031 net/mlx5e: Do not increment ESN when updating IPsec ESN state
7dc6ce3ef2 nh: fix scope used to find saddr when adding non gw nh
ba6ee85355 net: ehea: fix possible memory leak in ehea_register_port()
4175d6381f openvswitch: switch from WARN to pr_warn
0667bb6000 ALSA: aoa: Fix I2S device accounting
5bdea67453 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
2a47cc2a3d PM: domains: Fix handling of unavailable/disabled idle states
a49e74cc74 net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
e46f699ac2 i40e: Fix flow-type by setting GL_HASH_INSET registers
e88c2a1e28 i40e: Fix VF hang when reset is triggered on another VF
28c47fd23c i40e: Fix ethtool rx-flow-hash setting for X722
d303dabe7e media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
b4a3a01762 media: v4l2-dv-timings: add sanity checks for blanking values
d8f479c777 media: vivid: dev->bitmap_cap wasn't freed in all cases
9d6870949c media: vivid: s_fbuf: add more sanity checks
8e1592d415 PM: hibernate: Allow hybrid sleep to work with s2idle
77454bc744 can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
f79de6451e tcp: fix indefinite deferral of RTO with SACK reneging
38e4516960 net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
97ad240fd9 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
663682cd31 kcm: annotate data-races around kcm->rx_wait
e94395e916 kcm: annotate data-races around kcm->rx_psock
f85e54b4f3 amd-xgbe: add the bit rate quirk for Molex cables
71ba2a9566 amd-xgbe: fix the SFP compliance codes check for DAC cables
fe3fd27083 x86/unwind/orc: Fix unreliable stack dump with gcov
fda2d07234 net: netsec: fix error handling in netsec_register_mdio()
24b129aed8 tipc: fix a null-ptr-deref in tipc_topsrv_accept
758dbcc6fb ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
ccaeef126e arc: iounmap() arg is volatile
fa434a64a4 drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
29a6902eb0 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
6f3511eb86 net: ieee802154: fix error return code in dgram_bind()
11993652d0 mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
5a2d7c93d9 cgroup-v1: add disabled controller check in cgroup1_parse_param()
3d056d81b9 xen/gntdev: Prevent leaking grants
8f589b5c0e Xen/gntdev: don't ignore kernel unmapping error
f45ee20384 xfs: force the log after remapping a synchronous-writes file
102de7717d xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
03b449a880 xfs: finish dfops on every insert range shift iteration
3d295076ba s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
344e1cb0ba s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
4f969d0753 perf auxtrace: Fix address filter symbol name match for modules
c78b0dc6fb kernfs: fix use-after-free in __kernfs_remove
7a09c64b7d mmc: core: Fix kernel panic when remove non-standard SDIO card
ed7f1ff87a drm/msm/hdmi: fix memory corruption with too many bridges
f649ed0e1b drm/msm/dsi: fix memory corruption with too many bridges
e7348308f6 mac802154: Fix LQI recording
5385af2f89 fbdev: smscufx: Fix several use-after-free bugs
07ef3be6ca iio: light: tsl2583: Fix module unloading
cb972e6d01 tools: iio: iio_utils: fix digit calculation
8f1cd9633d xhci: Remove device endpoints from bandwidth list when freeing the device
914704e0d2 mtd: rawnand: marvell: Use correct logic for nand-keep-config
5d36037b22 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
7b7a0d5433 usb: bdc: change state when port disconnected
6827b58a95 usb: dwc3: gadget: Don't set IMI for no_interrupt
9aa0254303 usb: dwc3: gadget: Stop processing more requests on IMI
035dda2bfd USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
e4045fbcd9 ALSA: au88x0: use explicitly signed char
d853b43808 ALSA: Use del_timer_sync() before freeing timer
caea5b20ef can: kvaser_usb: Fix possible completions during init_completion
5437642f91 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
d1e6abc127 UPSTREAM: once: fix section mismatch on clang builds
5bb30ff63f ANDROID: fix up struct sk_buf ABI breakage
9470c670ee ANDROID: fix up CRC issue with struct tcp_sock
5282d4de78 Linux 5.4.222
59f89518f5 once: fix section mismatch on clang builds
34c78f8fb6 ANDROID: fix up 131287ff83 ("once: add DO_ONCE_SLOW() for sleepable contexts")
f4606e0bf2 Revert "serial: 8250: Fix restoring termios speed after suspend"
6b029aa535 Merge 5.4.220 into android11-5.4-lts
b70bfeb986 Linux 5.4.221
6bb8769326 mm: /proc/pid/smaps_rollup: fix no vma's null-deref
a351077e58 hv_netvsc: Fix race between VF offering and VF association message from host
2f1b3377b6 Makefile.debug: re-enable debug info for .S files
9220881831 ACPI: video: Force backlight native for more TongFang devices
8ad8fc82ee riscv: topology: fix default topology reporting
60dd3dc2ac arm64: topology: move store_cpu_topology() to shared code
724483b585 iommu/vt-d: Clean up si_domain in the init_dmars() error path
dfc0337c6d net: hns: fix possible memory leak in hnae_ae_register()
bc8301ea7e net: sched: cake: fix null pointer access issue when cake_init() fails
b87f88d58f net: phy: dp83867: Extend RX strap quirk for SGMII mode
6453077a00 net/atm: fix proc_mpc_write incorrect return value
4258c473ee HID: magicmouse: Do not set BTN_MOUSE on double report
567f8de358 tipc: fix an information leak in tipc_topsrv_kern_subscr
27ee73c119 tipc: Fix recognition of trial period
fa0676d94f ACPI: extlog: Handle multiple records
13a2719ec8 btrfs: fix processing of delayed tree block refs during backref walking
b397ce3477 btrfs: fix processing of delayed data refs during backref walking
96894a4fe6 r8152: add PID for the Lenovo OneLink+ Dock
7f6d2188ec arm64: errata: Remove AES hwcap for COMPAT tasks
aae3508163 media: venus: dec: Handle the case where find_format fails
fd596e7371 KVM: arm64: vgic: Fix exit condition in scan_its_table()
383b7c50f5 ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
da97931502 ata: ahci-imx: Fix MODULE_ALIAS
c00cdfc9bd hwmon/coretemp: Handle large core ID value
3ea7da6a97 x86/microcode/AMD: Apply the patch early on every logical thread
3064c74198 ocfs2: fix BUG when iput after ocfs2_mknod fails
c2489774a2 ocfs2: clear dinode links count in case of error
6391ed32b1 xfs: fix use-after-free on CIL context on shutdown
ac055fee25 xfs: move inode flush to the sync workqueue
d3eb14b8ea xfs: reflink should force the log out if mounted with wsync
05e2b279ea xfs: factor out a new xfs_log_force_inode helper
f1172b08bb xfs: trylock underlying buffer on dquot flush
890d7dfff7 xfs: don't write a corrupt unmount record to force summary counter recalc
8ebd3ba932 xfs: tail updates only need to occur when LSN changes
87b8a7fb62 xfs: factor common AIL item deletion code
4202b103d3 xfs: Throttle commits on delayed background CIL push
7a8f95bfb9 xfs: Lower CIL flush limit for large logs
f43ff28b01 xfs: preserve default grace interval during quotacheck
553e5c8031 xfs: fix unmount hang and memory leak on shutdown during quotaoff
835306dd3f xfs: factor out quotaoff intent AIL removal and memory free
a1e03f1600 xfs: Replace function declaration by actual definition
fdce40c8fd xfs: remove the xfs_qoff_logitem_t typedef
926ddf7846 xfs: remove the xfs_dq_logitem_t typedef
80f78aa76a xfs: remove the xfs_disk_dquot_t and xfs_dquot_t
4776ae328c xfs: Use scnprintf() for avoiding potential buffer overflow
2f55a03891 xfs: check owner of dir3 blocks
15b0651f38 xfs: check owner of dir3 data blocks
bc013efdcf xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails
6e204b9e67 xfs: xfs_buf_corruption_error should take __this_address
0213ee5f4c xfs: add a function to deal with corrupt buffers post-verifiers
3c88c3c00c xfs: rework collapse range into an atomic operation
3602df3f1f xfs: rework insert range into an atomic operation
7cd181cb23 xfs: open code insert range extent split helper
fe18f1af38 Linux 5.4.220
d9fdda5efe thermal: intel_powerclamp: Use first online CPU as control_cpu
c3bb4a7e8c inet: fully convert sk->sk_rx_dst to RCU rules
96e2e21284 efi: libstub: drop pointless get_memory_map() call
97238b8858 md: Replace snprintf with scnprintf
8b766dd707 ext4: continue to expand file system when the target size doesn't reach
4a36de8947 net/ieee802154: don't warn zero-sized raw_sendmsg()
cff6131217 Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
1210359a68 net: ieee802154: return -EINVAL for unknown addr type
04df9719df io_uring/af_unix: defer registered files gc to io_uring release
f5dd24a664 perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
036b1f3bca clk: bcm2835: Make peripheral PLLC critical
1eae30c011 usb: idmouse: fix an uninit-value in idmouse_open
0d150ccd55 nvmet-tcp: add bounds check on Transfer Tag
3a3a8d75af nvme: copy firmware_rev on each init
e5d8f05edb staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
072b5a41c5 Revert "usb: storage: Add quirk for Samsung Fit flash"
d6afcab1b4 usb: musb: Fix musb_gadget.c rxstate overflow bug
9fa81cbd2d usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
1c00bb624c md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
e30c3a9a88 HID: roccat: Fix use-after-free in roccat_read()
81247850b8 bcache: fix set_at_max_writeback_rate() for multiple attached devices
7cfc77f4fe ata: libahci_platform: Sanity check the DT child nodes number
16a45e78a6 staging: vt6655: fix potential memory leak
3376a0cf13 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
3575949513 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
22f49d9d6e scsi: 3w-9xxx: Avoid disabling device if failing to enable it
66de922076 clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
9181af2dbf media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
5dbfcf7b08 clk: zynqmp: Fix stack-out-of-bounds in strncpy`
715fe15785 btrfs: scrub: try to fix super block errors
8054f824a7 ARM: dts: imx6sx: add missing properties for sram
05f789afaf ARM: dts: imx6sll: add missing properties for sram
48d1766b35 ARM: dts: imx6sl: add missing properties for sram
ef4a3baf00 ARM: dts: imx6qp: add missing properties for sram
ee239c0340 ARM: dts: imx6dl: add missing properties for sram
82e5191b12 ARM: dts: imx6q: add missing properties for sram
0b2013ace8 ARM: dts: imx7d-sdb: config the max pressure for tsc2046
aec01503ba mmc: sdhci-msm: add compatible string check for sdm670
e67c2cda3d drm/amdgpu: fix initial connector audio value
079f64a1ea platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
30a3601c2f drm: panel-orientation-quirks: Add quirk for Anbernic Win600
7de3e3514c drm/vc4: vec: Fix timings for VEC modes
8f6cad7c4b drm/amd/display: fix overflow on MIN_I64 definition
cdde55f972 drm: Prevent drm_copy_field() to attempt copying a NULL pointer
fb282b4e8a drm: Use size_t type for len variable in drm_copy_field()
1d0803b153 drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
61fd56b0a1 r8152: Rate limit overflow messages
7d6f9cb24d Bluetooth: L2CAP: Fix user-after-free
a76462dbdd net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
4037270ea6 wifi: rt2x00: correctly set BBP register 86 for MT7620
2021a5aaf8 wifi: rt2x00: set SoC wmac clock register
f9c053c3e4 wifi: rt2x00: set VGC gain for both chains of MT7620
0facbe6083 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
2f383edcb7 wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
fdcc57ef8c can: bcm: check the result of can_send() in bcm_can_tx()
6e85d2ad95 Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
776f33c12f Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
49c742afd6 wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
18373ed500 xfrm: Update ipcomp_scratches with NULL when freed
2c485f4f2a wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
42d579d910 tcp: annotate data-race around tcp_md5sig_pool_populated
ce25d7caf3 openvswitch: Fix overreporting of drops in dropwatch
a7fe12cea5 openvswitch: Fix double reporting of drops in dropwatch
06d73f4e6b bpftool: Clear errno after libcap's checks
56a0ac4863 wifi: brcmfmac: fix invalid address access when enabling SCAN log level
38ca9ece96 NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
5a646c38f6 thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
49a6ffdaed powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
ac84b26a16 MIPS: BCM47XX: Cast memcmp() of function to (void *)
13f4d3665b ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
c5ed3a3789 f2fs: fix race condition on setting FI_NO_EXTENT flag
584561e942 crypto: cavium - prevent integer overflow loading firmware
00791e017b kbuild: remove the target in signal traps when interrupted
d59d36aa4c iommu/iova: Fix module config properly
0f224fde63 crypto: ccp - Release dma channels before dmaengine unrgister
95c4e20adc crypto: akcipher - default implementation for setting a private key
4010a1afaa iommu/omap: Fix buffer overflow in debugfs
b32a285998 cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
3317c7d211 powerpc: Fix SPE Power ISA properties for e500v1 platforms
6191f0310e powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
f11bce700b x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
828d190380 powerpc/powernv: add missing of_node_put() in opal_export_attrs()
0a5cee97c0 powerpc/pci_dn: Add missing of_node_put()
1535e14731 powerpc/sysdev/fsl_msi: Add missing of_node_put()
85d23c4933 powerpc/math_emu/efp: Include module.h
e77a85c3fb mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
f28eec4078 clk: ast2600: BCLK comes from EPLL
fc39ebf85d clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
111369bb8c clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
2ee652f072 spmi: pmic-arb: correct duplicate APID to PPID mapping logic
1ea4efc09f dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
8498490b3c clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
8542422192 mfd: sm501: Add check for platform_driver_register()
f95ba4aab6 mfd: fsl-imx25: Fix check for platform_get_irq() errors
6804b4fede mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
595d077f3c mfd: lp8788: Fix an error handling path in lp8788_probe()
b75f4912b3 mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
1f4f8b6adb mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
b6c2c3059e fsi: core: Check error number after calling ida_simple_get
117331a2a5 scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
558a9fcb6c serial: 8250: Fix restoring termios speed after suspend
c969316eee firmware: google: Test spinlock on panic path to avoid lockups
88b9cc60f2 staging: vt6655: fix some erroneous memory clean-up loops
83d11dd92a phy: qualcomm: call clk_disable_unprepare in the error handling
29b897ac7b tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
744c2d33a8 drivers: serial: jsm: fix some leaks in probe
9fe0a8c069 usb: gadget: function: fix dangling pnp_string in f_printer.c
59e3d41265 xhci: Don't show warning for reinit on known broken suspend
f8ba29ae23 md/raid5: Ensure stripe_fill happens on non-read IO with journal
9b881a2ca0 mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
22830560eb ata: fix ata_id_has_dipm()
10d52d8dd1 ata: fix ata_id_has_ncq_autosense()
99e7e64451 ata: fix ata_id_has_devslp()
6ea4b3303a ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
e09caa38e1 RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
b21b0d17ad mtd: devices: docg3: check the return value of devm_ioremap() in the probe
3ca6939b5d dyndbg: let query-modname override actual module name
ad0a65517c dyndbg: fix module.dyndbg handling
fc797285c4 misc: ocxl: fix possible refcount leak in afu_ioctl()
7ed37be3a2 RDMA/rxe: Fix the error caused by qp->sk
0d773c58d7 RDMA/rxe: Fix "kernel NULL pointer dereference" error
59b3153532 media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
80a955dabb tty: xilinx_uartps: Fix the ignore_status
3e77ac46f2 media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
3baf53328a HSI: omap_ssi_port: Fix dma_map_sg error check
aa9c0598b1 HSI: omap_ssi: Fix refcount leak in ssi_probe
5d9fb09612 clk: tegra20: Fix refcount leak in tegra20_clock_init
5984b1d661 clk: tegra: Fix refcount leak in tegra114_clock_init
6d3ac23b95 clk: tegra: Fix refcount leak in tegra210_clock_init
aa3898dec1 clk: berlin: Add of_node_put() for of_get_parent()
fcaff9bc6b clk: oxnas: Hold reference returned by of_get_parent()
ad3a056982 clk: meson: Hold reference returned by of_get_parent()
633c574e0f iio: ABI: Fix wrong format of differential capacitance channel ABI.
0111032d9a iio: inkern: only release the device node when done with it
246af42163 iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
46778752bb iio: adc: at91-sama5d2_adc: check return status for pressure and touch
d50e3817a4 iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
c29c3d32bd ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
e00480d42b ARM: Drop CMDLINE_* dependency on ATAGS
fcad2eef00 ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
6858d8599c ARM: dts: kirkwood: lsxl: remove first ethernet port
d45424d980 ARM: dts: kirkwood: lsxl: fix serial line
1edbceda07 ARM: dts: turris-omnia: Fix mpp26 pin name and comment
673db1cf4d soc: qcom: smem_state: Add refcounting for the 'state->of_node'
1e3ed59370 soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
85a40bfb8e memory: of: Fix refcount leak bug in of_get_ddr_timings()
b37f4a711e memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
56c4299f76 ALSA: hda/hdmi: Don't skip notification handling during PM operation
45387ca422 ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
371d4dbece ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
aa182988c0 ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
28a12e24d1 mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
93c8628183 ALSA: dmaengine: increment buffer pointer atomically
6c85495e58 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
c240431717 ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
9e421bd9fd mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
9d7af9b162 drm/omap: dss: Fix refcount leak bugs
0c55618aaa ALSA: hda: beep: Simplify keep-power-at-enable behavior
3ac2045d04 ASoC: rsnd: Add check for rsnd_mod_power_on
1daf69228e drm/bridge: megachips: Fix a null pointer dereference bug
b33b60afa5 drm: fix drm_mipi_dbi build errors
a367b7a96a platform/x86: msi-laptop: Fix resource cleanup
a9b32c9fe5 platform/x86: msi-laptop: Fix old-ec check for backlight registering
e548f9503c platform/chrome: fix memory corruption in ioctl
783c1c5000 platform/chrome: fix double-free in chromeos_laptop_prepare()
8242167cfc drm/mipi-dsi: Detach devices when removing the host
4d4a58c9d4 drm: bridge: adv7511: fix CEC power down control register offset
72c0d36194 net: mvpp2: fix mvpp2 debugfs leak
131287ff83 once: add DO_ONCE_SLOW() for sleepable contexts
03ac583eef net/ieee802154: reject zero-sized raw_sendmsg()
71e0ab5b75 bnx2x: fix potential memory leak in bnx2x_tpa_stop()
360aa72192 net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
3625b684a2 tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
382ff44716 sctp: handle the error returned from sctp_auth_asoc_init_active_key
466ed722f2 mISDN: fix use-after-free bugs in l1oip timer handlers
e6d0152c95 vhost/vsock: Use kvmalloc/kvfree for larger packets.
c202ad048f spi: s3c64xx: Fix large transfers with DMA
60a7496b40 netfilter: nft_fib: Fix for rpath check with VRF devices
610798a58e spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
1d8c928ed7 x86/microcode/AMD: Track patch allocation size explicitly
215c146b40 bpf: Ensure correct locking around vulnerable function find_vpid()
4017e91ff2 net: fs_enet: Fix wrong check in do_pd_setup
08a441a4ad wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
e0bab93245 bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
374dd4e519 wifi: rtl8xxxu: Fix skb misuse in TX queue selection
df0b024ade spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
026ffbb07f spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
321c51aa59 wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
7993680752 x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
bbe293db7e bpftool: Fix a wrong type cast in btf_dumper_int
9ee70c3cb4 wifi: mac80211: allow bw change during channel switch in mesh
4494ec1c0b wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
acc393aecd nfsd: Fix a memory leak in an error handling path
d7f1e7af1e ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
5abd2626ca sh: machvec: Use char[] for section boundaries
c0f4be8303 userfaultfd: open userfaultfds with O_RDONLY
29d0c45cf1 tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
b0c2e34be9 selinux: use "grep -E" instead of "egrep"
56ee957791 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
16435e58e5 gcov: support GCC 12.1 and newer compilers
b6094c4829 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
7644786461 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
45779be5ce KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
c3a98fc6c2 media: cedrus: Set the platform driver data earlier
3cf2ef86e0 ring-buffer: Fix race between reset page and reading page
7e06ef0345 ring-buffer: Check pending waiters when doing wake ups as well
cc1f35733c ring-buffer: Have the shortest_full queue be the shortest not longest
22707f033d ring-buffer: Allow splice to read previous partially read pages
e755b65a47 ftrace: Properly unset FTRACE_HASH_FL_MOD
f66de70930 livepatch: fix race between fork and KLP transition
1211121f0e ext4: place buffer head allocation before handle start
52c7b8d3b7 ext4: make ext4_lazyinit_thread freezable
3638aa1c7d ext4: fix null-ptr-deref in ext4_write_info
a22f52d883 ext4: avoid crash when inline data creation follows DIO write
21ea616f1e jbd2: wake up journal waiters in FIFO order, not LIFO
d1c2d820a2 nilfs2: fix use-after-free bug of struct nilfs_root
c99860f9a7 f2fs: fix to do sanity check on summary info
68b1e60755 f2fs: fix to do sanity check on destination blkaddr during recovery
c5d8198ce8 f2fs: increase the limit for reserve_root
26b7c0ac49 btrfs: fix race between quota enable and quota rescan ioctl
3742e9fd55 fbdev: smscufx: Fix use-after-free in ufx_ops_open()
52895c495b powerpc/boot: Explicitly disable usage of SPE instructions
e3f7e99337 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
cd251d39b1 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
08f03b333c riscv: Pass -mno-relax only on lld < 15.0.0
c61f553ba8 riscv: Allow PROT_WRITE-only mmap()
09058e5ef7 parisc: fbdev/stifb: Align graphics memory size to 4MB
2c60db6869 RISC-V: Make port I/O string accessors actually work
14c06375c8 regulator: qcom_rpm: Fix circular deferral regression
79b7547eeb ASoC: wcd9335: fix order of Slimbus unprepare/disable
6927ee818f quota: Check next/prev free block number after reading from quota file
4cf9233eb1 HID: multitouch: Add memory barriers
477ac1d57f fs: dlm: handle -EBUSY first in lock arg validation
d3961f732d fs: dlm: fix race between test_bit() and queue_work()
4352db1e33 mmc: sdhci-sprd: Fix minimum clock limit
fbefc5cce4 can: kvaser_usb_leaf: Fix CAN state after restart
9948b80910 can: kvaser_usb_leaf: Fix TX queue out of sync after restart
76d9afd30e can: kvaser_usb_leaf: Fix overread with an invalid command
953bb1dfea can: kvaser_usb: Fix use of uninitialized completion
42f7d93396 usb: add quirks for Lenovo OneLink+ Dock
37daa23f28 iio: pressure: dps310: Reset chip after timeout
228348a9fe iio: pressure: dps310: Refactor startup procedure
974c1f15ac iio: dac: ad5593r: Fix i2c read protocol requirements
d0050ec3eb cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
bd09adde67 cifs: destage dirty pages before re-reading them for cache=none
8298f20e11 mtd: rawnand: atmel: Unmap streaming DMA mappings
8d763c8e6c ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
4c35410517 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
a943c4a16b ALSA: hda/realtek: Correct pin configs for ASUS G533Z
1973164962 ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
121fadc0ca ALSA: usb-audio: Fix NULL dererence at error path
988ec0cd0a ALSA: usb-audio: Fix potential memory leaks
de7d80d0fe ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
afb507303e ALSA: oss: Fix potential deadlock at unregistration
Change-Id: I06f42bac516b0d4c4bf2fd0794ea017548f7cbd9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
The rmap locks(i_mmap_rwsem and anon_vma->root->rwsem) could be contended
under memory pressure if processes keep working on their vmas(e.g., fork,
mmap, munmap). It makes reclaim path stuck. In our real workload traces,
we see kswapd is waiting the lock for 300ms+(worst case, a sec) and it
makes other processes entering direct reclaim, which were also stuck on
the lock.
This patch makes lru aging path try_lock mode like shink_page_list so the
reclaim context will keep working with next lru pages without being stuck.
if it found the rmap lock contended, it rotates the page back to head of
lru in both active/inactive lrus to make them consistent behavior, which
is basic starting point rather than adding more heristic.
Since this patch introduces a new "contended" field as out-param along
with try_lock in-param in rmap_walk_control, it's not immutable any longer
if the try_lock is set so remove const keywords on rmap related functions.
Since rmap walking is already expensive operation, I doubt the const
would help sizable benefit( And we didn't have it until 5.17).
In a heavy app workload in Android, trace shows following statistics. It
almost removes rmap lock contention from reclaim path.
Martin Liu reported:
Before:
max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function
1632 0 1631 151.542173 31672 209 page_lock_anon_vma_read
601 0 601 145.544681 28817 198 rmap_walk_file
After:
max_dur(ms) min_dur(ms) max-min(dur)ms avg_dur(ms) sum_dur(ms) count blocked_function
NaN NaN NaN NaN NaN 0.0 NaN
0 0 0 0.127645 1 12 rmap_walk_file
[minchan@kernel.org: add comment, per Matthew]
Link: https://lkml.kernel.org/r/YnNqeB5tUf6LZ57b@google.com
Link: https://lkml.kernel.org/r/20220510215423.164547-1-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: John Dias <joaodias@google.com>
Cc: Tim Murray <timmurray@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Martin Liu <liumartin@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Conflicts:
folio->page
(cherry picked from commit 6d4675e601357834dadd2ba1d803f6484596015c)
Bug: 239681156
Bug: 252333201
Bug: 265247508
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I0c63e0291120c8a1b5f2d83b8a7b210cb56c27a2
Signed-off-by: chenxin <chenxinxin@xiaomi.corp-partner.google.com>
Signed-off-by: guchongchong <guchongchong@xiaomi.corp-partner.google.com>
(cherry picked from commit a0eae55f26a0cbdd828db226592093ad2142889c)
This allows creating more TTY devices bound to virtio-console devices.
Bug: 170149708
Test: ls /dev/hvc* on a cuttlefish device
Change-Id: Id07c25bded35dac5d17736731bfd8b8f4f1d463b
Signed-off-by: A. Cody Schuffelen <schuffelen@google.com>
https://source.android.com/docs/security/bulletin/2023-01-01
CVE-2022-42719
CVE-2022-42720
CVE-2022-42721
CVE-2022-2959
CVE-2022-41674
CVE-2023-20928
* tag 'ASB-2023-01-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: HID: playstation: support updated DualSense rumble mode.
UPSTREAM: HID: playstation: add initial DualSense Edge controller support
UPSTREAM: HID: playstation: stop DualSense output work on remove.
UPSTREAM: HID: playstation: convert to use dev_groups
UPSTREAM: HID: playstation: fix return from dualsense_player_led_set_brightness()
UPSTREAM: HID: playstation: expose DualSense player LEDs through LED class.
BACKPORT: leds: add new LED_FUNCTION_PLAYER for player LEDs for game controllers.
UPSTREAM: HID: playstation: expose DualSense lightbar through a multi-color LED.
UPSTREAM: leds: flash: Fix multicolor no-ops registration by return 0
UPSTREAM: leds: multicolor: Introduce a multicolor class definition
ANDROID: GKI: enable mulitcolor-led
BACKPORT: Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
Change-Id: I5fc3bd24adbafa6c280c2f122b9492fb0bdad9a3
Newer DualSense firmware supports a revised classic rumble mode,
which feels more similar to rumble as supported on previous PlayStation
controllers. It has been made the default on PlayStation and non-PlayStation
devices now (e.g. iOS and Windows). Default to this new mode when
supported.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20221010212313.78275-4-roderick.colenbrander@sony.com
Bug: 260685629
(cherry picked from commit 9fecab247ed15e6145c126fc56ee1e89860741a7)
Change-Id: Icd330111a4d1b1e76a04cd11c623d0982ce3d66f
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Provide initial support for the DualSense Edge controller. The brings
support up to the level of the original DualSense, but won't yet provide
support for new features (e.g. reprogrammable buttons).
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20221010212313.78275-3-roderick.colenbrander@sony.com
Bug: 260685629
(cherry picked from commit b8a968efab301743fd659b5649c5d7d3e30e63a6)
Change-Id: I5b95de806e823085d1144f016d8cfd76e4a933ef
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Ensure we don't schedule any new output work on removal and wait
for any existing work to complete. If we don't do this e.g. rumble
work can get queued during deletion and we trigger a kernel crash.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20221010212313.78275-2-roderick.colenbrander@sony.com
Bug: 260685629
(cherry picked from commit 182934a1e93b17f4edf71f4fcc8d19b19a6fe67a)
Change-Id: I40cadfde5765cdabf45def929860258d6019bf10
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
There is no need for a driver to individually add/create device groups,
the driver core will do it automatically for you. Convert the
hid-playstation driver to use the dev_groups pointer instead of manually
calling the driver core to create the group and have it be cleaned up
later on by the devm core.
Cc: Roderick Colenbrander <roderick.colenbrander@sony.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit b4a9af9be628e4f9d09997e0bdef30f6718e88ec)
Change-Id: I516a1b0ef7f4f8545e0c1b9485b49879dd7a3136
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
brightness_set_blocking() callback expects function returning int. This fixes
the follwoing build failure:
drivers/hid/hid-playstation.c: In function ‘dualsense_player_led_set_brightness’:
drivers/hid/hid-playstation.c:885:1: error: no return statement in function returning non-void [-Werror=return-type]
}
^
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit 3c92cb4cb60c71b574e47108ead8b6f0470850db)
Change-Id: Id16b960826a26ac22c1a14572444f9af29689ed6
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
The DualSense player LEDs were so far not adjustable from user-space.
This patch exposes each LED individually through the LED class. Each
LED uses the new 'player' function resulting in a name like:
'inputX:white:player-1' for the first LED.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit 8c0ab553b072025530308f74b2c0223ec50dffe5)
Change-Id: I49c699a99b0b8a7bb7980560e3ea7a12faf646aa
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Player LEDs are commonly found on game controllers from Nintendo and Sony
to indicate a player ID across a number of LEDs. For example, "Player 2"
might be indicated as "-x--" on a device with 4 LEDs where "x" means on.
This patch introduces LED_FUNCTION_PLAYER1-5 defines to properly indicate
player LEDs from the kernel. Until now there was no good standard, which
resulted in inconsistent behavior across xpad, hid-sony, hid-wiimote and
other drivers. Moving forward new drivers should use LED_FUNCTION_PLAYERx.
Note: management of Player IDs is left to user space, though a kernel
driver may pick a default value.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit 61177c088a57bed259122f3c7bc6d61984936a12)
[Farid: Fixed minor conflict due to skipped commits outside scope of
hid-playstation]
Change-Id: I696f62cda377be1523e74e92b66b28f3c0716c43
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
The DualSense lightbar has so far been supported, but it was not yet
adjustable from user space. This patch exposes it through a multi-color
LED.
Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Bug: 260685629
(cherry picked from commit fc97b4d6a1a6d418fd4053fd7716eca746fdd163)
Change-Id: I48204113da804b13ad5bed2f651a5826ab5a86f7
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Introduce a multicolor class that groups colored LEDs
within a LED node.
The multicolor class groups monochrome LEDs and allows controlling two
aspects of the final combined color: hue and lightness. The former is
controlled via the intensity file and the latter is controlled
via brightness file.
Signed-off-by: Dan Murphy <dmurphy@ti.com>
Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
[squashed leds: multicolor: Fix camel case in documentation in]
Bug: 260685629
(cherry picked from commit 55d5d3b46b08a4dc0b05343d24640744e7430ed7)
Change-Id: Ib1f41d74ace8e3a9c1071d52202c8d8b70a912e0
Signed-off-by: Farid Chahla <farid.chahla@sony.com>
Murali Nalajala
Divyanshu-Modi
Michael Bestas
Vaisakh Murali
Udipto Goswami
Jim Mattson
Baokun Li
Cong Wang
Eric Dumazet
Robin Murphy
Johannes Berg
Alessandro Astone
Arnd Bergmann
Todd Kjos
Li Li
Luca Stefani
Hang Lu
Carlos Llamas
Weilun Du
Ram Muthiah
Takashi Iwai
Srinivasarao Pathipati
Clement Lecigne
Lee Jones
Treehugger Robot
John Keeping
Maxim Devaev
Steve Muckle
Jialiang Wang
Linus Torvalds
Greg Kroah-Hartman
Minchan Kim
A. Cody Schuffelen
Roderick Colenbrander
Greg Kroah-Hartman
Jiri Kosina
Gene Chen
Dan Murphy