"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
Revert "ALSA: compress: Allow pause and resume during draining"
ALSA: compress: Allow pause and resume during draining
msm: kgsl: Prevent wrap around during user address mapping
msm: kgsl: Limit the syncpoint count for AUX commands
msm: kgsl: Prevent wrap around during user address mapping
Configured process_madvise with upstream syscall number
iommu: Fix missing return check of arm_lpae_init_pte
usb: gadget: cdev: Don't use spinlock with sleeping functions
securemsm-kernel: Fix multiple listener registration on same fd
msm: kgsl: Limit the syncpoint count for AUX commands
net: qrtr: use new update_marker api
char: virtio_eavb: use new update_marker api
usb: kpi: update_marker api for USB suspend resume
Change-Id: Id82b63ff555fbc7101b41a10c1ffbef3762627bd
CONFIG_DRM_MSM_DP is disabled on holi, making this function undefined
and breaking compilation. Like all other inline functions, make this one
return 0.
Change-Id: I1ae0eeab563c3a67fb35d92e8ad2c391458778e6
Newer clang builds complain about old-style function declarations
not having any prototype assigned. The missing `void` is triggering
the Wstrict-prototype warns. Explicitly add the `void` keyword to
satisfy the compiler.
This fixes the following warnings:
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_legacy.c:
1288:34: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_legacy()
^
void
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_srng.c:1017:32:
error: a function declaration without a prototype is deprecated in all
versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_srng()
^
void
drivers/staging/qca-wifi-host-cmn/target_if/core/src/target_if_main.c:
88:40: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct target_if_ctx *target_if_get_ctx()
^
void
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_extscan_api.c:
103:27: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
wlan_extscan_global_deinit()
^
void
Change-Id: Ifd95b57d19a25f0932e5de8ec4de2f2c1e7e1259
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
"LA.UM.9.14.r1-22900.01-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-22900.01-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
virt: haven: Correct max_buf_size for a connection
Change-Id: I37f3978594962ec64c921172d190a5b4aa107305
https://source.android.com/docs/security/bulletin/2023-10-01
* tag 'ASB-2023-10-06_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: arm64: efi: Make efi_rt_lock a raw_spinlock
UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve
UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Linux 5.4.254
sch_netem: fix issues in netem_change() vs get_dist_table()
alpha: remove __init annotation from exported page_is_ram()
scsi: core: Fix possible memory leak if device_add() fails
scsi: snic: Fix possible memory leak if device_add() fails
scsi: 53c700: Check that command slot is not NULL
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
scsi: core: Fix legacy /proc parsing buffer overflow
netfilter: nf_tables: report use refcount overflow
nvme-rdma: fix potential unbalanced freeze & unfreeze
nvme-tcp: fix potential unbalanced freeze & unfreeze
btrfs: set cache_block_group_error if we find an error
btrfs: don't stop integrity writeback too early
ibmvnic: Handle DMA unmapping of login buffs in release functions
net/mlx5: Allow 0 for total host VFs
dmaengine: mcf-edma: Fix a potential un-allocated memory access
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
IB/hfi1: Fix possible panic during hotplug remove
drivers: net: prevent tun_build_skb() to exceed the packet size limit
dccp: fix data-race around dp->dccps_mss_cache
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
net/packet: annotate data-races around tp->status
mISDN: Update parameter type of dsp_cmx_send()
selftests/rseq: Fix build with undefined __weak
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
x86: Move gds_ucode_mitigated() declaration to header
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
usb: dwc3: Properly handle processing of pending events
usb-storage: alauda: Fix uninit-value in alauda_check_media()
binder: fix memory leak in binder_init()
iio: cros_ec: Fix the allocation size for cros_ec_command
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate")
radix tree test suite: fix incorrect allocation size for pthreads
drm/nouveau/gr: enable memory loads on helper invocation on all channels
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
ipv6: adjust ndisc_is_useropt() to also return true for PIO
mmc: moxart: read scr register without changing byte order
Linux 5.4.253
Revert "driver core: Annotate dev_err_probe() with __must_check"
drivers: core: fix kernel-doc markup for dev_err_probe()
driver code: print symbolic error code
driver core: Annotate dev_err_probe() with __must_check
ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
ARM: dts: imx6sll: fixup of operating points
ARM: dts: imx: add usb alias
ARM: dts: imx: Align L2 cache-controller nodename with dtschema
ARM: dts: imx6sll: Make ssi node name same as other platforms
arm64: dts: stratix10: fix incorrect I2C property for SCL signal
ceph: defer stopping mdsc delayed_work
ceph: use kill_anon_super helper
ceph: show tasks waiting on caps in debugfs caps file
PM: sleep: wakeirq: fix wake irq arming
PM / wakeirq: support enabling wake-up irq after runtime_suspend called
selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
selftests/rseq: check if libc rseq support is registered
powerpc/mm/altmap: Fix altmap boundary check
mtd: rawnand: omap_elm: Fix incorrect type in assignment
test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
test_firmware: prevent race conditions by a correct implementation of locking
ext2: Drop fragment support
fs: Protect reconfiguration of sb read-write from racing writes
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
fs/sysv: Null check to prevent null-ptr-deref bug
net: tap_open(): set sk_uid from current_fsuid()
net: tun_chr_open(): set sk_uid from current_fsuid()
mtd: rawnand: meson: fix OOB available bytes for ECC
mtd: spinand: toshiba: Fix ecc_get_status
USB: zaurus: Add ID for A-300/B-500/C-700
libceph: fix potential hang in ceph_osdc_notify()
scsi: zfcp: Defer fc_rport blocking until after ADISC response
tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
tcp_metrics: annotate data-races around tm->tcpm_net
tcp_metrics: annotate data-races around tm->tcpm_vals[]
tcp_metrics: annotate data-races around tm->tcpm_lock
tcp_metrics: annotate data-races around tm->tcpm_stamp
tcp_metrics: fix addr_same() helper
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
net: dcb: choose correct policy to parse DCB_ATTR_BCN
net: ll_temac: fix error checking of irq_of_parse_and_map()
net: ll_temac: Switch to use dev_err_probe() helper
driver core: add device probe log helper
bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
net: add missing data-race annotation for sk_ll_usec
net: add missing data-race annotations around sk->sk_peek_off
net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
net: add missing READ_ONCE(sk->sk_sndbuf) annotation
net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
net: annotate data-races around sk->sk_max_pacing_rate
mISDN: hfcpci: Fix potential deadlock on &hc->lock
net: sched: cls_u32: Fix match key mis-addressing
perf test uprobe_from_different_cu: Skip if there is no gcc
rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
KVM: s390: fix sthyi error handling
word-at-a-time: use the same return type for has_zero regardless of endianness
loop: Select I/O scheduler 'none' from inside add_disk()
perf: Fix function pointer case
arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
arm64: Add AMPERE1 to the Spectre-BHB affected list
ASoC: cs42l51: fix driver to properly autoload with automatic module loading
net/sched: sch_qfq: account for stab overhead in qfq_enqueue
btrfs: fix race between quota disable and quota assign ioctls
btrfs: qgroup: return ENOTCONN instead of EINVAL when quotas are not enabled
btrfs: qgroup: remove one-time use variables for quota_root checks
cpufreq: intel_pstate: Drop ACPI _PSS states table patching
ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
ACPI: processor: perflib: Use the "no limit" frequency QoS
dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
s390/dasd: fix hanging device after quiesce/resume
virtio-net: fix race between set queues and probe
btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
tpm_tis: Explicitly check for error code
btrfs: check for commit error at btrfs_attach_transaction_barrier()
hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
Documentation: security-bugs.rst: clarify CVE handling
Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
Revert "usb: xhci: tegra: Fix error check"
usb: xhci-mtk: set the dma max_seg_size
USB: quirks: add quirk for Focusrite Scarlett
usb: ohci-at91: Fix the unhandle interrupt when resume
usb: dwc3: don't reset device side if dwc3 was configured as host-only
usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
USB: serial: simple: sort driver entries
USB: serial: simple: add Kaufmann RKS+CAN VCP
USB: serial: option: add Quectel EC200A module support
USB: serial: option: support Quectel EM060K_128
serial: sifive: Fix sifive_serial_console_setup() section
serial: 8250_dw: Preserve original value of DLF register
tracing: Fix warning in trace_buffered_event_disable()
ring-buffer: Fix wrong stat of cpu_buffer->read
ata: pata_ns87415: mark ns87560_tf_read static
dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
block: Fix a source code comment in include/uapi/linux/blkzoned.h
ASoC: fsl_spdif: Silence output on stop
drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
drm/msm/adreno: Fix snapshot BINDLESS_DATA size
drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
RDMA/mlx4: Make check for invalid flags stricter
benet: fix return value check in be_lancer_xmit_workarounds()
net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
net/sched: mqprio: add extack to mqprio_parse_nlattr()
net/sched: mqprio: refactor nlattr parsing to a separate function
platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
team: reset team's flags when down link is P2P device
bonding: reset bond's flags when down link is P2P device
tcp: Reduce chance of collisions in inet6_hashfn().
ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
ethernet: atheros: fix return value check in atl1e_tso_csum()
phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
vxlan: calculate correct header length for GPE
i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
keys: Fix linking a duplicate key to a keyring's assoc_array
uapi: General notification queue definitions
scsi: qla2xxx: Array index may go out of bound
scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c
pwm: meson: fix handling of period/duty if greater than UINT_MAX
pwm: meson: Simplify duplicated per-channel tracking
pwm: meson: Remove redundant assignment to variable fin_freq
ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
ftrace: Store the order of pages allocated in ftrace_page
ftrace: Check if pages were allocated before calling free_pages()
ftrace: Add information on number of page groups allocated
fs: dlm: interrupt posix locks only when process is killed
dlm: rearrange async condition return
dlm: cleanup plock_op vs plock_xop
PCI/ASPM: Avoid link retraining race
PCI/ASPM: Factor out pcie_wait_for_retrain()
PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
ext4: Fix reusing stale buffer heads from last failed mounting
ext4: rename journal_dev to s_journal_dev inside ext4_sb_info
btrfs: fix extent buffer leak after tree mod log failure at split_node()
btrfs: fix race between quota disable and relocation
btrfs: qgroup: catch reserved space leaks at unmount time
bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
bcache: remove 'int n' from parameter list of bch_bucket_alloc_set()
gpio: tps68470: Make tps68470_gpio_output() always set the initial value
jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
jbd2: recheck chechpointing non-dirty buffer
jbd2: remove redundant buffer io error checks
jbd2: fix kernel-doc markups
jbd2: fix incorrect code style
Linux 5.4.252
x86: fix backwards merge of GDS/SRSO bit
xen/netback: Fix buffer overrun triggered by unusual packet
x86/cpu, kvm: Add support for CPUID_80000021_EAX
x86/bugs: Increase the x86 bugs vector size to two u32s
tools headers cpufeatures: Sync with the kernel sources
x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX]
x86/cpu: Add VM page flush MSR availablility as a CPUID feature
x86/cpufeatures: Add SEV-ES CPU feature
Documentation/x86: Fix backwards on/off logic about YMM support
x86/mm: Initialize text poking earlier
mm: Move mm_cachep initialization to mm_init()
x86/mm: Use mm_alloc() in poking_init()
x86/mm: fix poking_init() for Xen PV guests
x86/xen: Fix secondary processors' FPU initialization
KVM: Add GDS_NO support to KVM
x86/speculation: Add Kconfig option for GDS
x86/speculation: Add force option to GDS mitigation
x86/speculation: Add Gather Data Sampling mitigation
x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
x86/fpu: Mark init functions __init
x86/fpu: Remove cpuinfo argument from init functions
init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
init: Invoke arch_cpu_finalize_init() earlier
init: Remove check_bugs() leftovers
um/cpu: Switch to arch_cpu_finalize_init()
sparc/cpu: Switch to arch_cpu_finalize_init()
sh/cpu: Switch to arch_cpu_finalize_init()
mips/cpu: Switch to arch_cpu_finalize_init()
m68k/cpu: Switch to arch_cpu_finalize_init()
ia64/cpu: Switch to arch_cpu_finalize_init()
ARM: cpu: Switch to arch_cpu_finalize_init()
x86/cpu: Switch to arch_cpu_finalize_init()
init: Provide arch_cpu_finalize_init()
Revert "posix-timers: Ensure timer ID search-loop limit is valid"
Revert "drm/panel: Initialise panel dev and funcs through drm_panel_init()"
Revert "drm/panel: Add and fill drm_panel type field"
Revert "drm/panel: simple: Add connector_type for innolux_at043tn24"
Revert "Revert "8250: add support for ASIX devices with a FIFO bug""
Linux 5.4.251
tracing/histograms: Return an error if we fail to add histogram to hist_vars list
tcp: annotate data-races around fastopenq.max_qlen
tcp: annotate data-races around tp->notsent_lowat
tcp: annotate data-races around rskq_defer_accept
tcp: annotate data-races around tp->linger2
net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX
tcp: annotate data-races around tp->tcp_tx_delay
netfilter: nf_tables: can't schedule in nft_chain_validate
netfilter: nf_tables: fix spurious set element insertion failure
llc: Don't drop packet from non-root netns.
fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
net:ipv6: check return value of pskb_trim()
iavf: Fix use-after-free in free_netdev
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
pinctrl: amd: Use amd_pinconf_set() for all config options
fbdev: imxfb: warn about invalid left/right margin
spi: bcm63xx: fix max prepend length
igb: Fix igb_down hung on surprise removal
wifi: iwlwifi: mvm: avoid baid size integer overflow
wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
devlink: report devlink_port_type_warn source device
bpf: Address KCSAN report on bpf_lru_list
sched/fair: Don't balance task to its current running CPU
arm64: mm: fix VA-range sanity check
posix-timers: Ensure timer ID search-loop limit is valid
md/raid10: prevent soft lockup while flush writes
md: fix data corruption for raid456 when reshape restart while grow up
nbd: Add the maximum limit of allocated index in nbd_dev_add
debugobjects: Recheck debug_objects_enabled before reporting
ext4: correct inline offset when handling xattrs in inode body
drm/client: Fix memory leak in drm_client_modeset_probe
drm/client: Fix memory leak in drm_client_target_cloned
can: bcm: Fix UAF in bcm_proc_show()
selftests: tc: set timeout to 15 minutes
fuse: revalidate: don't invalidate if interrupted
btrfs: fix warning when putting transaction with qgroups enabled after abort
perf probe: Add test for regression introduced by switch to die_get_decl_file()
drm/atomic: Fix potential use-after-free in nonblocking commits
scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
scsi: qla2xxx: Pointer may be dereferenced
scsi: qla2xxx: Correct the index of array
scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
scsi: qla2xxx: Fix potential NULL pointer dereference
scsi: qla2xxx: Wait for io return on terminate rport
tracing/probes: Fix not to count error code to total length
tracing: Fix null pointer dereference in tracing_err_log_open()
xtensa: ISS: fix call to split_if_spec
ring-buffer: Fix deadloop issue on reading trace_pipe
tracing/histograms: Add histograms to hist_vars if they have referenced variables
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
Revert "8250: add support for ASIX devices with a FIFO bug"
meson saradc: fix clock divider mask length
ceph: don't let check_caps skip sending responses for revoke msgs
hwrng: imx-rngc - fix the timeout for init and self check
firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
serial: atmel: don't enable IRQs prematurely
drm/rockchip: vop: Leave vblank enabled in self-refresh
drm/atomic: Allow vblank-enabled + self-refresh "disable"
fs: dlm: return positive pid value for F_GETLK
md/raid0: add discard support for the 'original' layout
misc: pci_endpoint_test: Re-init completion for every test
misc: pci_endpoint_test: Free IRQs before removing the device
PCI: rockchip: Set address alignment for endpoint mode
PCI: rockchip: Use u32 variable to access 32-bit registers
PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
PCI: rockchip: Write PCI Device ID to correct register
PCI: rockchip: Assert PCI Configuration Enable bit after probe
PCI: qcom: Disable write access to read only registers for IP v2.3.3
PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
ext4: only update i_reserved_data_blocks on successful block allocation
ext4: fix wrong unit use in ext4_mb_clear_bb
erofs: fix compact 4B support for 16k block size
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
misc: fastrpc: Create fastrpc scalar with correct buffer count
powerpc: Fail build if using recordmcount with binutils v2.37
net: bcmgenet: Ensure MDIO unregistration has clocks enabled
mtd: rawnand: meson: fix unaligned DMA buffers handling
tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
pinctrl: amd: Only use special debounce behavior for GPIO 0
pinctrl: amd: Detect internal GPIO0 debounce handling
pinctrl: amd: Fix mistake in handling clearing pins at startup
net/sched: make psched_mtu() RTNL-less safe
net/sched: flower: Ensure both minimum and maximum ports are specified
cls_flower: Add extack support for src and dst port range options
wifi: airo: avoid uninitialized warning in airo_get_rate()
erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
platform/x86: wmi: Break possible infinite loop when parsing GUID
platform/x86: wmi: move variables
platform/x86: wmi: use guid_t and guid_equal()
platform/x86: wmi: remove unnecessary argument
platform/x86: wmi: Fix indentation in some cases
platform/x86: wmi: Replace UUID redefinitions by their originals
ipv6/addrconf: fix a potential refcount underflow for idev
NTB: ntb_tool: Add check for devm_kcalloc
NTB: ntb_transport: fix possible memory leak while device_register() fails
ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
ntb: idt: Fix error handling in idt_pci_driver_init()
udp6: fix udp6_ehashfn() typo
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
ionic: remove WARN_ON to prevent panic_on_warn
ionic: ionic_intr_free parameter change
ionic: move irq request to qcq alloc
ionic: clean irq affinity on queue deinit
ionic: improve irq numa locality
net/sched: cls_fw: Fix improper refcount update leads to use-after-free
net: mvneta: fix txq_map in case of txq_number==1
scsi: qla2xxx: Fix error code in qla2x00_start_sp()
igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
igc: Remove delay during TX ring configuration
drm/panel: simple: Add connector_type for innolux_at043tn24
drm/panel: Add and fill drm_panel type field
drm/panel: Initialise panel dev and funcs through drm_panel_init()
workqueue: clean up WORK_* constant types, clarify masking
net: lan743x: Don't sleep in atomic context
block/partition: fix signedness issue for Amiga partitions
tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
netfilter: nf_tables: fix scheduling-while-atomic splat
netfilter: nf_tables: unbind non-anonymous set if rule construction fails
netfilter: nf_tables: reject unbound anonymous set before commit phase
netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
netfilter: nf_tables: add rescheduling points during loop detection walks
netfilter: nf_tables: use net_generic infra for transaction data
netfilter: add helper function to set up the nfnetlink header and use it
netfilter: nftables: add helper function to set the base sequence number
netfilter: nf_tables: fix nat hook table deletion
block: add overflow checks for Amiga partition support
fanotify: disallow mount/sb marks on kernel internal pseudo fs
fs: no need to check source
ARM: orion5x: fix d2net gpio initialization
btrfs: fix race when deleting quota root from the dirty cow roots list
fs: Lock moved directories
fs: Establish locking order for unrelated directories
Revert "f2fs: fix potential corruption when moving a directory"
ext4: Remove ext4 locking of moved directory
fs: avoid empty option when generating legacy mount string
jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
integrity: Fix possible multiple allocation in integrity_inode_get()
bcache: Remove unnecessary NULL point check in node allocations
mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
mmc: core: disable TRIM on Kingston EMMC04G-M627
NFSD: add encoding of op_recall flag for write delegation
ALSA: jack: Fix mutex call in snd_jack_report()
i2c: xiic: Don't try to handle more interrupt events after error
i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
sh: dma: Fix DMA channel offset calculation
net: dsa: tag_sja1105: fix MAC DA patching from meta frames
net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
xsk: Honor SO_BINDTODEVICE on bind
xsk: Improve documentation for AF_XDP
tcp: annotate data races in __tcp_oow_rate_limited()
net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
f2fs: fix error path handling in truncate_dnode()
mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
sctp: fix potential deadlock on &net->sctp.addr_wq_lock
rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
pwm: sysfs: Do not apply state to already disabled PWMs
pwm: imx-tpm: force 'real_period' to be zero in suspend
mfd: stmpe: Only disable the regulators if they are enabled
KVM: s390: vsie: fix the length of APCB bitmap
mfd: stmfx: Fix error path in stmfx_chip_init
serial: 8250_omap: Use force_suspend and resume for system suspend
mfd: intel-lpss: Add missing check for platform_get_resource
usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
mfd: rt5033: Drop rt5033-battery sub-device
usb: hide unused usbfs_notify_suspend/resume functions
usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
extcon: Fix kernel doc of property capability fields to avoid warnings
extcon: Fix kernel doc of property fields to avoid warnings
usb: dwc3: qcom: Fix potential memory leak
media: usb: siano: Fix warning due to null work_func_t function pointer
media: videodev2.h: Fix struct v4l2_input tuner index comment
media: usb: Check az6007_read() return value
sh: j2: Use ioremap() to translate device tree address into kernel memory
w1: fix loop in w1_fini()
block: change all __u32 annotations to __be32 in affs_hardblocks.h
block: fix signed int overflow in Amiga partition support
usb: dwc3: gadget: Propagate core init errors to UDC during pullup
USB: serial: option: add LARA-R6 01B PIDs
hwrng: st - keep clock enabled while hwrng is registered
hwrng: st - Fix W=1 unused variable warning
NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
modpost: fix off by one in is_executable_section()
crypto: marvell/cesa - Fix type mismatch warning
modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
modpost: fix section mismatch message for R_ARM_ABS32
crypto: nx - fix build warnings when DEBUG_FS is not enabled
hwrng: virtio - Fix race on data_avail and actual data
hwrng: virtio - always add a pending request
hwrng: virtio - don't waste entropy
hwrng: virtio - don't wait on cleanup
hwrng: virtio - add an internal buffer
powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
pinctrl: at91-pio4: check return value of devm_kasprintf()
perf dwarf-aux: Fix off-by-one in die_get_varname()
pinctrl: cherryview: Return correct value if pin in push-pull mode
PCI: Add pci_clear_master() stub for non-CONFIG_PCI
PCI: ftpci100: Release the clock resources
PCI: pciehp: Cancel bringup sequence if card is not present
scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
scsi: qedf: Fix NULL dereference in error handling
ASoC: imx-audmix: check return value of devm_kasprintf()
clk: keystone: sci-clk: check return value of kasprintf()
clk: cdce925: check return value of kasprintf()
ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
clk: tegra: tegra124-emc: Fix potential memory leak
drm/radeon: fix possible division-by-zero errors
drm/amdkfd: Fix potential deallocation of previously deallocated memory.
fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
soc/fsl/qe: fix usb.c build errors
ASoC: es8316: Do not set rate constraints for unsupported MCLKs
ASoC: es8316: Increment max value for ALC Capture Target Volume control
memory: brcmstb_dpfe: fix testing array offset after use
ARM: ep93xx: fix missing-prototype warnings
drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
arm64: dts: qcom: msm8916: correct camss unit address
ARM: dts: gta04: Move model property out of pinctrl node
RDMA/bnxt_re: Fix to remove an unnecessary log
drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
Input: adxl34x - do not hardcode interrupt trigger type
ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
Input: drv260x - sleep between polling GO bit
radeon: avoid double free in ci_dpm_init()
netlink: Add __sock_i_ino() for __netlink_diag_dump().
ipvlan: Fix return value of ipvlan_queue_xmit()
netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
lib/ts_bm: reset initial match offset for every block of text
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
nfc: llcp: simplify llcp_sock_connect() error paths
gtp: Fix use-after-free in __gtp_encap_destroy().
selftests: rtnetlink: remove netdevsim device after ipsec offload test
netlink: do not hard code device address lenth in fdb dumps
netlink: fix potential deadlock in netlink_set_err()
wifi: ath9k: convert msecs to jiffies where needed
wifi: cfg80211: rewrite merging of inherited elements
wifi: iwlwifi: pull from TXQs with softirqs disabled
rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
memstick r592: make memstick_debug_get_tpc_name() static
kexec: fix a memory leak in crash_shrink_memory()
watchdog/perf: more properly prevent false positives with turbo modes
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
wifi: ray_cs: Fix an error handling path in ray_probe()
wifi: ray_cs: Drop useless status variable in parse_addr()
wifi: ray_cs: Utilize strnlen() in parse_addr()
wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
wl3501_cs: use eth_hw_addr_set()
net: create netdev->dev_addr assignment helpers
wl3501_cs: Fix misspelling and provide missing documentation
wl3501_cs: Remove unnecessary NULL check
wl3501_cs: Fix a bunch of formatting issues related to function docs
wifi: atmel: Fix an error handling path in atmel_probe()
wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
regulator: core: Streamline debugfs operations
regulator: core: Fix more error checking for debugfs_create_dir()
nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
nfc: constify several pointers to u8, char and sk_buff
wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
samples/bpf: Fix buffer overflow in tcp_basertt
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
ima: Fix build warnings
pstore/ram: Add check for kstrdup
evm: Complete description of evm_inode_setattr()
ARM: 9303/1: kprobes: avoid missing-declaration warnings
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
PM: domains: fix integer overflow issues in genpd_parse_state()
clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
clocksource/drivers/cadence-ttc: Use ttc driver as platform driver
tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
md/raid10: fix io loss while replacement replace rdev
md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
md/raid10: fix wrong setting of max_corr_read_errors
md/raid10: fix overflow of md/safe_mode_delay
md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
x86/resctrl: Only show tasks' pid in current pid namespace
x86/resctrl: Use is_closid_match() in more places
bgmac: fix *initial* chip reset to support BCM5358
drm/amdgpu: Validate VM ioctl flags.
scripts/tags.sh: Resolve gtags empty index generation
drm/i915: Initialise outparam for error return from wait_for_register
HID: wacom: Use ktime_t rather than int when dealing with timestamps
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
video: imsttfb: check for ioremap() failures
x86/smp: Use dedicated cache-line for mwait_play_dead()
gfs2: Don't deref jdesc in evict
Linux 5.4.250
x86/cpu/amd: Add a Zenbleed fix
x86/cpu/amd: Move the errata checking functionality up
x86/microcode/AMD: Load late on both threads too
Conflicts:
drivers/usb/dwc3/gadget.c
Change-Id: Ibd4bab8255496e4640f2eaf4eb7836209dd7cbfb
With a stream with low bitrate, user can't pause or resume the stream
near the end of the stream because current ALSA doesn't allow it.
If the stream has very low bitrate enough to store whole stream into
the buffer, user can't do anything except stop the stream and then
restart it from the first because most of applications call draining
after sending last frame to the kernel.
If pause, resume are allowed during draining, user experience can be
enhanced.
To prevent malfunction in HW drivers which don't support pause
during draining, pause during draining will only work if HW driver
enable this feature explicitly by calling
snd_compr_use_pause_in_draining().
Signed-off-by: Gyeongtaek Lee <gt82.lee@samsung.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/000101d6c3f0$89b312b0$9d193810$@samsung.com
Change-Id: I480caca000544c4033cdf2d445598e31754d8e5e
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Git-commit: 9be9f2d3d073ef42127475f4fb6a392ab133f629
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_smanag@quicinc.com: resolve trivial merge conflicts]
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
When setting svm region during the gpuobj import ioctl call for a usermem
address, there is a possibility of a very large input size causing the
region's 64-bit end address to wrap around. This can cause the region
to incorrectly be considered valid, ultimately allowing a use after free
scenario. To prevent this, detect the occurrence of a wrap and reject the
import.
Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4
Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
(cherry picked from commit 970275cba2)
KGSL internally has a limit on the length of the list of syncpoints
submitted in a single AUX command. Enforce this limit so we don't
overwrite memory beyond the structures that track these syncpoints.
Change-Id: I261bfd4f786ff7e4fbe07e8bca9e9b8d8b87c950
Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com>
Signed-off-by: Kaushal Sanadhya <quic_ksanadhy@quicinc.com>
(cherry picked from commit 7779997686)
Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs
the following:
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0
preempt_count: 2, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by kworker/u320:0/9:
#0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41)
#1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41)
#2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101)
Preemption disabled at:
efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248)
CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1
Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18
Workqueue: efi_rts_wq efi_call_rts
Call trace:
dump_backtrace (arch/arm64/kernel/stacktrace.c:158)
show_stack (arch/arm64/kernel/stacktrace.c:165)
dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
dump_stack (lib/dump_stack.c:114)
__might_resched (kernel/sched/core.c:10134)
rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4))
efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101)
[...]
This seems to come from commit ff7a167961d1 ("arm64: efi: Execute
runtime services from a dedicated stack") which adds a spinlock. This
spinlock is taken through:
efi_call_rts()
\-efi_call_virt()
\-efi_call_virt_pointer()
\-arch_efi_call_virt_setup()
Make 'efi_rt_lock' a raw_spinlock to avoid being preempted.
[ardb: The EFI runtime services are called with a different set of
translation tables, and are permitted to use the SIMD registers.
The context switch code preserves/restores neither, and so EFI
calls must be made with preemption disabled, rather than only
disabling migration.]
Bug: 254441685
Fixes: ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack")
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Cc: <stable@vger.kernel.org> # v6.1+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
(cherry picked from commit 0e68b5517d3767562889f1d83fdb828c26adb24f)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Idcd18ddcc099aa063e042677984ce7f4914659ed
When setting svm region during the gpuobj import ioctl call for a usermem
address, there is a possibility of a very large input size causing the
region's 64-bit end address to wrap around. This can cause the region
to incorrectly be considered valid, ultimately allowing a use after free
scenario. To prevent this, detect the occurrence of a wrap and reject the
import.
Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4
Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ]
HFSC assumes that inner classes have an fsc curve, but it is currently
possible for classes without an fsc curve to become parents. This leads
to bugs including a use-after-free.
Don't allow non-root classes without HFSC_FSC to become parents.
Bug: 299921101
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 4cf994d3f4ff42d604fae2b461bdd5195a7dfabd)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5b44ae6bb340b978372ed9657ba2e23f75b850e5
Fixing the syscall mapping which was done wrongly by
'commit f4ed73112f ("mm/madvise: introduce process_madvise()
syscall: an external memory hinting API")' by correcting the syscall
number.
unistd#close_range cts testcase is expecting errno as ENOSYS
because msm-5.4 does not support close_range syscall, but it
receives errno as EINVAL because process_madvise is configured
with 436 which is close_range syscall number which leads to
this cts testcase failure. Hence, configured process_madvise
with proper upstream syscall number to fix this cts failure.
Applications using process_madvise that are built with previous
headers needs to be rebuilt. Otherwise the program would not
work as expected.
Change-Id: If524d109aa1f4072e9ed03d7d9f70cc517fd59dc
Signed-off-by: Saranya R <quic_sarar@quicinc.com>
UAF scenario may occur in clients with EL1 privileges for
iova mappings when we miss to check the return value of
arm_lpae_init_pte which may lead to an PTE be counted as
it was set even if it was already existing. This can cause a
dangling IOMMU PTE to be left mapped pointing to a
freed object and cause UAF in the client if the dangling PTE
is accessed after a failed unmap operation.
Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor")
Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 upstream.
Lion says:
-------
In the QFQ scheduler a similar issue to CVE-2023-31436
persists.
Consider the following code in net/sched/sch_qfq.c:
static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
unsigned int len = qdisc_pkt_len(skb), gso_segs;
// ...
if (unlikely(cl->agg->lmax < len)) {
pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
cl->agg->lmax, len, cl->common.classid);
err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
if (err) {
cl->qstats.drops++;
return qdisc_drop(skb, sch, to_free);
}
// ...
}
Similarly to CVE-2023-31436, "lmax" is increased without any bounds
checks according to the packet length "len". Usually this would not
impose a problem because packet sizes are naturally limited.
This is however not the actual packet length, rather the
"qdisc_pkt_len(skb)" which might apply size transformations according to
"struct qdisc_size_table" as created by "qdisc_get_stab()" in
net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.
A user may choose virtually any size using such a table.
As a result the same issue as in CVE-2023-31436 can occur, allowing heap
out-of-bounds read / writes in the kmalloc-8192 cache.
-------
We can create the issue with the following commands:
tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
overhead 999999999 linklayer ethernet qfq
tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
tc filter add dev $DEV parent 1: matchall classid 1:1
ping -I $DEV 1.1.1.2
This is caused by incorrectly assuming that qdisc_pkt_len() returns a
length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.
Bug: 292249631
Bug: 293987452
Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: Lion <nnamrec@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Shaoying Xu <shaoyi@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit cf8ecd6ea6)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I69bec7b092e980fe8e0946c26ed9b5ac7c57bf3d
- Bits: 0-27 are used to specify the level
information and bits 28-31 are reserved for
non-level information. For HEVC, these 4 bits(MSB)
are used for communicating the tier info.
- CTS tc will set the tier first, the level
next and the same is set to firmware. In
doing so, the level will override the tier value
which is set earlier and the same is communicated to
the firmware resulting in level info mismatch.
- Fix here is to extract the 4 MSB bits containing the
tier info and add it to the level value, then communicate
it to the firmware.
Change-Id: I530f0a0a92417f2076d5a1f93f724b6514ae9309
Signed-off-by: Madhukumar S J <quic_msj@quicinc.com>
(cherry picked from commit 51311d2374)
In present scenario, STA disconnects with AP if it receives
invalid channel in CSA IE. In this case STA shouldn't
disconnect with AP as this request may come from a spoof AP.
Ignore this CSA request as it might be from spoof AP and
if it is from genuine AP heart beat failure happens and
results in disconnection. After disconnection DUT may
reconnect to same or other APs.
Change-Id: I840508dd27d8c313a3e8f74c4e1f5aa64eecf6f9
CRs-Fixed: 3390251
https://source.android.com/docs/security/bulletin/2023-09-01
* tag 'ASB-2023-09-05_11-5.4' of https://android.googlesource.com/kernel/common:
BACKPORT: net: nfc: Fix use-after-free caused by nfc_llcp_find_local
UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
ANDROID: ABI: Update allowed list for QCOM
UPSTREAM: net: tap_open(): set sk_uid from current_fsuid()
UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid()
UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
Change-Id: Id067733b2597d8ef336d3b38f76669bd2d6726d7
"LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
Asoc: add functionality to get source Track data from FNN module
dsp: add support to get Source Track data from FNN module
asoc: lahaina: add 16 channel support on tdm interface
asoc: Add jitter cleaner external clock switch
dsp: q6asm: Add check for ADSP payload size
ASoC: msm-pcm-host-voice: Check validity of session idx
dsp: Address information leak in dsp drivers
dsp: q6lsm: Address use after free for mmap handle
dsp: q6afe: Add check for fbsp state
dsp: q6lsm: Add check for payload buffer
ASoC: Resolve use after free in listen sound client
ASoC: dsp: q6core: Avoid use after free
ASoC: msm-lsm-client: Integer overflow check
asoc:msm-lsm-client: check for param size before copying
Change-Id: Ia01bfa4467f137efa4578708177862b794aeaf91
"LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0:
Release 2.0.8.33M
qcacld-3.0: Remove interface up dependency for usable channels
Release 2.0.8.33L
qcacld-3.0: Fix data rate for mgmt tx packets in packet capture mode
Release 2.0.8.33K
qcacld-3.0: Fix RSO state change in disconnected state
Release 2.0.8.33J
qcacld-3.0: Reset wait for hw mode change event
Release 2.0.8.33I
qcacld-3.0: Pause Tx when bus suspend in progress
qcacld-3.0: Drop packets if suspend in progress
Release 2.0.8.33H
qcacld-3.0: Prefer power constraint over DTPC when both IE present
qcacld-3.0: Fix low TPC power for vendor DTPC IE
Release 2.0.8.33G
qcacld-3.0: Add lock for multicast list update
qcacld-3.0: Update NDP peer MC list
Release 2.0.8.33F
qcacld-3.0: add minimal UDP data length check for FISA
Change-Id: I1a99afdd89e0b540b3b0577426191e325812914b
"LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
qcacmn: Remove skip HP update logic during tx pause flag is set
qcacmn: Pause Tx HW enqueue when bus suspend in progress
qcacmn: Give SAE-PK AP more score to pass SAE-5.7.3 certification
Change-Id: I442fe2aa328c87c6e7342165c3a40abd0da34d4f
"LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-22400-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
virt: haven: Correct max_buf_size for a connection
mtd: msm_qpic_nand: Add runtime status check in notifiers
defconfig: sdxlemur: Enable binder configs
BACKPORT: FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap
PCI: Configure RC MPS to 128 for Realtek 8168 attach
bus: mhi: misc: Add check for dev_rp if it is iommu range or not
drivers: qcom: pil: Use update_marker for modem book kpi
soc: qcom: add buffer overflow check on AON rx_buffer
msm: kgsl: Defer drawobj_sync_timeline_fence_work() to a workqueue
memshare: Avoid accessing uninitialized nodes
ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
soc: qcom: socinfo: Add soc information for Blair APQ
soc: qcom: minidump: check the size parameter passed to qcom_smem_get()
drivers: qcom: pil: Add KPI boot markers for modem
usb: gadget: cdev: Fix spinlock recursion
defconfig: sdxlemur: Realtek r8168 IOSS glue driver config
Conflicts:
arch/arm64/boot/dts/vendor/bindings/rtc/allwinner,sun6i-a31-rtc.yaml
drivers/clk/qcom/gcc-qcs404.c
Change-Id: Ied2b86eda79d66e747ce5f4b7a3c83c3328edd2b
Michael Bestas
Albert Tang
LuK1337
Tashfin Shakeer Rhythm
andhu
Surapusetty Naresh Babu
Soumya Managoli
Linux Build Service Account
Pankaj Gupta
Kaushal Sanadhya
qctecmdr
Pierre Gondois
Greg Kroah-Hartman
valis
Budimir Markovic
Saranya R
spuligil
Pratyush Brahma
Pedro Tammela
Madhukumar S J
Prakash Manjunathappa
Aravind Kishore Sukla