commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream.
In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space")
fixed a kernel structure visibility issue. As part of that patch,
sizeof(void *) was used as the buffer size for 0-length data payloads so
the driver could detect abusive clients sending 0-length asynchronous
transactions to a server by enforcing limits on async_free_size.
Unfortunately, on the "free" side, the accounting of async_free_space
did not add the sizeof(void *) back. The result was that up to 8-bytes of
async_free_space were leaked on every async transaction of 8-bytes or
less. These small transactions are uncommon, so this accounting issue
has gone undetected for several years.
The fix is to use "buffer_size" (the allocated buffer size) instead of
"size" (the logical buffer size) when updating the async_free_space
during the free operation. These are the same except for this
corner case of asynchronous transactions with payloads < 8 bytes.
Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable@vger.kernel.org # 4.14+
Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ie01082a056bff56f51035c0f6be34e136bd56faf
commit dfd0743f1d9ea76931510ed150334d571fbab49d upstream.
Since the tee subsystem does not keep a strong reference to its idle
shared memory buffers, it races with other threads that try to destroy a
shared memory through a close of its dma-buf fd or by unmapping the
memory.
In tee_shm_get_from_id() when a lookup in teedev->idr has been
successful, it is possible that the tee_shm is in the dma-buf teardown
path, but that path is blocked by the teedev mutex. Since we don't have
an API to tell if the tee_shm is in the dma-buf teardown path or not we
must find another way of detecting this condition.
Fix this by doing the reference counting directly on the tee_shm using a
new refcount_t refcount field. dma-buf is replaced by using
anon_inode_getfd() instead, this separates the life-cycle of the
underlying file from the tee_shm. tee_shm_put() is updated to hold the
mutex when decreasing the refcount to 0 and then remove the tee_shm from
teedev->idr before releasing the mutex. This means that the tee_shm can
never be found unless it has a refcount larger than 0.
Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Lars Persson <larper@axis.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reported-by: Patrik Lantz <patrik.lantz@axis.com>
[JW: backport to 5.4-stable]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ibd2809a225b167563c65faff4a44e56e23c2e97b
commit 7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 upstream.
In 32-bit architecture, the result of sizeof() is a 32-bit integer so
the expression becomes the multiplication between 2 32-bit integer which
can potentially leads to integer overflow. As a result,
bpf_map_area_alloc() allocates less memory than needed.
Fix this by casting 1 operand to u64.
Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for sockmap and sockhash maps")
Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash buckets")
Fixes: 546ac1ffb7 ("bpf: add devmap, a map for storing net device references")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gmail.com
Signed-off-by: Connor O'Brien <connoro@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I9ce1991224a87eb39acf1da4923534e22380fc42
I got memory leak as follows:
unreferenced object 0xffff88801f0b2200 (size 64):
comm "i2c-lis2hh12-21", pid 5455, jiffies 4294944606 (age 15.224s)
hex dump (first 32 bytes):
72 65 67 75 6c 61 74 6f 72 3a 72 65 67 75 6c 61 regulator:regula
74 6f 72 2e 30 2d 2d 69 32 63 3a 31 2d 30 30 31 tor.0--i2c:1-001
backtrace:
[<00000000bf5b0c3b>] __kmalloc_track_caller+0x19f/0x3a0
[<0000000050da42d9>] kvasprintf+0xb5/0x150
[<000000004bbbed13>] kvasprintf_const+0x60/0x190
[<00000000cdac7480>] kobject_set_name_vargs+0x56/0x150
[<00000000bf83f8e8>] dev_set_name+0xc0/0x100
[<00000000cc1cf7e3>] device_link_add+0x6b4/0x17c0
[<000000009db9faed>] _regulator_get+0x297/0x680
[<00000000845e7f2b>] _devm_regulator_get+0x5b/0xe0
[<000000003958ee25>] st_sensors_power_enable+0x71/0x1b0 [st_sensors]
[<000000005f450f52>] st_accel_i2c_probe+0xd9/0x150 [st_accel_i2c]
[<00000000b5f2ab33>] i2c_device_probe+0x4d8/0xbe0
[<0000000070fb977b>] really_probe+0x299/0xc30
[<0000000088e226ce>] __driver_probe_device+0x357/0x500
[<00000000c21dda32>] driver_probe_device+0x4e/0x140
[<000000004e650441>] __device_attach_driver+0x257/0x340
[<00000000cf1891b8>] bus_for_each_drv+0x166/0x1e0
When device_register() returns an error, the name allocated in dev_set_name()
will be leaked, the put_device() should be used instead of kfree() to give up
the device reference, then the name will be freed in kobject_cleanup() and the
references of consumer and supplier will be decreased in device_link_release_fn().
Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Saravana Kannan <saravanak@google.com>
Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210930085714.2057460-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit df0a18149474c7e6b21f6367fbc6bc8d0f192444)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: Iba22f7d2f05da2cd24abe157d36fcb4c05b8ee82
For fixing use-after-free during iterating over requests, we grabbed
request's refcount before calling ->fn in commit 2e315dc07df0 ("blk-mq:
grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter").
Turns out this way may cause kernel panic when iterating over one flush
request:
1) old flush request's tag is just released, and this tag is reused by
one new request, but ->rqs[] isn't updated yet
2) the flush request can be re-used for submitting one new flush command,
so blk_rq_init() is called at the same time
3) meantime blk_mq_queue_tag_busy_iter() is called, and old flush request
is retrieved from ->rqs[tag]; when blk_mq_put_rq_ref() is called,
flush_rq->end_io may not be updated yet, so NULL pointer dereference
is triggered in blk_mq_put_rq_ref().
Fix the issue by calling refcount_set(&flush_rq->ref, 1) after
flush_rq->end_io is set. So far the only other caller of blk_rq_init() is
scsi_ioctl_reset() in which the request doesn't enter block IO stack and
the request reference count isn't used, so the change is safe.
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
Reported-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
Tested-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: John Garry <john.garry@huawei.com>
Link: https://lore.kernel.org/r/20210811142624.618598-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit c2da19ed50554ce52ecbad3655c98371fe58599f)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: Id7fb5f38b0fe35331df98ec2f96e4914f15d981c
Syzbot reported memory leak in xfrm_user_rcv_msg(). The
problem was is non-freed skb's frag_list.
In skb_release_all() skb_release_data() will be called only
in case of skb->head != NULL, but netlink_skb_destructor()
sets head to NULL. So, allocated frag_list skb should be
freed manualy, since consume_skb() won't take care of it
Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 7c1a80e80cde008f271bae630d28cf684351e807)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I4270f5f9f748d6ecd52dd62118b32a70d0921d4b
Syzbot recently found a number of issues related to incremental-fs
(see bug numbers below). All have to do with the fact that incr-fs
allows mounts of the same source and target multiple times.
The correct behavior for a file system is to allow only one such
mount, and then every subsequent attempt should fail with a -EBUSY
error code. In case of the issues listed below the common pattern
is that the reproducer calls:
mount("./file0", "./file0", "incremental-fs", 0, NULL)
many times and then invokes a file operation like chmod, setxattr,
or open on the ./file0. This causes a recursive call for all the
mounted instances, which eventually causes a stack overflow and
a kernel crash:
BUG: stack guard page was hit at ffffc90000c0fff8
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
The reason why many mounts with the same source and target are
possible is because the incfs_mount_fs() as it is allocates a new
super_block for every call, regardless of whether a given mount already
exists or not. This happens every time the sget() function is called
with a test param equal to NULL.
The correct behavior for an FS mount implementation is to call
appropriate mount vfs call for it's type, i.e. mount_bdev() for
a block device backed FS, mount_single() for a pseudo file system,
like sysfs that is mounted in a single, well know location, or
mount_nodev() for other special purpose FS like overlayfs.
In case of incremental-fs the open coded mount logic doesn't check
for abusive mount attempts such as overlays.
To fix this issue the logic needs to be changed to pass a proper
test function to sget() call, which then checks if a super_block
for a mount instance has already been allocated and also allows
the VFS to properly verify invalid mount attempts.
Bug: 211066171
Bug: 213140206
Bug: 213215835
Bug: 211914587
Bug: 211213635
Bug: 213137376
Bug: 211161296
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Change-Id: I66cfc3f1b5aaffb32b0845b2dad3ff26fe952e27
This is the merge of the upstream LTS release of 5.4.1161 into the
android11-5.4 branch.
It contains the following commits:
b52fb22557 ANDROID: GKI: disable CONFIG_FORTIFY_SOURCE
26b09f181d Merge 5.4.161 into android11-5.4-lts
5c088fba39 Linux 5.4.161
b786cb3236 erofs: fix unsafe pagevec reuse of hooked pclusters
83de35ae27 erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
b37f6da8c3 PCI: Add MSI masking quirk for Nvidia ION AHCI
db1390b60e PCI/MSI: Deal with devices lying about their MSI mask capability
49b55a7792 PCI/MSI: Destroy sysfs before freeing entries
7186be970c parisc/entry: fix trace test in syscall exit path
258c42a8fb fortify: Explicitly disable Clang support
4f9a3cda16 scsi: ufs: Fix tm request when non-fatal error happens
c468f9249d ext4: fix lazy initialization next schedule time computation in more granular unit
307c6f7287 MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL
7be773a028 scsi: ufs: Fix interrupt error message for shared interrupts
e3c97ba4a6 soc/tegra: pmc: Fix imbalanced clock disabling in error code path
ebd1ef6eae Revert "net: sched: update default qdisc visibility after Tx queue cnt changes"
9084a8ecc9 Revert "serial: core: Fix initializing and restoring termios speed"
91a7552bea Merge 5.4.160 into android11-5.4-lts
17efa1a44c Linux 5.4.160
66bd28d6be selftests/bpf: Fix also no-alu32 strobemeta selftest
e7ea088cd0 ath10k: fix invalid dma_addr_t token assignment
20a951afb7 SUNRPC: Partial revert of commit 6f9f17287e78
5b7a0a4f7c PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
256a1e009b powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload
fe02d37870 s390/cio: make ccw_device_dma_* more robust
8a8d007bae s390/tape: fix timer initialization in tape_std_assign()
5ef14af166 s390/cio: check the subchannel validity for dev_busid
b0989ae51d video: backlight: Drop maximum brightness override for brightness zero
66938ba128 mm, oom: do not trigger out_of_memory from the #PF
d6648b55ed mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
c6f9a5c11a powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC
453b779d2b powerpc/security: Add a helper to query stf_barrier type
84b3fbfd8e powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
7edda4bd9e powerpc/bpf: Validate branch ranges
0347c001c9 powerpc/lib: Add helper to check if offset is within conditional branch range
c4461ca7a8 ovl: fix deadlock in splice write
8d750efc8d 9p/net: fix missing error check in p9_check_errors
aba12bb38b net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE
223985fa1b f2fs: should use GFP_NOFS for directory inodes
af73b240e0 irqchip/sifive-plic: Fixup EOI failed when masked
53014c1c41 parisc: Fix set_fixmap() on PA1.x CPUs
645d6dfdcb parisc: Fix backtrace to always include init funtion names
62c4e0a3d8 ARM: 9156/1: drop cc-option fallbacks for architecture selection
61a5e446bb ARM: 9155/1: fix early early_iounmap()
dc33574246 selftests/net: udpgso_bench_rx: fix port argument
dd3a418ba5 cxgb4: fix eeprom len when diagnostics not implemented
1800c9eecd net/smc: fix sk_refcnt underflow on linkdown and fallback
b2d1b6624b vsock: prevent unnecessary refcnt inc for nonblocking connect
72aca95f95 net: hns3: allow configure ETS bandwidth of all TCs
07b218db54 net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any
18f2809441 bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
180a9b539c arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions
572599cbf1 nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
c1d5f943bb llc: fix out-of-bound array index in llc_sk_dev_hash()
bdf94057aa perf bpf: Add missing free to bpf_event__print_bpf_prog_info()
23def86bbf zram: off by one in read_block_state()
d26835de40 mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
46d695e870 bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
dce69e0a06 ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
700602b662 net: vlan: fix a UAF in vlan_dev_real_dev()
98e0ab88f4 net: davinci_emac: Fix interrupt pacing disable
70ecaadb49 xen-pciback: Fix return in pm_ctrl_init()
7f57b9bc8e i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
53ad06ff3b NFSv4: Fix a regression in nfs_set_open_stateid_locked()
c9dcb51ae4 scsi: qla2xxx: Turn off target reset during issue_lip
211f08d1ff scsi: qla2xxx: Fix gnl list corruption
9b180f3c2d ar7: fix kernel builds for compiler test
59e97c74d1 watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
162a1cfcd5 m68k: set a default value for MEMORY_RESERVE
9770f8c29f signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL)
9e6985190f dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
fd1de35901 netfilter: nfnetlink_queue: fix OOB when mac header was cleared
15351d5e8b soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read
be832f781d auxdisplay: ht16k33: Fix frame buffer device blanking
c441943075 auxdisplay: ht16k33: Connect backlight to fbdev
1fa9803de9 auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
e63507ea43 dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
04317e7474 mtd: core: don't remove debugfs directory if device is in use
59929f9a57 mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
a83aaf1507 fs: orangefs: fix error return code of orangefs_revalidate_lookup()
c79c37c775 NFS: Fix deadlocks in nfs_scan_commit_list()
5a893e0eab opp: Fix return in _opp_add_static_v2()
98ac698216 PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge
819925eff0 PCI: aardvark: Don't spam about PIO Response Status
bab1cfec7a drm/plane-helper: fix uninitialized variable reference
4b48c6ede3 pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
2b2fdb6f48 rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
bd48bdbfd9 apparmor: fix error check
a7b2947649 power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
3f698d97f7 mips: cm: Convert to bitfield API to fix out-of-bounds access
fb7b73cd94 powerpc/44x/fsp2: add missing of_node_put
d3dd1a057c HID: u2fzero: properly handle timeouts in usb_submit_urb
b216a39b32 HID: u2fzero: clarify error check and length calculations
fae0552d83 serial: xilinx_uartps: Fix race condition causing stuck TX
818e100c2b phy: qcom-qusb2: Fix a memory leak on probe
de43e75917 ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
f00ff5357b ASoC: cs42l42: Correct some register default values
baf5c1225e ARM: dts: stm32: fix SAI sub nodes register range
bb74ce1feb staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC
73aaa6222a RDMA/mlx4: Return missed an error if device doesn't support steering
20dfad97db scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
5ead6f4fea power: supply: rt5033_battery: Change voltage values to µV
fdbe8e8a08 usb: gadget: hid: fix error code in do_config()
15355466cd serial: 8250_dw: Drop wrong use of ACPI_PTR()
d8241e7a21 video: fbdev: chipsfb: use memset_io() instead of memset()
e7df004eb1 clk: at91: check pmc node status before registering syscore ops
44a2dcd146 memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
03fe35ce9a soc/tegra: Fix an error handling path in tegra_powergate_power_up()
543d85602f arm: dts: omap3-gta04a4: accelerometer irq fix
7cf7d9b83d ALSA: hda: Reduce udelay() at SKL+ position reporting
d1cf71d79e JFS: fix memleak in jfs_mount
56911ee537 MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
ee49b6598c scsi: dc395: Fix error case unwinding
dd49dee254 ARM: dts: at91: tse850: the emac<->phy interface is rmii
1df7102f26 arm64: dts: meson-g12a: Fix the pwm regulator supply properties
681c58f344 RDMA/bnxt_re: Fix query SRQ failure
50eca29537 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY
863e71a3af arm64: dts: rockchip: Fix GPU register width for RK3328
6694960195 ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
d27580c1b0 clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths
9212ebb1c6 RDMA/rxe: Fix wrong port_cap_flags
cf234bc5fb ibmvnic: Process crqs after enabling interrupts
bc40616481 ibmvnic: don't stop queue in xmit
a91c8ee2ed udp6: allow SO_MARK ctrl msg to affect routing
9ff14503f4 selftests/bpf: Fix fclose/pclose mismatch in test_progs
af51aa2b85 crypto: pcrypt - Delay write to padata->info
9be9cb2a2b net: phylink: avoid mvneta warning when setting pause parameters
077410c790 net: amd-xgbe: Toggle PLL settings during rate change
63a3b1af04 drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
9ca0d10742 wcn36xx: add proper DMA memory barriers in rx path
a3256ae45b libertas: Fix possible memory leak in probe and disconnect
427583b93d libertas_tf: Fix possible memory leak in probe and disconnect
2339ff4162 KVM: s390: Fix handle_sske page fault handling
3f3b4054e2 samples/kretprobes: Fix return value if register_kretprobe() failed
9435b2f9c0 tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()
a8226599cb irq: mips: avoid nested irq_enter()
ae5a244648 s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
8fb436d146 libbpf: Fix BTF data layout checks and allow empty BTF
03a818c096 smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
12ccb57379 drm/msm: Fix potential NULL dereference in DPU SSPP
dc18f08062 clocksource/drivers/timer-ti-dm: Select TIMER_OF
c523474f2a PM: hibernate: fix sparse warnings
0d22f55014 nvme-rdma: fix error code in nvme_rdma_setup_ctrl
67ba6c8e71 phy: micrel: ksz8041nl: do not use power down mode
ae213c059a mwifiex: Send DELBA requests according to spec
3a781e2131 rsi: stop thread firstly in rsi_91x_init() error handling
ad4cd01307 mt76: mt76x02: fix endianness warnings in mt76x02_mac.c
bdbc9311f1 platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
3446e5ecdf block: ataflop: fix breakage introduced at blk-mq refactoring
2918a29fc8 mmc: mxs-mmc: disable regulator on error and in the remove function
b631c603b5 net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
f27fbff862 drm/msm: uninitialized variable in msm_gem_import()
32ac072c24 ath10k: fix max antenna gain unit
218fb43fff hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff
8384c4a7bc hwmon: Fix possible memleak in __hwmon_device_register()
f7fd072039 net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE
9498f5272a memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
5f462b38ce memstick: avoid out-of-range warning
3a7525d5d7 mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured
dc73f7cae1 b43: fix a lower bounds test
1b6365fdae b43legacy: fix a lower bounds test
c51ac7fd02 hwrng: mtk - Force runtime pm ops for sleep ops
52d2cdab52 crypto: qat - disregard spurious PFVF interrupts
4d7881430f crypto: qat - detect PFVF collision after ACK
a3d3f9c5dc media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable()
73dd601bec netfilter: nft_dynset: relax superfluous check on set updates
62f6260f70 EDAC/amd64: Handle three rank interleaving mode
f399e650c0 ath9k: Fix potential interrupt storm on queue reset
843ff688eb media: em28xx: Don't use ops->suspend if it is NULL
e577924b70 cpuidle: Fix kobject memory leaks in error paths
18fdbdbecf crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency
a993159a2a kprobes: Do not use local variable when creating debugfs file
71411bd79e media: cx23885: Fix snd_card_free call on null card pointer
1c2c8030e7 media: tm6000: Avoid card name truncation
61266f852f media: si470x: Avoid card name truncation
4e65b9ec21 media: radio-wl1273: Avoid card name truncation
8eeec127d5 media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
2b9ae7bac9 media: TDA1997x: handle short reads of hdmi info frame.
23b65152a0 media: dvb-usb: fix ununit-value in az6027_rc_query
e2b2d221a4 media: cxd2880-spi: Fix a null pointer dereference on error handling path
f46da0c6af media: em28xx: add missing em28xx_close_extension
14f3d77c77 drm/amdgpu: fix warning for overflow check
465dc8a1b1 ath10k: Fix missing frame timestamp for beacon/probe-resp
7c12c2fe45 net: dsa: rtl8366rb: Fix off-by-one bug
674637270e rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()
d4cd7a167c crypto: caam - disable pkc for non-E SoCs
555fe5734d Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
8c68d12f1a wilc1000: fix possible memory leak in cfg_scan_result()
1713b85634 cgroup: Make rebind_subsystems() disable v2 controllers all at once
bd76ec43f1 net: net_namespace: Fix undefined member in key_remove_domain()
3a37742128 virtio-gpu: fix possible memory allocation failure
606c95078a drm/v3d: fix wait for TMU write combiner flush
6a93d8ebb8 rcu: Fix existing exp request check in sync_sched_exp_online_cleanup()
6237a1685c Bluetooth: fix init and cleanup of sco_conn.timeout_work
28c1d96562 selftests/bpf: Fix strobemeta selftest regression
f2c04d46c8 netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state
0c2acfede5 parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
cbe2872427 parisc/unwind: fix unwinder when CONFIG_64BIT is enabled
a9a411adca task_stack: Fix end_of_stack() for architectures with upwards-growing stack
c06cf3b1d0 parisc: fix warning in flush_tlb_all
7324419233 x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted
ad67a7e2ab spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
a15fc58933 btrfs: do not take the uuid_mutex in btrfs_rm_device
aba1db41dd net: annotate data-race in neigh_output()
2f78cb7ecc vrf: run conntrack only in context of lower/physdev for locally generated packets
5919f02e18 ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
d99f320a1b gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
9929b3db46 ARM: clang: Do not rely on lr register for stacktrace
681a426e6b smackfs: use __GFP_NOFAIL for smk_cipso_doi()
4752a9c3a0 iwlwifi: mvm: disable RX-diversity in powersave
41e583edb1 selftests: kvm: fix mismatched fclose() after popen()
4411d0d8df PM: hibernate: Get block device exclusively in swsusp_check()
a528d3aac3 nvme: drop scan_lock and always kick requeue list when removing namespaces
209c39b3f5 nvmet-tcp: fix use-after-free when a port is removed
81d11e40fd nvmet: fix use-after-free when a port is removed
1ec1ca2be9 block: remove inaccurate requeue check
bfde056402 mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
e4af3e42ba tracing/cfi: Fix cmp_entries_* functions signature mismatch
caeb6bae75 workqueue: make sysfs of unbound kworker cpumask more clever
58b4e0c075 lib/xz: Validate the value before assigning it to an enum variable
8cdab20660 lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
eb8f087201 memstick: r592: Fix a UAF bug when removing the driver
2226ad0314 leaking_addresses: Always print a trailing newline
63c3c7b699 ACPI: battery: Accept charges over the design capacity as full
2efb81b22d iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value
d5fb057f23 ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
e2c27194fc tracefs: Have tracefs directories not set OTH permission bits by default
ace6e7fe96 net-sysfs: try not to restart the syscall if it will fail eventually
d8d1d35405 media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
382e7b6458 media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info
e5f9be4869 media: ipu3-imgu: imgu_fmt: Handle properly try
cdf338e1db ACPICA: Avoid evaluating methods too early during system resume
9ff00d0b1d ipmi: Disable some operations during a panic
4bba26f89e media: rcar-csi2: Add checking to rcsi2_start_receiver()
c08a655ed9 brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet
f64551db52 ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
31b7848647 media: mceusb: return without resubmitting URB in case of -EPROTO error.
e419469adf media: imx: set a media_device bus_info string
b2b2f91782 media: s5p-mfc: Add checking to s5p_mfc_probe().
6b8ab552e2 media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
bc4af8c782 media: uvcvideo: Set unique vdev name based in type
7a646855d6 media: uvcvideo: Return -EIO for control errors
ab7fca0eae media: uvcvideo: Set capability in s_param
bff0833e2b media: stm32: Potential NULL pointer dereference in dcmi_irq_thread()
cede36511c media: netup_unidvb: handle interrupt properly according to the firmware
3fe3d04354 media: mt9p031: Fix corrupted frame after restarting stream
08743f9c48 ath10k: high latency fixes for beacon buffer
fadb4cd750 mwifiex: Properly initialize private structure on interface type changes
7d3e6635c2 mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
480c240ab6 x86: Increase exception stack sizes
91b9c23b6d smackfs: Fix use-after-free in netlbl_catmap_walk()
31df731c87 net: sched: update default qdisc visibility after Tx queue cnt changes
a82f379378 locking/lockdep: Avoid RCU-induced noinstr fail
f14eca60bf MIPS: lantiq: dma: reset correct number of channel
ca07aff257 MIPS: lantiq: dma: add small delay after reset
e5ea3dca94 platform/x86: wmi: do not fail if disabling fails
b57df4d6fc drm/panel-orientation-quirks: add Valve Steam Deck
67bd269a84 Bluetooth: fix use-after-free error in lock_sock_nested()
d416020f1a Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
a52bd11b24 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6
e5ca76568a drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1
c19cabfa55 drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2)
46a25b7a25 dma-buf: WARN on dmabuf release with pending attachments
1bee9e59c6 USB: chipidea: fix interrupt deadlock
8a643c0f95 USB: iowarrior: fix control-message timeouts
3285811674 USB: serial: keyspan: fix memleak on probe errors
8ce0bc6962 iio: dac: ad5446: Fix ad5622_write() return value
f01e16d324 pinctrl: core: fix possible memory leak in pinctrl_enable()
270541cbc0 quota: correct error number in free_dqentry()
10b808307d quota: check block number when reading the block in quota file
a509a515f3 PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
0ea58b9bb9 PCI: aardvark: Fix return value of MSI domain .alloc() method
ee9cdca4d6 PCI: aardvark: Fix reporting Data Link Layer Link Active
6f99c7a51e PCI: aardvark: Do not unmask unused interrupts
d964886327 PCI: aardvark: Fix checking for link up via LTSSM state
e0269c0c81 PCI: aardvark: Do not clear status bits of masked interrupts
50b0ce94fb PCI: pci-bridge-emul: Fix emulation of W1C bits
3d995568c9 xen/balloon: add late_initcall_sync() for initial ballooning done
3f6255a91b ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
6225a31b2e ALSA: mixer: oss: Fix racy access to slots
e9adf72bdb serial: core: Fix initializing and restoring termios speed
b535b63464 powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
bfefc5d6f9 can: j1939: j1939_can_recv(): ignore messages with invalid source address
94a3f521e3 can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport
8e61c799c8 KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use
654a824816 power: supply: max17042_battery: use VFSOC for capacity when no rsns
11129762e3 power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
625c3ed247 signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
ec5ef8d4d7 signal: Remove the bogus sigkill_pending in ptrace_stop
28c70d5036 RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
91a29609bd rsi: Fix module dev_oper_mode parameter description
9defe9b1ab rsi: fix rate mask set leading to P2P failure
2f1f06be3e rsi: fix key enabled check causing unwanted encryption for vap_id > 0
1fa1da8a60 rsi: fix occasional initialisation failure with BT coex
398e7e5add wcn36xx: handle connection loss indication
4a67355383 libata: fix checking of DMA state
6f2f91b9df mwifiex: Read a PCI register after writing the TX ring write pointer
3991cdc40f wcn36xx: Fix HT40 capability for 2Ghz band
301d33c954 evm: mark evm_fixmode as __ro_after_init
e1f71a3289 rtl8187: fix control-message timeouts
76d2ce7ca9 PCI: Mark Atheros QCA6174 to avoid bus reset
3110371c7a ath10k: fix division by zero in send path
2b94d10056 ath10k: fix control-message timeout
cfbe74d8b1 ath6kl: fix control-message timeout
1a2fe1c3d8 ath6kl: fix division by zero in send path
78ebff828a mwifiex: fix division by zero in fw download path
08501eb9ff EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
a147922924 regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
c9e5a00596 regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
3baa5886d1 hwmon: (pmbus/lm25066) Add offset coefficients
98bea92379 ia64: kprobes: Fix to pass correct trampoline address to the handler
ddb54bf3b7 btrfs: call btrfs_check_rw_degradable only if there is a missing device
5223324ed1 btrfs: fix lost error handling when replaying directory deletes
c25984fa18 btrfs: clear MISSING device status bit in btrfs_close_one_device
87a87c82f7 net/smc: Correct spelling mistake to TCPF_SYN_RECV
cc14499b9d nfp: bpf: relax prog rejection for mtu check through max_pkt_offset
a62d430841 vmxnet3: do not stop tx queues after netif_device_detach()
17dcecf20c r8169: Add device 10ec:8162 to driver r8169
e84b38e578 nvmet-tcp: fix header digest verification
2804181e1b drm: panel-orientation-quirks: Add quirk for GPD Win3
7273488fd3 watchdog: Fix OMAP watchdog early handling
5ffdddcf28 net: multicast: calculate csum of looped-back and forwarded packets
9420e2496d spi: spl022: fix Microwire full duplex mode
1a667bc329 nvmet-tcp: fix a memory leak when releasing a queue
2f3860ba60 xen/netfront: stop tx queues during live migration
de649ec7ad bpf: Prevent increasing bpf_jit_limit above max
df8665c398 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT
8dd688ba67 drm: panel-orientation-quirks: Add quirk for Aya Neo 2021
c4282bb805 mmc: winbond: don't build on M68K
05f0a97e2f reset: socfpga: add empty driver allowing consumers to probe
dfa8fb782b ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode
f09014e8be hyperv/vmbus: include linux/bitops.h
054fe50d26 sfc: Don't use netif_info before net_device setup
82005afbb3 cavium: Fix return values of the probe function
9f5fd5aab8 scsi: qla2xxx: Fix unmap of already freed sgl
96183337e9 scsi: qla2xxx: Return -ENOMEM if kzalloc() fails
8e3a0d28ed cavium: Return negative value when pci_alloc_irq_vectors() fails
58608e80d6 x86/irq: Ensure PI wakeup handler is unregistered before module unload
7252cb96e4 x86/cpu: Fix migration safety with X86_BUG_NULL_SEL
e3d4ba338b x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c
ccc4e5e60b fuse: fix page stealing
9505d48721 ALSA: timer: Unconditionally unlink slave instances, too
2c6446168f ALSA: timer: Fix use-after-free problem
246c6a1fe3 ALSA: synth: missing check for possible NULL after the call to kstrdup
ce9f7535ec ALSA: usb-audio: Add registration quirk for JBL Quantum 400
7da6f4c5c2 ALSA: line6: fix control and interrupt message timeouts
4a12e624e5 ALSA: 6fire: fix control and bulk message timeouts
ab3f823af2 ALSA: ua101: fix division by zero at probe
a3bb6e0db7 ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED
40243342d2 ALSA: hda/realtek: Add quirk for ASUS UX550VE
8af6ade7ac ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N
809416fe0a ALSA: hda/realtek: Add quirk for Clevo PC70HS
638b53d67f media: v4l2-ioctl: Fix check_ext_ctrls
8c11269bd6 media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers
bbd62d2fca media: ite-cir: IR receiver stop working after receive overflow
eef6cb3d3c crypto: s5p-sss - Add error handling in s5p_aes_probe()
d7a5d872b4 firmware/psci: fix application of sizeof to pointer
18f0fb57a9 tpm: Check for integer overflow in tpm2_map_response_body()
f38f3da360 parisc: Fix ptrace check on syscall return
acbc2a08ea mmc: dw_mmc: Dont wait for DRTO on Write RSP error
5ee76475f8 scsi: qla2xxx: Fix use after free in eh_abort path
cc5b139488 scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file
617d2fd48d ocfs2: fix data corruption on truncate
c20eb9551c libata: fix read log timeout value
69c2199f49 Input: i8042 - Add quirk for Fujitsu Lifebook T725
17ec1c6b45 Input: elantench - fix misreporting trackpoint coordinates
ce4bec0a54 Input: iforce - fix control-message timeout
db39f49ee7 binder: use cred instead of task for getsecid
fc9c470cd5 binder: use cred instead of task for selinux checks
28a1e470b0 binder: use euid from cred instead of using task
3e87c4996d usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform
3fa7efd1fa xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
f911d1ad48 Merge 5.4.159 into android11-5.4-lts
5915b0ea67 Linux 5.4.159
abc49cc45d rsi: fix control-message timeout
64e6632ab4 media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
6c382b6365 staging: rtl8192u: fix control-message timeouts
f66258cb60 staging: r8712u: fix control-message timeout
88a252ff78 comedi: vmk80xx: fix bulk and interrupt message timeouts
1ae4715121 comedi: vmk80xx: fix bulk-buffer overflow
199acd8c11 comedi: vmk80xx: fix transfer-buffer overflows
b0156b7c96 comedi: ni_usb6501: fix NULL-deref in command paths
3efb7af8ac comedi: dt9812: fix DMA buffers on stack
6e80e9314f isofs: Fix out of bound access for corrupted isofs image
adc56dbfc4 printk/console: Allow to disable console output by using console="" or console=null
589ac131b3 binder: don't detect sender/target during buffer cleanup
b60e89b63e usb-storage: Add compatibility quirk flags for iODD 2531/2541
5c3eba2904 usb: musb: Balance list entry in musb_gadget_queue
161571745d usb: gadget: Mark USB_FSL_QE broken on 64-bit
d6013265a7 usb: ehci: handshake CMD_RUN instead of STS_HALT
6d000e1c16 Revert "x86/kvm: fix vcpu-id indexed array sizes"
3197361248 Merge branch 'android11-5.4' into 'android11-5.4-lts'
7cd388bad4 Merge 5.4.158 into android11-5.4-lts
c65356f0f7 Linux 5.4.158
e31d51f8a4 ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
960b1fdfc3 Revert "drm/ttm: fix memleak in ttm_transfered_destroy"
a73ebe514a sfc: Fix reading non-legacy supported link modes
6789e4b759 Revert "usb: core: hcd: Add support for deferring roothub registration"
049849492b Revert "xhci: Set HCD flag to defer primary roothub registration"
2461f38384 media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
21fc2bb836 net: ethernet: microchip: lan743x: Fix skb allocation failure
e02fdd7db4 vrf: Revert "Reset skb conntrack connection..."
1ce287eff9 scsi: core: Put LLD module refcnt after SCSI device is released
553d3c4173 Merge 5.4.157 into android11-5.4-lts
e6de9a8b5b Linux 5.4.157
39fb393e21 perf script: Check session->header.env.arch before using it
472d9354a9 KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu
07e9a4e1ab KVM: s390: clear kicked_mask before sleeping again
5919a07d71 cfg80211: correct bridge/4addr mode check
dba9e632ed net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT
0f5b4c57dc sctp: add vtag check in sctp_sf_ootb
df52776407 sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
0aa322b5fe sctp: add vtag check in sctp_sf_violation
d6470c2200 sctp: fix the processing for COOKIE_ECHO chunk
5fe74d5e4d sctp: fix the processing for INIT_ACK chunk
5953ee99ba sctp: use init_tag from inithdr for ABORT chunk
5395650d15 phy: phy_start_aneg: Add an unlocked version
c85b696270 phy: phy_ethtool_ksettings_get: Lock the phy for consistency
0dea6379e2 net/tls: Fix flipped sign in async_wait.err assignment
e12b8f3c2b net: nxp: lpc_eth.c: avoid hang when bringing interface down
b232898c1d net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent
92507dc1ef net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails
3708aa267d nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
b1c76f97ad RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string
18a012869f net: Prevent infinite while loop in skb_tx_hash()
6422e84718 net: batman-adv: fix error handling
1cead23c1c regmap: Fix possible double-free in regcache_rbtree_exit()
207e6e93e7 arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
c29c3295e0 RDMA/mlx5: Set user priority for DCT
13ad93a42c nvme-tcp: fix data digest pointer calculation
b597b0e2e8 nvmet-tcp: fix data digest pointer calculation
d997d4e436 IB/hfi1: Fix abba locking issue with sc_disable()
0f8cdfff06 IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
5f0bfe21c8 tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function
bd99782f3c drm/ttm: fix memleak in ttm_transfered_destroy
d2c64ebcc7 net: lan78xx: fix division by zero in send path
a37c5e70ac cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
590abe5bec mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit
07da44b086 mmc: sdhci: Map more voltage level to SDHCI_POWER_330
0821c5608d mmc: dw_mmc: exynos: fix the finding clock sample value
08328d65cb mmc: cqhci: clear HALT state after CQE enable
55a3870f4a mmc: vub300: fix control-message timeouts
e0cfd5159f net/tls: Fix flipped sign in tls_err_abort() calls
6a18d155d5 Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
9fdcf66ee4 nfc: port100: fix using -ERRNO as command type mask
853f22623d ata: sata_mv: Fix the error handling of mv_chip_id()
6d0b30784f Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode"
b7dfc536db usbnet: fix error return code in usbnet_probe()
492140e45d usbnet: sanity check for maxpacket
4ba6c163fe ipv4: use siphash instead of Jenkins in fnhe_hashfun()
3f439c231a ipv6: use siphash in rt6_exception_hash()
1cad781ecf powerpc/bpf: Fix BPF_MOD when imm == 1
ca10ddbbab ARM: 9141/1: only warn about XIP address when not compile testing
40cd329455 ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
2f7647cc13 ARM: 9134/1: remove duplicate memcpy() definition
9f44f66396 ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
5f1f361447 Merge 5.4.156 into android11-5.4-lts
3a7a77d783 Merge branch 'android11-5.4' into 'android11-5.4-lts'
89b6869b94 Linux 5.4.156
7cdcaa7c76 pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
a9c4e246f7 ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
a98c81ab17 tracing: Have all levels of checks prevent recursion
b0feaa8376 net: mdiobus: Fix memory leak in __mdiobus_register
0ab35e7074 scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
9068beaa04 Input: snvs_pwrkey - add clk handling
8de335e819 ALSA: hda: avoid write to STATESTS if controller is in reset
570bc60dcd platform/x86: intel_scu_ipc: Update timeout value in comment
4054b869dc isdn: mISDN: Fix sleeping function called from invalid context
5001160d3e ARM: dts: spear3xx: Fix gmac node
e9d9ffa193 net: stmmac: add support for dwmac 3.40a
044fa2afd6 btrfs: deal with errors when checking if a dir entry exists during log replay
d49a293b94 gcc-plugins/structleak: add makefile var for disabling structleak
e8ef998441 selftests: netfilter: remove stray bash debug line
b7fdebde2c netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
285e9210b1 isdn: cpai: check ctr->cnr to avoid array index out of bound
1f75f8883b nfc: nci: fix the UAF of rf_conn_info object
4f5d1c29cf mm, slub: fix potential memoryleak in kmem_cache_open()
a1ec195a19 mm, slub: fix mismatch between reconstructed freelist depth and cnt
8e25a62e8d powerpc/idle: Don't corrupt back chain when going idle
d0148cfaf8 KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
80bbb0bc3a KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
722e6f6ac8 powerpc64/idle: Fix SP offsets when saving GPRs
d6f451f1f6 audit: fix possible null-pointer dereference in audit_filter_rules
c974f2f92c ASoC: DAPM: Fix missing kctl change notifications
5307a77b71 ALSA: hda/realtek: Add quirk for Clevo PC50HS
50fc52e5ca ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
0f218ba4c8 vfs: check fd has read access in kernel_read_file_from_fd()
f439d2bcb6 elfcore: correct reference to CONFIG_UML
d3a8357637 ocfs2: mount fails with buffer overflow in strlen
b05caf023b ocfs2: fix data corruption after conversion from inline format
bce53fbee9 ceph: fix handling of "meta" errors
151c72bba1 can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
0ddf781882 can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
a0e47d2833 can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
7e66cfed66 can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
1248582e47 can: peak_pci: peak_pci_remove(): fix UAF
ea82c2463e can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
c26dcd1cb8 can: rcar_can: fix suspend/resume
8c5585eae3 net: enetc: fix ethtool counter name for PM0_TERR
c0b0baade9 net: stmmac: Fix E2E delay mechanism
c4b64011e4 net: hns3: disable sriov before unload hclge layer
472acf1582 net: hns3: add limit ets dwrr bandwidth cannot be 0
b1f9380ee2 net: hns3: reset DWRR of unused tc to zero
12bdcbc043 NIOS2: irqflags: rename a redefined register name
599766696f net: dsa: lantiq_gswip: fix register definition
f49ce82f9b lan78xx: select CRC32
83094f8c44 netfilter: ipvs: make global sysctl readonly in non-init netns
ce70ee94dd ASoC: wm8960: Fix clock configuration on slave mode
0f5b08ca22 dma-debug: fix sg checks in debug_dma_map_sg()
50aefa9acc NFSD: Keep existing listeners on portlist error
4a5bf3e729 xtensa: xtfpga: Try software restart before simulating CPU reset
31137288b9 xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
d946a39bad ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
e7c4819c0b tee: optee: Fix missing devices unregister during optee_remove
b1e9b4e0f6 net: switchdev: do not propagate bridge updates across bridges
2d22cd0482 parisc: math-emu: Fix fall-through warnings
ff9005a69e Merge branch 'android11-5.4' into 'android11-5.4-lts'
fa6db42758 Merge 5.4.155 into android11-5.4-lts
4f508aa9dd Linux 5.4.155
32d2ce0b94 ionic: don't remove netdev->dev_addr when syncing uc list
abaf8e8b90 r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
a4f7d2246e qed: Fix missing error code in qed_slowpath_start()
62d96bb68b mqprio: Correct stats in mqprio_dump_class_stats().
fa272e8353 acpi/arm64: fix next_platform_timer() section mismatch error
32ac4ed32b drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
4620098958 drm/msm/dsi: Fix an error code in msm_dsi_modeset_init()
f302be08e3 drm/msm: Fix null pointer dereference on pointer edp
0d5ef1e875 drm/panel: olimex-lcd-olinuxino: select CRC32
9225d57f51 platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call
ae0993739e mlxsw: thermal: Fix out-of-bounds memory accesses
97e6dcb416 ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators()
b9352ed9b9 pata_legacy: fix a couple uninitialized variable bugs
2bde4aca56 NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
7ab488d722 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
69b3a13f0d nfc: fix error handling of nfc_proto_register()
2731eaac19 ethernet: s2io: fix setting mac address during resume
4c2eb80fc9 net: encx24j600: check error in devm_regmap_init_encx24j600
0904e1be2a net: stmmac: fix get_hw_feature() on old hardware
06251ea8d1 net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp
19a01522c5 net: korina: select CRC32
32b57d897e net: arc: select CRC32
2880dc1302 gpio: pca953x: Improve bias setting
d887745395 sctp: account stream padding length for reconf chunk
232c485c6b iio: dac: ti-dac5571: fix an error code in probe()
69696951de iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
10ecff1522 iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
ac0688bcd1 iio: light: opt3001: Fixed timeout error when 0 lux
3c00d93297 iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED
cf4b39907a iio: adc128s052: Fix the error handling path of 'adc128_probe()'
580c09a9ef iio: adc: aspeed: set driver data when adc probe.
1904050cac powerpc/xive: Discard disabled interrupts in get_irqchip_state()
5683ed468f x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically
0594f1d048 nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
d07571672c EDAC/armada-xp: Fix output of uncorrectable error counter
dba8834bae virtio: write back F_VERSION_1 before validate
1b39a67856 USB: serial: option: add prod. id for Quectel EG91
41e178c138 USB: serial: option: add Telit LE910Cx composition 0x1204
848eac2cb7 USB: serial: option: add Quectel EC200S-CN module support
958e98ca52 USB: serial: qcserial: add EM9191 QDL support
733dcc08e9 Input: xpad - add support for another USB ID of Nacon GC-100
9ab5d539bc usb: musb: dsps: Fix the probe error path
278e483dc7 efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
27a847dbc9 efi/cper: use stack buffer for error record decoding
6e35a5e926 cb710: avoid NULL pointer subtraction
e71ce4a81e xhci: Enable trust tx length quirk for Fresco FL11 USB controller
01c2dcb67e xhci: Fix command ring pointer corruption while aborting a command
7ce7d4a46d xhci: guard accesses to ep_state in xhci_endpoint_reset()
783579057c mei: me: add Ice Lake-N device id.
9264bd22d7 x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails
10b77e16b3 watchdog: orion: use 0 for unset heartbeat
9acf1c10f1 btrfs: check for error when looking up inode during dir entry replay
625565fd80 btrfs: deal with errors when adding inode reference during log replay
6e2ac49b21 btrfs: deal with errors when replaying dir entry during log replay
005a07c9ac btrfs: unlock newly allocated extent buffer after error
e9f457f056 csky: Fixup regs.sr broken in ptrace
a6f4ea748a csky: don't let sigreturn play with priveleged bits of status register
98544ca6cb s390: fix strrchr() implementation
5959e22e07 nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^'
2e41b9c846 ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW
90cf96afa3 ALSA: hda/realtek - ALC236 headset MIC recording issue
33627fa4db ALSA: hda/realtek: Add quirk for Clevo X170KM-G
e96079ab1c ALSA: hda/realtek: Complete partial device name to avoid ambiguity
dd3f048315 ALSA: seq: Fix a potential UAF by wrong private_free call order
825786f723 ALSA: usb-audio: Add quirk for VF0770
43d9332526 ovl: simplify file splice
615b28244c Merge 5.4.154 into android11-5.4-lts
ce061ef43f Linux 5.4.154
291a48871e sched: Always inline is_percpu_thread()
3e105ecc4a scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
1ff5ee9d39 scsi: ses: Fix unsigned comparison with less than zero
83d857d6b0 drm/amdgpu: fix gart.bo pin_count leak
1843ae8c4b net: sun: SUNVNET_COMMON should depend on INET
6d1d7acb10 mac80211: check return value of rhashtable_init
2aaf3fd5e1 net: prevent user from passing illegal stab size
1e66a472b5 m68k: Handle arrivals of multiple signals correctly
be191c8e68 mac80211: Drop frames from invalid MAC address in ad-hoc mode
fffad5988f netfilter: nf_nat_masquerade: defer conntrack walk to work queue
b3cb063034 netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic
a9d8aa2d3c HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
8c6680025b netfilter: ip6_tables: zero-initialize fragment offset
744b908a7f HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
b6bccc978e ext4: correct the error path of ext4_write_inline_data_end()
de4a28b718 net: phy: bcm7xxx: Fixed indirect MMD operations
57f5a5a9ae UPSTREAM: ovl: simplify file splice
65d414cb38 Merge branch 'android11-5.4' into 'android11-5.4-lts'
ffab1c7d7c Merge 5.4.153 into android11-5.4-lts
940a14a7d8 Linux 5.4.153
6a89b1e0c2 x86/Kconfig: Correct reference to MWINCHIP3D
5b3b400741 x86/hpet: Use another crystalball to evaluate HPET usability
367f643191 x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI
9e2a9da532 RISC-V: Include clone3() on rv32
a326f9c01c bpf, s390: Fix potential memory leak about jit_data
60bacf259e i2c: acpi: fix resource leak in reconfiguration device addition
b723b34a98 net: prefer socket bound to interface when not in VRF
17063cac40 i40e: Fix freeing of uninitialized misc IRQ vector
0a1fcc981d i40e: fix endless loop under rtnl
d6c0668119 gve: fix gve_get_stats()
d83787c26d rtnetlink: fix if_nlmsg_stats_size() under estimation
0311d97753 gve: Correct available tx qpl check
11cd944bb8 drm/nouveau/debugfs: fix file release memory leak
cb7e651879 video: fbdev: gbefb: Only instantiate device when built for IP32
04f981251e bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
809aa82ac6 netlink: annotate data races around nlk->bound
fd73c2e64b net: sfp: Fix typo in state machine debug string
c951c08a59 net/sched: sch_taprio: properly cancel timer from taprio_destroy()
c2c45102ae net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
8af0c7d3fb ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
ebe58e1c1a arm64: dts: ls1028a: add missing CAN nodes
1b9f0d242a arm64: dts: freescale: Fix SP805 clock-names
27e53e23a3 ptp_pch: Load module automatically if ID matches
a7b441a2e2 powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
c951a3be5e net_sched: fix NULL deref in fifo_set_limit()
414bb4ead1 phy: mdio: fix memory leak
b14f28126c bpf: Fix integer overflow in prealloc_elems_and_freelist()
a3d68a4245 bpf, arm: Fix register clobbering in div/mod implementation
e0c6e864d2 xtensa: call irqchip_init only when CONFIG_USE_OF is selected
d10a2a8f88 xtensa: use CONFIG_USE_OF instead of CONFIG_OF
73711563f5 xtensa: move XCHAL_KIO_* definitions to kmem_layout.h
c82cffe171 arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding
14c9c75d48 ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo
720a4dceee ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo
6b2855ac7e soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment
1179cd690a ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference
bdc189d6b6 soc: qcom: socinfo: Fixed argument passed to platform_set_data()
1a0fe45501 bpf, mips: Validate conditional branch offsets
7ed0402445 MIPS: BPF: Restore MIPS32 cBPF JIT
4239cd380a ARM: dts: qcom: apq8064: use compatible which contains chipid
30d68bf74d ARM: dts: omap3430-sdp: Fix NAND device node
2abb4077fa xen/balloon: fix cancelled balloon action
42fbcbaa8a nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
f88420197a nfsd: fix error handling of register_pernet_subsys() in init_nfsd()
fab338f33c ovl: fix missing negative dentry check in ovl_rename()
4920aae61b mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk
47f7bb3dc2 xen/privcmd: fix error handling in mmap-resource processing
9d93cfdaf8 usb: typec: tcpm: handle SRC_STARTUP state if cc changes
b53aa224ad USB: cdc-acm: fix break reporting
3135935b7f USB: cdc-acm: fix racy tty buffer accesses
7c2392f03f Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
cc109ff104 ANDROID: Different fix for KABI breakage in 5.4.151 in struct sock
17eb597c8b Merge 5.4.152 into android11-5.4-lts
faaca480fd Linux 5.4.152
caff281e20 libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
fecbe957ef silence nfscache allocation warnings with kvzalloc
5546e3987d perf/x86: Reset destroy callback on event init failure
2787cde6cb kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[]
ba58770c14 KVM: do not shrink halt_poll_ns below grow_start
d67e01e5e0 tools/vm/page-types: remove dependency on opt_file for idle page tracking
65c7e3c973 scsi: ses: Retry failed Send/Receive Diagnostic commands
e4e756054d selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn
1f830ab345 selftests: be sure to make khdr before other targets
8b9c1c33e5 usb: dwc2: check return value after calling platform_get_resource()
5d124ee0d2 usb: testusb: Fix for showing the connection speed
350d048cc5 scsi: sd: Free scsi_disk device via put_device()
4f194b5769 ext2: fix sleeping in atomic bugs on error
2d8eb45674 sparc64: fix pci_iounmap() when CONFIG_PCI is not set
61504f62bb xen-netback: correct success/error reporting for the SKB-with-fraglist case
2ecca3b282 net: mdio: introduce a shutdown method to mdio device drivers
4659036941 ANDROID: Fix up KABI breakage in 5.4.151 in struct sock
0454b0c925 Merge 5.4.151 into android11-5.4-lts
31cdcb6d43 Linux 5.4.151
965147067f HID: usbhid: free raw_report buffers in usbhid_stop
6f2f68640b netfilter: ipset: Fix oversized kvmalloc() calls
fe9bb925e7 HID: betop: fix slab-out-of-bounds Write in betop_probe
24f3d26091 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
62c5cacb09 usb: hso: remove the bailout parameter
fe57d53dd9 usb: hso: fix error handling code of hso_create_net_device
d29c7a1a32 hso: fix bailout in error case of probe
1f2b324e82 libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
dd336267d8 PCI: Fix pci_host_bridge struct device release/free handling
e81f3b7e71 net: stmmac: don't attach interface until resume finishes
f8ffde0bb9 net: udp: annotate data race around udp_sk(sk)->corkflag
9dbf7e343b HID: u2fzero: ignore incomplete packets without data
d518ea0314 ext4: fix potential infinite loop in ext4_dx_readdir()
59c19fdcde ext4: fix reserved space counter leakage
c4b8db2b47 ext4: fix loff_t overflow in ext4_max_bitmap_size()
3253c87e1e ipack: ipoctal: fix module reference leak
9c802a0574 ipack: ipoctal: fix missing allocation-failure check
3fd682d461 ipack: ipoctal: fix tty-registration error handling
e6a71c173e ipack: ipoctal: fix tty registration race
8657158a3b ipack: ipoctal: fix stack information leak
91d5de0b71 debugfs: debugfs_create_file_size(): use IS_ERR to check for error
98574c91e3 elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
9356e4dceb perf/x86/intel: Update event constraints for ICX
0fcfaa8ed9 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
694b0cee7f net: sched: flower: protect fl_walk() with rcu
5a31d4e73a net: hns3: do not allow call hns3_nic_net_open repeatedly
87de237b0b scsi: csiostor: Add module softdep on cxgb4
1b6ccfcec6 Revert "block, bfq: honor already-setup queue merges"
753096c38a selftests, bpf: test_lwt_ip_encap: Really disable rp_filter
897d1401d1 e100: fix buffer overrun in e100_get_regs
93372e02f9 e100: fix length calculation in e100_get_regs_len
a2624e0934 net: ipv4: Fix rtnexthop len when RTA_FLOW is present
c37d3287e7 hwmon: (tmp421) fix rounding for negative values
8a07d5aba3 hwmon: (tmp421) report /PVLD condition as fault
ec018021cf sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
9bee85de2c mac80211-hwsim: fix late beacon hrtimer handling
21c3a84493 mac80211: mesh: fix potentially unaligned access
ab85997465 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
87e06c4428 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
a6c42ae153 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
2c30592255 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
9a571d83ac drm/amd/display: Pass PCI deviceid into DC
3443eb443f x86/kvmclock: Move this_cpu_pvti into kvmclock.h
50149e0866 mac80211: fix use-after-free in CCMP/GCMP RX
956bc3ee31 scsi: ufs: Fix illegal offset in UPIU event trace
44d3c480e4 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
200ced5ba7 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
6cb01fe630 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
504cf969d5 fs-verity: fix signed integer overflow with i_size near S64_MAX
b2fb6ce06c usb: cdns3: fix race condition before setting doorbell
e2370e1935 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
67c98e0231 cpufreq: schedutil: Use kobject release() method to free sugov_tunables
883f7897a2 tty: Fix out-of-bound vmalloc access in imageblit
ec298edf02 Merge 5.4.150 into android11-5.4-lts
2abce4ec2a Merge 5.4.149 into android11-5.4-lts
5785e5360a Revert "crypto: public_key: fix overflow during implicit conversion"
3a7dc5b4cf Linux 5.4.150
27f8c4402c qnx4: work around gcc false positive warning bug
3a0f951e37 xen/balloon: fix balloon kthread freezing
f80b679381 arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
04783de9c0 thermal/drivers/int340x: Do not set a wrong tcc offset on resume
de1c350680 EDAC/synopsys: Fix wrong value type assignment for edac_mode
8ede848bc9 spi: Fix tegra20 build with CONFIG_PM=n
d193f7dbf4 net: 6pack: Fix tx timeout and slot time
fa56f2c987 alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
af4a142ab7 arm64: Mark __stack_chk_guard as __ro_after_init
aeb19da46c parisc: Use absolute_pointer() to define PAGE0
8cd34eb616 qnx4: avoid stringop-overread errors
1214ace614 sparc: avoid stringop-overread errors
113a8edfb9 net: i825xx: Use absolute_pointer for memcpy from fixed memory location
2397ea2db2 compiler.h: Introduce absolute_pointer macro
d12ddd843f blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
9d77988232 sparc32: page align size in arch_dma_alloc
ec49f3f7f6 nvme-multipath: fix ANA state updates when a namespace is not present
29917bbb07 xen/balloon: use a kernel thread instead a workqueue
93937596e0 bpf: Add oversize check before call kvcalloc()
7273cb182f ipv6: delay fib6_sernum increase in fib6_add
7432ecc55f m68k: Double cast io functions to unsigned long
29c70b0d33 net: stmmac: allow CSR clock of 300MHz
1da750d1e2 net: macb: fix use after free on rmmod
ebb8d26d93 blktrace: Fix uaf in blk_trace access after removing by sysfs
2b5befcd40 md: fix a lock order reversal in md_alloc
42d3711c23 irqchip/gic-v3-its: Fix potential VPE leak on error
71f323f605 irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build
1b59625da6 scsi: lpfc: Use correct scnprintf() limit
30d373dc35 scsi: qla2xxx: Restore initiator in dual mode
d140ccb140 cifs: fix a sign extension bug
1c1062c5cf thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
b869901cab fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
0ebc3e688f fpga: machxo2-spi: Return an error on failure
5bcead7cde tty: synclink_gt: rename a conflicting function name
c5f27aedf6 tty: synclink_gt, drop unneeded forward declarations
1deb94d37a scsi: iscsi: Adjust iface sysfs attr detection
d0f4a2eeeb net/mlx4_en: Don't allow aRFS for encapsulated packets
ae7b957ef0 qed: rdma - don't wait for resources under hw error recovery flow
23716d7153 gpio: uniphier: Fix void functions to remove return value
f7fb7dbdfb net/smc: add missing error check in smc_clc_prfx_set()
363438ed5d bnxt_en: Fix TX timeout when TX ring size is set to the smallest
4c4c305291 enetc: Fix illegal access when reading affinity_hint
cf9138c966 platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR()
a8e8b14819 afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation
acce91ba0d net: hso: fix muxed tty registration
494260e20a serial: mvebu-uart: fix driver's tx_empty callback
2d7c20db72 xhci: Set HCD flag to defer primary roothub registration
381c8ce0ab btrfs: prevent __btrfs_dump_space_info() to underflow its free space
d4ec140e71 erofs: fix up erofs_lookup tracepoint
7751f609ea mcb: fix error handling in mcb_alloc_bus()
406ff5bf72 USB: serial: option: add device id for Foxconn T99W265
4b2cf0faff USB: serial: option: remove duplicate USB device ID
59564b0183 USB: serial: option: add Telit LN920 compositions
5cc674a3f1 USB: serial: mos7840: remove duplicated 0xac24 device ID
20c9fdde30 usb: core: hcd: Add support for deferring roothub registration
a6c7d3c2d1 Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
4dc56951a8 staging: greybus: uart: fix tty use after free
aa2c274c27 binder: make sure fd closes complete
93fa08e9a3 USB: cdc-acm: fix minor-number release
0dc1cfa7b9 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
85d3493085 usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
d4e7647695 xen/x86: fix PV trap handling on secondary processors
8b06b0f17f cifs: fix incorrect check for null pointer in header_assemble
b1f6efa27b usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
b8c8060651 usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA
ff275c870e usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave
f013a5001b usb: gadget: r8a66597: fix a loop in set_feature()
aa40438c71 ocfs2: drop acl cache for directories too
e74e2950a0 Linux 5.4.149
3825263486 drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
409cb0b3d4 rtc: rx8010: select REGMAP_I2C
43832bf763 blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
c37a34d797 pwm: stm32-lp: Don't modify HW state in .remove() callback
8a29e68ea8 pwm: rockchip: Don't modify HW state in .remove() callback
ed60d2db31 pwm: img: Don't modify HW state in .remove() callback
b16f4acf6b nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
594addd436 nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
237ca37ca5 nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
288c8b5ba5 nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
dc70f0c8c3 nilfs2: fix NULL pointer in nilfs_##name##_attr_release
9c3ba40488 nilfs2: fix memory leak in nilfs_sysfs_create_device_group
fb4c7d2923 btrfs: fix lockdep warning while mounting sprout fs
3f2d5c11be ceph: lockdep annotations for try_nonblocking_invalidate
3bbb11261a ceph: request Fw caps before updating the mtime in ceph_write_iter
2c89a856fa dmaengine: xilinx_dma: Set DMA mask for coherent APIs
2f3206199d dmaengine: ioat: depends on !UML
644f1e87fe dmaengine: sprd: Add missing MODULE_DEVICE_TABLE
445a3379f6 parisc: Move pci_dev_is_behind_card_dino to where it is used
2f7bfc07e3 drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
a12743d072 thermal/core: Fix thermal_cooling_device_register() prototype
c7b9a866ee Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH
3c1d9b650c net: stmmac: reset Tx desc base address before restarting Tx
729f9d5ee3 phy: avoid unnecessary link-up delay in polling mode
81e6b51709 pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
b94def8a47 profiling: fix shift-out-of-bounds bugs
7e98111cb2 nilfs2: use refcount_dec_and_lock() to fix potential UAF
5607b1bae1 prctl: allow to setup brk for et_dyn executables
b40301607c 9p/trans_virtio: Remove sysfs file on probe failure
c3b45ea0a3 thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
e106080303 dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
93f8a98ad8 um: virtio_uml: fix memory leak on init failures
4cd05e390a staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb()
2f4b67bceb sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
cbd10b1189 sctp: validate chunk size in __rcv_asconf_lookup
6a12918e90 ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE
2f7974cd7b ARM: 9079/1: ftrace: Add MODULE_PLTS support
1b27a03d12 ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()
490be340c8 ARM: 9077/1: PLT: Move struct plt_entries definition to header
278df06460 apparmor: remove duplicate macro list_entry_is_head()
f23763ab46 ARM: Qualify enabling of swiotlb_init()
6bfdc3056c s390/pci_mmio: fully validate the VMA before calling follow_pte()
bd292c6873 console: consume APC, DM, DCS
b0c813fbbf KVM: remember position in kvm->vcpus array
5163578e9d PCI/ACPI: Add Ampere Altra SOC MCFG quirk
ec29e33e5c PCI: aardvark: Fix reporting CRS value
3f0e275e43 PCI: pci-bridge-emul: Add PCIe Root Capabilities Register
296895c4f0 PCI: aardvark: Indicate error in 'val' when config read fails
2fcb7b7a1d PCI: pci-bridge-emul: Fix big-endian support
c4f92aff87 Merge 5.4.148 into android11-5.4-lts
07e5f23d3f Linux 5.4.148
54ac8339ae s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant
a5fc48000b s390/bpf: Fix optimizing out zero-extensions
f7f1bac898 net: renesas: sh_eth: Fix freeing wrong tx descriptor
3d32ce5472 ip_gre: validate csum_start only on pull
f9b308f730 qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
93f54354cc fq_codel: reject silly quantum parameters
d448b240b1 netfilter: socket: icmp6: fix use-after-scope
b79204169d net: dsa: b53: Fix calculating number of switch ports
d5c0f016ae perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}
114bf5776f ARC: export clear_user_page() for modules
9b63c27d6b mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
14e0fdc43d PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
810f9b6f0a KVM: arm64: Handle PSCI resets before userspace touches vCPU state
5f289dcf0b mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
e1746c27c3 PCI: Fix pci_dev_str_match_path() alloc while atomic bug
beaf65f0fe mfd: axp20x: Update AXP288 volatile ranges
4a6c7c818b NTB: perf: Fix an error code in perf_setup_inbuf()
5a16141949 NTB: Fix an error code in ntb_msit_probe()
0980697969 ethtool: Fix an error code in cxgb2.c
f336aa92b4 PCI: ibmphp: Fix double unmap of io_mem
0f9550c4f4 block, bfq: honor already-setup queue merges
b61a99dda3 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
79b584d859 Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6
cf4168c4e0 PCI: Add ACS quirks for Cavium multi-function devices
b3435cd968 tracing/probes: Reject events which have the same name of existing one
32280649f0 mfd: Don't use irq_create_mapping() to resolve a mapping
e904621ae0 fuse: fix use after free in fuse_read_interrupt()
a1eaaa6b7d PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
47c4490617 mfd: db8500-prcmu: Adjust map to reality
88834a6253 dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
8656566821 mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
d291cca2c4 net: hns3: fix the timing issue of VF clearing interrupt sources
65bcb8f73a net: hns3: disable mac in flr process
d8fe64c351 net: hns3: change affinity_mask to numa node range
dede0381da net: hns3: pad the short tunnel frame before sending to hardware
4bf2c9605d KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers
235f782d5e ibmvnic: check failover_pending in login response
d3939844eb dt-bindings: arm: Fix Toradex compatible typo
c642afd17a qed: Handle management FW error
9ebbb8b964 tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
baf4504771 net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup
498e765b85 net/af_unix: fix a data-race in unix_dgram_poll
e7332a1ac1 vhost_net: fix OoB on sendmsg() failure.
172749c879 events: Reuse value read using READ_ONCE instead of re-reading it
cd78d9c996 net/mlx5: Fix potential sleeping in atomic context
48e79555c2 net/mlx5: FWTrace, cancel work on alloc pd error flow
4655f8a5af perf machine: Initialize srcline string member in add_location struct
6808e70a77 tipc: increase timeout in tipc_sk_enqueue()
678787dcfe r6040: Restore MDIO clock frequency after MAC reset
efe35db948 net/l2tp: Fix reference count leak in l2tp_udp_recv_core
5ab04a4ffe dccp: don't duplicate ccid when cloning dccp sock
6c4b7a87ba ptp: dp83640: don't define PAGE0
faf9d46542 net-caif: avoid user-triggerable WARN_ON(1)
79ab38864d tipc: fix an use-after-free issue in tipc_recvmsg
08f33350ed x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
fde4caf6fe s390/sclp: fix Secure-IPL facility detection
15b674b1e5 drm/etnaviv: add missing MMU context put when reaping MMU mapping
b2ec1e6f1d drm/etnaviv: reference MMU context when setting up hardware state
5827dbac41 drm/etnaviv: fix MMU context leak on GPU reset
5e67b38435 drm/etnaviv: exec and MMU state is lost when resetting the GPU
7068030d5e drm/etnaviv: keep MMU context across runtime suspend/resume
a7970d4f00 drm/etnaviv: stop abusing mmu_context as FE running marker
ee52ccecfe drm/etnaviv: put submit prev MMU context when it exists
a9bacefda0 drm/etnaviv: return context from etnaviv_iommu_context_get
b56b6c51a9 drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10
c221eb008a PCI: Add AMD GPU multi-function power dependencies
d180a373a0 PM: base: power: don't try to use non-existing RTC for storing data
484fbe9cc0 arm64/sve: Use correct size when reinitialising SVE state
2f72542033 bnx2x: Fix enabling network interfaces without VFs
66c88a4793 xen: reset legacy rtc flag for PV domU
c7fab1f536 btrfs: fix upper limit for max_inline for page size 64K
b9cc70e3dc drm/panfrost: Clamp lock region to Bifrost minimum
9a6c885489 drm/panfrost: Use u64 for size in lock_region
6c635129bf drm/panfrost: Simplify lock_region calculation
825ba38dfd drm/amdgpu: Fix BUG_ON assert
d7a936da63 drm/msi/mdp4: populate priv->kms in mdp4_kms_init
90358cb02a net: dsa: lantiq_gswip: fix maximum frame length
c1f12f440c lib/test_stackinit: Fix static initializer test
3c232895b8 platform/chrome: cros_ec_proto: Send command again when timeout occurs
0569920e43 memcg: enable accounting for pids in nested pid namespaces
d0ddb80bbf mm,vmscan: fix divide by zero in get_scan_count
22b11dbbf9 mm/hugetlb: initialize hugetlb_usage in mm_init
1dc6df795c s390/pv: fix the forcing of the swiotlb
f3b57cf090 cpufreq: powernv: Fix init_chip_info initialization in numa=off
b5eb54c4a9 scsi: qla2xxx: Sync queue idx with queue_pair_map idx
f499a9e9ed scsi: qla2xxx: Changes to support kdump kernel
cfa4591328 scsi: BusLogic: Fix missing pr_cont() use
a701ae9a0d ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
1a2f728b03 parisc: fix crash with signals and alloca
76bebc93e1 net: w5100: check return value after calling platform_get_resource()
3179dd79db fix array-index-out-of-bounds in taprio_change
ef9a7867b2 net: fix NULL pointer reference in cipso_v4_doi_free
88a4ed85e8 ath9k: fix sleeping in atomic context
99b950d55e ath9k: fix OOB read ar9300_eeprom_restore_internal
5f70ea4a5c parport: remove non-zero check on count
c30ea33b03 net/mlx5: DR, Enable QP retransmission
c9095f788d iwlwifi: mvm: fix access to BSS elements
f950996d64 iwlwifi: mvm: avoid static queue number aliasing
2db5ae5b28 iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed
3da13a1e2a drm/amdkfd: Account for SH/SE count when setting up cu masks.
2af60889c8 ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
98381f840f ASoC: rockchip: i2s: Fix regmap_ops hang
a1c7bc02e1 usbip:vhci_hcd USB port can get stuck in the disabled state
4f6095b0c9 usbip: give back URBs for unsent unlink requests during cleanup
9a4a680529 usb: musb: musb_dsps: request_irq() after initializing musb
d24381e5a7 Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
aa40cf19bf cifs: fix wrong release in sess_alloc_buffer() failed path
39111cbb7b mmc: core: Return correct emmc response in case of ioctl error
26f55b60f2 selftests/bpf: Enlarge select() timeout for test_maps
48f5a5f027 mmc: rtsx_pci: Fix long reads when clock is prescaled
4e773c5553 mmc: sdhci-of-arasan: Check return value of non-void funtions
a73bbfabfe of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
2fdf7d38ee ASoC: Intel: Skylake: Fix passing loadable flag for module
f6ff4d5609 ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER
736f60bd48 btrfs: tree-log: check btrfs_lookup_data_extent return value
53a72858bc m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch
3710cff57d drm/exynos: Always initialize mapping in exynos_drm_register_dma()
727c973ffe lockd: lockd server-side shouldn't set fl_ops
a18cfd715e usb: chipidea: host: fix port index underflow and UBSAN complains
8deedce385 gfs2: Don't call dlm after protocol is unmounted
50cf8f1b6c staging: rts5208: Fix get_ms_information() heap buffer size
8dfd785ae1 rpc: fix gss_svc_init cleanup on failure
0bc818e023 tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
2918eca497 serial: sh-sci: fix break handling for sysrq
d02a1c5fd7 opp: Don't print an error if required-opps is missing
d772d993b0 Bluetooth: Fix handling of LE Enhanced Connection Complete
fb8593e8ed nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data
072660f6c6 arm64: dts: ls1046a: fix eeprom entries
08825a784e arm64: tegra: Fix compatible string for Tegra132 CPUs
a6b69a76c3 ARM: tegra: tamonten: Fix UART pad setting
a66049c5ff mac80211: Fix monitor MTU limit so that A-MSDUs get through
1e2842fb7e drm/display: fix possible null-pointer dereference in dcn10_set_clock()
cf82fe45be gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
bbaa21da55 net/mlx5: Fix variable type to match 64bit
0d563020b8 Bluetooth: avoid circular locks in sco_sock_connect
37d7ae2b05 Bluetooth: schedule SCO timeouts with delayed_work
c408efcb8a selftests/bpf: Fix xdp_tx.c prog section name
350e7501ee drm/msm: mdp4: drop vblank get/put from prepare/complete_commit
e545080477 net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
ed3400f22b arm64: dts: qcom: sdm660: use reg value for memory node
52f8a30730 ARM: dts: imx53-ppd: Fix ACHC entry
e15afa6747 media: tegra-cec: Handle errors of clk_prepare_enable()
53d02b0409 media: TDA1997x: fix tda1997x_query_dv_timings() return value
71de2779e5 media: v4l2-dv-timings.c: fix wrong condition in two for-loops
d785cef384 media: imx258: Limit the max analogue gain to 480
33bd83fe3f media: imx258: Rectify mismatch of VTS value
8d179746b3 ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
37414bd6ec arm64: tegra: Fix Tegra194 PCIe EP compatible string
5a24034ad8 bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
b6cee35839 workqueue: Fix possible memory leaks in wq_numa_init()
9b4f0170e0 Bluetooth: skip invalid hci_sync_conn_complete_evt
7b1718666f ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
76cbc142a5 samples: bpf: Fix tracex7 error raised on the missing argument
917eb0bbb8 staging: ks7010: Fix the initialization of the 'sleep_status' structure
44fd61a8bd serial: 8250_pci: make setup_port() parameters explicitly unsigned
4beadefea8 hvsi: don't panic on tty_register_driver failure
af0bd97b9d xtensa: ISS: don't panic in rs_init
5418023f81 serial: 8250: Define RX trigger levels for OxSemi 950 devices
b050848bba s390: make PCI mio support a machine flag
0dd8da8ad0 s390/jump_label: print real address in a case of a jump label bug
91b4d44c7c flow_dissector: Fix out-of-bounds warnings
8076709052 ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
faf0749c90 video: fbdev: riva: Error out if 'pixclock' equals zero
ae0d210aa7 video: fbdev: kyro: Error out if 'pixclock' equals zero
98551f0a7b video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
9dff06c505 bpf/tests: Do not PASS tests without actually testing the result
58831317c9 bpf/tests: Fix copy-and-paste error in double word test
a23430e79e drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
9baa552b2f drm/amd/display: Fix timer_per_pixel unit error
6c78ee1aec tty: serial: jsm: hold port lock when reporting modem line changes
7993ee1733 staging: board: Fix uninitialized spinlock when attaching genpd
995567ded0 usb: gadget: composite: Allow bMaxPower=0 if self-powered
44bbd4e636 USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable()
7b96de5c30 usb: gadget: u_ether: fix a potential null pointer dereference
e1480bcb40 usb: host: fotg210: fix the actual_length of an iso packet
33109bdf2c usb: host: fotg210: fix the endpoint's transactional opportunities calculation
b190fdb93a igc: Check if num of q_vectors is smaller than max before array access
f4bf2fdfe3 drm: avoid blocking in drm_clients_info's rcu section
a1d12196c3 Smack: Fix wrong semantics in smk_access_entry()
c454b1a215 netlink: Deal with ESRCH error in nlmsg_notify()
5adbbb27bb video: fbdev: kyro: fix a DoS bug by restricting user input
4ee6cc0f52 ARM: dts: qcom: apq8064: correct clock names
b9707a9504 iavf: fix locking of critical sections
35429d3aa3 iavf: do not override the adapter state in the watchdog task
ab03f15c1d iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
0de0c16739 tipc: keep the skb in rcv queue until the whole data is read
fe14f10c07 PCI: Use pci_update_current_state() in pci_enable_device_flags()
7d35690974 crypto: mxs-dcp - Use sg_mapping_iter to copy data
80bec14b4e media: dib8000: rewrite the init prbs logic
4cab14bcff ASoC: atmel: ATMEL drivers don't need HAS_DMA
4a7c6e9159 drm/amdgpu: Fix amdgpu_ras_eeprom_init()
d766826eee userfaultfd: prevent concurrent API initialization
7bf2913a5b kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y
0ac2ecb915 MIPS: Malta: fix alignment of the devicetree buffer
debdff9600 f2fs: fix to unmap pages from userspace process in punch_hole()
1c28c23dc8 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks()
1ca5b00782 f2fs: fix to account missing .skipped_gc_rwsem
ec5cab3798 KVM: PPC: Fix clearing never mapped TCEs in realmode
e46ce5a8ab clk: at91: clk-generated: Limit the requested rate to our range
557f6445e3 clk: at91: clk-generated: pass the id of changeable parent at registration
d93a37889e clk: at91: sam9x60: Don't use audio PLL
57188e2cac fscache: Fix cookie key hashing
e2e3758a2c platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
ba5d4dc003 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live
a02309beb2 HID: i2c-hid: Fix Elan touchpad regression
f934961bf4 scsi: target: avoid per-loop XCOPY buffer allocations
389946024f powerpc/config: Renable MTD_PHYSMAP_OF
db16408d52 scsi: qedf: Fix error codes in qedf_alloc_global_queues()
5e56c8d843 scsi: qedi: Fix error codes in qedi_alloc_global_queues()
a90ef02f01 scsi: smartpqi: Fix an error code in pqi_get_raid_map()
3365d41c04 pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
ef476b8d5a scsi: fdomain: Fix error return code in fdomain_probe()
9ee7b45edd SUNRPC: Fix potential memory corruption
be09cbd6a3 dma-debug: fix debugfs initialization order
9315497b17 openrisc: don't printk() unconditionally
f56ee9af23 f2fs: reduce the scope of setting fsck tag when de->name_len is zero
2a2afb6d26 f2fs: show f2fs instance in printk_ratelimited
25ed049891 RDMA/efa: Remove double QP type assignment
b8bb4b2839 powerpc/stacktrace: Include linux/delay.h
02889ac588 vfio: Use config not menuconfig for VFIO_NOIOMMU
b900cc4816 pinctrl: samsung: Fix pinctrl bank pin count
e69c283621 docs: Fix infiniband uverbs minor number
fb42b9801e RDMA/iwcm: Release resources if iw_cm module initialization fails
7930b1f98d IB/hfi1: Adjust pkey entry in index 0
2b1addd585 scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND
a02982545e f2fs: quota: fix potential deadlock
bd74d6de0b HID: input: do not report stylus battery state as "full"
0656eb5e7e PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
2b58db229e PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
0f39f8429c PCI: aardvark: Fix checking for PIO status
d810fa6f5f PCI: xilinx-nwl: Enable the clock through CCF
d43ad02ad3 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
3aa6d023c6 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
4d2bc69df9 PCI/portdrv: Enable Bandwidth Notification only if port supports it
0445da50b7 ARM: 9105/1: atags_to_fdt: don't warn about stack size
8ec08f1431 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
7cfbf391e8 dmaengine: imx-sdma: remove duplicated sdma_load_context
788122c99d Revert "dmaengine: imx-sdma: refine to load context only once"
86e1abcd14 media: rc-loopback: return number of emitters rather than error
9d91046f6b media: uvc: don't do DMA on stack
1ccb1fa41f VMCI: fix NULL pointer dereference when unmapping queue pair
80d1675903 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
a6d4ac3f86 power: supply: max17042: handle fails of reading status register
668370dd4c block: bfq: fix bfq_set_next_ioprio_data()
cfdd25cd42 crypto: public_key: fix overflow during implicit conversion
3411b481ed arm64: head: avoid over-mapping in map_memory
991b64b89b soc: aspeed: p2a-ctrl: Fix boundary check for mmap
2712f29c44 soc: aspeed: lpc-ctrl: Fix boundary check for mmap
24c245de17 soc: qcom: aoss: Fix the out of bound usage of cooling_devs
603dbb1fa2 pinctrl: ingenic: Fix incorrect pull up/down info
eda59ca42f pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast
d4acec5e94 tools/thermal/tmon: Add cross compiling support
8a964aa6ed 9p/xen: Fix end of loop tests for list_for_each_entry
7d81fcc203 include/linux/list.h: add a macro to test if entry is pointing to the head
4bc0d1b535 xen: fix setting of max_pfn in shared_info
27f3b7f5c6 powerpc/perf/hv-gpci: Fix counter value parsing
7e9e6d0e07 PCI/MSI: Skip masking MSI-X on Xen PV
2edc06fa38 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
8da22cc41a blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
cd7b39e7c4 btrfs: reset replace target device to allocation state on close
8554095328 btrfs: wake up async_delalloc_pages waiters after submit
d609c63a71 rtc: tps65910: Correct driver module alias
4076dc42c4 Merge branch 'android11-5.4' into 'android11-5.4-lts'
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idd628e993b6566952e119bfe31f4c8fe87d818a8
The "PAGE_SIZE - 2 - size" calculation in legacy_parse_param() is an
unsigned type so a large value of "size" results in a high positive
value instead of a negative value as expected. Fix this by getting rid
of the subtraction.
Signed-off-by: Jamie Hill-Daniel <jamie@hill-daniel.co.uk>
Signed-off-by: William Liu <willsroot@protonmail.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 722d94847de29310e8aa03fcbdb41fc92c521756)
Bug: 213421437
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ica4c894715daae0d4393a377ac3e81260a651df9
e820__mapped_all() is passed as a callback to is_mmconf_reserved(),
which expects a function of type:
typedef bool (*check_reserved_t)(u64 start, u64 end, unsigned type);
However, e820__mapped_all() accepts enum e820_type as the last argument
and this type mismatch trips indirect call checking with Clang's
Control-Flow Integrity (CFI).
As is_mmconf_reserved() only passes enum e820_type values for the
type argument, change the typedef and the unused type argument in
is_acpi_reserved() to enum e820_type to fix the type mismatch.
Bug: 210705746
(cherry picked from commit 83321c335dccba262a57378361d63da96b8166d6)
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Suggested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20201130193900.456726-1-samitolvanen@google.com
Change-Id: I92f78710ac55d5f567ad73053fc9f8c7cef68f71
(cherry picked from commit 7d1d5848183bd1d9086d0572f9af431d3ded407f)
Szymon rightly pointed out that the previous check for the endpoint
direction in bRequestType was not looking at only the bit involved, but
rather the whole value. Normally this is ok, but for some request
types, bits other than bit 8 could be set and the check for the endpoint
length could not stall correctly.
Fix that up by only checking the single bit.
Fixes: 153a2d7e3350 ("USB: gadget: detect too-big endpoint 0 requests")
Cc: Felipe Balbi <balbi@kernel.org>
Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20211214184621.385828-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f08adf5add9a071160c68bb2a61d697f39ab0758
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Bug: 210292376
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7e708b2b94433009c87f697346e0515d93454f48
commit 50252e4b5e989ce64555c7aef7516bdefc2fea72 upstream.
signalfd_poll() and binder_poll() are special in that they use a
waitqueue whose lifetime is the current task, rather than the struct
file as is normally the case. This is okay for blocking polls, since a
blocking poll occurs within one task; however, non-blocking polls
require another solution. This solution is for the queue to be cleared
before it is freed, by sending a POLLFREE notification to all waiters.
Unfortunately, only eventpoll handles POLLFREE. A second type of
non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't
handle POLLFREE. This allows a use-after-free to occur if a signalfd or
binder fd is polled with aio poll, and the waitqueue gets freed.
Fix this by making aio poll handle POLLFREE.
A patch by Ramji Jiyani <ramjiyani@google.com>
(https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com)
tried to do this by making aio_poll_wake() always complete the request
inline if POLLFREE is seen. However, that solution had two bugs.
First, it introduced a deadlock, as it unconditionally locked the aio
context while holding the waitqueue lock, which inverts the normal
locking order. Second, it didn't consider that POLLFREE notifications
are missed while the request has been temporarily de-queued.
The second problem was solved by my previous patch. This patch then
properly fixes the use-after-free by handling POLLFREE in a
deadlock-free way. It does this by taking advantage of the fact that
freeing of the waitqueue is RCU-delayed, similar to what eventpoll does.
Fixes: 2c14fa838c ("aio: implement IOCB_CMD_POLL")
Cc: <stable@vger.kernel.org> # v4.18+
Link: https://lore.kernel.org/r/20211209010455.42744-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I87b4b20981f4283b15d51c48c8e422fcf0612ba8
commit 363bee27e25804d8981dd1c025b4ad49dc39c530 upstream.
Currently, aio_poll_wake() will always remove the poll request from the
waitqueue. Then, if aio_poll_complete_work() sees that none of the
polled events are ready and the request isn't cancelled, it re-adds the
request to the waitqueue. (This can easily happen when polling a file
that doesn't pass an event mask when waking up its waitqueue.)
This is fundamentally broken for two reasons:
1. If a wakeup occurs between vfs_poll() and the request being
re-added to the waitqueue, it will be missed because the request
wasn't on the waitqueue at the time. Therefore, IOCB_CMD_POLL
might never complete even if the polled file is ready.
2. When the request isn't on the waitqueue, there is no way to be
notified that the waitqueue is being freed (which happens when its
lifetime is shorter than the struct file's). This is supposed to
happen via the waitqueue entries being woken up with POLLFREE.
Therefore, leave the requests on the waitqueue until they are actually
completed (or cancelled). To keep track of when aio_poll_complete_work
needs to be scheduled, use new fields in struct poll_iocb. Remove the
'done' field which is now redundant.
Note that this is consistent with how sys_poll() and eventpoll work;
their wakeup functions do *not* remove the waitqueue entries.
Fixes: 2c14fa838c ("aio: implement IOCB_CMD_POLL")
Cc: <stable@vger.kernel.org> # v4.18+
Link: https://lore.kernel.org/r/20211209010455.42744-5-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib42bf5a65b2e21f15ae3f223f8949719c8ffeea5
commit 9537bae0da1f8d1e2361ab6d0479e8af7824e160 upstream.
wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up
all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll
and aio poll are fortunately not affected by this, but it's very
fragile. Thus, the new function wake_up_pollfree() has been introduced.
Convert signalfd to use wake_up_pollfree().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: d80e731eca ("epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2534cce4e3d5be1b439b01eb8717903e08bb8e65
commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream.
wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up
all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll
and aio poll are fortunately not affected by this, but it's very
fragile. Thus, the new function wake_up_pollfree() has been introduced.
Convert binder to use wake_up_pollfree().
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0f08d9f9a40348d7d2381607fabe3648416ab2a2
commit 42288cb44c4b5fff7653bc392b583a2b8bd6a8c0 upstream.
Several ->poll() implementations are special in that they use a
waitqueue whose lifetime is the current task, rather than the struct
file as is normally the case. This is okay for blocking polls, since a
blocking poll occurs within one task; however, non-blocking polls
require another solution. This solution is for the queue to be cleared
before it is freed, using 'wake_up_poll(wq, EPOLLHUP | POLLFREE);'.
However, that has a bug: wake_up_poll() calls __wake_up() with
nr_exclusive=1. Therefore, if there are multiple "exclusive" waiters,
and the wakeup function for the first one returns a positive value, only
that one will be called. That's *not* what's needed for POLLFREE;
POLLFREE is special in that it really needs to wake up everyone.
Considering the three non-blocking poll systems:
- io_uring poll doesn't handle POLLFREE at all, so it is broken anyway.
- aio poll is unaffected, since it doesn't support exclusive waits.
However, that's fragile, as someone could add this feature later.
- epoll doesn't appear to be broken by this, since its wakeup function
returns 0 when it sees POLLFREE. But this is fragile.
Although there is a workaround (see epoll), it's better to define a
function which always sends POLLFREE to all waiters. Add such a
function. Also make it verify that the queue really becomes empty after
all waiters have been woken up.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 185125206
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1ec70169a39be42640172af512f4b47827ef5569
Under some conditions, USB gadget devices can show allocated buffer
contents to a host. Fix this up by zero-allocating them so that any
extra data will all just be zeros.
Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Tested-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3)
Bug: 210292367
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I72b4376cd4296a8b8af0ade2d702cd420146f3aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Sometimes USB hosts can ask for buffers that are too large from endpoint
0, which should not be allowed. If this happens for OUT requests, stall
the endpoint, but for IN requests, trim the request size to the endpoint
buffer size.
Co-developed-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 153a2d7e3350cc89d406ba2d35be8793a64c2038)
Bug: 210292367
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9bbd6154177d7a1fb6c2e3a3dffa96634d85bb7f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux. However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7908d6af9e70865a6db17fac75624064165449ad
The wacom driver accepts devices of more than just USB types, but some
code paths can cause problems if the device being controlled is not a
USB device due to a lack of checking. Add the needed checks to ensure
that the USB device accesses are only happening on a "real" USB device,
and not one on some other bus.
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-2-gregkh@linuxfoundation.org
(cherry picked from commit 720ac467204a70308bd687927ed475afb904e11b)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I605a7a3598b54693ce2104d4afdbdf879bb7fb2e
When emulating the device through uhid, there is a chance we don't have
output reports and so report_field is null.
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20211202095334.14399-3-benjamin.tissoires@redhat.com
(cherry picked from commit 918aa1ef104d286d16b9e7ef139a463ac7a296f0)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia6fb77a7bd9426ce055e090fb2c1f3a21a2011cc
commit f237d9028f844a86955fc9da59d7ac4a5c55d7d5 upstream.
Some HID drivers are only for USB drivers, yet did not depend on
CONFIG_USB_HID. This was hidden by the fact that the USB functions were
stubbed out in the past, but now that drivers are checking for USB
devices properly, build errors can occur with some random
configurations.
Reported-by: kernel test robot <lkp@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211202114819.2511954-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f237d9028f844a86955fc9da59d7ac4a5c55d7d5)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia755dc2803f1111c33d1c4b06b02913eebdf34c0
The chicony HID driver only controls USB devices, yet did not have a
dependancy on USB_HID. This causes build errors on some configurations
like sparc when building due to new changes to the chicony driver.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: stable@vger.kernel.org
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211203075927.2829218-1-gregkh@linuxfoundation.org
(cherry picked from commit d080811f27936f712f619f847389f403ac873b8f)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic65d7879192eb876683d13eb18628dd0f4594e98
The prodikeys HID driver only controls USB devices, yet did not have a
dependancy on USB_HID. This causes build errors on some configurations
like nios2 when building due to new changes to the prodikeys driver.
Reported-by: kernel test robot <lkp@intel.com>
Cc: stable@vger.kernel.org
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211203081231.2856936-1-gregkh@linuxfoundation.org
(cherry picked from commit 30cb3c2ad24b66fb7639a6d1f4390c74d6e68f94)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifbff6c7522a684fab6974565570a92e61651ae0a
A number of HID drivers already call hid_is_using_ll_driver() but only
for the detection of if this is a USB device or not. Make this more
obvious by creating hid_is_usb() and calling the function that way.
Also converts the existing hid_is_using_ll_driver() functions to use the
new call.
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f83baa0cb6cfc92ebaf7f9d3a99d7e34f2e77a8a)
Bug: 188677105
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibfa4252d4b6501a09a997bb9efbab46fae3fd1dc
If there is page fault only for read case on inline inode, we don't need
to convert inline inode, instead, let's do conversion for write case.
Bug: 208371174
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 58c3b33eb9f1)
Change-Id: I68168bc08a77d8d8f039189d44d23f83a7eda1f5
Given RO feature in superblock, we don't need to check provisioning/reserve
spaces and SSA area.
Bug: 208371174
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 60bad8157831)
Change-Id: I2ec5fda15948bb17bd34b3b1c3efc356f527b515
Meta area is not included in section_count computation.
So the minimum number of total_sections is 1 meanwhile it cannot be
greater than segment_count_main.
The minimum number of meta segments is 8 (SB + 2 (CP + SIT + NAT) + SSA).
Bug: 208371174
Signed-off-by: Wang Xiaojun <wangxiaojun11@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 56faf97ebce8)
Change-Id: I36a97300e13bd760c29958bc36d85b441dd40eaa
Currently cgroup freezer is used to freeze the application threads, and
BINDER_FREEZE is used to freeze the corresponding binder interface.
There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any
existing transactions to drain out before actually freezing the binder
interface.
But freezing an app requires 2 steps, freezing the binder interface with
ioctl(BINDER_FREEZE) and then freezing the application main threads with
cgroupfs. This is not an atomic operation. The following race issue
might happen.
1) Binder interface is frozen by ioctl(BINDER_FREEZE);
2) Main thread A initiates a new sync binder transaction to process B;
3) Main thread A is frozen by "echo 1 > cgroup.freeze";
4) The response from process B reaches the frozen thread, which will
unexpectedly fail.
This patch provides a mechanism to check if there's any new pending
transaction happening between ioctl(BINDER_FREEZE) and freezing the
main thread. If there's any, the main thread freezing operation can
be rolled back to finish the pending transaction.
Furthermore, the response might reach the binder driver before the
rollback actually happens. That will still cause failed transaction.
As the other process doesn't wait for another response of the response,
the response transaction failure can be fixed by treating the response
transaction like an oneway/async one, allowing it to reach the frozen
thread. And it will be consumed when the thread gets unfrozen later.
NOTE: This patch reuses the existing definition of struct
binder_frozen_status_info but expands the bit assignments of __u32
member sync_recv.
To ensure backward compatibility, bit 0 of sync_recv still indicates
there's an outstanding sync binder transaction. This patch adds new
information to bit 1 of sync_recv, indicating the binder transaction
happens exactly when there's a race.
If an existing userspace app runs on a new kernel, a sync binder call
will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still
return the expected value (true). The app just doesn't check bit 1
intentionally so it doesn't have the ability to tell if there's a race.
This behavior is aligned with what happens on an old kernel which
doesn't set bit 1 at all.
A new userspace app can 1) check bit 0 to know if there's a sync binder
transaction happened when being frozen - same as before; and 2) check
bit 1 to know if that sync binder transaction happened exactly when
there's a race - a new information for rollback decision.
Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Li Li <dualli@google.com>
Test: stress test with apps being frozen and initiating binder calls at
the same time, confirmed the pending transactions succeeded.
Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 198493121
(cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-linus)
Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9
User space needs to know if binder transactions occurred to frozen
processes. Introduce a new BINDER_GET_FROZEN ioctl and keep track of
transactions occurring to frozen proceses.
Bug: 180989544
(cherry picked from commit c55019c24b22d6770bd8e2f12fbddf3f83d37547
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing)
Signed-off-by: Marco Ballesio <balejs@google.com>
Signed-off-by: Li Li <dualli@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20210316011630.1121213-4-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ie631f331ba4ca94a3bcdd43dec25fe9ba1306af2
when interrupted by a signal, binder_wait_for_work currently returns
-ERESTARTSYS. This error code isn't propagated to user space, but a way
to handle interruption due to signals must be provided to code using
this API.
Replace this instance of -ERESTARTSYS with -EINTR, which is propagated
to user space.
Bug: 180989544
(cherry picked from commit 48f10b7ed0c23e2df7b2c752ad1d3559dad007f9
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing)
Signed-off-by: Marco Ballesio <balejs@google.com>
Signed-off-by: Li Li <dualli@google.com>
Test: built, booted, interrupted a worker thread within
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20210316011630.1121213-3-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ie6c7993cab699bc2c1a25a2f9d94b200a1156e5d
Frozen tasks can't process binder transactions, so a way is required to
inform transmitting ends of communication failures due to the frozen
state of their receiving counterparts. Additionally, races are possible
between transitions to frozen state and binder transactions enqueued to
a specific process.
Implement BINDER_FREEZE ioctl for user space to inform the binder driver
about the intention to freeze or unfreeze a process. When the ioctl is
called, block the caller until any pending binder transactions toward
the target process are flushed. Return an error to transactions to
processes marked as frozen.
Bug: 180989544
(cherry picked from commit 15949c3cdd97bccdcd45c0c0f6c31058520b6494
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing)
Co-developed-by: Todd Kjos <tkjos@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Marco Ballesio <balejs@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20210316011630.1121213-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ia1b5951cd99eeb98b59e06c3e27d59062dc725f6
Prevents mishandling USB requests that are no longer present.
Bug: 161010552
Fixes: 483cb5629e ("ANDROID: usb: gadget: f_accessory: Add Android Accessory function")
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8ff24d6d49214c3bd10a1b5d5e72814ec2a91c61
This build option is broken for clang and upstream removed it in commit
258c42a8fb ("fortify: Explicitly disable Clang support") so we have to
also remove it for the gki defconfigs.
Fixes: 258c42a8fb ("fortify: Explicitly disable Clang support")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d4a1d38b736ee1fd4a6febfbab4d1a3c1c4d351
commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.
There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.
As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
_______________________________________________________________
| tail (partial) page | head (partial) page |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|
However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.
I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.
Call trace for reference:
z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
z_erofs_runqueue+0x5f3/0x840 [erofs]
z_erofs_readahead+0x1e8/0x320 [erofs]
read_pages+0x91/0x270
page_cache_ra_unbounded+0x18b/0x240
filemap_get_pages+0x10a/0x5f0
filemap_read+0xa9/0x330
new_sync_read+0x11b/0x1a0
vfs_read+0xf1/0x190
Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
Fixes: 3883a79abd ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.
No any behavior to variable occupied in z_erofs_attach_page() which
is only caller to z_erofs_pagevec_enqueue().
Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
Signed-off-by: Yue Hu <huyue2@yulong.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f21082fb20dbfb3e42b769b59ef21c2a7f2c7c1f upstream.
The ION AHCI device pretends that MSI masking isn't a thing, while it
actually implements it and needs MSIs to be unmasked to work. Add a quirk
to that effect.
Reported-by: Rui Salvaterra <rsalvaterra@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Link: https://lore.kernel.org/r/CALjTZvbzYfBuLB+H=fj2J+9=DxjQ2Uqcy0if_PvmJ-nU-qEgkg@mail.gmail.com
Link: https://lore.kernel.org/r/20211104180130.3825416-3-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2226667a145db2e1f314d7f57fd644fe69863ab9 upstream.
It appears that some devices are lying about their mask capability,
pretending that they don't have it, while they actually do.
The net result is that now that we don't enable MSIs on such
endpoint.
Add a new per-device flag to deal with this. Further patches will
make use of it, sadly.
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20211104180130.3825416-2-maz@kernel.org
Cc: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3735459037114d31e5acd9894fad9aed104231a0 upstream.
free_msi_irqs() frees the MSI entries before destroying the sysfs entries
which are exposing them. Nothing prevents a concurrent free while a sysfs
file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
Fixes: 1c51b50c29 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3ec18fc7831e7d79e2d536dd1f3bc0d3ba425e8a upstream.
commit 8779e05ba8aa ("parisc: Fix ptrace check on syscall return")
fixed testing of TI_FLAGS. This uncovered a bug in the test mask.
syscall_restore_rfi is only used when the kernel needs to exit to
usespace with single or block stepping and the recovery counter
enabled. The test however used _TIF_SYSCALL_TRACE_MASK, which
includes a lot of bits that shouldn't be tested here.
Fix this by using TIF_SINGLESTEP and TIF_BLOCKSTEP directly.
I encountered this bug by enabling syscall tracepoints. Both in qemu and
on real hardware. As soon as i enabled the tracepoint (sys_exit_read,
but i guess it doesn't really matter which one), i got random page
faults in userspace almost immediately.
Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream.
Clang has never correctly compiled the FORTIFY_SOURCE defenses due to
a couple bugs:
Eliding inlines with matching __builtin_* names
https://bugs.llvm.org/show_bug.cgi?id=50322
Incorrect __builtin_constant_p() of some globals
https://bugs.llvm.org/show_bug.cgi?id=41459
In the process of making improvements to the FORTIFY_SOURCE defenses, the
first (silent) bug (coincidentally) becomes worked around, but exposes
the latter which breaks the build. As such, Clang must not be used with
CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13),
and the fortify routines have been rearranged.
Update the Kconfig to reflect the reality of the current situation.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit eeb1b55b6e25c5f7265ff45cd050f3bc2cc423a4 upstream.
When non-fatal error like line-reset happens, ufshcd_err_handler() starts
to abort tasks by ufshcd_try_to_abort_task(). When it tries to issue a task
management request, we hit two warnings:
WARNING: CPU: 7 PID: 7 at block/blk-core.c:630 blk_get_request+0x68/0x70
WARNING: CPU: 4 PID: 157 at block/blk-mq-tag.c:82 blk_mq_get_tag+0x438/0x46c
After fixing the above warnings we hit another tm_cmd timeout which may be
caused by unstable controller state:
__ufshcd_issue_tm_cmd: task management cmd 0x80 timed-out
Then, ufshcd_err_handler() enters full reset, and kernel gets stuck. It
turned out ufshcd_print_trs() printed too many messages on console which
requires CPU locks. Likewise hba->silence_err_logs, we need to avoid too
verbose messages. This is actually not an error case.
Link: https://lore.kernel.org/r/20210107185316.788815-3-jaegeuk@kernel.org
Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs")
Reviewed-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[Zhai: remove an item of debug print not available in v5.4]
Signed-off-by: Orson Zhai <orson.zhai@unisoc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 39fec6889d15a658c3a3ebb06fd69d3584ddffd3 upstream.
Ext4 file system has default lazy inode table initialization setup once
it is mounted. However, it has issue on computing the next schedule time
that makes the timeout same amount in jiffies but different real time in
secs if with various HZ values. Therefore, fix by measuring the current
time in a more granular unit nanoseconds and make the next schedule time
independent of the HZ value.
Fixes: bfff68738f ("ext4: add support for lazy inode table initialization")
Signed-off-by: Shaoying Xu <shaoyi@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210902164412.9994-2-shaoyi@amazon.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a923a2676e60683aee46aa4b93c30aff240ac20d upstream.
Fix assembly errors like:
{standard input}: Assembler messages:
{standard input}:287: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
{standard input}:680: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
{standard input}:1274: Error: opcode not supported on this processor: mips3 (mips3) `dins $12,$9,32,32'
{standard input}:2175: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
make[1]: *** [scripts/Makefile.build:277: mm/highmem.o] Error 1
with code produced from `__cmpxchg64' for MIPS64r2 CPU configurations
using CONFIG_32BIT and CONFIG_PHYS_ADDR_T_64BIT.
This is due to MIPS_ISA_ARCH_LEVEL downgrading the assembly architecture
to `r4000' i.e. MIPS III for MIPS64r2 configurations, while there is a
block of code containing a DINS MIPS64r2 instruction conditionalized on
MIPS_ISA_REV >= 2 within the scope of the downgrade.
The assembly architecture override code pattern has been put there for
LL/SC instructions, so that code compiles for configurations that select
a processor to build for that does not support these instructions while
still providing run-time support for processors that do, dynamically
switched by non-constant `cpu_has_llsc'. It went in with linux-mips.org
commit aac8aa7717 ("Enable a suitable ISA for the assembler around
ll/sc so that code builds even for processors that don't support the
instructions. Plus minor formatting fixes.") back in 2005.
Fix the problem by wrapping these instructions along with the adjacent
SYNC instructions only, following the practice established with commit
cfd54de3b0 ("MIPS: Avoid move psuedo-instruction whilst using
MIPS_ISA_LEVEL") and commit 378ed6f0e3 ("MIPS: Avoid using .set mips0
to restore ISA"). Strictly speaking the SYNC instructions do not have
to be wrapped as they are only used as a Loongson3 erratum workaround,
so they will be enabled in the assembler by default, but do this so as
to keep code consistent with other places.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: c7e2d71dda ("MIPS: Fix set_pte() for Netlogic XLR using cmpxchg64()")
Cc: stable@vger.kernel.org # v5.1+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6337f58cec030b34ced435b3d9d7d29d63c96e36 upstream.
The interrupt might be shared, in which case it is not an error for the
interrupt handler to be called when the interrupt status is zero, so don't
print the message unless there was enabled interrupt status.
Link: https://lore.kernel.org/r/20200811133936.19171-1-adrian.hunter@intel.com
Fixes: 9333d7757348 ("scsi: ufs: Fix irq return code")
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Orson Zhai <orson.zhai@unisoc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 19221e3083020bd9537624caa0ee0145ed92ba36 upstream.
The tegra_powergate_power_up() has a typo in the error code path where it
will try to disable clocks twice, fix it. In practice that error never
happens, so this is a minor correction.
Tested-by: Peter Geis <pgwipeout@gmail.com> # Ouya T30
Tested-by: Nicolas Chauvet <kwizart@gmail.com> # PAZ00 T20 and TK1 T124
Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Todd Kjos
Jens Wiklander
Bui Quang Minh
Yang Yingliang
Ming Lei
Pavel Skripkin
Hang Lu
Tadeusz Struk
Greg Kroah-Hartman
Jamie Hill-Daniel
Joe Perches
Sami Tolvanen
Greg Kroah-Hartman
Eric Biggers
Benjamin Tissoires
Chao Yu
Jaegeuk Kim
Wang Xiaojun
Li Li
Marco Ballesio
Lee Jones
Gao Xiang
Yue Hu
Marc Zyngier
Thomas Gleixner
Sven Schnelle
Kees Cook
Shaoying Xu
Maciej W. Rozycki
Adrian Hunter
Dmitry Osipenko