Commit graph

918,239 commits

Author SHA1 Message Date
QCTECMDR Service
7ea86abd86 Merge "Merge android11-5.4.278(7453ecf) into msm-5.4" 2024-10-28 01:05:28 -07:00
QCTECMDR Service
c2fe5024c0 Merge "power: reset: Disable support of dynamic download mode (ramdump)" 2024-10-27 22:13:42 -07:00
QCTECMDR Service
113056cafc Merge "msm: virtio_npu: Fix use-after-free issue in unmap_buf" 2024-10-27 22:13:41 -07:00
kamasali Satyanarayan
e88bb9b374 Merge android11-5.4.278(7453ecf) into msm-5.4
* remotes/origin/tmp-7453ecf:
  UPSTREAM: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
  ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
  ANDROID: GKI: refresh ABI to include kimage_vaddr
  BACKPORT: arm64: move kimage_vaddr to .rodata
  BACKPORT: arm64: kernel: Convert to modern annotations for assembly data
  ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
  UPSTREAM: af_unix: Fix garbage collector racing against connect()
  Revert "drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector"
  Linux 5.4.278
  nfs: fix undefined behavior in nfs_block_bits()
  s390/ap: Fix crash in AP internal function modify_bitmap()
  ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
  sparc: move struct termio to asm/termios.h
  xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
  net: fix __dst_negative_advice() race
  kdb: Use format-specifiers rather than memset() for padding in kdb_read()
  kdb: Merge identical case statements in kdb_read()
  kdb: Fix console handling when editing and tab-completing commands
  kdb: Use format-strings rather than '\0' injection in kdb_read()
  kdb: Fix buffer overflow during tab-complete
  sparc64: Fix number of online CPUs
  intel_th: pci: Add Meteor Lake-S CPU support
  net/9p: fix uninit-value in p9_client_rpc()
  net/ipv6: Fix route deleting failure when metric equals 0
  crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
  crypto: ecrdsa - Fix module auto-load on add_key
  KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
  fbdev: savage: Handle err return when savagefb_check_var failed
  media: v4l2-core: hold videodev_lock until dev reg, finishes
  media: mxl5xx: Move xpt structures off stack
  media: mc: mark the media devnode as registered from the, start
  arm64: dts: hi3798cv200: fix the size of GICR
  wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
  md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
  arm64: tegra: Correct Tegra132 I2C alias
  ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
  ata: pata_legacy: make legacy_exit() work again
  drm/amdgpu: add error handle to avoid out-of-bounds
  media: lgdt3306a: Add a check against null-pointer-def
  f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
  x86/mm: Remove broken vsyscall emulation code from the page fault code
  vxlan: Fix regression when dropping packets due to invalid src addresses
  nilfs2: fix use-after-free of timer for log writer thread
  afs: Don't cross .backup mountpoint from backup volume
  io_uring: fail NOP if non-zero op flags is passed in
  mmc: core: Do not force a retune before RPMB switch
  binder: fix max_thread type inconsistency
  SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
  genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
  ALSA: timer: Set lower bound of start tick time
  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
  spi: stm32: Don't warn about spurious interrupts
  kconfig: fix comparison to constant symbols, 'm', 'n'
  netfilter: tproxy: bail out if IP has been disabled on the device
  net:fec: Add fec_enet_deinit()
  net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
  smsc95xx: use usbnet->driver_priv
  smsc95xx: remove redundant function arguments
  enic: Validate length of nl attributes in enic_set_vf_port
  dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
  net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
  nvmet: fix ns enable/disable possible hang
  spi: Don't mark message DMA mapped when no transfer in it is
  netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
  nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
  nfc: nci: Fix kcov check in nci_rx_work()
  net: fec: avoid lock evasion when reading pps_enable
  virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
  arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
  openvswitch: Set the skbuff pkt_type for proper pmtud support.
  tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
  params: lift param_set_uint_minmax to common code
  ipv6: sr: fix memleak in seg6_hmac_init_algo
  sunrpc: fix NFSACL RPC retry on soft mount
  nfc: nci: Fix uninit-value in nci_rx_work
  x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
  null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
  media: cec: cec-api: add locking in cec_release()
  media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  um: Fix the -Wmissing-prototypes warning for __switch_mm
  powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
  scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
  media: stk1160: fix bounds checking in stk1160_copy_video()
  um: Add winch to winch_handlers before registering winch IRQ
  um: Fix return value in ubd_init()
  drm/msm/dpu: Always flush the slave INTF on the CTL
  Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
  Input: ims-pcu - fix printf string overflow
  libsubcmd: Fix parse-options memory leak
  serial: sh-sci: protect invalidating RXDMA on shutdown
  f2fs: fix to release node block count in error path of f2fs_new_node_page()
  extcon: max8997: select IRQ_DOMAIN instead of depending on it
  ppdev: Add an error check in register_device
  ppdev: Remove usage of the deprecated ida_simple_xx() API
  stm class: Fix a double free in stm_register_device()
  usb: gadget: u_audio: Clear uac pointer when freed.
  microblaze: Remove early printk call from cpuinfo-static.c
  microblaze: Remove gcc flag for non existing early_printk.c file
  iio: pressure: dps310: support negative temperature values
  greybus: arche-ctrl: move device table to its right location
  serial: max3100: Fix bitwise types
  serial: max3100: Update uart_driver_registered on driver removal
  serial: max3100: Lock port->lock when calling uart_handle_cts_change()
  firmware: dmi-id: add a release callback function
  dmaengine: idma64: Add check for dma_set_max_seg_size
  soundwire: cadence: fix invalid PDI offset
  soundwire: cadence_master: improve PDI allocation
  soundwire: intel: don't filter out PDI0/1
  soundwire: cadence/intel: simplify PDI/port mapping
  greybus: lights: check return of get_channel_from_mode
  sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax
  af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
  netrom: fix possible dead-lock in nr_rt_ioctl()
  RDMA/IPoIB: Fix format truncation compilation errors
  selftests/kcmp: remove unused open mode
  selftests/kcmp: Make the test output consistent and clear
  SUNRPC: Fix gss_free_in_token_pages()
  sunrpc: removed redundant procp check
  ext4: avoid excessive credit estimate in ext4_tmpfile()
  x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
  RDMA/hns: Use complete parentheses in macros
  drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
  ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
  drm/arm/malidp: fix a possible null pointer dereference
  fbdev: sh7760fb: allow modular build
  platform/x86: wmi: Make two functions static
  media: radio-shark2: Avoid led_names truncations
  media: ngene: Add dvb_ca_en50221_init return value check
  fbdev: sisfb: hide unused variables
  powerpc/fsl-soc: hide unused const variable
  drm/mediatek: Add 0 size check to mtk_drm_gem_obj
  fbdev: shmobile: fix snprintf truncation
  mtd: rawnand: hynix: fixed typo
  drm/amd/display: Fix potential index out of bounds in color transformation function
  ipv6: sr: fix invalid unregister error path
  ipv6: sr: fix incorrect unregister order
  ipv6: sr: add missing seg6_local_exit
  net: openvswitch: fix overwriting ct original tuple for ICMPv6
  net: usb: smsc95xx: stop lying about skb->truesize
  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
  net: ethernet: cortina: Locking fixes
  m68k: mac: Fix reboot hang on Mac IIci
  m68k: Fix spinlock race in kernel thread creation
  net: usb: sr9700: stop lying about skb->truesize
  usb: aqc111: stop lying about skb->truesize
  wifi: mwl8k: initialize cmd->addr[] properly
  scsi: qedf: Ensure the copied buf is NUL terminated
  scsi: bfa: Ensure the copied buf is NUL terminated
  HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
  Revert "sh: Handle calling csum_partial with misaligned data"
  sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
  wifi: ar5523: enable proper endpoint verification
  wifi: carl9170: add a proper sanity check for endpoints
  macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
  tcp: avoid premature drops in tcp_add_backlog()
  tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
  tcp: minor optimization in tcp_add_backlog()
  wifi: ath10k: populate board data for WCN3990
  wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
  x86/purgatory: Switch to the position-independent small code model
  scsi: hpsa: Fix allocation size for Scsi_Host private data
  scsi: libsas: Fix the failure of adding phy with zero-address to port
  cpufreq: exit() callback is optional
  cpufreq: Rearrange locking in cpufreq_remove_dev()
  cpufreq: Split cpufreq_offline()
  cpufreq: Reorganize checks in cpufreq_offline()
  ACPI: disable -Wstringop-truncation
  irqchip/alpine-msi: Fix off-by-one in allocation error path
  scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
  scsi: ufs: core: Perform read back after disabling interrupts
  scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
  scsi: ufs: qcom: Perform read back after writing reset bit
  qed: avoid truncating work queue length
  x86/boot: Ignore relocations in .notes sections in walk_relocs() too
  wifi: ath10k: poll service ready message before failing
  md: fix resync softlockup when bitmap size is less than array size
  null_blk: Fix missing mutex_destroy() at module removal
  jffs2: prevent xattr node from overflowing the eraseblock
  s390/cio: fix tracepoint subchannel type field
  crypto: ccp - drop platform ifdef checks
  parisc: add missing export of __cmpxchg_u8()
  nilfs2: fix out-of-range warning
  ecryptfs: Fix buffer size for tag 66 packet
  firmware: raspberrypi: Use correct device for DMA mappings
  crypto: bcm - Fix pointer arithmetic
  openpromfs: finish conversion to the new mount API
  nvme: find numa distance only if controller has valid numa id
  drm/amdkfd: Flush the process wq before creating a kfd_process
  ASoC: da7219-aad: fix usage of device_get_named_child_node()
  ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
  ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
  drm/amd/display: Set color_mgmt_changed to true on unsuspend
  net: usb: qmi_wwan: add Telit FN920C04 compositions
  wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
  nilfs2: fix potential hang in nilfs_detach_log_writer()
  nilfs2: fix unexpected freezing of nilfs_segctor_sync()
  net: smc91x: Fix m68k kernel compilation for ColdFire CPU
  ring-buffer: Fix a race between readers and resize checks
  speakup: Fix sizeof() vs ARRAY_SIZE() bug
  tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
  x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
  Linux 5.4.277
  docs: kernel_include.py: Cope with docutils 0.21
  serial: kgdboc: Fix NMI-safety problems from keyboard reset code
  usb: typec: ucsi: displayport: Fix potential deadlock
  drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
  btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
  arm64: dts: qcom: Fix 'interrupt-map' parent address cells
  firmware: arm_scmi: Harden accesses to the reset domains
  smb: client: fix potential OOBs in smb2_parse_contexts()
  net: bcmgenet: synchronize UMAC_CMD access
  net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
  net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
  net: bcmgenet: keep MAC in reset until PHY is up
  Revert "net: bcmgenet: use RGMII loopback for MAC reset"
  Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
  ext4: fix bug_on in __es_tree_search
  pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
  Linux 5.4.276
  pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
  pinctrl: mediatek: remove set but not used variable 'e'
  pinctrl: mediatek: Fix some off by one bugs
  pinctrl: mediatek: Fix fallback behavior for bias_set_combo
  regulator: core: fix debugfs creation regression
  net: fix out-of-bounds access in ops_init
  drm/vmwgfx: Fix invalid reads in fence signaled events
  dyndbg: fix old BUG_ON in >control parser
  tipc: fix UAF in error path
  usb: gadget: f_fs: Fix a race condition when processing setup packets.
  usb: gadget: composite: fix OS descriptors w_value logic
  firewire: nosy: ensure user_length is taken into account when fetching packet contents
  net: qede: use return from qede_parse_flow_attr() for flower
  net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
  ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
  net: bridge: fix corrupted ethernet header on multicast-to-unicast
  phonet: fix rtm_phonet_notify() skb allocation
  rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
  Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
  tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
  tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
  xfrm: Preserve vlan tags for transport mode software GRO
  pinctrl: mediatek: Fix fallback call path
  net:usb:qmi_wwan: support Rolling modules
  fs/9p: drop inodes immediately on non-.L too
  clk: Don't hold prepare_lock when calling kref_put()
  gpio: crystalcove: Use -ENOTSUPP consistently
  gpio: wcove: Use -ENOTSUPP consistently
  9p: explicitly deny setlease attempts
  fs/9p: translate O_TRUNC into OTRUNC
  fs/9p: only translate RWX permissions for plain 9P2000
  selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
  MIPS: scall: Save thread_info.syscall unconditionally on entry
  gpu: host1x: Do not setup DMA for virtual devices
  scsi: target: Fix SELinux error when systemd-modules loads the target module
  btrfs: always clear PERTRANS metadata during commit
  btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
  tools/power turbostat: Fix Bzy_MHz documentation typo
  tools/power turbostat: Fix added raw MSR output
  firewire: ohci: mask bus reset interrupts between ISR and bottom half
  ata: sata_gemini: Check clk_enable() result
  net: bcmgenet: Reset RBUF on first open
  ALSA: line6: Zero-initialize message buffers
  scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
  net: mark racy access on sk->sk_rcvbuf
  wifi: cfg80211: fix rdev_dump_mpp() arguments order
  wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
  gfs2: Fix invalid metadata access in punch_hole
  scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
  clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
  tipc: fix a possible memleak in tipc_buf_append
  net: bridge: fix multicast-to-unicast with fraglist GSO
  net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
  net: dsa: mv88e6xxx: Add number of MACs in the ATU
  net: qede: use return from qede_parse_flow_attr() for flow_spec
  net l2tp: drop flow hash on forward
  nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
  bna: ensure the copied buf is NUL terminated
  s390/mm: Fix clearing storage keys for huge pages
  s390/mm: Fix storage key clearing for guest huge pages
  pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
  power: rt9455: hide unused rt9455_boost_voltage_values
  nfs: Handle error of rpc_proc_register() in nfs_net_init().
  nfs: make the rpc_stat per net namespace
  nfs: expose /proc/net/sunrpc/nfs in net namespaces
  sunrpc: add a struct rpc_stats arg to rpc_create_args
  pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
  pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
  pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
  pinctrl: mediatek: remove shadow variable declaration
  pinctrl: mediatek: Backward compatible to previous Mediatek's bias-pull usage
  pinctrl: mediatek: Refine mtk_pinconf_get()
  pinctrl: mediatek: Refine mtk_pinconf_get() and mtk_pinconf_set()
  pinctrl: mediatek: Supporting driving setting without mapping current to register value
  pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()
  pinctrl: core: delete incorrect free in pinctrl_enable()
  wifi: nl80211: don't free NULL coalescing rule
  dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
  dmaengine: pl330: issue_pending waits until WFP state
  Revert "clk: Get runtime PM before walking tree during disable_unused"
  Linux 5.4.275
  serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
  udp: preserve the connected status if only UDP cmsg
  dm: limit the number of targets and parameter size area
  bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
  HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
  i2c: smbus: fix NULL function pointer dereference
  idma64: Don't try to serve interrupts when device is powered off
  dmaengine: owl: fix register access functions
  tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
  tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
  mtd: diskonchip: work around ubsan link failure
  stackdepot: respect __GFP_NOLOCKDEP allocation flag
  net: b44: set pause params only when interface is up
  ethernet: Add helper for assigning packet type when dest address does not match device address
  irqchip/gic-v3-its: Prevent double free on error
  drm/amdgpu: Fix leak when GPU memory allocation fails
  arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
  btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
  Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
  Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
  tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
  tracing: Show size of requested perf buffer
  net/mlx5e: Fix a race in command alloc flow
  Revert "crypto: api - Disallow identical driver names"
  drm/amdgpu: validate the parameters of bo mapping operations more clearly
  amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
  drm/amdgpu: restrict bo mapping within gpu address limits
  serial: mxs-auart: add spinlock around changing cts state
  serial: core: Provide port lock wrappers
  af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
  iavf: Fix TC config comparison with existing adapter TC config
  i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
  mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
  mlxsw: spectrum_acl_tcam: Fix warning during rehash
  mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
  mlxsw: spectrum_acl_tcam: Rate limit error message
  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
  mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
  net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  ipvs: Fix checksumming on GSO of SCTP packets
  net: gtp: Fix Use-After-Free in gtp_dellink
  net: usb: ax88179_178a: stop lying about skb->truesize
  NFC: trf7970a: disable all regulators on removal
  mlxsw: core: Unregister EMAD trap using FORWARD action
  vxlan: drop packets from invalid src-address
  ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
  arm64: dts: mediatek: mt2712: fix validation errors
  arm64: dts: mt2712: add ethernet device node
  arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
  arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
  arm64: dts: mediatek: mt7622: fix IR nodename
  arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
  arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
  KVM: async_pf: Cleanup kvm_setup_async_pf()
  nilfs2: fix OOB in nilfs_set_de_type
  nouveau: fix instmem race condition around ptr stores
  fs: sysfs: Fix reference leak in sysfs_break_active_protection()
  speakup: Avoid crash on very long word
  usb: Disable USB3 LPM at shutdown
  usb: dwc2: host: Fix dereference issue in DDMA completion flow.
  Revert "usb: cdc-wdm: close race between read and workqueue"
  USB: serial: option: add Telit FN920C04 rmnet compositions
  USB: serial: option: add Rolling RW101-GL and RW135-GL support
  USB: serial: option: support Quectel EM060K sub-models
  USB: serial: option: add Lonsung U8300/U9300 product
  USB: serial: option: add support for Fibocom FM650/FG650
  USB: serial: option: add Fibocom FM135-GL variants
  serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  comedi: vmk80xx: fix incomplete endpoint checking
  binder: check offset alignment in binder_get_object()
  x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  clk: Get runtime PM before walking tree during disable_unused
  clk: Initialize struct clk_core kref earlier
  clk: Print an info line before disabling unused clocks
  clk: remove extra empty line
  clk: Mark 'all_lists' as const
  clk: Remove prepare_lock hold assertion in __clk_release()
  drm: nv04: Fix out of bounds access
  RDMA/mlx5: Fix port number for counter query in multi-port configuration
  RDMA/rxe: Fix the problem "mutex_destroy missing"
  tun: limit printing rate when illegal packet received by tun dev
  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
  Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
  kprobes: Fix possible use-after-free issue on kprobe registration
  selftests/ftrace: Limit length in subsystem-enable tests
  btrfs: record delayed inode root in transaction
  x86/apic: Force native_apic_mem_read() to use the MOV instruction
  selftests: timers: Fix abs() warning in posix_timers test
  vhost: Add smp_rmb() in vhost_vq_avail_empty()
  drm/client: Fully protect modes[] with dev->mode_config.mutex
  btrfs: qgroup: correctly model root qgroup rsv in convert
  net: ena: Fix potential sign extension issue
  af_unix: Fix garbage collector racing against connect()
  af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
  net/mlx5: Properly link new fs rules into the tree
  ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
  ipv4/route: avoid unused-but-set-variable warning
  ipv6: fib: hide unused 'pn' variable
  geneve: fix header validation in geneve[6]_xmit_skb
  u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
  net: openvswitch: fix unwanted error log on timeout policy probing
  nouveau: fix function cast warning
  Bluetooth: Fix memory leak in hci_req_sync_complete()
  batman-adv: Avoid infinite loop trying to resize local TT

Change-Id: I36df890fc0cf15277cf5d6be8f56774233fb4431
Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
2024-10-15 16:13:40 +05:30
Gao Wang
a721c06f7d msm: virtio_npu: Fix use-after-free issue in unmap_buf
address the security CR of virtio_npu driver

Change-Id: Ibf656fa76dedb19086b75d8bf519b2f415ac8d22
Signed-off-by: Gao Wang <quic_gaowang@quicinc.com>
2024-10-14 00:51:57 -07:00
gaowang
79c14fa641 msm: virtio_npu: Fix use-after-free issue in virt_npu_map_buf
address the security CR of virtio_npu driver

Change-Id: Ib77014bc12490e7b09367354024baa2754d3e433
Signed-off-by: gaowang <quic_gaowang@quicinc.com>
2024-10-13 19:53:36 -07:00
Anil Veshala Veshala
c5539fb1c2 i2c: i2c-master-msm-geni: add null pointer check in event call back
Currently i2c geni driver doesn't have null pointer check condition
in event call back function. If any invalid event is coming from GSI,
i2c geni driver accessing null pointer which is causing crash.
To solve this added null pointer checks in event call back functions.

Change-Id: Ie14a40eee846c0ea29bec512d6320e9548c509b5
Signed-off-by: Anil Veshala Veshala <quic_aveshala@quicinc.com>
2024-09-18 02:50:52 -07:00
QCTECMDR Service
e4c2f15ba5 Merge "firmware: qcom_scm: handle echo b > /proc/sysrq-trigger" 2024-09-17 03:35:03 -07:00
QCTECMDR Service
4adbc0218a Merge "msm: ep_pcie: Disable hot reset and ignore linkdown" 2024-09-16 07:20:29 -07:00
QCTECMDR Service
94c4fda252 Merge "scripts: mod: replace with a safe function" 2024-09-16 03:42:38 -07:00
Mukesh Ojha
b2af2b5f9f firmware: qcom_scm: handle echo b > /proc/sysrq-trigger
Introduce restart handler to handle "echo b > /proc/sysrq-trigger".
One special thing with 'b' kind of reboot is, it does not call reboot
notifiers and call restart handler right a way and that does not seems
to work for blair SoC and it goes to dump mode.

Keep this restart handler priority to 201 greater than 200 which is the
priority for msm-poweroff to make reboot work cleaner.

Change-Id: I42f8c0fde29af402096d760c37ec2d8b3a85439a
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Sayan Dey <quic_sayand@quicinc.com>
2024-09-16 12:49:11 +05:30
Vishnu Teja
f1d1549d8e scripts: mod: replace with a safe function
Add safe function vsnprintf instead of sprintf
by passing size as argument.

Change-Id: Ibd21a0c7d9039543dee32c1297035ed9984ed748
Signed-off-by: Vishnu Teja <quic_vteja@quicinc.com>
2024-09-14 01:04:36 -07:00
Qiang Yu
32de0804b1 msm: ep_pcie: Disable hot reset and ignore linkdown
Intel host tends to retrain the link if device doesn't send PM_Enter_L23
in time, leading to linkdown and hot reset in device side. The hot reset
here even results to PERST# timeout and device crash to PBL, which is
not expected.

Since we are in the entry of shutdown the link when linkdown happen, it
makes sense to ignore the linkdown. To avoid device crash because of
PERST# timeout, disable hot reset in pm_turnoff irq and reenable it when
we do linktrain again.

Change-Id: I87961faaae2a14c9a5e7d24543b416914076dd2e
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
2024-09-13 17:38:37 +05:30
Yuanfang Zhang
bb76f075ca coresight-tmc: Replace deprecated function
Use 'scnprintf' to replace deprecated function 'sprintf'.

Change-Id: Ic258e7dfe719f1f871f9c9eb5988609a5f3b6284
Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
2024-09-11 18:53:09 +08:00
QCTECMDR Service
c3d6993d5c Merge "msm-5.4.c3: qseecom: Fix possible race condition" 2024-08-30 04:08:23 -07:00
Divisha Bisht
f0e3f64088 msm-5.4.c3: qseecom: Fix possible race condition
Fix possible race condition in data->type value in case of multithreaded
listener or app IOCTLs.

For example, below could cause inconsistent data->type value while
racing belows IOCTLs

Thread1 with QSEECOM_IOCTL_REGISTER_LISTENER_REQ
Thread2 with QSEECOM_IOCTL_UNREGISTER_LISTENER_REQ.

Change-Id: I436b63c044a66c324d94db27566a7be70981bd6b
Signed-off-by: Divisha Bisht <quic_divibish@quicinc.com>
2024-08-29 22:14:16 -07:00
Rajashekar kuruva
54d3e3ca11 USB: storage: Replace the sprintf with scnprintf
'sprintf' has been deprecated, hence replace it with
a safer function scnprintf.

Change-Id: I9bc8e3dfd2032a0447f38fc98a3ad31d9d609cab
Signed-off-by: Rajashekar kuruva <quic_kuruva@quicinc.com>
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
2024-08-29 21:16:16 -07:00
QCTECMDR Service
83ba639ff8 Merge "adsprpc: Handle UAF scenario in put_args" 2024-08-29 17:29:58 -07:00
Santosh Sakore
c6e7698c0c adsprpc: Handle UAF scenario in put_args
Currently, the DSP updates header buffers with unused DMA handle fds.
In the put_args section, if any DMA handle FDs are present in the
header buffer, the corresponding map is freed. However, since the
header buffer is exposed to users in unsigned PD, users can update
invalid FDs. If this invalid FD matches with any FD that is already
in use, it could lead to a use-after-free (UAF) vulnerability.
As a solution,add DMA handle references for DMA FDs, and the map for
the FD will be freed only when a reference is found.

Acked-by: Om Deore <quic_odeore@quicinc.com>
Change-Id: I19ae21230bf11fe89858b10c9069a5daccabc392
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
2024-08-29 09:15:22 -07:00
QCTECMDR Service
177e8e0fad Merge "msm: adsprpc: Avoid taking reference for group_info" 2024-08-29 07:38:37 -07:00
ANANDU KRISHNAN E
de9f4fe6f8 msm: adsprpc: Avoid taking reference for group_info
Currently, the get_current_groups API accesses group info, which
increases the usage refcount. If the IOCTL using the
get_current_groups API is called many times, the usage counter
overflows. To avoid this, access group info without taking a
reference. A reference is not required as group info is not
released during the IOCTL call.

Change-Id: Ib4de80cac8b36f73d8f5c6dd9824722153189285
Signed-off-by: ANANDU KRISHNAN E <quic_anane@quicinc.com>
2024-08-29 02:16:09 -07:00
Prashanth K
63a32bf361 usb: gadget: f_gsi: bail out if opts is null
Currently, functions gsi_inst_clean & gsi_free_inst utilises
gsi_opts without any check, however there is a possibility
that the opts structure could become NULL. In such case, due
to lack of if checks can result in NULL pointer dereference.

Change-Id: I548690e2eee377b5292f258972ae7e38417f3085
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
2024-08-28 22:14:17 -07:00
QCTECMDR Service
0fc0638ba8 Merge "msm: ep_pcie: Avoid setting host wake pending flag for D0" 2024-08-27 00:24:32 -07:00
QCTECMDR Service
97fd8bd8e6 Merge "msm: ep_pcie: Prevent repetitive wake operation if wake is in process" 2024-08-23 07:47:48 -07:00
Sai Chaitanya Kaveti
ccba394a90 msm: ep_pcie: Avoid setting host wake pending flag for D0
In current implementation, when host wake request is received in D0 and
M3 states, the following sequence of events are happening causing next
host wake request from IPA/ client to fail.

Sequence of events:
1. Device is in waking up process in D0, M3 states and expecting M0
next.
2. Wake up request received as device in M3.
3. Host wake API is executed setting host_wake_pending flag as well.
4. M0 received as part of wake up from 1.
5. Device in D0, M0 states.
6. Device again went to suspend state as no transfers are happening.
7. Device in D3cold, M3 states
8. Wake up request received from IPA.
9. Host wake API is called again but its returning without any operation
as host_wake_pending flag is set. wake toggle is not done.
10. host_wake_pending flag is cleared only on receiving next D0.
11. Host wake requests are failing because of 9.

To handle this, avoiding setting of host_wake_pending flag when the host
wake request is received in D0 state.

Change-Id: I83acde55e6c116653c3ed00e6b4560e3db6390bd
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
2024-08-23 14:46:48 +05:30
Qiang Yu
d62bca7bf4 msm: ep_pcie: Prevent repetitive wake operation if wake is in process
Sometimes, device receives two consecutive wake-up events, added into a
workqueue. Then device assert WAKE# and host deassert PERST# if device
in D3cold state, triggering deassert perst IRQ. In IRQ thread, device
flush the workqueue to make sure previous d3cold process has completed
before enable endpoint. commit 43917f862f7d ("msm: mhi_dev: Flush
workqueue before processing PERST deassert"). However, the second wake
event is also in the workqueue, so ep_pcie_core_wakeup_host_internal
is invoked and seeing dev->perst_deast is true, setted by deassert
PERST# IRQ. Then device goes to access MHI register to issue inband PME,
leading to NOC error because endpoint is still disabled.

So add a check to prevent wake operation if a previous wake has completed.

10567.834470: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_CORE_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.834498: ep_pcie_core_toggle_wake_gpio: PCIe V1711211: No. 115 to
assert PCIe WAKE#; perst is asserted; D3hot is  received, WAKE GPIO
state:0
10567.834507: ep_pcie_core_wakeup_host_internal: PCIe V1711211: Set wake
pending : 1 and return ; perst is not de-asserted; D3hot is set
10567.849704: [0x8219195 mhi_dev_notify_sm_event] received:
MHI_DEV_EVENT_HW_ACC_WAKEUP
10567.849976: ep_pcie_handle_perst_irq: PCIe V1711211: No. 1018 PERST
deassertion
10567.850053: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_HW_ACC_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.850071: ep_pcie_core_wakeup_host_internal: PCIe V1711211: request to
assert WAKE# when in D3hot
10567.860093: ep_pcie_core_issue_inband_pme: PCIe V1711211: request to
assert inband wake.

Change-Id: I85fb37c4171c5ef4974c573f0abba199cb718a84
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
2024-08-23 14:36:50 +05:30
QCTECMDR Service
0f0f48e68a Merge "msm_ipa: Install exception rule for PPPoE-MPLS" 2024-08-13 00:40:16 -07:00
Himansu Nayak
752e583b65 msm_ipa: Install exception rule for PPPoE-MPLS
Add code to install exception rule for icmp
and dhcp packet in DL direction for v4 and v6.

Change-Id: I27a2c3cb9cb342a5e4d22246e350bf721d784a15
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
2024-08-13 00:15:43 +05:30
QCTECMDR Service
13dd90963a Merge "Merge android11-5.4.274 (564901b) into msm-5.4" 2024-08-03 23:34:20 -07:00
kamasali Satyanarayan
f60d08db83 Merge android11-5.4.274 (564901b) into msm-5.4
* remotes/origin/tmp-564901b:
  ANDROID: 16K: Only check basename of linker context
  UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
  ANDROID: ABI fixup for abi break in struct dst_ops
  BACKPORT: net: fix __dst_negative_advice() race
  UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
  ANDROID: 16K: Fix show maps CFI failure
  ANDROID: 16K: Handle pad VMA splits and merges
  ANDROID: 16K: madvise_vma_pad_pages: Remove filemap_fault check
  ANDROID: 16K: Only madvise padding from dynamic linker context
  ANDROID: 16K: Separate padding from ELF LOAD segment mappings
  ANDROID: 16K: Exclude ELF padding for fault around range
  ANDROID: 16K: Use MADV_DONTNEED to save VMA padding pages.
  ANDROID: 16K: Introduce ELF padding representation for VMAs
  ANDROID: 16K: Introduce /sys/kernel/mm/pgsize_miration/enabled
  Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
  Reapply "media: ttpci: fix two memleaks in budget_av_attach"
  Revert "media: rename VFL_TYPE_GRABBER to _VIDEO"
  Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO"
  Revert "media: ttpci: fix two memleaks in budget_av_attach"
  Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
  Revert "regmap: allow to define reg_update_bits for no bus configuration"
  Revert "regmap: Add bulk read/write callbacks into regmap_config"
  Revert "serial: max310x: fix IO data corruption in batched operations"
  Revert "geneve: make sure to pull inner header in geneve_rx()"
  ANDROID: GKI: add snd_compr_stop_error to Xiaomi_abi
  UPSTREAM: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  UPSTREAM: netfilter: nf_tables: release batch on table validation from abort path
  UPSTREAM: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  Linux 5.4.274
  firmware: meson_sm: fix to avoid potential NULL pointer dereference
  ip_gre: do not report erspan version on GRE interface
  erspan: Check IFLA_GRE_ERSPAN_VER is set.
  VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
  Bluetooth: btintel: Fixe build regression
  x86/alternative: Don't call text_poke() in lazy TLB mode
  drm/i915/gt: Reset queue_priority_hint on parking
  x86/mm/pat: fix VM_PAT handling in COW mappings
  virtio: reenable config if freezing device failed
  drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  netfilter: nf_tables: discard table flag update with pending basechain deletion
  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  netfilter: nf_tables: release batch on table validation from abort path
  netfilter: nf_tables: reject new basechain after table flag update
  fbmon: prevent division by zero in fb_videomode_from_videomode()
  fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
  usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
  usb: typec: tcpci: add generic tcpci fallback compatible
  tools: iio: replace seekdir() in iio_generic_buffer
  ktest: force $buildonly = 1 for 'make_warnings_file' test type
  Input: allocate keycode for Display refresh rate toggle
  block: prevent division by zero in blk_rq_stat_sum()
  Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
  SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
  drm/amd/display: Fix nanosec stat overflow
  media: sta2x11: fix irq handler cast
  isofs: handle CDs with bad root inode but good Joliet root directory
  scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
  sysv: don't call sb_bread() with pointers_lock held
  Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
  Bluetooth: btintel: Fix null ptr deref in btintel_read_version
  btrfs: send: handle path ref underflow in header iterate_inode_ref()
  btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
  btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
  tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
  ionic: set adminq irq affinity
  arm64: dts: rockchip: fix rk3399 hdmi ports node
  arm64: dts: rockchip: fix rk3328 hdmi ports node
  panic: Flush kernel log buffer at the end
  VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
  wifi: ath9k: fix LNA selection in ath_ant_try_scan()
  s390/entry: align system call table on 8 bytes
  x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
  ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
  ata: sata_mv: Fix PCI device ID table declaration compilation warning
  scsi: mylex: Fix sysfs buffer lengths
  ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
  ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
  net: ravb: Always process TX descriptor ring
  erspan: make sure erspan_base_hdr is present in skb->head
  erspan: Add type I version 0 support.
  init: open /initrd.image with O_LARGEFILE
  initramfs: switch initramfs unpacking to struct file based APIs
  fs: add a vfs_fchmod helper
  fs: add a vfs_fchown helper
  staging: vc04_services: fix information leak in create_component()
  staging: vc04_services: changen strncpy() to strscpy_pad()
  staging: mmal-vchiq: Fix client_component for 64 bit kernel
  staging: mmal-vchiq: Allocate and free components as required
  i40e: fix vf may be used uninitialized in this function warning
  ipv6: Fix infinite recursion in fib6_dump_done().
  selftests: reuseaddr_conflict: add missing new line at the end of the output
  net: stmmac: fix rx queue priority assignment
  net/sched: act_skbmod: prevent kernel-infoleak
  bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
  netfilter: nf_tables: flush pending destroy work before exit_net release
  mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
  Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
  vfio/platform: Create persistent IRQ handlers
  vfio/pci: Create persistent INTx handler
  vfio: Introduce interface to flush virqfd inject workqueue
  vfio/pci: Lock external INTx masking ops
  vfio/pci: Disable auto-enable of exclusive INTx IRQ
  net/rds: fix possible cp null dereference
  netfilter: nf_tables: disallow timeout for anonymous sets
  Bluetooth: Fix TOCTOU in HCI debugfs implementation
  Bluetooth: hci_event: set the conn encrypted before conn establishes
  x86/cpufeatures: Add new word for scattered features
  r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
  dm integrity: fix out-of-range warning
  tcp: properly terminate timers for kernel sockets
  ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
  nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
  USB: core: Fix deadlock in usb_deauthorize_interface()
  scsi: lpfc: Correct size for wqe for memset()
  x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
  scsi: qla2xxx: Fix command flush on cable pull
  usb: udc: remove warning when queue disabled ep
  usb: dwc2: gadget: LPM flow fix
  usb: dwc2: host: Fix ISOC flow in DDMA mode
  usb: dwc2: host: Fix hibernation flow
  usb: dwc2: host: Fix remote wakeup from hibernation
  scsi: core: Fix unremoved procfs host directory regression
  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
  usb: cdc-wdm: close race between read and workqueue
  mmc: core: Avoid negative index with array access
  mmc: core: Initialize mmc_blk_ioc_data
  exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
  mm/migrate: set swap entry values of THP tail pages properly.
  mm/memory-failure: fix an incorrect use of tail pages
  vt: fix memory overlapping when deleting chars in the buffer
  bounds: support non-power-of-two CONFIG_NR_CPUS
  powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
  efivarfs: Request at most 512 bytes for variable names
  perf/core: Fix reentry problem in perf_output_read_group()
  loop: loop_set_status_from_info() check before assignment
  loop: Check for overflow while configuring loop
  loop: Factor out configuring loop from status
  loop: Refactor loop_set_status() size calculation
  loop: Factor out setting loop device size
  loop: Remove sector_t truncation checks
  loop: Call loop_config_discard() only after new config is applied
  Revert "loop: Check for overflow while configuring loop"
  btrfs: allocate btrfs_ioctl_defrag_range_args on stack
  printk: Update @console_may_schedule in console_trylock_spinning()
  xen/events: close evtchn after mapping cleanup
  x86/speculation: Support intra-function call validation
  objtool: Add support for intra-function calls
  objtool: is_fentry_call() crashes if call has no destination
  fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  vt: fix unicode buffer corruption when deleting characters
  tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
  usb: port: Don't try to peer unused USB ports based on location
  usb: gadget: ncm: Fix handling of zero block length packets
  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
  ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
  xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
  netfilter: nf_tables: reject constant set with timeout
  netfilter: nf_tables: disallow anonymous set with timeout flag
  netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
  comedi: comedi_test: Prevent timers rescheduling during deletion
  dm snapshot: fix lockup in dm_exception_table_exit
  ahci: asm1064: asm1166: don't limit reported ports
  ahci: asm1064: correct count of reported ports
  x86/CPU/AMD: Update the Zenbleed microcode revisions
  nilfs2: prevent kernel bug at submit_bh_wbc()
  nilfs2: use a more common logging style
  nilfs2: fix failure to detect DAT corruption in btree and direct mappings
  memtest: use {READ,WRITE}_ONCE in memory scanning
  drm/vc4: hdmi: do not return negative values from .get_modes()
  drm/imx/ipuv3: do not return negative values from .get_modes()
  drm/exynos: do not return negative values from .get_modes()
  s390/zcrypt: fix reference counting on zcrypt card objects
  soc: fsl: qbman: Use raw spinlock for cgr_lock
  soc: fsl: qbman: Add CGR update function
  soc: fsl: qbman: Add helper for sanity checking cgr ops
  soc: fsl: qbman: Always disable interrupts when taking cgr_lock
  ring-buffer: Fix full_waiters_pending in poll
  ring-buffer: Fix resetting of shortest_full
  vfio/platform: Disable virqfds on cleanup
  kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
  speakup: Fix 8bit characters from direct synth
  slimbus: core: Remove usage of the deprecated ida_simple_xx() API
  nvmem: meson-efuse: fix function pointer type mismatch
  firmware: meson_sm: Rework driver as a proper platform driver
  ext4: fix corruption during on-line resize
  hwmon: (amc6821) add of_match table
  mmc: core: Fix switch on gp3 partition
  dm-raid: fix lockdep waring in "pers->hot_add_disk"
  Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
  PCI/PM: Drain runtime-idle callbacks before driver removal
  PCI: Drop pci_device_remove() test of pci_dev->driver
  btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
  fuse: don't unhash root
  mmc: tmio: avoid concurrent runs of mmc_request_done()
  PM: sleep: wakeirq: fix wake irq warning in system suspend
  USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
  USB: serial: option: add MeiG Smart SLM320 product
  USB: serial: cp210x: add ID for MGP Instruments PDS100
  USB: serial: add device ID for VeriFone adapter
  USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
  powerpc/fsl: Fix mfpmr build errors with newer binutils
  clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
  clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
  clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
  PM: suspend: Set mem_sleep_current during kernel command line setup
  parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
  parisc: Fix csum_ipv6_magic on 64-bit systems
  parisc: Fix csum_ipv6_magic on 32-bit systems
  parisc: Fix ip_fast_csum
  parisc: Do not hardcode registers in checksum functions
  mtd: rawnand: meson: fix scrambling mode value in command macro
  ubi: correct the calculation of fastmap size
  ubi: Check for too small LEB size in VTBL code
  ubifs: Set page uptodate in the correct place
  fat: fix uninitialized field in nostale filehandles
  ext4: correct best extent lstart adjustment logic
  selftests/mqueue: Set timeout to 180 seconds
  crypto: qat - resolve race condition during AER recovery
  crypto: qat - fix double free during reset
  sparc: vDSO: fix return value of __setup handler
  sparc64: NMI watchdog: fix return value of __setup handler
  KVM: Always flush async #PF workqueue when vCPU is being destroyed
  media: xc4000: Fix atomicity violation in xc4000_get_frequency
  serial: max310x: fix NULL pointer dereference in I2C instantiation
  arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
  ARM: dts: mmp2-brownstone: Don't redeclare phandle references
  smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
  smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
  clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
  media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
  wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
  timers: Rename del_timer_sync() to timer_delete_sync()
  timers: Use del_timer_sync() even on UP
  timers: Update kernel-doc for various functions
  x86/bugs: Use sysfs_emit()
  x86/cpu: Support AMD Automatic IBRS
  Documentation/hw-vuln: Update spectre doc
  amdkfd: use calloc instead of kzalloc to avoid integer overflow
  Linux 5.4.273
  regmap: Add missing map->bus check
  spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
  bpf: report RCU QS in cpumap kthread
  rcu: add a helper to report consolidated flavor QS
  netfilter: nf_tables: do not compare internal table flags on updates
  ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
  octeontx2-af: Use separate handlers for interrupts
  net/bnx2x: Prevent access to a freed page in page_pool
  hsr: Handle failures in module init
  rds: introduce acquire/release ordering in acquire/release_in_xmit()
  packet: annotate data-races around ignore_outgoing
  hsr: Fix uninit-value access in hsr_get_node()
  s390/vtime: fix average steal time calculation
  octeontx2-af: Use matching wake_up API variant in CGX command interface
  usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
  staging: greybus: fix get_channel_from_mode() failure path
  serial: 8250_exar: Don't remove GPIO device on suspend
  rtc: mt6397: select IRQ_DOMAIN instead of depending on it
  kconfig: fix infinite loop when expanding a macro at the end of file
  tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
  serial: max310x: fix syntax error in IRQ error message
  tty: vt: fix 20 vs 0x20 typo in EScsiignore
  afs: Revert "afs: Hide silly-rename files from userspace"
  NFS: Fix an off by one in root_nfs_cat()
  watchdog: stm32_iwdg: initialize default timeout
  net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
  scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
  RDMA/device: Fix a race between mad_client and cm_client init
  scsi: csiostor: Avoid function pointer casts
  ALSA: usb-audio: Stop parsing channels bits when all channels are found.
  clk: Fix clk_core_get NULL dereference
  sparc32: Fix section mismatch in leon_pci_grpci
  backlight: lp8788: Fully initialize backlight_properties during probe
  backlight: lm3639: Fully initialize backlight_properties during probe
  backlight: da9052: Fully initialize backlight_properties during probe
  backlight: lm3630a: Don't set bl->props.brightness in get_brightness
  backlight: lm3630a: Initialize backlight_properties on init
  powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
  drm/msm/dpu: add division of drm_display_mode's hskew parameter
  powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
  drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
  media: ttpci: fix two memleaks in budget_av_attach
  media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
  media: rename VFL_TYPE_GRABBER to _VIDEO
  media: v4l2-core: correctly validate video and metadata ioctls
  media: go7007: fix a memleak in go7007_load_encoder
  media: dvb-frontends: avoid stack overflow warnings with clang
  media: pvrusb2: fix uaf in pvr2_context_set_notify
  drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
  ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
  mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
  mtd: maps: physmap-core: fix flash size larger than 32-bit
  crypto: arm/sha - fix function cast warnings
  mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
  mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
  drm/tegra: put drm_gem_object ref on error in tegra_fb_create
  clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
  PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
  drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
  clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
  media: pvrusb2: fix pvr2_stream_callback casts
  media: pvrusb2: remove redundant NULL check
  media: go7007: add check of return value of go7007_read_addr()
  media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
  perf stat: Avoid metric-only segv
  ALSA: seq: fix function cast warnings
  drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
  perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
  PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
  quota: Fix rcu annotations of inode dquot pointers
  quota: Fix potential NULL pointer dereference
  quota: simplify drop_dquot_ref()
  clk: qcom: reset: Ensure write completion on reset de/assertion
  clk: qcom: reset: Commonize the de/assert functions
  clk: qcom: reset: support resetting multiple bits
  clk: qcom: reset: Allow specifying custom reset delay
  media: edia: dvbdev: fix a use-after-free
  media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
  media: v4l2-tpg: fix some memleaks in tpg_alloc
  media: em28xx: annotate unchecked call to media_device_register()
  perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
  drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
  perf record: Fix possible incorrect free in record__switch_output()
  PCI/DPC: Print all TLP Prefixes, not just the first
  media: tc358743: register v4l2 async device only after successful setup
  dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
  drm/rockchip: lvds: do not overwrite error code
  drm: Don't treat 0 as -1 in drm_fixp2int_ceil
  drm/rockchip: inno_hdmi: Fix video timing
  drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
  drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
  drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
  drm/tegra: dsi: Make use of the helper function dev_err_probe()
  gpu: host1x: mipi: Update tegra_mipi_request() to be node based
  drm/tegra: dsi: Add missing check for of_find_device_by_node
  dm: call the resume method on internal suspend
  dm raid: fix false positive for requeue needed during reshape
  nfp: flower: handle acti_netdevs allocation failure
  net/x25: fix incorrect parameter validation in the x25_getsockopt() function
  net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
  udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
  l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
  tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
  net: hns3: fix port duplex configure error in IMP reset
  net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
  ipv6: fib6_rules: flush route cache when rule is changed
  bpf: Fix stackmap overflow check on 32-bit arches
  bpf: Fix hashtab overflow check on 32-bit arches
  sr9800: Add check for usbnet_get_endpoints
  Bluetooth: hci_core: Fix possible buffer overflow
  Bluetooth: Remove superfluous call to hci_conn_check_pending()
  igb: Fix missing time sync events
  igb: move PEROUT and EXTTS isr logic to separate functions
  mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
  SUNRPC: fix some memleaks in gssx_dec_option_array
  x86, relocs: Ignore relocations in .notes section
  ACPI: scan: Fix device check notification handling
  ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
  ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
  ARM: dts: imx6dl-yapp4: Move phy reset into switch node
  ARM: dts: arm: realview: Fix development chip ROM compatible value
  net: ena: Remove ena_select_queue
  net: ena: cosmetic: fix line break issues
  wifi: brcmsmac: avoid function pointer casts
  iommu/amd: Mark interrupt as managed
  bus: tegra-aconnect: Update dependency to ARCH_TEGRA
  ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
  arm64: dts: qcom: msm8996: Pad addresses
  arm64: dts: qcom: msm8996: Move regulator consumers to db820c
  arm64: dts: qcom: msm8996: Use node references in db820c
  arm64: dts: qcom: db820c: Move non-soc entries out of /soc
  bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
  bpf: Factor out bpf_spin_lock into helpers.
  bpf: Add typecast to bpf helpers to help BTF generation
  arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
  wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  net: blackhole_dev: fix build warning for ethh set but not used
  af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
  sock_diag: annotate data-races around sock_diag_handlers[family]
  wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
  wifi: wilc1000: fix RCU usage in connect path
  wifi: wilc1000: fix declarations ordering
  wifi: b43: Disable QoS for bcm4331
  wifi: b43: Stop correct queue in DMA worker when QoS is disabled
  b43: main: Fix use true/false for bool type
  wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
  wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
  b43: dma: Fix use true/false for bool type variable
  wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
  timekeeping: Fix cross-timestamp interpolation for non-x86
  timekeeping: Fix cross-timestamp interpolation corner case decision
  timekeeping: Fix cross-timestamp interpolation on counter wrap
  aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  fs/select: rework stack allocation hack for clang
  nbd: null check for nla_nest_start
  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
  ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
  ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
  Input: gpio_keys_polled - suppress deferred probe error for gpio
  ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
  firewire: core: use long bus reset on gap count error
  Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
  btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
  dm-verity, dm-crypt: align "struct bvec_iter" correctly
  block: sed-opal: handle empty atoms when parsing response
  parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
  net/iucv: fix the allocation size of iucv_path_table array
  RDMA/mlx5: Relax DEVX access upon modify commands
  HID: multitouch: Add required quirk for Synaptics 0xcddc device
  MIPS: Clear Cause.BD in instruction_pointer_set
  x86/xen: Add some null pointer checking to smp.c
  ASoC: rt5645: Make LattePanda board DMI match more precise
  selftests: tls: use exact comparison in recv_partial
  io_uring: drop any code related to SCM_RIGHTS
  io_uring/unix: drop usage of io_uring socket
  UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845
  Linux 5.4.272
  arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
  arm64: dts: qcom: add PDC interrupt controller for SDM845
  serial: max310x: fix IO data corruption in batched operations
  serial: max310x: implement I2C support
  serial: max310x: make accessing revision id interface-agnostic
  regmap: Add bulk read/write callbacks into regmap_config
  regmap: allow to define reg_update_bits for no bus configuration
  serial: max310x: Unprepare and disable clock in error path
  getrusage: use sig->stats_lock rather than lock_task_sighand()
  getrusage: use __for_each_thread()
  getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
  getrusage: add the "signal_struct *sig" local variable
  y2038: rusage: use __kernel_old_timeval
  hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
  hv_netvsc: use netif_is_bond_master() instead of open code
  hv_netvsc: Make netvsc/VF binding check both MAC and serial number
  Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
  serial: max310x: prevent infinite while() loop in port startup
  serial: max310x: use a separate regmap for each port
  serial: max310x: use regmap methods for SPI batch operations
  serial: max310x: Make use of device properties
  serial: max310x: fail probe if clock crystal is unstable
  serial: max310x: Try to get crystal clock rate from property
  serial: max310x: Use devm_clk_get_optional() to get the input clock
  um: allow not setting extra rpaths in the linux binary
  selftests: mm: fix map_hugetlb failure on 64K page size systems
  netrom: Fix data-races around sysctl_net_busy_read
  netrom: Fix a data-race around sysctl_netrom_link_fails_count
  netrom: Fix a data-race around sysctl_netrom_routing_control
  netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
  netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
  netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
  netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
  netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
  netrom: Fix a data-race around sysctl_netrom_transport_timeout
  netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
  netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
  netrom: Fix a data-race around sysctl_netrom_default_path_quality
  netfilter: nf_conntrack_h323: Add protection for bmp length out of range
  netfilter: nft_ct: fix l3num expectations with inet pseudo family
  net/rds: fix WARNING in rds_conn_connect_if_down
  net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
  geneve: make sure to pull inner header in geneve_rx()
  ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
  net: lan78xx: fix runtime PM count underflow on link stop
  lan78xx: Fix race conditions in suspend/resume handling
  lan78xx: Fix partial packet errors on suspend/resume
  lan78xx: Add missing return code checks
  lan78xx: Fix white space and style issues
  Linux 5.4.271
  gpio: 74x164: Enable output pins after registers are reset
  fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
  cachefiles: fix memory leak in cachefiles_add_cache()
  x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
  mmc: core: Fix eMMC initialization with 1-bit bus connection
  dmaengine: fsl-qdma: init irq after reg initialization
  dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
  btrfs: dev-replace: properly validate device names
  wifi: nl80211: reject iftype change with mesh ID change
  gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  afs: Fix endless loop in directory parsing
  ALSA: Drop leftover snd-rtctimer stuff from Makefile
  power: supply: bq27xxx-i2c: Do not free non existing IRQ
  efi/capsule-loader: fix incorrect allocation size
  rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
  netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
  Bluetooth: Enforce validation on max value of connection interval
  Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
  Bluetooth: Avoid potential use-after-free in hci_error_reset
  net: usb: dm9601: fix wrong return value in dm9601_mdio_read
  lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
  ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
  tun: Fix xdp_rxq_info's queue_index when detaching
  net: ip_tunnel: prevent perpetual headroom growth
  netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  ANDROID: GKI: update .xml file due to USB changes in 5.4.270
  Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
  Revert "hrtimer: Report offline hrtimer enqueue"
  Revert "drm/mipi-dsi: Fix detach call without attach"
  Linux 5.4.270
  scripts/bpf: Fix xdp_md forward declaration typo
  fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
  drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
  drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
  netfilter: nf_tables: set dormant flag on hook register failure
  tls: stop recv() if initial process_rx_list gave us non-DATA
  tls: rx: drop pointless else after goto
  tls: rx: jump to a more appropriate label
  s390: use the correct count for __iowrite64_copy()
  packet: move from strlcpy with unused retval to strscpy
  ipv6: sr: fix possible use-after-free and null-ptr-deref
  afs: Increase buffer size in afs_update_volume_status()
  ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
  ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
  nouveau: fix function cast warnings
  scsi: jazz_esp: Only build if SCSI core is builtin
  bpf, scripts: Correct GPL license name
  scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
  RDMA/srpt: fix function pointer cast warnings
  RDMA/srpt: Make debug output more detailed
  RDMA/bnxt_re: Return error for SRQ resize
  IB/hfi1: Fix a memleak in init_credit_return
  usb: roles: don't get/set_role() when usb_role_switch is unregistered
  usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  usb: cdns3: fix memory double free when handle zero packet
  usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
  ARM: ep93xx: Add terminator to gpiod_lookup_table
  l2tp: pass correct message length to ip6_append_data
  PCI/MSI: Prevent MSI hardware interrupt number truncation
  gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
  dm-crypt: don't modify the data when using authenticated encryption
  IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
  PCI: tegra: Fix OF node reference leak
  PCI: tegra: Fix reporting GPIO error value
  arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
  drm/amdgpu: Fix type of second parameter in trans_msg() callback
  iomap: Set all uptodate bits for an Uptodate page
  dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  x86/alternatives: Disable KASAN in apply_alternatives()
  drm/amdgpu: Check for valid number of registers to read
  Revert "drm/sun4i: dsi: Change the start delay calculation"
  ALSA: hda/realtek - Enable micmute LED on and HP system
  selftests/bpf: Avoid running unprivileged tests with alignment requirements
  net: bridge: clear bridge's private skb space on xmit
  spi: mt7621: Fix an error message in mt7621_spi_probe()
  pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
  pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
  tcp: add annotations around sk->sk_shutdown accesses
  tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
  tcp: factor out __tcp_close() helper
  pmdomain: renesas: r8a77980-sysc: CR7 must be always on
  s390/qeth: Fix potential loss of L3-IP@ in case of network issues
  virtio-blk: Ensure no requests in virtqueues before deleting vqs.
  firewire: core: send bus reset promptly on gap count error
  scsi: lpfc: Use unsigned type for num_sge
  hwmon: (coretemp) Enlarge per package core count limit
  nvmet-fc: abort command when there is no binding
  netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
  ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
  nvmet-tcp: fix nvme tcp ida memory leak
  regulator: pwm-regulator: Add validity checks in continuous .get_voltage
  ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
  ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
  ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
  ahci: asm1166: correct count of reported ports
  fbdev: sis: Error out if pixclock equals zero
  fbdev: savage: Error out if pixclock equals zero
  wifi: mac80211: fix race condition on enabling fast-xmit
  wifi: cfg80211: fix missing interfaces when dumping
  dmaengine: fsl-qdma: increase size of 'irq_name'
  dmaengine: shdma: increase size of 'dev_id'
  scsi: target: core: Add TMF to tmr_list handling
  sched/rt: Disallow writing invalid values to sched_rt_period_us
  sched/rt: Fix sysctl_sched_rr_timeslice intial value
  userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
  nilfs2: replace WARN_ONs for invalid DAT metadata block requests
  memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
  sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
  net/sched: Retire dsmark qdisc
  net/sched: Retire ATM qdisc
  net/sched: Retire CBQ qdisc
  KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
  KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
  Linux 5.4.269
  of: gpio unittest kfree() wrong object
  of: unittest: fix EXPECT text for gpio hog errors
  net: bcmgenet: Fix EEE implementation
  Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
  netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
  lsm: new security_file_ioctl_compat() hook
  drm/msm/dsi: Enable runtime PM
  PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
  PM: runtime: add devm_pm_runtime_enable helper
  nilfs2: fix potential bug in end_buffer_async_write
  sched/membarrier: reduce the ability to hammer on sys_membarrier
  net: prevent mss overflow in skb_segment()
  netfilter: ipset: Missing gc cancellations fixed
  netfilter: ipset: fix performance regression in swap operation
  KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
  mips: Fix max_mapnr being uninitialized on early stages
  arch, mm: remove stale mentions of DISCONIGMEM
  bus: moxtet: Add spi device table
  Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
  tracing: Inform kmemleak of saved_cmdlines allocation
  pmdomain: core: Move the unused cleanup to a _sync initcall
  can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
  irqchip/irq-brcmstb-l2: Add write memory barrier before exit
  nfp: flower: prevent re-adding mac index for bonded port
  nfp: use correct macro for LengthSelect in BAR config
  nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
  nilfs2: fix data corruption in dsync block recovery for small block sizes
  ALSA: hda/conexant: Add quirk for SWS JS201D
  mmc: slot-gpio: Allow non-sleeping GPIO ro
  x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
  x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
  serial: max310x: improve crystal stable clock detection
  serial: max310x: set default value when reading clock ready bit
  ring-buffer: Clean ring_buffer_poll_wait() error return
  iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
  staging: iio: ad5933: fix type mismatch regression
  tracing: Fix wasted memory in saved_cmdlines logic
  ext4: fix double-free of blocks due to wrong extents moved_len
  misc: fastrpc: Mark all sessions as invalid in cb_remove
  binder: signal epoll threads of self-work
  ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
  xen-netback: properly sync TX responses
  nfc: nci: free rx_data_reassembly skb on NCI device cleanup
  kbuild: Fix changing ELF file type for output of gen_btf for big endian
  firewire: core: correct documentation of fw_csr_string() kernel API
  scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
  i2c: i801: Fix block process call transactions
  i2c: i801: Remove i801_set_block_buffer_mode
  usb: f_mass_storage: forbid async queue when shutdown happen
  USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
  HID: wacom: Do not register input devices until after hid_hw_start
  HID: wacom: generic: Avoid reporting a serial of '0' to userspace
  mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
  tracing/trigger: Fix to return error if failed to alloc snapshot
  i40e: Fix waiting for queues of all VSIs to be disabled
  MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
  ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
  spi: ppc4xx: Drop write-only variable
  of: unittest: Fix compile in the non-dynamic case
  of: unittest: add overlay gpio test to catch gpio hog problem
  btrfs: send: return EOPNOTSUPP on unknown flags
  btrfs: forbid deleting live subvol qgroup
  btrfs: forbid creating subvol qgroups
  netfilter: nft_set_rbtree: skip end interval element from gc
  net: stmmac: xgmac: fix a typo of register name in DPP safety handling
  net: stmmac: xgmac: use #define for string constants
  vhost: use kzalloc() instead of kmalloc() followed by memset()
  Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
  hrtimer: Report offline hrtimer enqueue
  USB: serial: cp210x: add ID for IMST iM871A-USB
  USB: serial: option: add Fibocom FM101-GL variant
  USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
  net/af_iucv: clean up a try_then_request_module()
  netfilter: nft_ct: reject direction for ct id
  netfilter: nft_compat: restrict match/target protocol to u16
  netfilter: nft_compat: reject unused compat flag
  ppp_async: limit MRU to 64K
  tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
  rxrpc: Fix response to PING RESPONSE ACKs to a dead call
  inet: read sk->sk_family once in inet_recv_error()
  hwmon: (coretemp) Fix bogus core_id to attr name mapping
  hwmon: (coretemp) Fix out-of-bounds memory access
  hwmon: (aspeed-pwm-tacho) mutex for tach reading
  atm: idt77252: fix a memleak in open_card_ubr0
  selftests: net: avoid just another constant wait
  net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
  phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
  dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
  phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
  dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
  dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
  bonding: remove print in bond_verify_device_path
  HID: apple: Add 2021 magic keyboard FN key mapping
  HID: apple: Swap the Fn and Left Control keys on Apple keyboards
  HID: apple: Add support for the 2021 Magic Keyboard
  net: sysfs: Fix /sys/class/net/<iface> path
  af_unix: fix lockdep positive in sk_diag_dump_icons()
  net: ipv4: fix a memleak in ip_setup_cork
  netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
  netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
  llc: call sock_orphan() at release time
  ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
  ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
  ixgbe: Refactor overtemp event handling
  ixgbe: Refactor returning internal error codes
  ixgbe: Remove non-inclusive language
  net: remove unneeded break
  scsi: isci: Fix an error code problem in isci_io_request_build()
  wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
  perf: Fix the nr_addr_filters fix
  drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
  ceph: fix deadlock or deadcode of misusing dget()
  blk-mq: fix IO hang from sbitmap wakeup race
  virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
  libsubcmd: Fix memory leak in uniq()
  PCI/AER: Decode Requester ID when no error info found
  fs/kernfs/dir: obey S_ISGID
  usb: hub: Replace hardcoded quirk value with BIT() macro
  PCI: switchtec: Fix stdev_release() crash after surprise hot remove
  PCI: Only override AMD USB controller if required
  mfd: ti_am335x_tscadc: Fix TI SoC dependencies
  i3c: master: cdns: Update maximum prescaler value for i2c clock
  um: net: Fix return type of uml_net_start_xmit()
  um: Don't use vfprintf() for os_info()
  um: Fix naming clash between UML and scheduler
  leds: trigger: panic: Don't register panic notifier if creating the trigger failed
  drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
  drm/amdgpu: Let KFD sync with VM fences
  clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
  clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
  drm/msm/dpu: Ratelimit framedone timeout msgs
  media: ddbridge: fix an error code problem in ddb_probe
  IB/ipoib: Fix mcast list locking
  drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
  ALSA: hda: Intel: add HDA_ARL PCI ID support
  PCI: add INTEL_HDA_ARL to pci_ids.h
  media: rockchip: rga: fix swizzling for RGB formats
  media: stk1160: Fixed high volume of stk1160_dbg messages
  drm/mipi-dsi: Fix detach call without attach
  drm/framebuffer: Fix use of uninitialized variable
  drm/drm_file: fix use of uninitialized variable
  RDMA/IPoIB: Fix error code return in ipoib_mcast_join
  fast_dput(): handle underflows gracefully
  ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
  f2fs: fix to check return value of f2fs_reserve_new_block()
  wifi: cfg80211: free beacon_ies when overridden from hidden BSS
  wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
  wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
  arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
  arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
  md: Whenassemble the array, consult the superblock of the freshest device
  block: prevent an integer overflow in bvec_try_merge_hw_page
  ARM: dts: imx23/28: Fix the DMA controller node name
  ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
  ARM: dts: imx27-apf27dev: Fix LED name
  ARM: dts: imx25/27: Pass timing0
  ARM: dts: imx1: Fix sram node
  ARM: dts: imx27: Fix sram node
  ARM: dts: imx: Use flash@0,0 pattern
  ARM: dts: imx25/27-eukrea: Fix RTC node name
  ARM: dts: rockchip: fix rk3036 hdmi ports node
  scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
  scsi: libfc: Don't schedule abort twice
  bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
  ARM: dts: imx7s: Fix nand-controller #size-cells
  ARM: dts: imx7s: Fix lcdif compatible
  ARM: dts: imx7d: Fix coresight funnel ports
  bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
  PCI: Add no PM reset quirk for NVIDIA Spectrum devices
  scsi: lpfc: Fix possible file string name overflow when updating firmware
  selftests/bpf: Fix pyperf180 compilation failure with clang18
  selftests/bpf: satisfy compiler by having explicit return in btf test
  wifi: rt2x00: restart beacon queue when hardware reset
  ext4: avoid online resizing failures due to oversized flex bg
  ext4: remove unnecessary check from alloc_flex_gd()
  ext4: unify the type of flexbg_size to unsigned int
  ext4: fix inconsistent between segment fstrim and full fstrim
  ecryptfs: Reject casefold directory inodes
  SUNRPC: Fix a suspicious RCU usage warning
  KVM: s390: fix setting of fpc register
  s390/ptrace: handle setting of fpc register correctly
  jfs: fix array-index-out-of-bounds in diNewExt
  rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
  afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
  crypto: stm32/crc32 - fix parsing list of devices
  pstore/ram: Fix crash when setting number of cpus to an odd number
  jfs: fix uaf in jfs_evict_inode
  jfs: fix array-index-out-of-bounds in dbAdjTree
  jfs: fix slab-out-of-bounds Read in dtSearch
  UBSAN: array-index-out-of-bounds in dtSplitRoot
  FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
  ACPI: extlog: fix NULL pointer dereference check
  PNP: ACPI: fix fortify warning
  ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
  audit: Send netlink ACK before setting connection in auditd_set
  regulator: core: Only increment use_count when enable_count changes
  perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
  x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
  powerpc/lib: Validate size for vector operations
  powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
  powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
  powerpc: Fix build error due to is_valid_bugaddr()
  powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  x86/entry/ia32: Ensure s32 is sign extended to s64
  tick/sched: Preserve number of idle sleeps across CPU hotplug events
  mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
  spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
  gpio: eic-sprd: Clear interrupt after set the interrupt type
  drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
  drm/exynos: fix accidental on-stack copy of exynos_drm_plane
  drm/bridge: nxp-ptn3460: simplify some error checking
  drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
  drm: Don't unref the same fb many times by mistake due to deadlock handling
  gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
  netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  rbd: don't move requests to the running list on errors
  btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
  btrfs: don't warn if discard range is not aligned to sector
  btrfs: tree-checker: fix inline ref size in error messages
  btrfs: ref-verify: free ref cache before clearing mount opt
  net: fec: fix the unhandled context fault from smmu
  fjes: fix memleaks in fjes_hw_setup
  netfilter: nf_tables: validate NFPROTO_* family
  netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
  net/mlx5e: fix a double-free in arfs_create_groups
  net/mlx5: Use kfree(ft->g) in arfs_create_groups()
  net/mlx5: DR, Use the right GVMI number for drop action
  netlink: fix potential sleeping issue in mqueue_flush_file
  tcp: Add memory barrier to tcp_push()
  afs: Hide silly-rename files from userspace
  tracing: Ensure visibility when inserting an element into tracing_map
  net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
  llc: Drop support for ETH_P_TR_802_2.
  llc: make llc_ui_sendmsg() more robust against bonding changes
  vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
  net/smc: fix illegal rmb_desc access in SMC-D connection dump
  x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
  powerpc: Use always instead of always-y in for crtsavres.o
  fs: move S_ISGID stripping into the vfs_*() helpers
  fs: add mode_strip_sgid() helper
  mtd: spinand: macronix: Fix MX35LFxGE4AD page size
  block: Remove special-casing of compound pages
  rename(): fix the locking of subdirectories
  ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
  nouveau/vmm: don't set addr on the fail path to avoid warning
  mmc: core: Use mrq.sbc in close-ended ffu
  arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
  parisc/firmware: Fix F-extend for PDC addresses
  rpmsg: virtio: Free driver_override when rpmsg_remove()
  hwrng: core - Fix page fault dead lock on mmap-ed hwrng
  PM: hibernate: Enforce ordering during image compression/decompression
  crypto: api - Disallow identical driver names
  ext4: allow for the last group to be marked as trimmed
  serial: sc16is7xx: add check for unsupported SPI modes during probe
  spi: introduce SPI_MODE_X_MASK macro
  serial: sc16is7xx: set safe default SPI clock frequency
  units: add the HZ macros
  units: change from 'L' to 'UL'
  units: Add Watt units
  include/linux/units.h: add helpers for kelvin to/from Celsius conversion
  PCI: mediatek: Clear interrupt status before dispatching handler

Conflicts:
     both modified:   include/linux/timer.h
     both modified:   mm/memory-failure.c
     both modified:   mm/mlock.c
     both modified:   mm/mprotect.c
     both modified:   scripts/Makefile.extrawarn

Change-Id: Ia59be9dbba9400fa82dcd3c3a7d50ee6012701fb
Signed-off-by: kamasali Satyanarayan <kamasali@qti.qualcomm.com>
2024-07-24 20:38:43 -07:00
Nishant Pandey
01f564dfc6 securemsm-kernel: Decrement the server object ref count in mutex context
Decrement the smcinvoke server object refcount in mutex context
so that we never get an object which is being freed.

Change-Id: I1bab3d630436923c7eb60f2d46dcc3f2bd037097
Signed-off-by: Nishant Pandey <quic_nishpand@quicinc.com>
2024-07-24 04:59:36 -07:00
Daniel Perez-Zoghbi
ed97e9cf1d qcedev: fix UAF in qcedev_smmu
External researcher found UAF in qcedev_smmu.c on an error condition in
qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it
is still kept in the registeredbufs list. The fix removes it from the
list before freeing binfo.

Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd
Signed-off-by: Daniel Perez-Zoghbi <quic_dperezzo@quicinc.com>
2024-07-22 20:59:38 -07:00
Lee Jones
7453ecf4d1 UPSTREAM: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream.

Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.

There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.

Bug: 346754046
Signed-off-by: Lee Jones <lee@kernel.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit d1205033e912f9332c1dbefa812e6ceb0575ce0a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Id9a34f3e5495aef0d2a800a1386210f4d9fa8116
2024-07-22 16:28:44 +01:00
QCTECMDR Service
8375c081bb Merge "msm: eva: Adding kref count for cvp_get_inst_from_id" 2024-07-22 04:48:15 -07:00
QCTECMDR Service
c2a6a9ca1a Merge "msm: eva: Fix UAF issue when remove module" 2024-07-21 23:56:22 -07:00
Greg Kroah-Hartman
56e07d95b5 Merge tag 'android11-5.4.278_r00' into android11-5.4
This catches android11-5.4 up to the 5.4.278 LTS release.  Included in
here are the following commits:

* 06b018ca42 Revert "drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector"
*   eb1a0358d1 Merge 5.4.278 into android11-5.4-lts
|\
| * 189ee9735a Linux 5.4.278
| * 2997e2fb1c nfs: fix undefined behavior in nfs_block_bits()
| * 7c72af16ab s390/ap: Fix crash in AP internal function modify_bitmap()
| * 896a7e7d0d ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
| * 95572c6b8e sparc: move struct termio to asm/termios.h
| * 0b45c25d60 xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
| * db00828250 net: fix __dst_negative_advice() race
| * 6b84387afe kdb: Use format-specifiers rather than memset() for padding in kdb_read()
| * 147bac05f2 kdb: Merge identical case statements in kdb_read()
| * 084e84ede9 kdb: Fix console handling when editing and tab-completing commands
| * 6a3836f29b kdb: Use format-strings rather than '\0' injection in kdb_read()
| * ddd2972d8e kdb: Fix buffer overflow during tab-complete
| * 2098b237ba sparc64: Fix number of online CPUs
| * 68682329fc intel_th: pci: Add Meteor Lake-S CPU support
| * 2101901dd5 net/9p: fix uninit-value in p9_client_rpc()
| * 636438dd9d net/ipv6: Fix route deleting failure when metric equals 0
| * 6396b33e98 crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
| * 95abba5168 crypto: ecrdsa - Fix module auto-load on add_key
| * a2579c802c KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
| * 86435f39c1 fbdev: savage: Handle err return when savagefb_check_var failed
| * bec5fe171f media: v4l2-core: hold videodev_lock until dev reg, finishes
| * 0dcb04014f media: mxl5xx: Move xpt structures off stack
| * 6ac608af7b media: mc: mark the media devnode as registered from the, start
| * c125ebaf03 arm64: dts: hi3798cv200: fix the size of GICR
| * 6649fea036 wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
| * 634ba3c97e md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
| * fe60a7bc34 arm64: tegra: Correct Tegra132 I2C alias
| * 68edebd1ff ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
| * 3b472ad39c ata: pata_legacy: make legacy_exit() work again
| * 5594971e02 drm/amdgpu: add error handle to avoid out-of-bounds
| * 8915dcd29a media: lgdt3306a: Add a check against null-pointer-def
| * c559a8d840 f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
| * 27fba38ddd x86/mm: Remove broken vsyscall emulation code from the page fault code
| * 9a7f481f3e vxlan: Fix regression when dropping packets due to invalid src addresses
| * 82933c84f1 nilfs2: fix use-after-free of timer for log writer thread
| * ffbda400b2 afs: Don't cross .backup mountpoint from backup volume
| * 6e23457791 io_uring: fail NOP if non-zero op flags is passed in
| * 63664389b6 mmc: core: Do not force a retune before RPMB switch
| * e4daa1a1ff binder: fix max_thread type inconsistency
| * 6ed45d20d3 SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
| * f5f4675960 genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
| * 74bfb8d90f ALSA: timer: Set lower bound of start tick time
| * 54768bacfd ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
| * ce05d4a3b0 spi: stm32: Don't warn about spurious interrupts
| * f13fc5113d kconfig: fix comparison to constant symbols, 'm', 'n'
| * 10f0af5234 netfilter: tproxy: bail out if IP has been disabled on the device
| * 582233516a net:fec: Add fec_enet_deinit()
| * 00a762ee6b net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
| * 2be4ac3d99 smsc95xx: use usbnet->driver_priv
| * a4ecfe6a98 smsc95xx: remove redundant function arguments
| * ca63fb7af9 enic: Validate length of nl attributes in enic_set_vf_port
| * 165b25e3ee dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
| * a921cd1f0c net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
| * 5f4278f151 nvmet: fix ns enable/disable possible hang
| * 27a6986af2 spi: Don't mark message DMA mapped when no transfer in it is
| * 3989b81785 netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
| * 2271803d9f nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
| * db58c41b51 nfc: nci: Fix kcov check in nci_rx_work()
| * 4b179b0cfc net: fec: avoid lock evasion when reading pps_enable
| * 43a9aaf632 virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
| * 22469a0335 arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
| * 09ef5c5e36 openvswitch: Set the skbuff pkt_type for proper pmtud support.
| * 6aacaa80d9 tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
| * 07b002723c params: lift param_set_uint_minmax to common code
| * 4a3fcf5372 ipv6: sr: fix memleak in seg6_hmac_init_algo
| * b1589a6eef sunrpc: fix NFSACL RPC retry on soft mount
| * 485ded868e nfc: nci: Fix uninit-value in nci_rx_work
| * eae8e2dcb0 x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
| * f5acbae737 null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
| * 2990b6c0a6 media: cec: cec-api: add locking in cec_release()
| * 8890dd70fa media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
| * 3f5c5d869e um: Fix the -Wmissing-prototypes warning for __switch_mm
| * 5b1796345d powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
| * b648756eb9 scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
| * ecf4ddc3ae media: stk1160: fix bounds checking in stk1160_copy_video()
| * dc1ff95602 um: Add winch to winch_handlers before registering winch IRQ
| * 94bf61b291 um: Fix return value in ubd_init()
| * 0a5ad8dc33 drm/msm/dpu: Always flush the slave INTF on the CTL
| * 2b486d2306 Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
| * 33d148cdb1 Input: ims-pcu - fix printf string overflow
| * b01d29acc8 libsubcmd: Fix parse-options memory leak
| * d9754fc9c0 serial: sh-sci: protect invalidating RXDMA on shutdown
| * cd97dcd412 f2fs: fix to release node block count in error path of f2fs_new_node_page()
| * 7420402619 extcon: max8997: select IRQ_DOMAIN instead of depending on it
| * b8c6b83cc3 ppdev: Add an error check in register_device
| * 5f3c34b719 ppdev: Remove usage of the deprecated ida_simple_xx() API
| * a0450d3f38 stm class: Fix a double free in stm_register_device()
| * 4591a1764a usb: gadget: u_audio: Clear uac pointer when freed.
| * eba6b40877 microblaze: Remove early printk call from cpuinfo-static.c
| * 0df1153511 microblaze: Remove gcc flag for non existing early_printk.c file
| * 463d714a58 iio: pressure: dps310: support negative temperature values
| * c0e9a72845 greybus: arche-ctrl: move device table to its right location
| * e728f8dfff serial: max3100: Fix bitwise types
| * 9db4222ed8 serial: max3100: Update uart_driver_registered on driver removal
| * ea9b35372b serial: max3100: Lock port->lock when calling uart_handle_cts_change()
| * 4ba0e40fdd firmware: dmi-id: add a release callback function
| * 7481337ab7 dmaengine: idma64: Add check for dma_set_max_seg_size
| * 002364b2d5 soundwire: cadence: fix invalid PDI offset
| * 98a649463a soundwire: cadence_master: improve PDI allocation
| * 6584388c03 soundwire: intel: don't filter out PDI0/1
| * 10568e442c soundwire: cadence/intel: simplify PDI/port mapping
| * e2c64246e5 greybus: lights: check return of get_channel_from_mode
| * 5c05727363 sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
| * 2137d07adb sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax
| * b5b2d42bb3 af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
| * 1fbfb483c1 netrom: fix possible dead-lock in nr_rt_ioctl()
| * fdee55c429 RDMA/IPoIB: Fix format truncation compilation errors
| * a7d9afa3dd selftests/kcmp: remove unused open mode
| * e7af24598d selftests/kcmp: Make the test output consistent and clear
| * 4420b73c7f SUNRPC: Fix gss_free_in_token_pages()
| * ff15f1100c sunrpc: removed redundant procp check
| * 9462d82504 ext4: avoid excessive credit estimate in ext4_tmpfile()
| * ce366a2c94 x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
| * 2679ddbf08 RDMA/hns: Use complete parentheses in macros
| * f5734138fb drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
| * bab3a580ee ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
| * 565d9ad7e5 drm/arm/malidp: fix a possible null pointer dereference
| * a790c8a742 fbdev: sh7760fb: allow modular build
| * a8c15b9f30 platform/x86: wmi: Make two functions static
| * 51184b721d media: radio-shark2: Avoid led_names truncations
| * 166e0d4d79 media: ngene: Add dvb_ca_en50221_init return value check
| * 472e95f220 fbdev: sisfb: hide unused variables
| * e8d37421d4 powerpc/fsl-soc: hide unused const variable
| * be34a1b351 drm/mediatek: Add 0 size check to mtk_drm_gem_obj
| * 9b8deba36a fbdev: shmobile: fix snprintf truncation
| * 6658e44858 mtd: rawnand: hynix: fixed typo
| * e280ab978c drm/amd/display: Fix potential index out of bounds in color transformation function
| * 646cd236c5 ipv6: sr: fix invalid unregister error path
| * 6d7723bdc7 ipv6: sr: fix incorrect unregister order
| * 08094420c6 ipv6: sr: add missing seg6_local_exit
| * 0b532f5943 net: openvswitch: fix overwriting ct original tuple for ICMPv6
| * 90fa1b38c3 net: usb: smsc95xx: stop lying about skb->truesize
| * de6641d213 af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
| * 3cd46d51a4 net: ethernet: cortina: Locking fixes
| * c03effc478 m68k: mac: Fix reboot hang on Mac IIci
| * 5213cc01d0 m68k: Fix spinlock race in kernel thread creation
| * 85f70f8aeb net: usb: sr9700: stop lying about skb->truesize
| * 43b78d06e7 usb: aqc111: stop lying about skb->truesize
| * d0209bbac2 wifi: mwl8k: initialize cmd->addr[] properly
| * a75001678e scsi: qedf: Ensure the copied buf is NUL terminated
| * 595a6b98de scsi: bfa: Ensure the copied buf is NUL terminated
| * c5d19837cc HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
| * 2bdad9da45 Revert "sh: Handle calling csum_partial with misaligned data"
| * deb3c6e64b sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
| * 68a5a00c5d wifi: ar5523: enable proper endpoint verification
| * ac3ed46a87 wifi: carl9170: add a proper sanity check for endpoints
| * 1e9c3f2cae macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
| * 31e1da773a tcp: avoid premature drops in tcp_add_backlog()
| * 9d04b4d0fe tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
| * 527eaa5aa6 tcp: minor optimization in tcp_add_backlog()
| * 539c4bf754 wifi: ath10k: populate board data for WCN3990
| * 9e16d735c6 wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
| * 15650ffd47 x86/purgatory: Switch to the position-independent small code model
| * e3a45d8134 scsi: hpsa: Fix allocation size for Scsi_Host private data
| * e999155c60 scsi: libsas: Fix the failure of adding phy with zero-address to port
| * 2d730b465e cpufreq: exit() callback is optional
| * e660a2e670 cpufreq: Rearrange locking in cpufreq_remove_dev()
| * 14bef1ad61 cpufreq: Split cpufreq_offline()
| * 458965e83c cpufreq: Reorganize checks in cpufreq_offline()
| * a65066c520 ACPI: disable -Wstringop-truncation
| * 8e44605294 irqchip/alpine-msi: Fix off-by-one in allocation error path
| * 0dba8fd01a scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
| * 14baa35711 scsi: ufs: core: Perform read back after disabling interrupts
| * db5e443d5a scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
| * 50b2cebe33 scsi: ufs: qcom: Perform read back after writing reset bit
| * 8cff599e2f qed: avoid truncating work queue length
| * 6dde0c15c5 x86/boot: Ignore relocations in .notes sections in walk_relocs() too
| * a50b7aae18 wifi: ath10k: poll service ready message before failing
| * 43771597fe md: fix resync softlockup when bitmap size is less than array size
| * 0f306d16ff null_blk: Fix missing mutex_destroy() at module removal
| * 526235dffc jffs2: prevent xattr node from overflowing the eraseblock
| * f84dd50f91 s390/cio: fix tracepoint subchannel type field
| * 2246880d90 crypto: ccp - drop platform ifdef checks
| * 3a7c49e101 parisc: add missing export of __cmpxchg_u8()
| * 354bc3231f nilfs2: fix out-of-range warning
| * 235b859810 ecryptfs: Fix buffer size for tag 66 packet
| * 94ac93159b firmware: raspberrypi: Use correct device for DMA mappings
| * e719c8991c crypto: bcm - Fix pointer arithmetic
| * 281ccb2a54 openpromfs: finish conversion to the new mount API
| * fce3de55e8 nvme: find numa distance only if controller has valid numa id
| * 74d98cccea drm/amdkfd: Flush the process wq before creating a kfd_process
| * 7e44593de9 ASoC: da7219-aad: fix usage of device_get_named_child_node()
| * b159bd7fa8 ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
| * 63175250af ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
| * 07191510c3 drm/amd/display: Set color_mgmt_changed to true on unsuspend
| * 47bce5529c net: usb: qmi_wwan: add Telit FN920C04 compositions
| * 917c553186 wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
| * bc9cee50a4 nilfs2: fix potential hang in nilfs_detach_log_writer()
| * bcb5016559 nilfs2: fix unexpected freezing of nilfs_segctor_sync()
| * 8cd4b29283 net: smc91x: Fix m68k kernel compilation for ColdFire CPU
| * c68b7a442e ring-buffer: Fix a race between readers and resize checks
| * cd7f3978c2 speakup: Fix sizeof() vs ARRAY_SIZE() bug
| * b229bc6c6e tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
| * 491bd4d7aa x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
* | 5c67c52b0d Merge branch 'android11-5.4' into branch 'android11-5.4-lts'
* | 4b533a5511 Merge 5.4.277 into android11-5.4-lts
|\|
| * 4a548b29cd Linux 5.4.277
| * 2b21f3095b docs: kernel_include.py: Cope with docutils 0.21
| * ecef5df796 serial: kgdboc: Fix NMI-safety problems from keyboard reset code
| * 6b40d4c262 usb: typec: ucsi: displayport: Fix potential deadlock
| * 467139546f drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
| * 791d236a68 btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
| * ea4105d991 arm64: dts: qcom: Fix 'interrupt-map' parent address cells
| * 7184491fc5 firmware: arm_scmi: Harden accesses to the reset domains
| * 6726429c18 smb: client: fix potential OOBs in smb2_parse_contexts()
| * db389e74d3 net: bcmgenet: synchronize UMAC_CMD access
| * ae59f1f444 net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
| * 40fc58f86b net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
| * 4f470a80ce net: bcmgenet: keep MAC in reset until PHY is up
| * bf3ace5c10 Revert "net: bcmgenet: use RGMII loopback for MAC reset"
| * 44f0418482 Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
| * d0083459e2 ext4: fix bug_on in __es_tree_search
| * c9e7f98f55 pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
* 18ae7bded0 Merge branch 'android11-5.4' into branch 'android11-5.4-lts'

Change-Id: I77842e63e44ae93d7f0cdc0022f1f43edc1dc89e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-07-20 13:35:08 +00:00
Kalesh Singh
adc9210e7e ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
vma_pad_fixup_flags() and is_mergable_pad_vma() were inadvertently
affecting the vm_flags on 32-bit arch, making some VMAs not mergable.

This causes zygote to crash as the Art GC's heap compaction fails.

The compaction depends on mremap() which will fail when operating on
a range that spans multiple VMAs [1]. This can happen now due to the
incorrect is_mergable_pad_vma() check.

Make all the pgsize_migration APIs no-ops in 32-bit architectures,
since Android only performs ELF segment extension in 64-bit archs.

[1] https://github.com/torvalds/linux/blob/v6.9/mm/mremap.c#L841-L843

Bug: 353667356
Change-Id: Id9b0076ef173d75a4afc85577355d340fce03e65
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
(cherry picked from commit f3437db87063f624f189e1cd38347a971fdd3fa0)
2024-07-18 20:00:41 +00:00
QCTECMDR Service
b7e3d54e1b Merge "msm: cvp: OOB write fix due to integer underflow" 2024-07-15 21:50:14 -07:00
QCTECMDR Service
d3b92de37c Merge "msm: ep_pcie: Avoid writing req_L1_exit during dstate change" 2024-07-14 23:37:26 -07:00
Giuliano Procida
dc1385281a ANDROID: GKI: refresh ABI to include kimage_vaddr
This symbol is now recognised by ABI tooling.

Bug: 352610488
Change-Id: I2136a106eaf1c194d49c891ef0d27d0b40b780ba
Signed-off-by: Giuliano Procida <gprocida@google.com>
2024-07-12 15:32:13 +01:00
Remi Denis-Courmont
9ace17ce18 BACKPORT: arm64: move kimage_vaddr to .rodata
Clean backport.

This datum is not referenced from .idmap.text: it does not need to be
mapped in idmap. Lets move it to .rodata as it is never written to after
early boot of the primary CPU.
(Maybe .data.ro_after_init would be cleaner though?)

Bug: 352610488
Change-Id: I83bc69358eca7eca1a5e9916bc6fe477f1c6ef96
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 6cf9a2dce6bd10cf454cf6299c1c23182cb486e7)
Signed-off-by: Giuliano Procida <gprocida@google.com>
2024-07-12 15:32:07 +01:00
Mark Brown
db0d3aeed9 BACKPORT: arm64: kernel: Convert to modern annotations for assembly data
This backport excludes the changes to entry.S due to unresolvable merge
conflicts. They are not needed as no symbols there are exported. The
changes to head.S merged cleanly.

In an effort to clarify and simplify the annotation of assembly functions
in the kernel new macros have been introduced. These include specific
annotations for the start and end of data, update symbols for data to use
these.

Bug: 352610488
Change-Id: I53ed408ccd7bc96af9221a9ba7ed4450ffcd6299
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit a5d4420b26b5068a98ce75210b07d2e083f5f691)
Signed-off-by: Giuliano Procida <gprocida@google.com>
2024-07-12 15:31:35 +01:00
Manaf Meethalavalappu Pallikunhi
c360f7cb0c thermal: qcom: Add support to update tsens trip based on nvmem data
Add support to detect higher thermal profile parts and update thermal
zone trips dynamically based on nvmem cell data for tsens.

Change-Id: I792c4f2736d10d68b45cc9b64c0ec08d185cf007
Signed-off-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com>
2024-07-12 13:01:01 +05:30
ptak
12a570651b msm: eva: Fix UAF issue when remove module
Should use different way to get the core info for
different device.

Change-Id: I8231d08afa75a1f47781f54ec2e5fa264820cc9e
Signed-off-by: ptak <quic_ptak@quicinc.com>
2024-07-11 17:07:46 +05:30
ptak
143f500168 msm: cvp: OOB write fix due to integer underflow
If FW send a pkt->size which is less than the sizeof packet structure
then pkt->size - sizeof() would result into an integer underflow.
Due to this the subsequent check would be bypassed and we will
start write to an OOB memory.

Change-Id: Icb3e4e6d64275592ceb6f747de653dcc1c65fec7
Signed-off-by: ptak <quic_ptak@quicinc.com>
2024-07-11 12:25:08 +05:30
Pallavi Singh
bbf350b175 msm: ep_pcie: Avoid writing req_L1_exit during dstate change
Avoid setting this bit to make sure device stays in L1SS when D-state is
changes to D3 Hot.

Because of device not staying in L1SS the PCIe link was going through
recovery all the time power consumption was higher than expected value.

Change-Id: Id06996745171e62d3a9dbc499c693f8a9870b2ea
Signed-off-by: Pallavi Singh <quic_pallsing@quicinc.com>
2024-07-10 23:27:28 -07:00
QCTECMDR Service
02194073f2 Merge "msm_ipa: EoGRE Multi tunnel support" 2024-07-01 17:58:07 -07:00
Todd Kjos
7f5fa80716 ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
An android-only patch to work around frozen KMI for android14 kernels
allows a dependency between hid and uhid if both modules are enabled:

if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver)
    max_buffer_size = UHID_DATA_MAX;

For allmodconfig builds, both hid and uhid are modules so this creates
a cyclic dependancy and we see this error in kernelci tests:

    ERROR: Cycle detected: hid -> uhid -> hid

Fix by changeing to IS_BUILTIN() instead of IS_ENABLED() since Android
builds always build uhid into the core kernel.

Fixes: 7668cef28386 ("ANDROID: HID: Only utilise UHID provided exports if UHID is enabled")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I622466a42ad94e3606820cf506188bd679078cbf
2024-07-01 17:33:09 +00:00
Himansu Nayak
503c564d87 msm_ipa: EoGRE Multi tunnel support
Updated the existing pad variable to
support multi tunnel in SINGLE_TAG
feature.

Change-Id: I9be926250308e1b4375b677834e0e83eaa9aad41
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
2024-07-01 11:08:46 +05:30
QCTECMDR Service
6d33a677e4 Merge "usb: dwc3: Fix dwc3 version and revisions in remote wakeup path" 2024-06-30 20:59:58 -07:00