mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-07 04:12:04 -04:00
918,239 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
|
7ea86abd86 | Merge "Merge android11-5.4.278(7453ecf) into msm-5.4" | ||
|
|
c2fe5024c0 | Merge "power: reset: Disable support of dynamic download mode (ramdump)" | ||
|
|
113056cafc | Merge "msm: virtio_npu: Fix use-after-free issue in unmap_buf" | ||
|
|
e88bb9b374 |
Merge android11-5.4.278(7453ecf) into msm-5.4
* remotes/origin/tmp-7453ecf:
UPSTREAM: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
ANDROID: GKI: refresh ABI to include kimage_vaddr
BACKPORT: arm64: move kimage_vaddr to .rodata
BACKPORT: arm64: kernel: Convert to modern annotations for assembly data
ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
UPSTREAM: af_unix: Fix garbage collector racing against connect()
Revert "drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector"
Linux 5.4.278
nfs: fix undefined behavior in nfs_block_bits()
s390/ap: Fix crash in AP internal function modify_bitmap()
ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
sparc: move struct termio to asm/termios.h
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
net: fix __dst_negative_advice() race
kdb: Use format-specifiers rather than memset() for padding in kdb_read()
kdb: Merge identical case statements in kdb_read()
kdb: Fix console handling when editing and tab-completing commands
kdb: Use format-strings rather than '\0' injection in kdb_read()
kdb: Fix buffer overflow during tab-complete
sparc64: Fix number of online CPUs
intel_th: pci: Add Meteor Lake-S CPU support
net/9p: fix uninit-value in p9_client_rpc()
net/ipv6: Fix route deleting failure when metric equals 0
crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
crypto: ecrdsa - Fix module auto-load on add_key
KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
fbdev: savage: Handle err return when savagefb_check_var failed
media: v4l2-core: hold videodev_lock until dev reg, finishes
media: mxl5xx: Move xpt structures off stack
media: mc: mark the media devnode as registered from the, start
arm64: dts: hi3798cv200: fix the size of GICR
wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING
arm64: tegra: Correct Tegra132 I2C alias
ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
ata: pata_legacy: make legacy_exit() work again
drm/amdgpu: add error handle to avoid out-of-bounds
media: lgdt3306a: Add a check against null-pointer-def
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
x86/mm: Remove broken vsyscall emulation code from the page fault code
vxlan: Fix regression when dropping packets due to invalid src addresses
nilfs2: fix use-after-free of timer for log writer thread
afs: Don't cross .backup mountpoint from backup volume
io_uring: fail NOP if non-zero op flags is passed in
mmc: core: Do not force a retune before RPMB switch
binder: fix max_thread type inconsistency
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
ALSA: timer: Set lower bound of start tick time
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
spi: stm32: Don't warn about spurious interrupts
kconfig: fix comparison to constant symbols, 'm', 'n'
netfilter: tproxy: bail out if IP has been disabled on the device
net:fec: Add fec_enet_deinit()
net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM
smsc95xx: use usbnet->driver_priv
smsc95xx: remove redundant function arguments
enic: Validate length of nl attributes in enic_set_vf_port
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion
nvmet: fix ns enable/disable possible hang
spi: Don't mark message DMA mapped when no transfer in it is
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()
nfc: nci: Fix kcov check in nci_rx_work()
net: fec: avoid lock evasion when reading pps_enable
virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
openvswitch: Set the skbuff pkt_type for proper pmtud support.
tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
params: lift param_set_uint_minmax to common code
ipv6: sr: fix memleak in seg6_hmac_init_algo
sunrpc: fix NFSACL RPC retry on soft mount
nfc: nci: Fix uninit-value in nci_rx_work
x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y
null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
media: cec: cec-api: add locking in cec_release()
media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
um: Fix the -Wmissing-prototypes warning for __switch_mm
powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp
scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy()
media: stk1160: fix bounds checking in stk1160_copy_video()
um: Add winch to winch_handlers before registering winch IRQ
um: Fix return value in ubd_init()
drm/msm/dpu: Always flush the slave INTF on the CTL
Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
Input: ims-pcu - fix printf string overflow
libsubcmd: Fix parse-options memory leak
serial: sh-sci: protect invalidating RXDMA on shutdown
f2fs: fix to release node block count in error path of f2fs_new_node_page()
extcon: max8997: select IRQ_DOMAIN instead of depending on it
ppdev: Add an error check in register_device
ppdev: Remove usage of the deprecated ida_simple_xx() API
stm class: Fix a double free in stm_register_device()
usb: gadget: u_audio: Clear uac pointer when freed.
microblaze: Remove early printk call from cpuinfo-static.c
microblaze: Remove gcc flag for non existing early_printk.c file
iio: pressure: dps310: support negative temperature values
greybus: arche-ctrl: move device table to its right location
serial: max3100: Fix bitwise types
serial: max3100: Update uart_driver_registered on driver removal
serial: max3100: Lock port->lock when calling uart_handle_cts_change()
firmware: dmi-id: add a release callback function
dmaengine: idma64: Add check for dma_set_max_seg_size
soundwire: cadence: fix invalid PDI offset
soundwire: cadence_master: improve PDI allocation
soundwire: intel: don't filter out PDI0/1
soundwire: cadence/intel: simplify PDI/port mapping
greybus: lights: check return of get_channel_from_mode
sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax
af_packet: do not call packet_read_pending() from tpacket_destruct_skb()
netrom: fix possible dead-lock in nr_rt_ioctl()
RDMA/IPoIB: Fix format truncation compilation errors
selftests/kcmp: remove unused open mode
selftests/kcmp: Make the test output consistent and clear
SUNRPC: Fix gss_free_in_token_pages()
sunrpc: removed redundant procp check
ext4: avoid excessive credit estimate in ext4_tmpfile()
x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map
RDMA/hns: Use complete parentheses in macros
drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector
ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
drm/arm/malidp: fix a possible null pointer dereference
fbdev: sh7760fb: allow modular build
platform/x86: wmi: Make two functions static
media: radio-shark2: Avoid led_names truncations
media: ngene: Add dvb_ca_en50221_init return value check
fbdev: sisfb: hide unused variables
powerpc/fsl-soc: hide unused const variable
drm/mediatek: Add 0 size check to mtk_drm_gem_obj
fbdev: shmobile: fix snprintf truncation
mtd: rawnand: hynix: fixed typo
drm/amd/display: Fix potential index out of bounds in color transformation function
ipv6: sr: fix invalid unregister error path
ipv6: sr: fix incorrect unregister order
ipv6: sr: add missing seg6_local_exit
net: openvswitch: fix overwriting ct original tuple for ICMPv6
net: usb: smsc95xx: stop lying about skb->truesize
af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
net: ethernet: cortina: Locking fixes
m68k: mac: Fix reboot hang on Mac IIci
m68k: Fix spinlock race in kernel thread creation
net: usb: sr9700: stop lying about skb->truesize
usb: aqc111: stop lying about skb->truesize
wifi: mwl8k: initialize cmd->addr[] properly
scsi: qedf: Ensure the copied buf is NUL terminated
scsi: bfa: Ensure the copied buf is NUL terminated
HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
Revert "sh: Handle calling csum_partial with misaligned data"
sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()
wifi: ar5523: enable proper endpoint verification
wifi: carl9170: add a proper sanity check for endpoints
macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"
tcp: avoid premature drops in tcp_add_backlog()
tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
tcp: minor optimization in tcp_add_backlog()
wifi: ath10k: populate board data for WCN3990
wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()
x86/purgatory: Switch to the position-independent small code model
scsi: hpsa: Fix allocation size for Scsi_Host private data
scsi: libsas: Fix the failure of adding phy with zero-address to port
cpufreq: exit() callback is optional
cpufreq: Rearrange locking in cpufreq_remove_dev()
cpufreq: Split cpufreq_offline()
cpufreq: Reorganize checks in cpufreq_offline()
ACPI: disable -Wstringop-truncation
irqchip/alpine-msi: Fix off-by-one in allocation error path
scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL
scsi: ufs: core: Perform read back after disabling interrupts
scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV
scsi: ufs: qcom: Perform read back after writing reset bit
qed: avoid truncating work queue length
x86/boot: Ignore relocations in .notes sections in walk_relocs() too
wifi: ath10k: poll service ready message before failing
md: fix resync softlockup when bitmap size is less than array size
null_blk: Fix missing mutex_destroy() at module removal
jffs2: prevent xattr node from overflowing the eraseblock
s390/cio: fix tracepoint subchannel type field
crypto: ccp - drop platform ifdef checks
parisc: add missing export of __cmpxchg_u8()
nilfs2: fix out-of-range warning
ecryptfs: Fix buffer size for tag 66 packet
firmware: raspberrypi: Use correct device for DMA mappings
crypto: bcm - Fix pointer arithmetic
openpromfs: finish conversion to the new mount API
nvme: find numa distance only if controller has valid numa id
drm/amdkfd: Flush the process wq before creating a kfd_process
ASoC: da7219-aad: fix usage of device_get_named_child_node()
ASoC: dt-bindings: rt5645: add cbj sleeve gpio property
ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating
drm/amd/display: Set color_mgmt_changed to true on unsuspend
net: usb: qmi_wwan: add Telit FN920C04 compositions
wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class
nilfs2: fix potential hang in nilfs_detach_log_writer()
nilfs2: fix unexpected freezing of nilfs_segctor_sync()
net: smc91x: Fix m68k kernel compilation for ColdFire CPU
ring-buffer: Fix a race between readers and resize checks
speakup: Fix sizeof() vs ARRAY_SIZE() bug
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
Linux 5.4.277
docs: kernel_include.py: Cope with docutils 0.21
serial: kgdboc: Fix NMI-safety problems from keyboard reset code
usb: typec: ucsi: displayport: Fix potential deadlock
drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
arm64: dts: qcom: Fix 'interrupt-map' parent address cells
firmware: arm_scmi: Harden accesses to the reset domains
smb: client: fix potential OOBs in smb2_parse_contexts()
net: bcmgenet: synchronize UMAC_CMD access
net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
net: bcmgenet: keep MAC in reset until PHY is up
Revert "net: bcmgenet: use RGMII loopback for MAC reset"
Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
ext4: fix bug_on in __es_tree_search
pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin()
Linux 5.4.276
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
pinctrl: mediatek: remove set but not used variable 'e'
pinctrl: mediatek: Fix some off by one bugs
pinctrl: mediatek: Fix fallback behavior for bias_set_combo
regulator: core: fix debugfs creation regression
net: fix out-of-bounds access in ops_init
drm/vmwgfx: Fix invalid reads in fence signaled events
dyndbg: fix old BUG_ON in >control parser
tipc: fix UAF in error path
usb: gadget: f_fs: Fix a race condition when processing setup packets.
usb: gadget: composite: fix OS descriptors w_value logic
firewire: nosy: ensure user_length is taken into account when fetching packet contents
net: qede: use return from qede_parse_flow_attr() for flower
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
net: bridge: fix corrupted ethernet header on multicast-to-unicast
phonet: fix rtm_phonet_notify() skb allocation
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
xfrm: Preserve vlan tags for transport mode software GRO
pinctrl: mediatek: Fix fallback call path
net:usb:qmi_wwan: support Rolling modules
fs/9p: drop inodes immediately on non-.L too
clk: Don't hold prepare_lock when calling kref_put()
gpio: crystalcove: Use -ENOTSUPP consistently
gpio: wcove: Use -ENOTSUPP consistently
9p: explicitly deny setlease attempts
fs/9p: translate O_TRUNC into OTRUNC
fs/9p: only translate RWX permissions for plain 9P2000
selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
MIPS: scall: Save thread_info.syscall unconditionally on entry
gpu: host1x: Do not setup DMA for virtual devices
scsi: target: Fix SELinux error when systemd-modules loads the target module
btrfs: always clear PERTRANS metadata during commit
btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
tools/power turbostat: Fix Bzy_MHz documentation typo
tools/power turbostat: Fix added raw MSR output
firewire: ohci: mask bus reset interrupts between ISR and bottom half
ata: sata_gemini: Check clk_enable() result
net: bcmgenet: Reset RBUF on first open
ALSA: line6: Zero-initialize message buffers
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
net: mark racy access on sk->sk_rcvbuf
wifi: cfg80211: fix rdev_dump_mpp() arguments order
wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
gfs2: Fix invalid metadata access in punch_hole
scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
tipc: fix a possible memleak in tipc_buf_append
net: bridge: fix multicast-to-unicast with fraglist GSO
net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
net: dsa: mv88e6xxx: Add number of MACs in the ATU
net: qede: use return from qede_parse_flow_attr() for flow_spec
net l2tp: drop flow hash on forward
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
bna: ensure the copied buf is NUL terminated
s390/mm: Fix clearing storage keys for huge pages
s390/mm: Fix storage key clearing for guest huge pages
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
power: rt9455: hide unused rt9455_boost_voltage_values
nfs: Handle error of rpc_proc_register() in nfs_net_init().
nfs: make the rpc_stat per net namespace
nfs: expose /proc/net/sunrpc/nfs in net namespaces
sunrpc: add a struct rpc_stats arg to rpc_create_args
pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
pinctrl: mediatek: remove shadow variable declaration
pinctrl: mediatek: Backward compatible to previous Mediatek's bias-pull usage
pinctrl: mediatek: Refine mtk_pinconf_get()
pinctrl: mediatek: Refine mtk_pinconf_get() and mtk_pinconf_set()
pinctrl: mediatek: Supporting driving setting without mapping current to register value
pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()
pinctrl: core: delete incorrect free in pinctrl_enable()
wifi: nl80211: don't free NULL coalescing rule
dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
dmaengine: pl330: issue_pending waits until WFP state
Revert "clk: Get runtime PM before walking tree during disable_unused"
Linux 5.4.275
serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
udp: preserve the connected status if only UDP cmsg
dm: limit the number of targets and parameter size area
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
i2c: smbus: fix NULL function pointer dereference
idma64: Don't try to serve interrupts when device is powered off
dmaengine: owl: fix register access functions
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
mtd: diskonchip: work around ubsan link failure
stackdepot: respect __GFP_NOLOCKDEP allocation flag
net: b44: set pause params only when interface is up
ethernet: Add helper for assigning packet type when dest address does not match device address
irqchip/gic-v3-its: Prevent double free on error
drm/amdgpu: Fix leak when GPU memory allocation fails
arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
tracing: Show size of requested perf buffer
net/mlx5e: Fix a race in command alloc flow
Revert "crypto: api - Disallow identical driver names"
drm/amdgpu: validate the parameters of bo mapping operations more clearly
amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
drm/amdgpu: restrict bo mapping within gpu address limits
serial: mxs-auart: add spinlock around changing cts state
serial: core: Provide port lock wrappers
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
iavf: Fix TC config comparison with existing adapter TC config
i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
mlxsw: spectrum_acl_tcam: Fix warning during rehash
mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
mlxsw: spectrum_acl_tcam: Rate limit error message
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
net: openvswitch: Fix Use-After-Free in ovs_ct_exit
ipvs: Fix checksumming on GSO of SCTP packets
net: gtp: Fix Use-After-Free in gtp_dellink
net: usb: ax88179_178a: stop lying about skb->truesize
NFC: trf7970a: disable all regulators on removal
mlxsw: core: Unregister EMAD trap using FORWARD action
vxlan: drop packets from invalid src-address
ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
arm64: dts: mediatek: mt2712: fix validation errors
arm64: dts: mt2712: add ethernet device node
arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
arm64: dts: mediatek: mt7622: fix IR nodename
arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
KVM: async_pf: Cleanup kvm_setup_async_pf()
nilfs2: fix OOB in nilfs_set_de_type
nouveau: fix instmem race condition around ptr stores
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
speakup: Avoid crash on very long word
usb: Disable USB3 LPM at shutdown
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
Revert "usb: cdc-wdm: close race between read and workqueue"
USB: serial: option: add Telit FN920C04 rmnet compositions
USB: serial: option: add Rolling RW101-GL and RW135-GL support
USB: serial: option: support Quectel EM060K sub-models
USB: serial: option: add Lonsung U8300/U9300 product
USB: serial: option: add support for Fibocom FM650/FG650
USB: serial: option: add Fibocom FM135-GL variants
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
comedi: vmk80xx: fix incomplete endpoint checking
binder: check offset alignment in binder_get_object()
x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
clk: Get runtime PM before walking tree during disable_unused
clk: Initialize struct clk_core kref earlier
clk: Print an info line before disabling unused clocks
clk: remove extra empty line
clk: Mark 'all_lists' as const
clk: Remove prepare_lock hold assertion in __clk_release()
drm: nv04: Fix out of bounds access
RDMA/mlx5: Fix port number for counter query in multi-port configuration
RDMA/rxe: Fix the problem "mutex_destroy missing"
tun: limit printing rate when illegal packet received by tun dev
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
kprobes: Fix possible use-after-free issue on kprobe registration
selftests/ftrace: Limit length in subsystem-enable tests
btrfs: record delayed inode root in transaction
x86/apic: Force native_apic_mem_read() to use the MOV instruction
selftests: timers: Fix abs() warning in posix_timers test
vhost: Add smp_rmb() in vhost_vq_avail_empty()
drm/client: Fully protect modes[] with dev->mode_config.mutex
btrfs: qgroup: correctly model root qgroup rsv in convert
net: ena: Fix potential sign extension issue
af_unix: Fix garbage collector racing against connect()
af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
net/mlx5: Properly link new fs rules into the tree
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
ipv4/route: avoid unused-but-set-variable warning
ipv6: fib: hide unused 'pn' variable
geneve: fix header validation in geneve[6]_xmit_skb
u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
net: openvswitch: fix unwanted error log on timeout policy probing
nouveau: fix function cast warning
Bluetooth: Fix memory leak in hci_req_sync_complete()
batman-adv: Avoid infinite loop trying to resize local TT
Change-Id: I36df890fc0cf15277cf5d6be8f56774233fb4431
Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
|
||
|
|
a721c06f7d |
msm: virtio_npu: Fix use-after-free issue in unmap_buf
address the security CR of virtio_npu driver Change-Id: Ibf656fa76dedb19086b75d8bf519b2f415ac8d22 Signed-off-by: Gao Wang <quic_gaowang@quicinc.com> |
||
|
|
79c14fa641 |
msm: virtio_npu: Fix use-after-free issue in virt_npu_map_buf
address the security CR of virtio_npu driver Change-Id: Ib77014bc12490e7b09367354024baa2754d3e433 Signed-off-by: gaowang <quic_gaowang@quicinc.com> |
||
|
|
c5539fb1c2 |
i2c: i2c-master-msm-geni: add null pointer check in event call back
Currently i2c geni driver doesn't have null pointer check condition in event call back function. If any invalid event is coming from GSI, i2c geni driver accessing null pointer which is causing crash. To solve this added null pointer checks in event call back functions. Change-Id: Ie14a40eee846c0ea29bec512d6320e9548c509b5 Signed-off-by: Anil Veshala Veshala <quic_aveshala@quicinc.com> |
||
|
|
e4c2f15ba5 | Merge "firmware: qcom_scm: handle echo b > /proc/sysrq-trigger" | ||
|
|
4adbc0218a | Merge "msm: ep_pcie: Disable hot reset and ignore linkdown" | ||
|
|
94c4fda252 | Merge "scripts: mod: replace with a safe function" | ||
|
|
b2af2b5f9f |
firmware: qcom_scm: handle echo b > /proc/sysrq-trigger
Introduce restart handler to handle "echo b > /proc/sysrq-trigger". One special thing with 'b' kind of reboot is, it does not call reboot notifiers and call restart handler right a way and that does not seems to work for blair SoC and it goes to dump mode. Keep this restart handler priority to 201 greater than 200 which is the priority for msm-poweroff to make reboot work cleaner. Change-Id: I42f8c0fde29af402096d760c37ec2d8b3a85439a Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com> Signed-off-by: Sayan Dey <quic_sayand@quicinc.com> |
||
|
|
f1d1549d8e |
scripts: mod: replace with a safe function
Add safe function vsnprintf instead of sprintf by passing size as argument. Change-Id: Ibd21a0c7d9039543dee32c1297035ed9984ed748 Signed-off-by: Vishnu Teja <quic_vteja@quicinc.com> |
||
|
|
32de0804b1 |
msm: ep_pcie: Disable hot reset and ignore linkdown
Intel host tends to retrain the link if device doesn't send PM_Enter_L23 in time, leading to linkdown and hot reset in device side. The hot reset here even results to PERST# timeout and device crash to PBL, which is not expected. Since we are in the entry of shutdown the link when linkdown happen, it makes sense to ignore the linkdown. To avoid device crash because of PERST# timeout, disable hot reset in pm_turnoff irq and reenable it when we do linktrain again. Change-Id: I87961faaae2a14c9a5e7d24543b416914076dd2e Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com> Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com> |
||
|
|
bb76f075ca |
coresight-tmc: Replace deprecated function
Use 'scnprintf' to replace deprecated function 'sprintf'. Change-Id: Ic258e7dfe719f1f871f9c9eb5988609a5f3b6284 Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com> |
||
|
|
c3d6993d5c | Merge "msm-5.4.c3: qseecom: Fix possible race condition" | ||
|
|
f0e3f64088 |
msm-5.4.c3: qseecom: Fix possible race condition
Fix possible race condition in data->type value in case of multithreaded listener or app IOCTLs. For example, below could cause inconsistent data->type value while racing belows IOCTLs Thread1 with QSEECOM_IOCTL_REGISTER_LISTENER_REQ Thread2 with QSEECOM_IOCTL_UNREGISTER_LISTENER_REQ. Change-Id: I436b63c044a66c324d94db27566a7be70981bd6b Signed-off-by: Divisha Bisht <quic_divibish@quicinc.com> |
||
|
|
54d3e3ca11 |
USB: storage: Replace the sprintf with scnprintf
'sprintf' has been deprecated, hence replace it with a safer function scnprintf. Change-Id: I9bc8e3dfd2032a0447f38fc98a3ad31d9d609cab Signed-off-by: Rajashekar kuruva <quic_kuruva@quicinc.com> Signed-off-by: Prashanth K <quic_prashk@quicinc.com> |
||
|
|
83ba639ff8 | Merge "adsprpc: Handle UAF scenario in put_args" | ||
|
|
c6e7698c0c |
adsprpc: Handle UAF scenario in put_args
Currently, the DSP updates header buffers with unused DMA handle fds. In the put_args section, if any DMA handle FDs are present in the header buffer, the corresponding map is freed. However, since the header buffer is exposed to users in unsigned PD, users can update invalid FDs. If this invalid FD matches with any FD that is already in use, it could lead to a use-after-free (UAF) vulnerability. As a solution,add DMA handle references for DMA FDs, and the map for the FD will be freed only when a reference is found. Acked-by: Om Deore <quic_odeore@quicinc.com> Change-Id: I19ae21230bf11fe89858b10c9069a5daccabc392 Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com> |
||
|
|
177e8e0fad | Merge "msm: adsprpc: Avoid taking reference for group_info" | ||
|
|
de9f4fe6f8 |
msm: adsprpc: Avoid taking reference for group_info
Currently, the get_current_groups API accesses group info, which increases the usage refcount. If the IOCTL using the get_current_groups API is called many times, the usage counter overflows. To avoid this, access group info without taking a reference. A reference is not required as group info is not released during the IOCTL call. Change-Id: Ib4de80cac8b36f73d8f5c6dd9824722153189285 Signed-off-by: ANANDU KRISHNAN E <quic_anane@quicinc.com> |
||
|
|
63a32bf361 |
usb: gadget: f_gsi: bail out if opts is null
Currently, functions gsi_inst_clean & gsi_free_inst utilises gsi_opts without any check, however there is a possibility that the opts structure could become NULL. In such case, due to lack of if checks can result in NULL pointer dereference. Change-Id: I548690e2eee377b5292f258972ae7e38417f3085 Signed-off-by: Prashanth K <quic_prashk@quicinc.com> |
||
|
|
0fc0638ba8 | Merge "msm: ep_pcie: Avoid setting host wake pending flag for D0" | ||
|
|
97fd8bd8e6 | Merge "msm: ep_pcie: Prevent repetitive wake operation if wake is in process" | ||
|
|
ccba394a90 |
msm: ep_pcie: Avoid setting host wake pending flag for D0
In current implementation, when host wake request is received in D0 and M3 states, the following sequence of events are happening causing next host wake request from IPA/ client to fail. Sequence of events: 1. Device is in waking up process in D0, M3 states and expecting M0 next. 2. Wake up request received as device in M3. 3. Host wake API is executed setting host_wake_pending flag as well. 4. M0 received as part of wake up from 1. 5. Device in D0, M0 states. 6. Device again went to suspend state as no transfers are happening. 7. Device in D3cold, M3 states 8. Wake up request received from IPA. 9. Host wake API is called again but its returning without any operation as host_wake_pending flag is set. wake toggle is not done. 10. host_wake_pending flag is cleared only on receiving next D0. 11. Host wake requests are failing because of 9. To handle this, avoiding setting of host_wake_pending flag when the host wake request is received in D0 state. Change-Id: I83acde55e6c116653c3ed00e6b4560e3db6390bd Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com> |
||
|
|
d62bca7bf4 |
msm: ep_pcie: Prevent repetitive wake operation if wake is in process
Sometimes, device receives two consecutive wake-up events, added into a
workqueue. Then device assert WAKE# and host deassert PERST# if device
in D3cold state, triggering deassert perst IRQ. In IRQ thread, device
flush the workqueue to make sure previous d3cold process has completed
before enable endpoint. commit 43917f862f7d ("msm: mhi_dev: Flush
workqueue before processing PERST deassert"). However, the second wake
event is also in the workqueue, so ep_pcie_core_wakeup_host_internal
is invoked and seeing dev->perst_deast is true, setted by deassert
PERST# IRQ. Then device goes to access MHI register to issue inband PME,
leading to NOC error because endpoint is still disabled.
So add a check to prevent wake operation if a previous wake has completed.
10567.834470: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_CORE_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.834498: ep_pcie_core_toggle_wake_gpio: PCIe V1711211: No. 115 to
assert PCIe WAKE#; perst is asserted; D3hot is received, WAKE GPIO
state:0
10567.834507: ep_pcie_core_wakeup_host_internal: PCIe V1711211: Set wake
pending : 1 and return ; perst is not de-asserted; D3hot is set
10567.849704: [0x8219195 mhi_dev_notify_sm_event] received:
MHI_DEV_EVENT_HW_ACC_WAKEUP
10567.849976: ep_pcie_handle_perst_irq: PCIe V1711211: No. 1018 PERST
deassertion
10567.850053: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_HW_ACC_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.850071: ep_pcie_core_wakeup_host_internal: PCIe V1711211: request to
assert WAKE# when in D3hot
10567.860093: ep_pcie_core_issue_inband_pme: PCIe V1711211: request to
assert inband wake.
Change-Id: I85fb37c4171c5ef4974c573f0abba199cb718a84
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
|
||
|
|
0f0f48e68a | Merge "msm_ipa: Install exception rule for PPPoE-MPLS" | ||
|
|
752e583b65 |
msm_ipa: Install exception rule for PPPoE-MPLS
Add code to install exception rule for icmp and dhcp packet in DL direction for v4 and v6. Change-Id: I27a2c3cb9cb342a5e4d22246e350bf721d784a15 Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com> |
||
|
|
13dd90963a |
Merge "Merge android11-5.4.274 (564901b) into msm-5.4"
|
||
|
|
f60d08db83 |
Merge android11-5.4.274 (564901b) into msm-5.4
* remotes/origin/tmp-564901b:
ANDROID: 16K: Only check basename of linker context
UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
ANDROID: ABI fixup for abi break in struct dst_ops
BACKPORT: net: fix __dst_negative_advice() race
UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
ANDROID: 16K: Fix show maps CFI failure
ANDROID: 16K: Handle pad VMA splits and merges
ANDROID: 16K: madvise_vma_pad_pages: Remove filemap_fault check
ANDROID: 16K: Only madvise padding from dynamic linker context
ANDROID: 16K: Separate padding from ELF LOAD segment mappings
ANDROID: 16K: Exclude ELF padding for fault around range
ANDROID: 16K: Use MADV_DONTNEED to save VMA padding pages.
ANDROID: 16K: Introduce ELF padding representation for VMAs
ANDROID: 16K: Introduce /sys/kernel/mm/pgsize_miration/enabled
Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
Reapply "media: ttpci: fix two memleaks in budget_av_attach"
Revert "media: rename VFL_TYPE_GRABBER to _VIDEO"
Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO"
Revert "media: ttpci: fix two memleaks in budget_av_attach"
Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
Revert "regmap: allow to define reg_update_bits for no bus configuration"
Revert "regmap: Add bulk read/write callbacks into regmap_config"
Revert "serial: max310x: fix IO data corruption in batched operations"
Revert "geneve: make sure to pull inner header in geneve_rx()"
ANDROID: GKI: add snd_compr_stop_error to Xiaomi_abi
UPSTREAM: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
UPSTREAM: netfilter: nf_tables: release batch on table validation from abort path
UPSTREAM: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Linux 5.4.274
firmware: meson_sm: fix to avoid potential NULL pointer dereference
ip_gre: do not report erspan version on GRE interface
erspan: Check IFLA_GRE_ERSPAN_VER is set.
VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
Bluetooth: btintel: Fixe build regression
x86/alternative: Don't call text_poke() in lazy TLB mode
drm/i915/gt: Reset queue_priority_hint on parking
x86/mm/pat: fix VM_PAT handling in COW mappings
virtio: reenable config if freezing device failed
drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
netfilter: nf_tables: discard table flag update with pending basechain deletion
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
netfilter: nf_tables: release batch on table validation from abort path
netfilter: nf_tables: reject new basechain after table flag update
fbmon: prevent division by zero in fb_videomode_from_videomode()
fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
usb: typec: tcpci: add generic tcpci fallback compatible
tools: iio: replace seekdir() in iio_generic_buffer
ktest: force $buildonly = 1 for 'make_warnings_file' test type
Input: allocate keycode for Display refresh rate toggle
block: prevent division by zero in blk_rq_stat_sum()
Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
drm/amd/display: Fix nanosec stat overflow
media: sta2x11: fix irq handler cast
isofs: handle CDs with bad root inode but good Joliet root directory
scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
sysv: don't call sb_bread() with pointers_lock held
Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
Bluetooth: btintel: Fix null ptr deref in btintel_read_version
btrfs: send: handle path ref underflow in header iterate_inode_ref()
btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
ionic: set adminq irq affinity
arm64: dts: rockchip: fix rk3399 hdmi ports node
arm64: dts: rockchip: fix rk3328 hdmi ports node
panic: Flush kernel log buffer at the end
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
wifi: ath9k: fix LNA selection in ath_ant_try_scan()
s390/entry: align system call table on 8 bytes
x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
ata: sata_mv: Fix PCI device ID table declaration compilation warning
scsi: mylex: Fix sysfs buffer lengths
ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
net: ravb: Always process TX descriptor ring
erspan: make sure erspan_base_hdr is present in skb->head
erspan: Add type I version 0 support.
init: open /initrd.image with O_LARGEFILE
initramfs: switch initramfs unpacking to struct file based APIs
fs: add a vfs_fchmod helper
fs: add a vfs_fchown helper
staging: vc04_services: fix information leak in create_component()
staging: vc04_services: changen strncpy() to strscpy_pad()
staging: mmal-vchiq: Fix client_component for 64 bit kernel
staging: mmal-vchiq: Allocate and free components as required
i40e: fix vf may be used uninitialized in this function warning
ipv6: Fix infinite recursion in fib6_dump_done().
selftests: reuseaddr_conflict: add missing new line at the end of the output
net: stmmac: fix rx queue priority assignment
net/sched: act_skbmod: prevent kernel-infoleak
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
netfilter: nf_tables: flush pending destroy work before exit_net release
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
vfio/platform: Create persistent IRQ handlers
vfio/pci: Create persistent INTx handler
vfio: Introduce interface to flush virqfd inject workqueue
vfio/pci: Lock external INTx masking ops
vfio/pci: Disable auto-enable of exclusive INTx IRQ
net/rds: fix possible cp null dereference
netfilter: nf_tables: disallow timeout for anonymous sets
Bluetooth: Fix TOCTOU in HCI debugfs implementation
Bluetooth: hci_event: set the conn encrypted before conn establishes
x86/cpufeatures: Add new word for scattered features
r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
dm integrity: fix out-of-range warning
tcp: properly terminate timers for kernel sockets
ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
USB: core: Fix deadlock in usb_deauthorize_interface()
scsi: lpfc: Correct size for wqe for memset()
x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
scsi: qla2xxx: Fix command flush on cable pull
usb: udc: remove warning when queue disabled ep
usb: dwc2: gadget: LPM flow fix
usb: dwc2: host: Fix ISOC flow in DDMA mode
usb: dwc2: host: Fix hibernation flow
usb: dwc2: host: Fix remote wakeup from hibernation
scsi: core: Fix unremoved procfs host directory regression
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
usb: cdc-wdm: close race between read and workqueue
mmc: core: Avoid negative index with array access
mmc: core: Initialize mmc_blk_ioc_data
exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
mm/migrate: set swap entry values of THP tail pages properly.
mm/memory-failure: fix an incorrect use of tail pages
vt: fix memory overlapping when deleting chars in the buffer
bounds: support non-power-of-two CONFIG_NR_CPUS
powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
efivarfs: Request at most 512 bytes for variable names
perf/core: Fix reentry problem in perf_output_read_group()
loop: loop_set_status_from_info() check before assignment
loop: Check for overflow while configuring loop
loop: Factor out configuring loop from status
loop: Refactor loop_set_status() size calculation
loop: Factor out setting loop device size
loop: Remove sector_t truncation checks
loop: Call loop_config_discard() only after new config is applied
Revert "loop: Check for overflow while configuring loop"
btrfs: allocate btrfs_ioctl_defrag_range_args on stack
printk: Update @console_may_schedule in console_trylock_spinning()
xen/events: close evtchn after mapping cleanup
x86/speculation: Support intra-function call validation
objtool: Add support for intra-function calls
objtool: is_fentry_call() crashes if call has no destination
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
vt: fix unicode buffer corruption when deleting characters
tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
usb: port: Don't try to peer unused USB ports based on location
usb: gadget: ncm: Fix handling of zero block length packets
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
netfilter: nf_tables: reject constant set with timeout
netfilter: nf_tables: disallow anonymous set with timeout flag
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
comedi: comedi_test: Prevent timers rescheduling during deletion
dm snapshot: fix lockup in dm_exception_table_exit
ahci: asm1064: asm1166: don't limit reported ports
ahci: asm1064: correct count of reported ports
x86/CPU/AMD: Update the Zenbleed microcode revisions
nilfs2: prevent kernel bug at submit_bh_wbc()
nilfs2: use a more common logging style
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
memtest: use {READ,WRITE}_ONCE in memory scanning
drm/vc4: hdmi: do not return negative values from .get_modes()
drm/imx/ipuv3: do not return negative values from .get_modes()
drm/exynos: do not return negative values from .get_modes()
s390/zcrypt: fix reference counting on zcrypt card objects
soc: fsl: qbman: Use raw spinlock for cgr_lock
soc: fsl: qbman: Add CGR update function
soc: fsl: qbman: Add helper for sanity checking cgr ops
soc: fsl: qbman: Always disable interrupts when taking cgr_lock
ring-buffer: Fix full_waiters_pending in poll
ring-buffer: Fix resetting of shortest_full
vfio/platform: Disable virqfds on cleanup
kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
speakup: Fix 8bit characters from direct synth
slimbus: core: Remove usage of the deprecated ida_simple_xx() API
nvmem: meson-efuse: fix function pointer type mismatch
firmware: meson_sm: Rework driver as a proper platform driver
ext4: fix corruption during on-line resize
hwmon: (amc6821) add of_match table
mmc: core: Fix switch on gp3 partition
dm-raid: fix lockdep waring in "pers->hot_add_disk"
Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
PCI/PM: Drain runtime-idle callbacks before driver removal
PCI: Drop pci_device_remove() test of pci_dev->driver
btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
fuse: don't unhash root
mmc: tmio: avoid concurrent runs of mmc_request_done()
PM: sleep: wakeirq: fix wake irq warning in system suspend
USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
USB: serial: option: add MeiG Smart SLM320 product
USB: serial: cp210x: add ID for MGP Instruments PDS100
USB: serial: add device ID for VeriFone adapter
USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
powerpc/fsl: Fix mfpmr build errors with newer binutils
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
PM: suspend: Set mem_sleep_current during kernel command line setup
parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
parisc: Fix csum_ipv6_magic on 64-bit systems
parisc: Fix csum_ipv6_magic on 32-bit systems
parisc: Fix ip_fast_csum
parisc: Do not hardcode registers in checksum functions
mtd: rawnand: meson: fix scrambling mode value in command macro
ubi: correct the calculation of fastmap size
ubi: Check for too small LEB size in VTBL code
ubifs: Set page uptodate in the correct place
fat: fix uninitialized field in nostale filehandles
ext4: correct best extent lstart adjustment logic
selftests/mqueue: Set timeout to 180 seconds
crypto: qat - resolve race condition during AER recovery
crypto: qat - fix double free during reset
sparc: vDSO: fix return value of __setup handler
sparc64: NMI watchdog: fix return value of __setup handler
KVM: Always flush async #PF workqueue when vCPU is being destroyed
media: xc4000: Fix atomicity violation in xc4000_get_frequency
serial: max310x: fix NULL pointer dereference in I2C instantiation
arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
ARM: dts: mmp2-brownstone: Don't redeclare phandle references
smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
timers: Rename del_timer_sync() to timer_delete_sync()
timers: Use del_timer_sync() even on UP
timers: Update kernel-doc for various functions
x86/bugs: Use sysfs_emit()
x86/cpu: Support AMD Automatic IBRS
Documentation/hw-vuln: Update spectre doc
amdkfd: use calloc instead of kzalloc to avoid integer overflow
Linux 5.4.273
regmap: Add missing map->bus check
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
bpf: report RCU QS in cpumap kthread
rcu: add a helper to report consolidated flavor QS
netfilter: nf_tables: do not compare internal table flags on updates
ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
octeontx2-af: Use separate handlers for interrupts
net/bnx2x: Prevent access to a freed page in page_pool
hsr: Handle failures in module init
rds: introduce acquire/release ordering in acquire/release_in_xmit()
packet: annotate data-races around ignore_outgoing
hsr: Fix uninit-value access in hsr_get_node()
s390/vtime: fix average steal time calculation
octeontx2-af: Use matching wake_up API variant in CGX command interface
usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
staging: greybus: fix get_channel_from_mode() failure path
serial: 8250_exar: Don't remove GPIO device on suspend
rtc: mt6397: select IRQ_DOMAIN instead of depending on it
kconfig: fix infinite loop when expanding a macro at the end of file
tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
serial: max310x: fix syntax error in IRQ error message
tty: vt: fix 20 vs 0x20 typo in EScsiignore
afs: Revert "afs: Hide silly-rename files from userspace"
NFS: Fix an off by one in root_nfs_cat()
watchdog: stm32_iwdg: initialize default timeout
net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
RDMA/device: Fix a race between mad_client and cm_client init
scsi: csiostor: Avoid function pointer casts
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
clk: Fix clk_core_get NULL dereference
sparc32: Fix section mismatch in leon_pci_grpci
backlight: lp8788: Fully initialize backlight_properties during probe
backlight: lm3639: Fully initialize backlight_properties during probe
backlight: da9052: Fully initialize backlight_properties during probe
backlight: lm3630a: Don't set bl->props.brightness in get_brightness
backlight: lm3630a: Initialize backlight_properties on init
powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
drm/msm/dpu: add division of drm_display_mode's hskew parameter
powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
media: ttpci: fix two memleaks in budget_av_attach
media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
media: rename VFL_TYPE_GRABBER to _VIDEO
media: v4l2-core: correctly validate video and metadata ioctls
media: go7007: fix a memleak in go7007_load_encoder
media: dvb-frontends: avoid stack overflow warnings with clang
media: pvrusb2: fix uaf in pvr2_context_set_notify
drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
mtd: maps: physmap-core: fix flash size larger than 32-bit
crypto: arm/sha - fix function cast warnings
mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
media: pvrusb2: fix pvr2_stream_callback casts
media: pvrusb2: remove redundant NULL check
media: go7007: add check of return value of go7007_read_addr()
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
perf stat: Avoid metric-only segv
ALSA: seq: fix function cast warnings
drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
quota: Fix rcu annotations of inode dquot pointers
quota: Fix potential NULL pointer dereference
quota: simplify drop_dquot_ref()
clk: qcom: reset: Ensure write completion on reset de/assertion
clk: qcom: reset: Commonize the de/assert functions
clk: qcom: reset: support resetting multiple bits
clk: qcom: reset: Allow specifying custom reset delay
media: edia: dvbdev: fix a use-after-free
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
media: v4l2-tpg: fix some memleaks in tpg_alloc
media: em28xx: annotate unchecked call to media_device_register()
perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
perf record: Fix possible incorrect free in record__switch_output()
PCI/DPC: Print all TLP Prefixes, not just the first
media: tc358743: register v4l2 async device only after successful setup
dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
drm/rockchip: lvds: do not overwrite error code
drm: Don't treat 0 as -1 in drm_fixp2int_ceil
drm/rockchip: inno_hdmi: Fix video timing
drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
drm/tegra: dsi: Make use of the helper function dev_err_probe()
gpu: host1x: mipi: Update tegra_mipi_request() to be node based
drm/tegra: dsi: Add missing check for of_find_device_by_node
dm: call the resume method on internal suspend
dm raid: fix false positive for requeue needed during reshape
nfp: flower: handle acti_netdevs allocation failure
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
net: hns3: fix port duplex configure error in IMP reset
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
ipv6: fib6_rules: flush route cache when rule is changed
bpf: Fix stackmap overflow check on 32-bit arches
bpf: Fix hashtab overflow check on 32-bit arches
sr9800: Add check for usbnet_get_endpoints
Bluetooth: hci_core: Fix possible buffer overflow
Bluetooth: Remove superfluous call to hci_conn_check_pending()
igb: Fix missing time sync events
igb: move PEROUT and EXTTS isr logic to separate functions
mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
SUNRPC: fix some memleaks in gssx_dec_option_array
x86, relocs: Ignore relocations in .notes section
ACPI: scan: Fix device check notification handling
ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
ARM: dts: imx6dl-yapp4: Move phy reset into switch node
ARM: dts: arm: realview: Fix development chip ROM compatible value
net: ena: Remove ena_select_queue
net: ena: cosmetic: fix line break issues
wifi: brcmsmac: avoid function pointer casts
iommu/amd: Mark interrupt as managed
bus: tegra-aconnect: Update dependency to ARCH_TEGRA
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
arm64: dts: qcom: msm8996: Pad addresses
arm64: dts: qcom: msm8996: Move regulator consumers to db820c
arm64: dts: qcom: msm8996: Use node references in db820c
arm64: dts: qcom: db820c: Move non-soc entries out of /soc
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
bpf: Factor out bpf_spin_lock into helpers.
bpf: Add typecast to bpf helpers to help BTF generation
arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
net: blackhole_dev: fix build warning for ethh set but not used
af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
sock_diag: annotate data-races around sock_diag_handlers[family]
wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
wifi: wilc1000: fix RCU usage in connect path
wifi: wilc1000: fix declarations ordering
wifi: b43: Disable QoS for bcm4331
wifi: b43: Stop correct queue in DMA worker when QoS is disabled
b43: main: Fix use true/false for bool type
wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
b43: dma: Fix use true/false for bool type variable
wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
timekeeping: Fix cross-timestamp interpolation for non-x86
timekeeping: Fix cross-timestamp interpolation corner case decision
timekeeping: Fix cross-timestamp interpolation on counter wrap
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
fs/select: rework stack allocation hack for clang
nbd: null check for nla_nest_start
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
Input: gpio_keys_polled - suppress deferred probe error for gpio
ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
firewire: core: use long bus reset on gap count error
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
dm-verity, dm-crypt: align "struct bvec_iter" correctly
block: sed-opal: handle empty atoms when parsing response
parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
net/iucv: fix the allocation size of iucv_path_table array
RDMA/mlx5: Relax DEVX access upon modify commands
HID: multitouch: Add required quirk for Synaptics 0xcddc device
MIPS: Clear Cause.BD in instruction_pointer_set
x86/xen: Add some null pointer checking to smp.c
ASoC: rt5645: Make LattePanda board DMI match more precise
selftests: tls: use exact comparison in recv_partial
io_uring: drop any code related to SCM_RIGHTS
io_uring/unix: drop usage of io_uring socket
UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845
Linux 5.4.272
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
arm64: dts: qcom: add PDC interrupt controller for SDM845
serial: max310x: fix IO data corruption in batched operations
serial: max310x: implement I2C support
serial: max310x: make accessing revision id interface-agnostic
regmap: Add bulk read/write callbacks into regmap_config
regmap: allow to define reg_update_bits for no bus configuration
serial: max310x: Unprepare and disable clock in error path
getrusage: use sig->stats_lock rather than lock_task_sighand()
getrusage: use __for_each_thread()
getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
getrusage: add the "signal_struct *sig" local variable
y2038: rusage: use __kernel_old_timeval
hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
hv_netvsc: use netif_is_bond_master() instead of open code
hv_netvsc: Make netvsc/VF binding check both MAC and serial number
Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
serial: max310x: prevent infinite while() loop in port startup
serial: max310x: use a separate regmap for each port
serial: max310x: use regmap methods for SPI batch operations
serial: max310x: Make use of device properties
serial: max310x: fail probe if clock crystal is unstable
serial: max310x: Try to get crystal clock rate from property
serial: max310x: Use devm_clk_get_optional() to get the input clock
um: allow not setting extra rpaths in the linux binary
selftests: mm: fix map_hugetlb failure on 64K page size systems
netrom: Fix data-races around sysctl_net_busy_read
netrom: Fix a data-race around sysctl_netrom_link_fails_count
netrom: Fix a data-race around sysctl_netrom_routing_control
netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
netrom: Fix a data-race around sysctl_netrom_transport_timeout
netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
netrom: Fix a data-race around sysctl_netrom_default_path_quality
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
netfilter: nft_ct: fix l3num expectations with inet pseudo family
net/rds: fix WARNING in rds_conn_connect_if_down
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
geneve: make sure to pull inner header in geneve_rx()
ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
net: lan78xx: fix runtime PM count underflow on link stop
lan78xx: Fix race conditions in suspend/resume handling
lan78xx: Fix partial packet errors on suspend/resume
lan78xx: Add missing return code checks
lan78xx: Fix white space and style issues
Linux 5.4.271
gpio: 74x164: Enable output pins after registers are reset
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
cachefiles: fix memory leak in cachefiles_add_cache()
x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
mmc: core: Fix eMMC initialization with 1-bit bus connection
dmaengine: fsl-qdma: init irq after reg initialization
dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
btrfs: dev-replace: properly validate device names
wifi: nl80211: reject iftype change with mesh ID change
gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
afs: Fix endless loop in directory parsing
ALSA: Drop leftover snd-rtctimer stuff from Makefile
power: supply: bq27xxx-i2c: Do not free non existing IRQ
efi/capsule-loader: fix incorrect allocation size
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
Bluetooth: Enforce validation on max value of connection interval
Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
Bluetooth: Avoid potential use-after-free in hci_error_reset
net: usb: dm9601: fix wrong return value in dm9601_mdio_read
lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
tun: Fix xdp_rxq_info's queue_index when detaching
net: ip_tunnel: prevent perpetual headroom growth
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
ANDROID: GKI: update .xml file due to USB changes in 5.4.270
Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
Revert "hrtimer: Report offline hrtimer enqueue"
Revert "drm/mipi-dsi: Fix detach call without attach"
Linux 5.4.270
scripts/bpf: Fix xdp_md forward declaration typo
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
netfilter: nf_tables: set dormant flag on hook register failure
tls: stop recv() if initial process_rx_list gave us non-DATA
tls: rx: drop pointless else after goto
tls: rx: jump to a more appropriate label
s390: use the correct count for __iowrite64_copy()
packet: move from strlcpy with unused retval to strscpy
ipv6: sr: fix possible use-after-free and null-ptr-deref
afs: Increase buffer size in afs_update_volume_status()
ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
nouveau: fix function cast warnings
scsi: jazz_esp: Only build if SCSI core is builtin
bpf, scripts: Correct GPL license name
scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
RDMA/srpt: fix function pointer cast warnings
RDMA/srpt: Make debug output more detailed
RDMA/bnxt_re: Return error for SRQ resize
IB/hfi1: Fix a memleak in init_credit_return
usb: roles: don't get/set_role() when usb_role_switch is unregistered
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
usb: cdns3: fix memory double free when handle zero packet
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
ARM: ep93xx: Add terminator to gpiod_lookup_table
l2tp: pass correct message length to ip6_append_data
PCI/MSI: Prevent MSI hardware interrupt number truncation
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
dm-crypt: don't modify the data when using authenticated encryption
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
PCI: tegra: Fix OF node reference leak
PCI: tegra: Fix reporting GPIO error value
arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
drm/amdgpu: Fix type of second parameter in trans_msg() callback
iomap: Set all uptodate bits for an Uptodate page
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
x86/alternatives: Disable KASAN in apply_alternatives()
drm/amdgpu: Check for valid number of registers to read
Revert "drm/sun4i: dsi: Change the start delay calculation"
ALSA: hda/realtek - Enable micmute LED on and HP system
selftests/bpf: Avoid running unprivileged tests with alignment requirements
net: bridge: clear bridge's private skb space on xmit
spi: mt7621: Fix an error message in mt7621_spi_probe()
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
tcp: add annotations around sk->sk_shutdown accesses
tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
tcp: factor out __tcp_close() helper
pmdomain: renesas: r8a77980-sysc: CR7 must be always on
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
virtio-blk: Ensure no requests in virtqueues before deleting vqs.
firewire: core: send bus reset promptly on gap count error
scsi: lpfc: Use unsigned type for num_sge
hwmon: (coretemp) Enlarge per package core count limit
nvmet-fc: abort command when there is no binding
netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
nvmet-tcp: fix nvme tcp ida memory leak
regulator: pwm-regulator: Add validity checks in continuous .get_voltage
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
ahci: asm1166: correct count of reported ports
fbdev: sis: Error out if pixclock equals zero
fbdev: savage: Error out if pixclock equals zero
wifi: mac80211: fix race condition on enabling fast-xmit
wifi: cfg80211: fix missing interfaces when dumping
dmaengine: fsl-qdma: increase size of 'irq_name'
dmaengine: shdma: increase size of 'dev_id'
scsi: target: core: Add TMF to tmr_list handling
sched/rt: Disallow writing invalid values to sched_rt_period_us
sched/rt: Fix sysctl_sched_rr_timeslice intial value
userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
nilfs2: replace WARN_ONs for invalid DAT metadata block requests
memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
net/sched: Retire dsmark qdisc
net/sched: Retire ATM qdisc
net/sched: Retire CBQ qdisc
KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
Linux 5.4.269
of: gpio unittest kfree() wrong object
of: unittest: fix EXPECT text for gpio hog errors
net: bcmgenet: Fix EEE implementation
Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
lsm: new security_file_ioctl_compat() hook
drm/msm/dsi: Enable runtime PM
PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
PM: runtime: add devm_pm_runtime_enable helper
nilfs2: fix potential bug in end_buffer_async_write
sched/membarrier: reduce the ability to hammer on sys_membarrier
net: prevent mss overflow in skb_segment()
netfilter: ipset: Missing gc cancellations fixed
netfilter: ipset: fix performance regression in swap operation
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
mips: Fix max_mapnr being uninitialized on early stages
arch, mm: remove stale mentions of DISCONIGMEM
bus: moxtet: Add spi device table
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
tracing: Inform kmemleak of saved_cmdlines allocation
pmdomain: core: Move the unused cleanup to a _sync initcall
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
irqchip/irq-brcmstb-l2: Add write memory barrier before exit
nfp: flower: prevent re-adding mac index for bonded port
nfp: use correct macro for LengthSelect in BAR config
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
nilfs2: fix data corruption in dsync block recovery for small block sizes
ALSA: hda/conexant: Add quirk for SWS JS201D
mmc: slot-gpio: Allow non-sleeping GPIO ro
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
serial: max310x: improve crystal stable clock detection
serial: max310x: set default value when reading clock ready bit
ring-buffer: Clean ring_buffer_poll_wait() error return
iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
staging: iio: ad5933: fix type mismatch regression
tracing: Fix wasted memory in saved_cmdlines logic
ext4: fix double-free of blocks due to wrong extents moved_len
misc: fastrpc: Mark all sessions as invalid in cb_remove
binder: signal epoll threads of self-work
ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
xen-netback: properly sync TX responses
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
kbuild: Fix changing ELF file type for output of gen_btf for big endian
firewire: core: correct documentation of fw_csr_string() kernel API
scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
i2c: i801: Fix block process call transactions
i2c: i801: Remove i801_set_block_buffer_mode
usb: f_mass_storage: forbid async queue when shutdown happen
USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
HID: wacom: Do not register input devices until after hid_hw_start
HID: wacom: generic: Avoid reporting a serial of '0' to userspace
mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
tracing/trigger: Fix to return error if failed to alloc snapshot
i40e: Fix waiting for queues of all VSIs to be disabled
MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
spi: ppc4xx: Drop write-only variable
of: unittest: Fix compile in the non-dynamic case
of: unittest: add overlay gpio test to catch gpio hog problem
btrfs: send: return EOPNOTSUPP on unknown flags
btrfs: forbid deleting live subvol qgroup
btrfs: forbid creating subvol qgroups
netfilter: nft_set_rbtree: skip end interval element from gc
net: stmmac: xgmac: fix a typo of register name in DPP safety handling
net: stmmac: xgmac: use #define for string constants
vhost: use kzalloc() instead of kmalloc() followed by memset()
Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
hrtimer: Report offline hrtimer enqueue
USB: serial: cp210x: add ID for IMST iM871A-USB
USB: serial: option: add Fibocom FM101-GL variant
USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
net/af_iucv: clean up a try_then_request_module()
netfilter: nft_ct: reject direction for ct id
netfilter: nft_compat: restrict match/target protocol to u16
netfilter: nft_compat: reject unused compat flag
ppp_async: limit MRU to 64K
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
inet: read sk->sk_family once in inet_recv_error()
hwmon: (coretemp) Fix bogus core_id to attr name mapping
hwmon: (coretemp) Fix out-of-bounds memory access
hwmon: (aspeed-pwm-tacho) mutex for tach reading
atm: idt77252: fix a memleak in open_card_ubr0
selftests: net: avoid just another constant wait
net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
bonding: remove print in bond_verify_device_path
HID: apple: Add 2021 magic keyboard FN key mapping
HID: apple: Swap the Fn and Left Control keys on Apple keyboards
HID: apple: Add support for the 2021 Magic Keyboard
net: sysfs: Fix /sys/class/net/<iface> path
af_unix: fix lockdep positive in sk_diag_dump_icons()
net: ipv4: fix a memleak in ip_setup_cork
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
llc: call sock_orphan() at release time
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
ixgbe: Refactor overtemp event handling
ixgbe: Refactor returning internal error codes
ixgbe: Remove non-inclusive language
net: remove unneeded break
scsi: isci: Fix an error code problem in isci_io_request_build()
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
perf: Fix the nr_addr_filters fix
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
ceph: fix deadlock or deadcode of misusing dget()
blk-mq: fix IO hang from sbitmap wakeup race
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
libsubcmd: Fix memory leak in uniq()
PCI/AER: Decode Requester ID when no error info found
fs/kernfs/dir: obey S_ISGID
usb: hub: Replace hardcoded quirk value with BIT() macro
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
PCI: Only override AMD USB controller if required
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
i3c: master: cdns: Update maximum prescaler value for i2c clock
um: net: Fix return type of uml_net_start_xmit()
um: Don't use vfprintf() for os_info()
um: Fix naming clash between UML and scheduler
leds: trigger: panic: Don't register panic notifier if creating the trigger failed
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
drm/amdgpu: Let KFD sync with VM fences
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
drm/msm/dpu: Ratelimit framedone timeout msgs
media: ddbridge: fix an error code problem in ddb_probe
IB/ipoib: Fix mcast list locking
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
ALSA: hda: Intel: add HDA_ARL PCI ID support
PCI: add INTEL_HDA_ARL to pci_ids.h
media: rockchip: rga: fix swizzling for RGB formats
media: stk1160: Fixed high volume of stk1160_dbg messages
drm/mipi-dsi: Fix detach call without attach
drm/framebuffer: Fix use of uninitialized variable
drm/drm_file: fix use of uninitialized variable
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
fast_dput(): handle underflows gracefully
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
f2fs: fix to check return value of f2fs_reserve_new_block()
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
md: Whenassemble the array, consult the superblock of the freshest device
block: prevent an integer overflow in bvec_try_merge_hw_page
ARM: dts: imx23/28: Fix the DMA controller node name
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
ARM: dts: imx27-apf27dev: Fix LED name
ARM: dts: imx25/27: Pass timing0
ARM: dts: imx1: Fix sram node
ARM: dts: imx27: Fix sram node
ARM: dts: imx: Use flash@0,0 pattern
ARM: dts: imx25/27-eukrea: Fix RTC node name
ARM: dts: rockchip: fix rk3036 hdmi ports node
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
scsi: libfc: Don't schedule abort twice
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
ARM: dts: imx7s: Fix nand-controller #size-cells
ARM: dts: imx7s: Fix lcdif compatible
ARM: dts: imx7d: Fix coresight funnel ports
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
scsi: lpfc: Fix possible file string name overflow when updating firmware
selftests/bpf: Fix pyperf180 compilation failure with clang18
selftests/bpf: satisfy compiler by having explicit return in btf test
wifi: rt2x00: restart beacon queue when hardware reset
ext4: avoid online resizing failures due to oversized flex bg
ext4: remove unnecessary check from alloc_flex_gd()
ext4: unify the type of flexbg_size to unsigned int
ext4: fix inconsistent between segment fstrim and full fstrim
ecryptfs: Reject casefold directory inodes
SUNRPC: Fix a suspicious RCU usage warning
KVM: s390: fix setting of fpc register
s390/ptrace: handle setting of fpc register correctly
jfs: fix array-index-out-of-bounds in diNewExt
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
crypto: stm32/crc32 - fix parsing list of devices
pstore/ram: Fix crash when setting number of cpus to an odd number
jfs: fix uaf in jfs_evict_inode
jfs: fix array-index-out-of-bounds in dbAdjTree
jfs: fix slab-out-of-bounds Read in dtSearch
UBSAN: array-index-out-of-bounds in dtSplitRoot
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
ACPI: extlog: fix NULL pointer dereference check
PNP: ACPI: fix fortify warning
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
audit: Send netlink ACK before setting connection in auditd_set
regulator: core: Only increment use_count when enable_count changes
perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
powerpc/lib: Validate size for vector operations
powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
powerpc: Fix build error due to is_valid_bugaddr()
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
x86/entry/ia32: Ensure s32 is sign extended to s64
tick/sched: Preserve number of idle sleeps across CPU hotplug events
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
gpio: eic-sprd: Clear interrupt after set the interrupt type
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
drm/exynos: fix accidental on-stack copy of exynos_drm_plane
drm/bridge: nxp-ptn3460: simplify some error checking
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
drm: Don't unref the same fb many times by mistake due to deadlock handling
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
rbd: don't move requests to the running list on errors
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
btrfs: don't warn if discard range is not aligned to sector
btrfs: tree-checker: fix inline ref size in error messages
btrfs: ref-verify: free ref cache before clearing mount opt
net: fec: fix the unhandled context fault from smmu
fjes: fix memleaks in fjes_hw_setup
netfilter: nf_tables: validate NFPROTO_* family
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
net/mlx5e: fix a double-free in arfs_create_groups
net/mlx5: Use kfree(ft->g) in arfs_create_groups()
net/mlx5: DR, Use the right GVMI number for drop action
netlink: fix potential sleeping issue in mqueue_flush_file
tcp: Add memory barrier to tcp_push()
afs: Hide silly-rename files from userspace
tracing: Ensure visibility when inserting an element into tracing_map
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
llc: Drop support for ETH_P_TR_802_2.
llc: make llc_ui_sendmsg() more robust against bonding changes
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
net/smc: fix illegal rmb_desc access in SMC-D connection dump
x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
powerpc: Use always instead of always-y in for crtsavres.o
fs: move S_ISGID stripping into the vfs_*() helpers
fs: add mode_strip_sgid() helper
mtd: spinand: macronix: Fix MX35LFxGE4AD page size
block: Remove special-casing of compound pages
rename(): fix the locking of subdirectories
ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
nouveau/vmm: don't set addr on the fail path to avoid warning
mmc: core: Use mrq.sbc in close-ended ffu
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
parisc/firmware: Fix F-extend for PDC addresses
rpmsg: virtio: Free driver_override when rpmsg_remove()
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
PM: hibernate: Enforce ordering during image compression/decompression
crypto: api - Disallow identical driver names
ext4: allow for the last group to be marked as trimmed
serial: sc16is7xx: add check for unsupported SPI modes during probe
spi: introduce SPI_MODE_X_MASK macro
serial: sc16is7xx: set safe default SPI clock frequency
units: add the HZ macros
units: change from 'L' to 'UL'
units: Add Watt units
include/linux/units.h: add helpers for kelvin to/from Celsius conversion
PCI: mediatek: Clear interrupt status before dispatching handler
Conflicts:
both modified: include/linux/timer.h
both modified: mm/memory-failure.c
both modified: mm/mlock.c
both modified: mm/mprotect.c
both modified: scripts/Makefile.extrawarn
Change-Id: Ia59be9dbba9400fa82dcd3c3a7d50ee6012701fb
Signed-off-by: kamasali Satyanarayan <kamasali@qti.qualcomm.com>
|
||
|
|
01f564dfc6 |
securemsm-kernel: Decrement the server object ref count in mutex context
Decrement the smcinvoke server object refcount in mutex context so that we never get an object which is being freed. Change-Id: I1bab3d630436923c7eb60f2d46dcc3f2bd037097 Signed-off-by: Nishant Pandey <quic_nishpand@quicinc.com> |
||
|
|
ed97e9cf1d |
qcedev: fix UAF in qcedev_smmu
External researcher found UAF in qcedev_smmu.c on an error condition in qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it is still kept in the registeredbufs list. The fix removes it from the list before freeing binfo. Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd Signed-off-by: Daniel Perez-Zoghbi <quic_dperezzo@quicinc.com> |
||
|
|
7453ecf4d1 |
UPSTREAM: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream. Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Bug: 346754046 Signed-off-by: Lee Jones <lee@kernel.org> Cc: stable <stable@kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit d1205033e912f9332c1dbefa812e6ceb0575ce0a) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: Id9a34f3e5495aef0d2a800a1386210f4d9fa8116 |
||
|
|
8375c081bb | Merge "msm: eva: Adding kref count for cvp_get_inst_from_id" | ||
|
|
c2a6a9ca1a | Merge "msm: eva: Fix UAF issue when remove module" | ||
|
|
56e07d95b5 |
Merge tag 'android11-5.4.278_r00' into android11-5.4
This catches android11-5.4 up to the 5.4.278 LTS release. Included in here are the following commits: * |
||
|
|
adc9210e7e |
ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
vma_pad_fixup_flags() and is_mergable_pad_vma() were inadvertently affecting the vm_flags on 32-bit arch, making some VMAs not mergable. This causes zygote to crash as the Art GC's heap compaction fails. The compaction depends on mremap() which will fail when operating on a range that spans multiple VMAs [1]. This can happen now due to the incorrect is_mergable_pad_vma() check. Make all the pgsize_migration APIs no-ops in 32-bit architectures, since Android only performs ELF segment extension in 64-bit archs. [1] https://github.com/torvalds/linux/blob/v6.9/mm/mremap.c#L841-L843 Bug: 353667356 Change-Id: Id9b0076ef173d75a4afc85577355d340fce03e65 Signed-off-by: Kalesh Singh <kaleshsingh@google.com> (cherry picked from commit f3437db87063f624f189e1cd38347a971fdd3fa0) |
||
|
|
b7e3d54e1b | Merge "msm: cvp: OOB write fix due to integer underflow" | ||
|
|
d3b92de37c | Merge "msm: ep_pcie: Avoid writing req_L1_exit during dstate change" | ||
|
|
dc1385281a |
ANDROID: GKI: refresh ABI to include kimage_vaddr
This symbol is now recognised by ABI tooling. Bug: 352610488 Change-Id: I2136a106eaf1c194d49c891ef0d27d0b40b780ba Signed-off-by: Giuliano Procida <gprocida@google.com> |
||
|
|
9ace17ce18 |
BACKPORT: arm64: move kimage_vaddr to .rodata
Clean backport. This datum is not referenced from .idmap.text: it does not need to be mapped in idmap. Lets move it to .rodata as it is never written to after early boot of the primary CPU. (Maybe .data.ro_after_init would be cleaner though?) Bug: 352610488 Change-Id: I83bc69358eca7eca1a5e9916bc6fe477f1c6ef96 Signed-off-by: Rémi Denis-Courmont <remi@remlab.net> Acked-by: Will Deacon <will@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit 6cf9a2dce6bd10cf454cf6299c1c23182cb486e7) Signed-off-by: Giuliano Procida <gprocida@google.com> |
||
|
|
db0d3aeed9 |
BACKPORT: arm64: kernel: Convert to modern annotations for assembly data
This backport excludes the changes to entry.S due to unresolvable merge conflicts. They are not needed as no symbols there are exported. The changes to head.S merged cleanly. In an effort to clarify and simplify the annotation of assembly functions in the kernel new macros have been introduced. These include specific annotations for the start and end of data, update symbols for data to use these. Bug: 352610488 Change-Id: I53ed408ccd7bc96af9221a9ba7ed4450ffcd6299 Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> (cherry picked from commit a5d4420b26b5068a98ce75210b07d2e083f5f691) Signed-off-by: Giuliano Procida <gprocida@google.com> |
||
|
|
c360f7cb0c |
thermal: qcom: Add support to update tsens trip based on nvmem data
Add support to detect higher thermal profile parts and update thermal zone trips dynamically based on nvmem cell data for tsens. Change-Id: I792c4f2736d10d68b45cc9b64c0ec08d185cf007 Signed-off-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com> |
||
|
|
12a570651b |
msm: eva: Fix UAF issue when remove module
Should use different way to get the core info for different device. Change-Id: I8231d08afa75a1f47781f54ec2e5fa264820cc9e Signed-off-by: ptak <quic_ptak@quicinc.com> |
||
|
|
143f500168 |
msm: cvp: OOB write fix due to integer underflow
If FW send a pkt->size which is less than the sizeof packet structure then pkt->size - sizeof() would result into an integer underflow. Due to this the subsequent check would be bypassed and we will start write to an OOB memory. Change-Id: Icb3e4e6d64275592ceb6f747de653dcc1c65fec7 Signed-off-by: ptak <quic_ptak@quicinc.com> |
||
|
|
bbf350b175 |
msm: ep_pcie: Avoid writing req_L1_exit during dstate change
Avoid setting this bit to make sure device stays in L1SS when D-state is changes to D3 Hot. Because of device not staying in L1SS the PCIe link was going through recovery all the time power consumption was higher than expected value. Change-Id: Id06996745171e62d3a9dbc499c693f8a9870b2ea Signed-off-by: Pallavi Singh <quic_pallsing@quicinc.com> |
||
|
|
02194073f2 | Merge "msm_ipa: EoGRE Multi tunnel support" | ||
|
|
7f5fa80716 |
ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
An android-only patch to work around frozen KMI for android14 kernels
allows a dependency between hid and uhid if both modules are enabled:
if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver)
max_buffer_size = UHID_DATA_MAX;
For allmodconfig builds, both hid and uhid are modules so this creates
a cyclic dependancy and we see this error in kernelci tests:
ERROR: Cycle detected: hid -> uhid -> hid
Fix by changeing to IS_BUILTIN() instead of IS_ENABLED() since Android
builds always build uhid into the core kernel.
Fixes: 7668cef28386 ("ANDROID: HID: Only utilise UHID provided exports if UHID is enabled")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I622466a42ad94e3606820cf506188bd679078cbf
|
||
|
|
503c564d87 |
msm_ipa: EoGRE Multi tunnel support
Updated the existing pad variable to support multi tunnel in SINGLE_TAG feature. Change-Id: I9be926250308e1b4375b677834e0e83eaa9aad41 Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com> |
||
|
|
6d33a677e4 | Merge "usb: dwc3: Fix dwc3 version and revisions in remote wakeup path" |