Author	SHA1	Message	Date
Greg Kroah-Hartman	85547bc085	Merge tag 'android11-5.4.274_r00' into branch 'android11-5.4' ... This is the merge of the upstream 5.4.274 relelease into the android11-5.4 branch. Included in here are the following commits: * 181edea14a Revert "timers: Rename del_timer_sync() to timer_delete_sync()" * 46cf330263 Merge 5.4.274 into android11-5.4-lts |\ | * 0dbd436fb9 Linux 5.4.274 | * fba9c24c19 firmware: meson_sm: fix to avoid potential NULL pointer dereference | * 35a5acfa7a ip_gre: do not report erspan version on GRE interface | * 61206032d6 erspan: Check IFLA_GRE_ERSPAN_VER is set. | * 7f12ecf453 VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() | * d006b709db Bluetooth: btintel: Fixe build regression | * 0bf9fd89ba x86/alternative: Don't call text_poke() in lazy TLB mode | * 67944e6db6 drm/i915/gt: Reset queue_priority_hint on parking | * 09e6bb5321 x86/mm/pat: fix VM_PAT handling in COW mappings | * 6e5da7d65b virtio: reenable config if freezing device failed | * e7bda8f58b drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put() | * 7a529c9023 tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc | * 9a3b90904d netfilter: nf_tables: discard table flag update with pending basechain deletion | * 61ac728434 netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path | * 0a14e16239 netfilter: nf_tables: release batch on table validation from abort path | * 41bad13c0e netfilter: nf_tables: reject new basechain after table flag update | * 72d091b751 fbmon: prevent division by zero in fb_videomode_from_videomode() | * 77f34b9af3 fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 | * 0eab73ffb6 usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined | * 261a831427 usb: typec: tcpci: add generic tcpci fallback compatible | * fcc68c952c tools: iio: replace seekdir() in iio_generic_buffer | * 97832659b1 ktest: force $buildonly = 1 for 'make_warnings_file' test type | * 71de605098 Input: allocate keycode for Display refresh rate toggle | * edd073c78d block: prevent division by zero in blk_rq_stat_sum() | * 73daab5b8c Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" | * 4256e1460e SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int | * 08a07d5a20 drm/amd/display: Fix nanosec stat overflow | * 4a35b778d0 media: sta2x11: fix irq handler cast | * 2c1f840469 isofs: handle CDs with bad root inode but good Joliet root directory | * e2cd32435b scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() | * 1b4fe801b5 sysv: don't call sb_bread() with pointers_lock held | * e04cae532a Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails | * 68a69bb2ec Bluetooth: btintel: Fix null ptr deref in btintel_read_version | * 024529c27c btrfs: send: handle path ref underflow in header iterate_inode_ref() | * a9252c8cfa btrfs: export: handle invalid inode or root reference in btrfs_get_parent() | * 576164bd01 btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() | * 41aff62bf1 tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() | * 97ad3fc426 ionic: set adminq irq affinity | * 67611c11d7 arm64: dts: rockchip: fix rk3399 hdmi ports node | * 223145f838 arm64: dts: rockchip: fix rk3328 hdmi ports node | * 60d417f3e4 panic: Flush kernel log buffer at the end | * f15eca9513 VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() | * dec0f1b008 wifi: ath9k: fix LNA selection in ath_ant_try_scan() | * 485b5d1d6a s390/entry: align system call table on 8 bytes | * 976b1b2680 x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() | * 039458c058 ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone | * fc4387dce4 ata: sata_mv: Fix PCI device ID table declaration compilation warning | * 0e9207b054 scsi: mylex: Fix sysfs buffer lengths | * d887674f09 ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit | * 517884404e ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw | * 9c11271714 net: ravb: Always process TX descriptor ring | * e54a0c79cd erspan: make sure erspan_base_hdr is present in skb->head | * 959fe471f1 erspan: Add type I version 0 support. | * 19d7e7c1ee init: open /initrd.image with O_LARGEFILE | * 32e34d96b3 initramfs: switch initramfs unpacking to struct file based APIs | * 13b2d81505 fs: add a vfs_fchmod helper | * 8eba8d1145 fs: add a vfs_fchown helper | * 9550632ba9 staging: vc04_services: fix information leak in create_component() | * bbd974d444 staging: vc04_services: changen strncpy() to strscpy_pad() | * d07aab3ca7 staging: mmal-vchiq: Fix client_component for 64 bit kernel | * 50bc5a96f8 staging: mmal-vchiq: Allocate and free components as required | * 9dcf0fcb80 i40e: fix vf may be used uninitialized in this function warning | * 9c52581961 ipv6: Fix infinite recursion in fib6_dump_done(). | * 73fac254ec selftests: reuseaddr_conflict: add missing new line at the end of the output | * 2882bb3b91 net: stmmac: fix rx queue priority assignment | * f356eb2fb5 net/sched: act_skbmod: prevent kernel-infoleak | * f7990498b0 bpf, sockmap: Prevent lock inversion deadlock in map delete elem | * a347bc8e62 netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() | * f4e14695fe netfilter: nf_tables: flush pending destroy work before exit_net release | * ab81b3d2f3 mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations | * 144c56d5dd Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." | * 07afdfd8a6 vfio/platform: Create persistent IRQ handlers | * b18fa894d6 vfio/pci: Create persistent INTx handler | * 3777fa4c8f vfio: Introduce interface to flush virqfd inject workqueue | * 1e71b6449d vfio/pci: Lock external INTx masking ops | * 26389925d6 vfio/pci: Disable auto-enable of exclusive INTx IRQ | * bcd46782e2 net/rds: fix possible cp null dereference | * 49ce99ae43 netfilter: nf_tables: disallow timeout for anonymous sets | * f5450973eb Bluetooth: Fix TOCTOU in HCI debugfs implementation | * 5c8b927293 Bluetooth: hci_event: set the conn encrypted before conn establishes | * 9d161e8af4 x86/cpufeatures: Add new word for scattered features | * ff7a4adbd7 r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d | * e78f604693 dm integrity: fix out-of-range warning | * 44e62f5d35 tcp: properly terminate timers for kernel sockets | * a4bb81d890 ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() | * 03fe259649 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet | * 12d6a5681a USB: core: Fix deadlock in usb_deauthorize_interface() | * ea9a4fce2e scsi: lpfc: Correct size for wqe for memset() | * fa24c1a49d x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled | * d7a68eee87 scsi: qla2xxx: Fix command flush on cable pull | * 68d951880d usb: udc: remove warning when queue disabled ep | * a79ac9f3da usb: dwc2: gadget: LPM flow fix | * 693bbbccd9 usb: dwc2: host: Fix ISOC flow in DDMA mode | * eb97df08c3 usb: dwc2: host: Fix hibernation flow | * 4cf44c9fa0 usb: dwc2: host: Fix remote wakeup from hibernation | * 0053f15d50 scsi: core: Fix unremoved procfs host directory regression | * 4206ad65a0 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs | * 3afdcc4e1a usb: cdc-wdm: close race between read and workqueue | * b9a7339ae4 mmc: core: Avoid negative index with array access | * fd20d84bae mmc: core: Initialize mmc_blk_ioc_data | * c7a9b1b777 exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() | * be1dd9254f wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes | * 747d4ee747 mm/migrate: set swap entry values of THP tail pages properly. | * 7f75e937ec mm/memory-failure: fix an incorrect use of tail pages | * 815be99d93 vt: fix memory overlapping when deleting chars in the buffer | * d6077e0d38 bounds: support non-power-of-two CONFIG_NR_CPUS | * 282e4deafe powerpc: xor_vmx: Add '-mhard-float' to CFLAGS | * 34b5d2ff9e efivarfs: Request at most 512 bytes for variable names | * 37a65df6a9 perf/core: Fix reentry problem in perf_output_read_group() | * 861021710b loop: loop_set_status_from_info() check before assignment | * b40877b856 loop: Check for overflow while configuring loop | * f4476da8ea loop: Factor out configuring loop from status | * 7423a124fa loop: Refactor loop_set_status() size calculation | * 3c9e7e8cb6 loop: Factor out setting loop device size | * e08b2e4176 loop: Remove sector_t truncation checks | * ea3bec644a loop: Call loop_config_discard() only after new config is applied | * 2ea7077748 Revert "loop: Check for overflow while configuring loop" | * 735e525d8c btrfs: allocate btrfs_ioctl_defrag_range_args on stack | * 501561d808 printk: Update @console_may_schedule in console_trylock_spinning() | * 9470f5b250 xen/events: close evtchn after mapping cleanup | * 03b19c7fa1 x86/speculation: Support intra-function call validation | * f8f25fde0c objtool: Add support for intra-function calls | * eafb29361a objtool: is_fentry_call() crashes if call has no destination | * 396dbbc189 fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion | * ff7342090c vt: fix unicode buffer corruption when deleting characters | * 741dee500f tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled | * d79cd5c29a usb: port: Don't try to peer unused USB ports based on location | * a766761d20 usb: gadget: ncm: Fix handling of zero block length packets | * eb7b01ca77 USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command | * 9e93b41109 ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform | * 57ae281a67 xfrm: Avoid clang fortify warning in copy_to_user_tmpl() | * 0920c618d2 netfilter: nf_tables: reject constant set with timeout | * e9a0d3f376 netfilter: nf_tables: disallow anonymous set with timeout flag | * edcf1a3f18 netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout | * 1ba8fdef88 comedi: comedi_test: Prevent timers rescheduling during deletion | * e7d4cff57c dm snapshot: fix lockup in dm_exception_table_exit | * 35ff8175d9 ahci: asm1064: asm1166: don't limit reported ports | * 86e248c2d6 ahci: asm1064: correct count of reported ports | * 89c4357725 x86/CPU/AMD: Update the Zenbleed microcode revisions | * 32eaee72e9 nilfs2: prevent kernel bug at submit_bh_wbc() | * 6503d76d91 nilfs2: use a more common logging style | * 9cbe1ad5f4 nilfs2: fix failure to detect DAT corruption in btree and direct mappings | * f2cee08a69 memtest: use {READ,WRITE}_ONCE in memory scanning | * 673fb93c92 drm/vc4: hdmi: do not return negative values from .get_modes() | * 7ecbec89e4 drm/imx/ipuv3: do not return negative values from .get_modes() | * 348aa3d47e drm/exynos: do not return negative values from .get_modes() | * 9daddee03d s390/zcrypt: fix reference counting on zcrypt card objects | * ff50716b7d soc: fsl: qbman: Use raw spinlock for cgr_lock | * f248ecc186 soc: fsl: qbman: Add CGR update function | * 6e9629518c soc: fsl: qbman: Add helper for sanity checking cgr ops | * 62c3ecd283 soc: fsl: qbman: Always disable interrupts when taking cgr_lock | * 3f91ba9653 ring-buffer: Fix full_waiters_pending in poll | * f7578a3b7c ring-buffer: Fix resetting of shortest_full | * b0beb669a8 vfio/platform: Disable virqfds on cleanup | * b046ab1642 kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 | * 31722ed2c3 speakup: Fix 8bit characters from direct synth | * b2b93a38d6 slimbus: core: Remove usage of the deprecated ida_simple_xx() API | * aec74a14d1 nvmem: meson-efuse: fix function pointer type mismatch | * 525ae72d9f firmware: meson_sm: Rework driver as a proper platform driver | * ee4e9c1976 ext4: fix corruption during on-line resize | * 1a560f1969 hwmon: (amc6821) add of_match table | * d7bc1877c1 mmc: core: Fix switch on gp3 partition | * 24019e5ac6 dm-raid: fix lockdep waring in "pers->hot_add_disk" | * 0b949dc225 Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" | * 47d8aafcfe PCI/PM: Drain runtime-idle callbacks before driver removal | * ec6f7c0807 PCI: Drop pci_device_remove() test of pci_dev->driver | * 287a9a9b6e btrfs: fix off-by-one chunk length calculation at contains_pending_extent() | * ab95a42020 fuse: don't unhash root | * c180d65df8 mmc: tmio: avoid concurrent runs of mmc_request_done() | * 2e94147e20 PM: sleep: wakeirq: fix wake irq warning in system suspend | * bd140aef69 USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M | * b11cd74c31 USB: serial: option: add MeiG Smart SLM320 product | * f5167c50af USB: serial: cp210x: add ID for MGP Instruments PDS100 | * 4fda3ad19d USB: serial: add device ID for VeriFone adapter | * 3f01bf964e USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB | * 4fc30a31e1 powerpc/fsl: Fix mfpmr build errors with newer binutils | * 86bf75d915 clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays | * b2dfb216f3 clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays | * 83fe1bbd9e clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays | * ddcd5ea7b2 PM: suspend: Set mem_sleep_current during kernel command line setup | * 42dcb0a374 parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds | * 10e031fbe5 parisc: Fix csum_ipv6_magic on 64-bit systems | * 4dc4793c9d parisc: Fix csum_ipv6_magic on 32-bit systems | * 89cb6c7169 parisc: Fix ip_fast_csum | * 331b43d79a parisc: Do not hardcode registers in checksum functions | * 64a1ccfa9a mtd: rawnand: meson: fix scrambling mode value in command macro | * a1d549aec8 ubi: correct the calculation of fastmap size | * 4e09d5210b ubi: Check for too small LEB size in VTBL code | * 778c6ad402 ubifs: Set page uptodate in the correct place | * f52d7663a1 fat: fix uninitialized field in nostale filehandles | * b224a3b8d3 ext4: correct best extent lstart adjustment logic | * e8b25c7bae selftests/mqueue: Set timeout to 180 seconds | * 8e81cd58ae crypto: qat - resolve race condition during AER recovery | * 5a9f7e9123 crypto: qat - fix double free during reset | * fca0c42c34 sparc: vDSO: fix return value of __setup handler | * 75159bcec2 sparc64: NMI watchdog: fix return value of __setup handler | * 82e25cc1c2 KVM: Always flush async #PF workqueue when vCPU is being destroyed | * ce6e52cade media: xc4000: Fix atomicity violation in xc4000_get_frequency | * 7d271b798a serial: max310x: fix NULL pointer dereference in I2C instantiation | * d453dd485e arm: dts: marvell: Fix maxium->maxim typo in brownstone dts | * 36f6b76341 ARM: dts: mmp2-brownstone: Don't redeclare phandle references | * 60f9cecf6a smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() | * cec55e30e3 smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() | * 9a353d80ba clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd | * a7923ecece media: staging: ipu3-imgu: Set fields before media_entity_pads_init() | * 8e3f03f4ef wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach | * df4209170b timers: Rename del_timer_sync() to timer_delete_sync() | * ef5f71db1e timers: Use del_timer_sync() even on UP | * 9ec9c420db timers: Update kernel-doc for various functions | * c513b79129 x86/bugs: Use sysfs_emit() | * 922bc61d8c x86/cpu: Support AMD Automatic IBRS | * d9caea5f1b Documentation/hw-vuln: Update spectre doc | * 8b05647042 amdkfd: use calloc instead of kzalloc to avoid integer overflow * | ff7463a1e9 Reapply "media: ttpci: fix two memleaks in budget_av_attach" * | 7cc7098648 Revert "media: rename VFL_TYPE_GRABBER to _VIDEO" * | b8c488bb24 Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO" * | be024bb2cd Revert "media: ttpci: fix two memleaks in budget_av_attach" * | d873f54a70 Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()" * | 960240ce53 Merge 5.4.273 into android11-5.4-lts |\| | * 24489321d0 Linux 5.4.273 | * b37f030486 regmap: Add missing map->bus check | * 55f8ea6731 spi: spi-mt65xx: Fix NULL pointer access in interrupt handler | * 59426454b8 bpf: report RCU QS in cpumap kthread | * 3ffe591b27 rcu: add a helper to report consolidated flavor QS | * 2531f907d3 netfilter: nf_tables: do not compare internal table flags on updates | * 71002d9eb1 ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2 | * 94cb17e5cf octeontx2-af: Use separate handlers for interrupts | * 4f37d3a7e0 net/bnx2x: Prevent access to a freed page in page_pool | * 69f9f55891 hsr: Handle failures in module init | * f781fb5177 rds: introduce acquire/release ordering in acquire/release_in_xmit() | * 84c510411e packet: annotate data-races around ignore_outgoing | * 889ed056ea hsr: Fix uninit-value access in hsr_get_node() | * 48cef94b69 s390/vtime: fix average steal time calculation | * 305c31b970 octeontx2-af: Use matching wake_up API variant in CGX command interface | * b63362b317 usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin | * 254b27c4ae staging: greybus: fix get_channel_from_mode() failure path | * f6bf49e76f serial: 8250_exar: Don't remove GPIO device on suspend | * 8dd52ab78f rtc: mt6397: select IRQ_DOMAIN instead of depending on it | * ca6279d1a1 kconfig: fix infinite loop when expanding a macro at the end of file | * a8cc354a81 tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT | * f1c9a0c338 serial: max310x: fix syntax error in IRQ error message | * bd2f4df259 tty: vt: fix 20 vs 0x20 typo in EScsiignore | * 854ebf45a4 afs: Revert "afs: Hide silly-rename files from userspace" | * afcbba70bf NFS: Fix an off by one in root_nfs_cat() | * bcc3ec2bdb watchdog: stm32_iwdg: initialize default timeout | * e95eeb7f7d net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() | * 3b8415daaa scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn | * 2b38dbd7fa RDMA/device: Fix a race between mad_client and cm_client init | * 39b1af7bc9 scsi: csiostor: Avoid function pointer casts | * 6d5dc96b15 ALSA: usb-audio: Stop parsing channels bits when all channels are found. | * d7ae7d1265 clk: Fix clk_core_get NULL dereference | * a1129b0922 sparc32: Fix section mismatch in leon_pci_grpci | * c8c038beb4 backlight: lp8788: Fully initialize backlight_properties during probe | * 8c351a9ef5 backlight: lm3639: Fully initialize backlight_properties during probe | * 12a0153f78 backlight: da9052: Fully initialize backlight_properties during probe | * 1c8d8c6b4e backlight: lm3630a: Don't set bl->props.brightness in get_brightness | * 40a89f1bc4 backlight: lm3630a: Initialize backlight_properties on init | * bb9981f915 powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. | * a6e96cc265 drm/msm/dpu: add division of drm_display_mode's hskew parameter | * 41eec45c71 powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks | * dfde84cc6c drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip | * af37aed049 media: ttpci: fix two memleaks in budget_av_attach | * 353f980a5d media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO | * fa83fca55c media: rename VFL_TYPE_GRABBER to _VIDEO | * 25f5765521 media: v4l2-core: correctly validate video and metadata ioctls | * 291cda0b80 media: go7007: fix a memleak in go7007_load_encoder | * fa8b472952 media: dvb-frontends: avoid stack overflow warnings with clang | * d29ed08964 media: pvrusb2: fix uaf in pvr2_context_set_notify | * 86c10c56f2 drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() | * 23d57b99ca ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs | * 8df143c608 mtd: rawnand: lpc32xx_mlc: fix irq handler prototype | * d9d4d1363b mtd: maps: physmap-core: fix flash size larger than 32-bit | * a8c73f0439 crypto: arm/sha - fix function cast warnings | * 4b6569e142 mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref | * ac1170674d mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref | * 3472fa83d9 drm/tegra: put drm_gem_object ref on error in tegra_fb_create | * f27aaaecf7 clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() | * 44163c73b0 PCI: Mark 3ware-9650SE Root Port Extended Tags as broken | * 9b074f2ed1 drm/mediatek: dsi: Fix DSI RGB666 formats and definitions | * 2e1120e480 clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times | * d2f3c762ba media: pvrusb2: fix pvr2_stream_callback casts | * e9d391cc70 media: pvrusb2: remove redundant NULL check | * 013fb50518 media: go7007: add check of return value of go7007_read_addr() | * 8c2e4efe12 media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak | * cf95808632 perf stat: Avoid metric-only segv | * 9e411c40bd ALSA: seq: fix function cast warnings | * a0ae3335b3 drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() | * 9df9108a91 perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() | * 79ab819393 PCI: switchtec: Fix an error handling path in switchtec_pci_probe() | * 00b07b4962 quota: Fix rcu annotations of inode dquot pointers | * 49669f8e7e quota: Fix potential NULL pointer dereference | * ff29b5f9f0 quota: simplify drop_dquot_ref() | * 68435ffc1c clk: qcom: reset: Ensure write completion on reset de/assertion | * 026d3984a1 clk: qcom: reset: Commonize the de/assert functions | * 48846ddc71 clk: qcom: reset: support resetting multiple bits | * 7f82802d47 clk: qcom: reset: Allow specifying custom reset delay | * f20c3270f3 media: edia: dvbdev: fix a use-after-free | * 0175f2d34c media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity | * 8269ab1641 media: v4l2-tpg: fix some memleaks in tpg_alloc | * 2e6892b2be media: em28xx: annotate unchecked call to media_device_register() | * 639155da9b perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() | * e019d87e02 drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' | * 1d4d674173 perf record: Fix possible incorrect free in record__switch_output() | * adc8a91676 PCI/DPC: Print all TLP Prefixes, not just the first | * daf21394f9 media: tc358743: register v4l2 async device only after successful setup | * ba34d8a5aa dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA | * cc31a90eb7 drm/rockchip: lvds: do not overwrite error code | * f1dfd026cd drm: Don't treat 0 as -1 in drm_fixp2int_ceil | * b061b28b66 drm/rockchip: inno_hdmi: Fix video timing | * 91dc47cd72 drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() | * 030d46f859 drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() | * b4cb57ec2c drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() | * e04e773fb8 drm/tegra: dsi: Make use of the helper function dev_err_probe() | * 85f28e98c5 gpu: host1x: mipi: Update tegra_mipi_request() to be node based | * f05631a852 drm/tegra: dsi: Add missing check for of_find_device_by_node | * da7ece2197 dm: call the resume method on internal suspend | * 6070692ea3 dm raid: fix false positive for requeue needed during reshape | * 3b1e8a617e nfp: flower: handle acti_netdevs allocation failure | * e06f0d3f66 net/x25: fix incorrect parameter validation in the x25_getsockopt() function | * 26843eefcf net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function | * b9979cae62 udp: fix incorrect parameter validation in the udp_lib_getsockopt() function | * 1bd08e5314 l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function | * 2e7f3cabc6 tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function | * fb6639c748 net: hns3: fix port duplex configure error in IMP reset | * ec6bb01e02 net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() | * a9f5faf28e ipv6: fib6_rules: flush route cache when rule is changed | * 21e5fa4688 bpf: Fix stackmap overflow check on 32-bit arches | * 92c81fbb3e bpf: Fix hashtab overflow check on 32-bit arches | * 8a8b6a2468 sr9800: Add check for usbnet_get_endpoints | * 54a03e4ac1 Bluetooth: hci_core: Fix possible buffer overflow | * f6177a1723 Bluetooth: Remove superfluous call to hci_conn_check_pending() | * 03df15b579 igb: Fix missing time sync events | * 141897c5b0 igb: move PEROUT and EXTTS isr logic to separate functions | * 8081d80a92 mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function | * bfa9d86d39 SUNRPC: fix some memleaks in gssx_dec_option_array | * 52018aa146 x86, relocs: Ignore relocations in .notes section | * 450ac90ed4 ACPI: scan: Fix device check notification handling | * 33b498a123 ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node | * 0655698da8 ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address | * 8deafa61fb ARM: dts: imx6dl-yapp4: Move phy reset into switch node | * 174e3c8ee7 ARM: dts: arm: realview: Fix development chip ROM compatible value | * de8abc894b net: ena: Remove ena_select_queue | * f434eacad6 net: ena: cosmetic: fix line break issues | * a4fc14a662 wifi: brcmsmac: avoid function pointer casts | * 6234e09e69 iommu/amd: Mark interrupt as managed | * 073b5bbb13 bus: tegra-aconnect: Update dependency to ARCH_TEGRA | * ea96bf3f80 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() | * 2eb2a5d6f5 arm64: dts: qcom: msm8996: Pad addresses | * a8f3650656 arm64: dts: qcom: msm8996: Move regulator consumers to db820c | * 1f685fa06c arm64: dts: qcom: msm8996: Use node references in db820c | * adcf4eeb34 arm64: dts: qcom: db820c: Move non-soc entries out of /soc | * 6bbbd2fd08 bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly | * 6f51d61a43 bpf: Factor out bpf_spin_lock into helpers. | * cf0d888ea7 bpf: Add typecast to bpf helpers to help BTF generation | * e1f7fef6e2 arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes | * bea9573c79 wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() | * 6fd9061497 net: blackhole_dev: fix build warning for ethh set but not used | * ef036a0598 af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). | * 4bdfc38a98 sock_diag: annotate data-races around sock_diag_handlers[family] | * 76ac9c141e wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() | * e556006de4 wifi: wilc1000: fix RCU usage in connect path | * 1bda3ff1fd wifi: wilc1000: fix declarations ordering | * 8c6210d175 wifi: b43: Disable QoS for bcm4331 | * 12062b149f wifi: b43: Stop correct queue in DMA worker when QoS is disabled | * c668f0f825 b43: main: Fix use true/false for bool type | * 47ec637b11 wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled | * 31aaf17200 wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled | * 801be44049 b43: dma: Fix use true/false for bool type variable | * 88a9dffaec wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() | * be26970980 timekeeping: Fix cross-timestamp interpolation for non-x86 | * fee4e84c4e timekeeping: Fix cross-timestamp interpolation corner case decision | * 7cec7d8388 timekeeping: Fix cross-timestamp interpolation on counter wrap | * 1a54aa506b aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts | * 72dacc72b2 fs/select: rework stack allocation hack for clang | * 44214d744b nbd: null check for nla_nest_start | * 772a7def98 do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak | * 3f6186cc65 ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll | * 9f27f4d5d1 ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode | * f1d3be9eb9 ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC | * 5f3c13930b Input: gpio_keys_polled - suppress deferred probe error for gpio | * fa14a15373 ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet | * da17f556ad firewire: core: use long bus reset on gap count error | * 5f369efd9d Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security | * 6e9c113992 scsi: mpt3sas: Prevent sending diag_reset when the controller is ready | * 2daa2a8e89 btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve | * 890a1b31fa dm-verity, dm-crypt: align "struct bvec_iter" correctly | * 5d8afc25c7 block: sed-opal: handle empty atoms when parsing response | * 745718d00f parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check | * b43b1a7062 net/iucv: fix the allocation size of iucv_path_table array | * c411a3c828 RDMA/mlx5: Relax DEVX access upon modify commands | * 69dd0a99da HID: multitouch: Add required quirk for Synaptics 0xcddc device | * 7d7fa0bea3 MIPS: Clear Cause.BD in instruction_pointer_set | * 025a8a96c7 x86/xen: Add some null pointer checking to smp.c | * 4c00abb52a ASoC: rt5645: Make LattePanda board DMI match more precise | * ef5de5d505 selftests: tls: use exact comparison in recv_partial | * cfb24022bb io_uring: drop any code related to SCM_RIGHTS | * 2692b8a016 io_uring/unix: drop usage of io_uring socket * | f509fa9b09 Revert "regmap: allow to define reg_update_bits for no bus configuration" * | 012b5eceed Revert "regmap: Add bulk read/write callbacks into regmap_config" * | 0efa1aa851 Revert "serial: max310x: fix IO data corruption in batched operations" * | 43bbe91c9f Revert "geneve: make sure to pull inner header in geneve_rx()" * | ee2f1c68f1 Merge 5.4.272 into android11-5.4-lts |\| | * 8407582630 Linux 5.4.272 | * 345ced4052 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts | * 1b3d8cbd1c arm64: dts: qcom: add PDC interrupt controller for SDM845 | * 59b3583da1 serial: max310x: fix IO data corruption in batched operations | * f5c252aaa1 serial: max310x: implement I2C support | * 112094efd6 serial: max310x: make accessing revision id interface-agnostic | * b96b017919 regmap: Add bulk read/write callbacks into regmap_config | * 758c6799da regmap: allow to define reg_update_bits for no bus configuration | * 9a7bbea266 serial: max310x: Unprepare and disable clock in error path | * 664a6a904a getrusage: use sig->stats_lock rather than lock_task_sighand() | * 2b34f60383 getrusage: use __for_each_thread() | * c50a059431 getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() | * ef8a8b36a1 getrusage: add the "signal_struct *sig" local variable | * f184f21978 y2038: rusage: use __kernel_old_timeval | * c7441c77c9 hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed | * f2ab3eaa64 hv_netvsc: use netif_is_bond_master() instead of open code | * 9b5ef7a528 hv_netvsc: Make netvsc/VF binding check both MAC and serial number | * 5402ec577f Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU | * bf6bb3612e serial: max310x: prevent infinite while() loop in port startup | * 7e30e5c143 serial: max310x: use a separate regmap for each port | * 3fb7c9bcd0 serial: max310x: use regmap methods for SPI batch operations | * 2c9c830d74 serial: max310x: Make use of device properties | * b765176ae1 serial: max310x: fail probe if clock crystal is unstable | * 816700131e serial: max310x: Try to get crystal clock rate from property | * c76dcad53b serial: max310x: Use devm_clk_get_optional() to get the input clock | * b569d91e51 um: allow not setting extra rpaths in the linux binary | * 47c68edecc selftests: mm: fix map_hugetlb failure on 64K page size systems | * f9055fa2b2 netrom: Fix data-races around sysctl_net_busy_read | * 07bbccd1ad netrom: Fix a data-race around sysctl_netrom_link_fails_count | * c4309e5f8e netrom: Fix a data-race around sysctl_netrom_routing_control | * cbba77abb4 netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout | * 89aa78a343 netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size | * 1f60795dca netrom: Fix a data-race around sysctl_netrom_transport_busy_delay | * 80578681ea netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay | * f716a68234 netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries | * eadec8da44 netrom: Fix a data-race around sysctl_netrom_transport_timeout | * eda02a0bed netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser | * 1e84b108f2 netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser | * 7f61523255 netrom: Fix a data-race around sysctl_netrom_default_path_quality | * 4bafcc43ba netfilter: nf_conntrack_h323: Add protection for bmp length out of range | * 6ec3032022 netfilter: nft_ct: fix l3num expectations with inet pseudo family | * 997efea2bf net/rds: fix WARNING in rds_conn_connect_if_down | * 664f9c6472 net/ipv6: avoid possible UAF in ip6_route_mpath_notify() | * d9fefc5113 net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() | * 59d2a40769 geneve: make sure to pull inner header in geneve_rx() | * a248b1f58a ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able | * 7f08778469 net: lan78xx: fix runtime PM count underflow on link stop | * 81934a2ab5 lan78xx: Fix race conditions in suspend/resume handling | * 57b9c48cd5 lan78xx: Fix partial packet errors on suspend/resume | * e68b46e9aa lan78xx: Add missing return code checks | * b1cc23ffe1 lan78xx: Fix white space and style issues * | 79ed7de671 Merge branch 'android11-5.4' into branch 'android11-5.4-lts' * | 26385fa150 UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts * | e1dfe2d3de UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845 * | 40df6b551d Merge 5.4.271 into android11-5.4-lts |\| | * 3fec063b05 Linux 5.4.271 | * 9162730a83 gpio: 74x164: Enable output pins after registers are reset | * 1dde8ef4b7 fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super | * 037d5a949b cachefiles: fix memory leak in cachefiles_add_cache() | * ace0fdf796 x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers | * 9d660e5adf mmc: core: Fix eMMC initialization with 1-bit bus connection | * 3cc5fb824c dmaengine: fsl-qdma: init irq after reg initialization | * 518d78b4fa dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read | * c6652e20d7 btrfs: dev-replace: properly validate device names | * 0cfbb26ee5 wifi: nl80211: reject iftype change with mesh ID change | * ec92aa2cab gtp: fix use-after-free and null-ptr-deref in gtp_newlink() | * 5c78be006e afs: Fix endless loop in directory parsing | * 26dda65b09 ALSA: Drop leftover snd-rtctimer stuff from Makefile | * 7394abc892 power: supply: bq27xxx-i2c: Do not free non existing IRQ | * 950d4d74d3 efi/capsule-loader: fix incorrect allocation size | * b9fbc44159 rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back | * 260410c589 netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() | * 20f6f150e1 Bluetooth: Enforce validation on max value of connection interval | * 79820a7e1e Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST | * 98fb98fd37 Bluetooth: Avoid potential use-after-free in hci_error_reset | * 6e0000a432 net: usb: dm9601: fix wrong return value in dm9601_mdio_read | * 69624e28d6 lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected | * 9d4ffb5b9d ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() | * f5f11f7e28 tun: Fix xdp_rxq_info's queue_index when detaching | * f81e94d2dc net: ip_tunnel: prevent perpetual headroom growth | * 9ae51361da netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter * | 7dde2bcd3f ANDROID: GKI: update .xml file due to USB changes in 5.4.270 * | 1ac7c39f24 Merge 5.4.270 into android11-5.4-lts |\| | * e133c1ee6d Linux 5.4.270 | * 7a54338219 scripts/bpf: Fix xdp_md forward declaration typo | * b4eea7a05e fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio | * c28fc1aa6f drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set | * 29db9725f2 drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 | * ae4360cbd3 netfilter: nf_tables: set dormant flag on hook register failure | * f310143961 tls: stop recv() if initial process_rx_list gave us non-DATA | * a26742ada7 tls: rx: drop pointless else after goto | * c1287c1d6b tls: rx: jump to a more appropriate label | * 06de230254 s390: use the correct count for __iowrite64_copy() | * 7eee00feb6 packet: move from strlcpy with unused retval to strscpy | * 82831e3ff7 ipv6: sr: fix possible use-after-free and null-ptr-deref | * 5c27d85a69 afs: Increase buffer size in afs_update_volume_status() | * 799a4afaa5 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid | * 5888f34249 ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid | * a50cb1d6f3 nouveau: fix function cast warnings | * fe031dfcea scsi: jazz_esp: Only build if SCSI core is builtin | * dd90af71fa bpf, scripts: Correct GPL license name | * 1f18b5bb45 scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions | * 48ebca0a11 RDMA/srpt: fix function pointer cast warnings | * 3107633774 RDMA/srpt: Make debug output more detailed | * 6e461952df RDMA/bnxt_re: Return error for SRQ resize | * cecfb90cf7 IB/hfi1: Fix a memleak in init_credit_return | * bbcf72333b usb: roles: don't get/set_role() when usb_role_switch is unregistered | * a31cf46d10 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs | * aad6132ae6 usb: cdns3: fix memory double free when handle zero packet | * cfa9abb557 usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() | * 999a8bb70d ARM: ep93xx: Add terminator to gpiod_lookup_table | * c1d3a84a67 l2tp: pass correct message length to ip6_append_data | * caf4a67c01 PCI/MSI: Prevent MSI hardware interrupt number truncation | * f8cbd17919 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() | * 0dccbb9353 dm-crypt: don't modify the data when using authenticated encryption | * 5833024a98 IB/hfi1: Fix sdma.h tx->num_descs off-by-one error | * 6ede985c6b PCI: tegra: Fix OF node reference leak | * e04a2afd08 PCI: tegra: Fix reporting GPIO error value | * e3fc080911 arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node | * efd63c23a4 drm/amdgpu: Fix type of second parameter in trans_msg() callback | * f691ab24cf iomap: Set all uptodate bits for an Uptodate page | * 45227ae32f dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() | * 3770c38cd6 x86/alternatives: Disable KASAN in apply_alternatives() | * f45dc10a3c drm/amdgpu: Check for valid number of registers to read | * 90aa9135a4 Revert "drm/sun4i: dsi: Change the start delay calculation" | * 7000efb6d8 ALSA: hda/realtek - Enable micmute LED on and HP system | * 82c53047fe selftests/bpf: Avoid running unprivileged tests with alignment requirements | * 81e03f638d net: bridge: clear bridge's private skb space on xmit | * 82174d6bd7 spi: mt7621: Fix an error message in mt7621_spi_probe() | * 954a7a0011 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups | * 759756e2cf pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours | * 99dc568545 tcp: add annotations around sk->sk_shutdown accesses | * 41ca938616 tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit | * 5a9dc14df2 tcp: factor out __tcp_close() helper | * d428676420 pmdomain: renesas: r8a77980-sysc: CR7 must be always on | * 3bc35da667 s390/qeth: Fix potential loss of L3-IP@ in case of network issues | * b7bfaea8f5 virtio-blk: Ensure no requests in virtqueues before deleting vqs. | * d124ab01fc firewire: core: send bus reset promptly on gap count error | * b5854f923d scsi: lpfc: Use unsigned type for num_sge | * 60635f8a05 hwmon: (coretemp) Enlarge per package core count limit | * 6d338fb1a1 nvmet-fc: abort command when there is no binding | * ac524b7b3f netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new | * 6f5015ce25 ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 | * c3a25d4fdd nvmet-tcp: fix nvme tcp ida memory leak | * 5068cb91ed regulator: pwm-regulator: Add validity checks in continuous .get_voltage | * 6b92b1bc16 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() | * 260fc96283 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() | * bccb418eba ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers | * e896bf4878 ahci: asm1166: correct count of reported ports | * 6db07619d1 fbdev: sis: Error out if pixclock equals zero | * 84dce0f6a4 fbdev: savage: Error out if pixclock equals zero | * 85720b69ae wifi: mac80211: fix race condition on enabling fast-xmit | * d3032de2c8 wifi: cfg80211: fix missing interfaces when dumping | * bb3813a6a7 dmaengine: fsl-qdma: increase size of 'irq_name' | * a7229c75c3 dmaengine: shdma: increase size of 'dev_id' | * 11f3fe5001 scsi: target: core: Add TMF to tmr_list handling | * d2fc4134aa sched/rt: Disallow writing invalid values to sched_rt_period_us | * b69677bfd7 sched/rt: Fix sysctl_sched_rr_timeslice intial value | * 429aaf144b userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb | * b0911b8d37 nilfs2: replace WARN_ONs for invalid DAT metadata block requests | * febd743200 memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock() | * d7b5bdb52d sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset | * 010dc505ea net/sched: Retire dsmark qdisc | * 40e8abb86d net/sched: Retire ATM qdisc | * 493685f3dd net/sched: Retire CBQ qdisc | * 9d17e73504 KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler | * 68799371c9 KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() * | 3298a76a41 Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()" * | 241e0d860f Revert "hrtimer: Report offline hrtimer enqueue" * | ce97b1b6bc Revert "drm/mipi-dsi: Fix detach call without attach" * | 806fb883ea Merge 5.4.269 into android11-5.4-lts |/ * 6e1f54a498 Linux 5.4.269 * e9aa8e5a72 of: gpio unittest kfree() wrong object * 6ac8965955 of: unittest: fix EXPECT text for gpio hog errors * 7dd275ce3b net: bcmgenet: Fix EEE implementation * 10c586da9f Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"" * 25b42be4e0 netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() * 3dd76bebcd lsm: new security_file_ioctl_compat() hook * efdf644062 drm/msm/dsi: Enable runtime PM * fef59ee6c0 PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() * 835ed5effb PM: runtime: add devm_pm_runtime_enable helper * d31c8721e8 nilfs2: fix potential bug in end_buffer_async_write * 2441a64070 sched/membarrier: reduce the ability to hammer on sys_membarrier * cd1022eaf8 net: prevent mss overflow in skb_segment() * 6587af96ef netfilter: ipset: Missing gc cancellations fixed * c7f2733e50 netfilter: ipset: fix performance regression in swap operation * d04acadb64 KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache * 4705a9fc50 mips: Fix max_mapnr being uninitialized on early stages * 5e0854b60a arch, mm: remove stale mentions of DISCONIGMEM * c324e2716d bus: moxtet: Add spi device table * 7f71d9817c Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" * 60e092289c tracing: Inform kmemleak of saved_cmdlines allocation * fbe86124b7 pmdomain: core: Move the unused cleanup to a _sync initcall * 08de58abed can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) * a257ffde37 irqchip/irq-brcmstb-l2: Add write memory barrier before exit * 91a7c00235 nfp: flower: prevent re-adding mac index for bonded port * b22c9a37c7 nfp: use correct macro for LengthSelect in BAR config * 862ee4422c nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() * a6efe6dbaa nilfs2: fix data corruption in dsync block recovery for small block sizes * 6ce7d5e6d2 ALSA: hda/conexant: Add quirk for SWS JS201D * 6b8bdc509e mmc: slot-gpio: Allow non-sleeping GPIO ro * 4f2fde5051 x86/mm/ident_map: Use gbpages only where full GB page should be mapped. * 4c7b1d08ad x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 * ed14ab2611 serial: max310x: improve crystal stable clock detection * 5814a9045c serial: max310x: set default value when reading clock ready bit * ef60665ea9 ring-buffer: Clean ring_buffer_poll_wait() error return * 7200170e88 iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC * 720d0112b3 staging: iio: ad5933: fix type mismatch regression * 77e7a316cd tracing: Fix wasted memory in saved_cmdlines logic * afbcad9ae7 ext4: fix double-free of blocks due to wrong extents moved_len * 15238f4b21 misc: fastrpc: Mark all sessions as invalid in cb_remove * 42beab162d binder: signal epoll threads of self-work * 93a52449fe ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL * 9086b27eac xen-netback: properly sync TX responses * 71349abe3a nfc: nci: free rx_data_reassembly skb on NCI device cleanup * 4ae191effb kbuild: Fix changing ELF file type for output of gen_btf for big endian * 750a4e5999 firewire: core: correct documentation of fw_csr_string() kernel API * 2209fc6e3d scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" * d074d5ff5a i2c: i801: Fix block process call transactions * 4de1489d80 i2c: i801: Remove i801_set_block_buffer_mode * df112ccb9b usb: f_mass_storage: forbid async queue when shutdown happen * addaa8627f USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT * dbaca8fa9e HID: wacom: Do not register input devices until after hid_hw_start * e13bed5cfe HID: wacom: generic: Avoid reporting a serial of '0' to userspace * 1f12e4b328 mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again * 8ffd5590f4 tracing/trigger: Fix to return error if failed to alloc snapshot * a67f1f83f3 i40e: Fix waiting for queues of all VSIs to be disabled * 9a3a82affa MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler * 422d5243b9 ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() * 91b48c6339 spi: ppc4xx: Drop write-only variable * 61da1f41d0 of: unittest: Fix compile in the non-dynamic case * f6997a2416 of: unittest: add overlay gpio test to catch gpio hog problem * 89485251f6 btrfs: send: return EOPNOTSUPP on unknown flags * 863837df8a btrfs: forbid deleting live subvol qgroup * d25031ba2a btrfs: forbid creating subvol qgroups * 10e9cb3931 netfilter: nft_set_rbtree: skip end interval element from gc * 7fde2acc6d net: stmmac: xgmac: fix a typo of register name in DPP safety handling * b9ff931f00 net: stmmac: xgmac: use #define for string constants * 88c7e1e7a6 vhost: use kzalloc() instead of kmalloc() followed by memset() * 09e77c7d67 Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID * a012efe0df hrtimer: Report offline hrtimer enqueue * 4a589de93c USB: serial: cp210x: add ID for IMST iM871A-USB * cd0ab7f2a8 USB: serial: option: add Fibocom FM101-GL variant * 896695af51 USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e * 11ca9624cc net/af_iucv: clean up a try_then_request_module() * 1c7488156e netfilter: nft_ct: reject direction for ct id * 8e2a84c6da netfilter: nft_compat: restrict match/target protocol to u16 * f139a4c6d2 netfilter: nft_compat: reject unused compat flag * 56fae81633 ppp_async: limit MRU to 64K * 6f70f0b412 tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() * ef1f56f2cd rxrpc: Fix response to PING RESPONSE ACKs to a dead call * 5993f121fb inet: read sk->sk_family once in inet_recv_error() * 7c96975c24 hwmon: (coretemp) Fix bogus core_id to attr name mapping * 1eb74c00c9 hwmon: (coretemp) Fix out-of-bounds memory access * 51d76b7230 hwmon: (aspeed-pwm-tacho) mutex for tach reading * df0965935a atm: idt77252: fix a memleak in open_card_ubr0 * a0ac20fd53 selftests: net: avoid just another constant wait * e9837c83be net: stmmac: xgmac: fix handling of DPP safety error for DMA channels * 8398d8d735 phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP * 0cb90f27a3 dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV * 6ff4827315 phy: renesas: rcar-gen3-usb2: Fix returning wrong error code * 1c75fe450b dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA * c263609416 dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA * 817bedcd7f bonding: remove print in bond_verify_device_path * e95120698b HID: apple: Add 2021 magic keyboard FN key mapping * 5991ab8940 HID: apple: Swap the Fn and Left Control keys on Apple keyboards * 6d4771ab2d HID: apple: Add support for the 2021 Magic Keyboard * 67f56ef9e1 net: sysfs: Fix /sys/class/net/<iface> path * b169ffde73 af_unix: fix lockdep positive in sk_diag_dump_icons() * b3dace37f1 net: ipv4: fix a memleak in ip_setup_cork * f549f340c9 netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations * 06608603fa netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger * 64babb17e8 llc: call sock_orphan() at release time * 2a09d1784c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses * 7f1a24914b ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() * a10e95d6cf ixgbe: Refactor overtemp event handling * 2d533ddca2 ixgbe: Refactor returning internal error codes * 980c806f67 ixgbe: Remove non-inclusive language * 7c03b74865 net: remove unneeded break * b81f679ac5 scsi: isci: Fix an error code problem in isci_io_request_build() * 12f58dce48 wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update * ad2bd6cd17 perf: Fix the nr_addr_filters fix * 34da3b9fa5 drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' * 6ab4fd508f ceph: fix deadlock or deadcode of misusing dget() * ecd7744a14 blk-mq: fix IO hang from sbitmap wakeup race * 977105472f virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings * 884b746209 libsubcmd: Fix memory leak in uniq() * 3e06e9b906 PCI/AER: Decode Requester ID when no error info found * 133bf750d7 fs/kernfs/dir: obey S_ISGID * 17c252f192 usb: hub: Replace hardcoded quirk value with BIT() macro * d8c2935499 PCI: switchtec: Fix stdev_release() crash after surprise hot remove * a32a24da0e PCI: Only override AMD USB controller if required * e2048eb3cb mfd: ti_am335x_tscadc: Fix TI SoC dependencies * 838cbe01db i3c: master: cdns: Update maximum prescaler value for i2c clock * a6946682dd um: net: Fix return type of uml_net_start_xmit() * c8115f2bd8 um: Don't use vfprintf() for os_info() * 735a29ce08 um: Fix naming clash between UML and scheduler * ddd1f258f0 leds: trigger: panic: Don't register panic notifier if creating the trigger failed * 9052b3e0e7 drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' * 548f9a37d7 drm/amdgpu: Let KFD sync with VM fences * 15d674571a clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() * 105444e207 clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() * 8a96f1caf1 drm/msm/dpu: Ratelimit framedone timeout msgs * 4d181fe966 media: ddbridge: fix an error code problem in ddb_probe * 615e3adc20 IB/ipoib: Fix mcast list locking * fb703d31fd drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time * c1b2e5e837 ALSA: hda: Intel: add HDA_ARL PCI ID support * c91bda92fb PCI: add INTEL_HDA_ARL to pci_ids.h * fbbee078cf media: rockchip: rga: fix swizzling for RGB formats * acb1bffe5f media: stk1160: Fixed high volume of stk1160_dbg messages * 67997250d3 drm/mipi-dsi: Fix detach call without attach * d778e10dde drm/framebuffer: Fix use of uninitialized variable * da980f8db0 drm/drm_file: fix use of uninitialized variable * 00a5feb060 RDMA/IPoIB: Fix error code return in ipoib_mcast_join * b0f907a4ef fast_dput(): handle underflows gracefully * 12ba5b9cf8 ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument * 9fceaf8182 f2fs: fix to check return value of f2fs_reserve_new_block() * 52240224e7 wifi: cfg80211: free beacon_ies when overridden from hidden BSS * 18c2989c30 wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() * 8ec36f2d0c wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices * f3b7a31bf1 arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property * c3f22192a2 arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property * 351b37b88e md: Whenassemble the array, consult the superblock of the freshest device * 6f2cd02ff5 block: prevent an integer overflow in bvec_try_merge_hw_page * fb9c25ea0a ARM: dts: imx23/28: Fix the DMA controller node name * c48e75a7ee ARM: dts: imx23-sansa: Use preferred i2c-gpios properties * 83b1cceca9 ARM: dts: imx27-apf27dev: Fix LED name * 06c3f5920f ARM: dts: imx25/27: Pass timing0 * 826e8fa48e ARM: dts: imx1: Fix sram node * 05f309a3fa ARM: dts: imx27: Fix sram node * 1e35a4cf5a ARM: dts: imx: Use flash@0,0 pattern * 30cfab1c8c ARM: dts: imx25/27-eukrea: Fix RTC node name * ca14da9a1e ARM: dts: rockchip: fix rk3036 hdmi ports node * e9ac3e3398 scsi: libfc: Fix up timeout error in fc_fcp_rec_error() * f5a875051e scsi: libfc: Don't schedule abort twice * eb6f68ec92 bpf: Add map and need_defer parameters to .map_fd_put_ptr() * f11f0fd1ad wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() * 53dd674b32 ARM: dts: imx7s: Fix nand-controller #size-cells * a86ce3671d ARM: dts: imx7s: Fix lcdif compatible * 183edc0ad2 ARM: dts: imx7d: Fix coresight funnel ports * 6c50e561ce bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk * 4d981d9224 PCI: Add no PM reset quirk for NVIDIA Spectrum devices * 0e8c8aa8e3 scsi: lpfc: Fix possible file string name overflow when updating firmware * cbd0b6268a selftests/bpf: Fix pyperf180 compilation failure with clang18 * 982bdaa0fc selftests/bpf: satisfy compiler by having explicit return in btf test * e1f113b57d wifi: rt2x00: restart beacon queue when hardware reset * b183fe8702 ext4: avoid online resizing failures due to oversized flex bg * 92c3c5cfed ext4: remove unnecessary check from alloc_flex_gd() * 7cb19e1336 ext4: unify the type of flexbg_size to unsigned int * 360c28a2fd ext4: fix inconsistent between segment fstrim and full fstrim * ec10755496 ecryptfs: Reject casefold directory inodes * 7a96d85bf1 SUNRPC: Fix a suspicious RCU usage warning * 5e63c9ae80 KVM: s390: fix setting of fpc register * 6d0822f2cc s390/ptrace: handle setting of fpc register correctly * de6a91aed1 jfs: fix array-index-out-of-bounds in diNewExt * 592d29eb6b rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() * f4a0b57632 afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() * 3f4cba4cf8 crypto: stm32/crc32 - fix parsing list of devices * e9f6ac5089 pstore/ram: Fix crash when setting number of cpus to an odd number * 93df0a2a0b jfs: fix uaf in jfs_evict_inode * 3f8217c323 jfs: fix array-index-out-of-bounds in dbAdjTree * 1b9d682858 jfs: fix slab-out-of-bounds Read in dtSearch * fd3486a893 UBSAN: array-index-out-of-bounds in dtSplitRoot * 98f9537fe6 FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree * d2049af7dd ACPI: extlog: fix NULL pointer dereference check * 0d2adafba9 PNP: ACPI: fix fortify warning * b0b96859ab ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop * 20277842d9 audit: Send netlink ACK before setting connection in auditd_set * 27756ae366 regulator: core: Only increment use_count when enable_count changes * aed181fbc2 perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file * 980d5fe989 x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel * 0580f4403a powerpc/lib: Validate size for vector operations * 7cd81d2358 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE * 9bf6c6f097 powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() * 171468044b powerpc: Fix build error due to is_valid_bugaddr() * f6781add1c powerpc/mm: Fix null-pointer dereference in pgtable_cache_add * 3cdbfac106 x86/entry/ia32: Ensure s32 is sign extended to s64 * aa8bd0d9b2 tick/sched: Preserve number of idle sleeps across CPU hotplug events * 200d17b226 mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan * b2b0d40775 spi: bcm-qspi: fix SFDP BFPT read by usig mspi read * 344e8f3392 gpio: eic-sprd: Clear interrupt after set the interrupt type * f81d67832c drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume * 83d86b4a77 drm/exynos: fix accidental on-stack copy of exynos_drm_plane * 3e835d6e65 drm/bridge: nxp-ptn3460: simplify some error checking * 021e214947 drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking * 9dd334a824 drm: Don't unref the same fb many times by mistake due to deadlock handling * 5624d628a1 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 * 4e66422f1b netfilter: nf_tables: reject QUEUE/DROP verdict parameters * bd517df3bd rbd: don't move requests to the running list on errors * 69a0876252 btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args * d0bf04c965 btrfs: don't warn if discard range is not aligned to sector * 927d1a3d32 btrfs: tree-checker: fix inline ref size in error messages * 5c9e576bfd btrfs: ref-verify: free ref cache before clearing mount opt * d3d6162eb1 net: fec: fix the unhandled context fault from smmu * 3422bfda92 fjes: fix memleaks in fjes_hw_setup * 07bcc3cd3d netfilter: nf_tables: validate NFPROTO_* family * b55e492f06 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes * 2501afe6c4 net/mlx5e: fix a double-free in arfs_create_groups * bca555e8a2 net/mlx5: Use kfree(ft->g) in arfs_create_groups() * 0917d771f6 net/mlx5: DR, Use the right GVMI number for drop action * 4f4dc7098b netlink: fix potential sleeping issue in mqueue_flush_file * da70948068 tcp: Add memory barrier to tcp_push() * 01d15b68f0 afs: Hide silly-rename files from userspace * dad9b28f67 tracing: Ensure visibility when inserting an element into tracing_map * a37ae111db net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv * b8e8838f82 llc: Drop support for ETH_P_TR_802_2. * b643d0defc llc: make llc_ui_sendmsg() more robust against bonding changes * 06f30fdbc4 vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING * 1fea9969b8 net/smc: fix illegal rmb_desc access in SMC-D connection dump * 5c6183f3c7 x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum * 7e180b702a powerpc: Use always instead of always-y in for crtsavres.o * 457ef4fe54 fs: move S_ISGID stripping into the vfs_*() helpers * 0cb0093fd6 fs: add mode_strip_sgid() helper * 635a0039e8 mtd: spinand: macronix: Fix MX35LFxGE4AD page size * 3f4e660144 block: Remove special-casing of compound pages * 0785e29899 rename(): fix the locking of subdirectories * f0824ca283 ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path * a1e80a33bf nouveau/vmm: don't set addr on the fail path to avoid warning * f49f9e8027 mmc: core: Use mrq.sbc in close-ended ffu * e15b1553d0 arm64: dts: qcom: sdm845: fix USB wakeup interrupt types * 830c99794b parisc/firmware: Fix F-extend for PDC addresses * dd50fe18c2 rpmsg: virtio: Free driver_override when rpmsg_remove() * 5030d4c798 hwrng: core - Fix page fault dead lock on mmap-ed hwrng * 5bc17b4fc2 PM: hibernate: Enforce ordering during image compression/decompression * cf6889bb8b crypto: api - Disallow identical driver names * a7edaf40fc ext4: allow for the last group to be marked as trimmed * e2ecfd5565 serial: sc16is7xx: add check for unsupported SPI modes during probe * 120b65f80b spi: introduce SPI_MODE_X_MASK macro * 2b708e6b28 serial: sc16is7xx: set safe default SPI clock frequency * e53321b341 units: add the HZ macros * 34d74cf3c7 units: change from 'L' to 'UL' * 7478445a45 units: Add Watt units * b617974548 include/linux/units.h: add helpers for kelvin to/from Celsius conversion * 2ed05a8cc9 PCI: mediatek: Clear interrupt status before dispatching handler Change-Id: I1ddbcc9d61402546e16694894da56199a22ec74d Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-01 07:06:09 +00:00
Carlos Llamas	66f4b04cb0	FROMLIST: binder: check offset alignment in binder_get_object() ... Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320 ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: <stable@vger.kernel.org> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 320661088 Link: https://lore.kernel.org/all/20240330190115.1877819-1-cmllamas@google.com/ Change-Id: Iaddabaa28de7ba7b7d35dbb639d38ca79dbc5077 Signed-off-by: Carlos Llamas <cmllamas@google.com>	2024-04-01 16:16:30 +00:00
Greg Kroah-Hartman	806fb883ea	This is the 5.4.269 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmXYSHgACgkQONu9yGCS aT74ag/6AqWJBzK/2xvUCYjfBU5+4ApFWQt47Ly9MKFhFX7YBjQGXS6av1YFA9Kw i01R9SCpIv2eaDrM7/J0wvXGybemfvQ8VyNngG30QC/0jTc4ZAj0PEbtyHpUaz4F HWOFfAlHAYcLQWhmjhXitoGUfeyhchWnQZpn45mkT0i3DSAEFc5gsiMlO+jaM8No hOaAHEpGsd7zlH32NYpWrFI0i54HSCwlaHlQFJ7U+rbWyG935RdLjMAX+488R8oc KccOj+xb4zQyASdC7qdgPz02U7Tm3UB5s0lLrviDiBrYVxSe77vw2TBEeejF+7ZE oYqjsygRYmRbKuI55rxyxph7cT93ZctL48DZJ4fT4zVIT9kak3S/NtFs0Hyr3TkY N6ZlDnd10cj8QsnXXtTd9QgT7Ind+3KySv7sr4a/gLO/N39EYpztrMCc/lKfG/Bu MPDMXBrEtKkjMelcnISwac9QcOb/MAJaepCWtYgcXbEcaBP+/Or8OM0yZPOEk7SA 3CamE+ou0Ds/c6gnsBw6WDMTJd+sX6sw6+4cMEaWzaWiE12Ryc0gscCDJXjEAYzc +47PiPijNJ+iPjsos8ZaNnTQHALemgJ4cjolHivsEvAYU1s5cyKjVEgMB1MJN8ib y19D9L8T9BtG2ukWBxtIXMIt51VZ7B8fXodcYXbyqtV25JZj/k8= =cJfu -----END PGP SIGNATURE----- Merge 5.4.269 into android11-5.4-lts Changes in 5.4.269 PCI: mediatek: Clear interrupt status before dispatching handler include/linux/units.h: add helpers for kelvin to/from Celsius conversion units: Add Watt units units: change from 'L' to 'UL' units: add the HZ macros serial: sc16is7xx: set safe default SPI clock frequency spi: introduce SPI_MODE_X_MASK macro serial: sc16is7xx: add check for unsupported SPI modes during probe ext4: allow for the last group to be marked as trimmed crypto: api - Disallow identical driver names PM: hibernate: Enforce ordering during image compression/decompression hwrng: core - Fix page fault dead lock on mmap-ed hwrng rpmsg: virtio: Free driver_override when rpmsg_remove() parisc/firmware: Fix F-extend for PDC addresses arm64: dts: qcom: sdm845: fix USB wakeup interrupt types mmc: core: Use mrq.sbc in close-ended ffu nouveau/vmm: don't set addr on the fail path to avoid warning ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path rename(): fix the locking of subdirectories block: Remove special-casing of compound pages mtd: spinand: macronix: Fix MX35LFxGE4AD page size fs: add mode_strip_sgid() helper fs: move S_ISGID stripping into the vfs_*() helpers powerpc: Use always instead of always-y in for crtsavres.o x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum net/smc: fix illegal rmb_desc access in SMC-D connection dump vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING llc: make llc_ui_sendmsg() more robust against bonding changes llc: Drop support for ETH_P_TR_802_2. net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv tracing: Ensure visibility when inserting an element into tracing_map afs: Hide silly-rename files from userspace tcp: Add memory barrier to tcp_push() netlink: fix potential sleeping issue in mqueue_flush_file net/mlx5: DR, Use the right GVMI number for drop action net/mlx5: Use kfree(ft->g) in arfs_create_groups() net/mlx5e: fix a double-free in arfs_create_groups netfilter: nf_tables: restrict anonymous set and map names to 16 bytes netfilter: nf_tables: validate NFPROTO_* family fjes: fix memleaks in fjes_hw_setup net: fec: fix the unhandled context fault from smmu btrfs: ref-verify: free ref cache before clearing mount opt btrfs: tree-checker: fix inline ref size in error messages btrfs: don't warn if discard range is not aligned to sector btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args rbd: don't move requests to the running list on errors netfilter: nf_tables: reject QUEUE/DROP verdict parameters gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 drm: Don't unref the same fb many times by mistake due to deadlock handling drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking drm/bridge: nxp-ptn3460: simplify some error checking drm/exynos: fix accidental on-stack copy of exynos_drm_plane drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume gpio: eic-sprd: Clear interrupt after set the interrupt type spi: bcm-qspi: fix SFDP BFPT read by usig mspi read mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan tick/sched: Preserve number of idle sleeps across CPU hotplug events x86/entry/ia32: Ensure s32 is sign extended to s64 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add powerpc: Fix build error due to is_valid_bugaddr() powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE powerpc/lib: Validate size for vector operations x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file regulator: core: Only increment use_count when enable_count changes audit: Send netlink ACK before setting connection in auditd_set ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop PNP: ACPI: fix fortify warning ACPI: extlog: fix NULL pointer dereference check FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree UBSAN: array-index-out-of-bounds in dtSplitRoot jfs: fix slab-out-of-bounds Read in dtSearch jfs: fix array-index-out-of-bounds in dbAdjTree jfs: fix uaf in jfs_evict_inode pstore/ram: Fix crash when setting number of cpus to an odd number crypto: stm32/crc32 - fix parsing list of devices afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() jfs: fix array-index-out-of-bounds in diNewExt s390/ptrace: handle setting of fpc register correctly KVM: s390: fix setting of fpc register SUNRPC: Fix a suspicious RCU usage warning ecryptfs: Reject casefold directory inodes ext4: fix inconsistent between segment fstrim and full fstrim ext4: unify the type of flexbg_size to unsigned int ext4: remove unnecessary check from alloc_flex_gd() ext4: avoid online resizing failures due to oversized flex bg wifi: rt2x00: restart beacon queue when hardware reset selftests/bpf: satisfy compiler by having explicit return in btf test selftests/bpf: Fix pyperf180 compilation failure with clang18 scsi: lpfc: Fix possible file string name overflow when updating firmware PCI: Add no PM reset quirk for NVIDIA Spectrum devices bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk ARM: dts: imx7d: Fix coresight funnel ports ARM: dts: imx7s: Fix lcdif compatible ARM: dts: imx7s: Fix nand-controller #size-cells wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() bpf: Add map and need_defer parameters to .map_fd_put_ptr() scsi: libfc: Don't schedule abort twice scsi: libfc: Fix up timeout error in fc_fcp_rec_error() ARM: dts: rockchip: fix rk3036 hdmi ports node ARM: dts: imx25/27-eukrea: Fix RTC node name ARM: dts: imx: Use flash@0,0 pattern ARM: dts: imx27: Fix sram node ARM: dts: imx1: Fix sram node ARM: dts: imx25/27: Pass timing0 ARM: dts: imx27-apf27dev: Fix LED name ARM: dts: imx23-sansa: Use preferred i2c-gpios properties ARM: dts: imx23/28: Fix the DMA controller node name block: prevent an integer overflow in bvec_try_merge_hw_page md: Whenassemble the array, consult the superblock of the freshest device arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() wifi: cfg80211: free beacon_ies when overridden from hidden BSS f2fs: fix to check return value of f2fs_reserve_new_block() ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument fast_dput(): handle underflows gracefully RDMA/IPoIB: Fix error code return in ipoib_mcast_join drm/drm_file: fix use of uninitialized variable drm/framebuffer: Fix use of uninitialized variable drm/mipi-dsi: Fix detach call without attach media: stk1160: Fixed high volume of stk1160_dbg messages media: rockchip: rga: fix swizzling for RGB formats PCI: add INTEL_HDA_ARL to pci_ids.h ALSA: hda: Intel: add HDA_ARL PCI ID support drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time IB/ipoib: Fix mcast list locking media: ddbridge: fix an error code problem in ddb_probe drm/msm/dpu: Ratelimit framedone timeout msgs clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() drm/amdgpu: Let KFD sync with VM fences drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' leds: trigger: panic: Don't register panic notifier if creating the trigger failed um: Fix naming clash between UML and scheduler um: Don't use vfprintf() for os_info() um: net: Fix return type of uml_net_start_xmit() i3c: master: cdns: Update maximum prescaler value for i2c clock mfd: ti_am335x_tscadc: Fix TI SoC dependencies PCI: Only override AMD USB controller if required PCI: switchtec: Fix stdev_release() crash after surprise hot remove usb: hub: Replace hardcoded quirk value with BIT() macro fs/kernfs/dir: obey S_ISGID PCI/AER: Decode Requester ID when no error info found libsubcmd: Fix memory leak in uniq() virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings blk-mq: fix IO hang from sbitmap wakeup race ceph: fix deadlock or deadcode of misusing dget() drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' perf: Fix the nr_addr_filters fix wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update scsi: isci: Fix an error code problem in isci_io_request_build() net: remove unneeded break ixgbe: Remove non-inclusive language ixgbe: Refactor returning internal error codes ixgbe: Refactor overtemp event handling ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() ipv6: Ensure natural alignment of const ipv6 loopback and router addresses llc: call sock_orphan() at release time netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations net: ipv4: fix a memleak in ip_setup_cork af_unix: fix lockdep positive in sk_diag_dump_icons() net: sysfs: Fix /sys/class/net/<iface> path HID: apple: Add support for the 2021 Magic Keyboard HID: apple: Swap the Fn and Left Control keys on Apple keyboards HID: apple: Add 2021 magic keyboard FN key mapping bonding: remove print in bond_verify_device_path dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA phy: renesas: rcar-gen3-usb2: Fix returning wrong error code dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP net: stmmac: xgmac: fix handling of DPP safety error for DMA channels selftests: net: avoid just another constant wait atm: idt77252: fix a memleak in open_card_ubr0 hwmon: (aspeed-pwm-tacho) mutex for tach reading hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping inet: read sk->sk_family once in inet_recv_error() rxrpc: Fix response to PING RESPONSE ACKs to a dead call tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() ppp_async: limit MRU to 64K netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id net/af_iucv: clean up a try_then_request_module() USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e USB: serial: option: add Fibocom FM101-GL variant USB: serial: cp210x: add ID for IMST iM871A-USB hrtimer: Report offline hrtimer enqueue Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID vhost: use kzalloc() instead of kmalloc() followed by memset() net: stmmac: xgmac: use #define for string constants net: stmmac: xgmac: fix a typo of register name in DPP safety handling netfilter: nft_set_rbtree: skip end interval element from gc btrfs: forbid creating subvol qgroups btrfs: forbid deleting live subvol qgroup btrfs: send: return EOPNOTSUPP on unknown flags of: unittest: add overlay gpio test to catch gpio hog problem of: unittest: Fix compile in the non-dynamic case spi: ppc4xx: Drop write-only variable ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler i40e: Fix waiting for queues of all VSIs to be disabled tracing/trigger: Fix to return error if failed to alloc snapshot mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again HID: wacom: generic: Avoid reporting a serial of '0' to userspace HID: wacom: Do not register input devices until after hid_hw_start USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT usb: f_mass_storage: forbid async queue when shutdown happen i2c: i801: Remove i801_set_block_buffer_mode i2c: i801: Fix block process call transactions scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" firewire: core: correct documentation of fw_csr_string() kernel API kbuild: Fix changing ELF file type for output of gen_btf for big endian nfc: nci: free rx_data_reassembly skb on NCI device cleanup xen-netback: properly sync TX responses ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL binder: signal epoll threads of self-work misc: fastrpc: Mark all sessions as invalid in cb_remove ext4: fix double-free of blocks due to wrong extents moved_len tracing: Fix wasted memory in saved_cmdlines logic staging: iio: ad5933: fix type mismatch regression iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC ring-buffer: Clean ring_buffer_poll_wait() error return serial: max310x: set default value when reading clock ready bit serial: max310x: improve crystal stable clock detection x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 x86/mm/ident_map: Use gbpages only where full GB page should be mapped. mmc: slot-gpio: Allow non-sleeping GPIO ro ALSA: hda/conexant: Add quirk for SWS JS201D nilfs2: fix data corruption in dsync block recovery for small block sizes nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() nfp: use correct macro for LengthSelect in BAR config nfp: flower: prevent re-adding mac index for bonded port irqchip/irq-brcmstb-l2: Add write memory barrier before exit can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) pmdomain: core: Move the unused cleanup to a _sync initcall tracing: Inform kmemleak of saved_cmdlines allocation Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" bus: moxtet: Add spi device table arch, mm: remove stale mentions of DISCONIGMEM mips: Fix max_mapnr being uninitialized on early stages KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache netfilter: ipset: fix performance regression in swap operation netfilter: ipset: Missing gc cancellations fixed net: prevent mss overflow in skb_segment() sched/membarrier: reduce the ability to hammer on sys_membarrier nilfs2: fix potential bug in end_buffer_async_write PM: runtime: add devm_pm_runtime_enable helper PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() drm/msm/dsi: Enable runtime PM lsm: new security_file_ioctl_compat() hook netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"" net: bcmgenet: Fix EEE implementation of: unittest: fix EXPECT text for gpio hog errors of: gpio unittest kfree() wrong object Linux 5.4.269 Change-Id: Iedabcdbe95a83593f102e237f2a80d2fc7206669 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-02-24 15:47:08 +00:00
Carlos Llamas	42beab162d	binder: signal epoll threads of self-work ... commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream. In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Cc: Arve Hjønnevåg <arve@android.com> Cc: Martijn Coenen <maco@android.com> Cc: Alice Ryhl <aliceryhl@google.com> Cc: Steven Moreland <smoreland@google.com> Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-02-23 08:25:11 +01:00
Greg Kroah-Hartman	74299cb130	This is the 5.4.268 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWy4hYACgkQONu9yGCS aT7SVBAAyx1DlSyJWcqzpESH0+VfqyWHxXlKS6Ip5wT0/+t0gglIKkwU/O0FsRXw pLO24wL0+MuIzgfZZj7wieAOPlGLOonKAvvUHGEMlpfAzyKjmZuW93WLKQlA/Oec uaT2ooQevRQcgXzbuV1yN/CeCnhbtmiQdcwy6OU5QACfzguQYtDbNGpbVHJEyEIW khlr+tj1KgRMzh/Sx76RPg4C/hkZBHun3tPcE0lTg+5QZDSkUj5gEdhVOSG2qmSh Lj9zt/isY3v6Whixel9YoTLr9SukI7ZlKzMrH1kSbGtTW3uZqgqB+7wCi1tWoNE1 Zwu9/kUe1dU1kfwYW8AA5OwupjBjADVnZZx1cKN3nQZG2J8bSKHwHmuZPx3DGhJ1 sxlaQ0nGvcEbCKljlIqsHzx2U22YKk939mVz5Y+MZYT5uwWRHI+iH4yRW97putSP t8tb3uX69Gsl6B+gLu38Mr7kkwyY06xmMnc5dfNCPwh8SxLj3dG7Gft90CNq1JKT q2cwlMEcDZRlC08kwzD7pRehZ6hYLRlTOv8yhQsQefcfzrtsT18Cec5TI2k72NOe fbIY8us3Qsr8JVSYuObGqT8LmkX9pkmRozEXgENvwltijEsWULoO2Hs+Z/yD07z8 RYqtxWxVxFVeHTkrXbbMUTZWhFx5LE+rtxCySpfeFkv0WgRRwa8= =vkKq -----END PGP SIGNATURE----- Merge 5.4.268 into android11-5.4-lts Changes in 5.4.268 f2fs: explicitly null-terminate the xattr list pinctrl: lochnagar: Don't build on MIPS ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 ASoC: Intel: Skylake: mem leak in skl register function ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration ASoC: rt5650: add mutex to avoid the jack detection failure nouveau/tu102: flush all pdbs on vmm flush net/tg3: fix race condition in tg3_reset_task() ASoC: da7219: Support low DC impedance headset nvme: introduce helper function to get ctrl state drm/exynos: fix a potential error pointer dereference drm/exynos: fix a wrong error checking clk: rockchip: rk3128: Fix HCLK_OTG gate register jbd2: correct the printing of write_flags in jbd2_write_superblock() drm/crtc: Fix uninit-value bug in drm_mode_setcrtc neighbour: Don't let neigh_forced_gc() disable preemption for long tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Input: atkbd - skip ATKBD_CMD_GETID in translated mode Input: i8042 - add nomux quirk for Acer P459-G2-M s390/scm: fix virtual vs physical address confusion ARC: fix spare error Input: xpad - add Razer Wolverine V2 support ida: Fix crash in ida_free when the bitmap is empty ARM: sun9i: smp: fix return code check of of_property_match_string drm/crtc: fix uninitialized variable use ACPI: resource: Add another DMI match for the TongFang GMxXGxx binder: use EPOLLERR from eventpoll.h binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value uio: Fix use-after-free in uio_open parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry coresight: etm4x: Fix width of CCITMIN field x86/lib: Fix overflow when counting digits EDAC/thunderx: Fix possible out-of-bounds string access powerpc: add crtsavres.o to always-y instead of extra-y powerpc/44x: select I2C for CURRITUCK powerpc/pseries/memhotplug: Quieten some DLPAR operations powerpc/pseries/memhp: Fix access beyond end of drmem array selftests/powerpc: Fix error handling in FPU/VMX preemption tests powerpc/powernv: Add a null pointer check to scom_debug_init_one() powerpc/powernv: Add a null pointer check in opal_event_init() powerpc/powernv: Add a null pointer check in opal_powercap_init() powerpc/imc-pmu: Add a null pointer check in update_events_in_group() mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response ACPI: video: check for error while searching for backlight device parent ACPI: LPIT: Avoid u32 multiplication overflow net: netlabel: Fix kerneldoc warnings netlabel: remove unused parameter in netlbl_netlink_auditinfo() calipso: fix memory leak in netlbl_calipso_add_pass() spi: sh-msiof: Enforce fixed DTDL for R-Car H3 mtd: Fix gluebi NULL pointer dereference caused by ftl notifier selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket crypto: virtio - Handle dataq logic with tasklet crypto: virtio - don't use 'default m' virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC crypto: ccp - fix memleak in ccp_init_dm_workarea crypto: af_alg - Disallow multiple in-flight AIO requests crypto: sahara - remove FLAGS_NEW_KEY logic crypto: sahara - fix ahash selftest failure crypto: sahara - fix processing requests with cryptlen < sg->length crypto: sahara - fix error handling in sahara_hw_descriptor_create() pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump crypto: virtio - Wait for tasklet to complete on device remove crypto: sahara - fix ahash reqsize crypto: sahara - fix wait_for_completion_timeout() error handling crypto: sahara - improve error handling in sahara_sha_process() crypto: sahara - fix processing hash requests with req->nbytes < sg->length crypto: sahara - do not resize req->src when doing hash operations crypto: scomp - fix req->dst buffer overflow blocklayoutdriver: Fix reference leak of pnfs_device_node NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT wifi: rtw88: fix RX filter in FIF_ALLMULTI flag bpf, lpm: Fix check prefixlen before walking trie wifi: libertas: stop selecting wext ARM: dts: qcom: apq8064: correct XOADC register address ncsi: internal.h: Fix a spello net/ncsi: Fix netlink major/minor version numbers firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior scsi: fnic: Return error if vmalloc() failed arm64: dts: qcom: sdm845-db845c: correct LED panic indicator scsi: hisi_sas: Replace with standard error code return value selftests/net: fix grep checking for fib_nexthop_multiprefix virtio/vsock: fix logic which reduces credit update messages dma-mapping: clear dev->dma_mem to NULL after freeing it wifi: rtlwifi: add calculate_bit_shift() wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() wifi: rtlwifi: rtl8192c: using calculate_bit_shift() wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() rtlwifi: rtl8192de: make arrays static const, makes object smaller wifi: rtlwifi: rtl8192de: using calculate_bit_shift() wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() wifi: rtlwifi: rtl8192se: using calculate_bit_shift() netfilter: nf_tables: mark newset as dead on transaction abort Bluetooth: Fix bogus check for re-auth no supported with non-ssp Bluetooth: btmtkuart: fix recv_buf() return value ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() ARM: davinci: always select CONFIG_CPU_ARM926T RDMA/usnic: Silence uninitialized symbol smatch warnings media: pvrusb2: fix use after free on context disconnection drm/bridge: Fix typo in post_disable() description f2fs: fix to avoid dirent corruption drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() drm/radeon: check return value of radeon_ring_lock() ASoC: cs35l33: Fix GPIO name and drop legacy include ASoC: cs35l34: Fix GPIO name and drop legacy include drm/msm/mdp4: flush vblank event on disable drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks drm/drv: propagate errors from drm_modeset_register_all() drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() drm/radeon/dpm: fix a memleak in sumo_parse_power_table drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table drm/bridge: tc358767: Fix return value on error case media: cx231xx: fix a memleak in cx231xx_init_isoc media: dvbdev: drop refcount on error path in dvb_device_open() drm/amdgpu/debugfs: fix error code when smc register accessors are NULL drm/amd/pm: fix a double-free in si_dpm_init drivers/amd/pm: fix a use-after-free in kv_parse_power_table gpu/drm/radeon: fix two memleaks in radeon_vm_init drivers: clk: zynqmp: calculate closest mux rate watchdog: set cdev owner before adding watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling clk: si5341: fix an error code problem in si5341_output_clk_set_rate mmc: sdhci_omap: Fix TI SoC dependencies of: Fix double free in of_parse_phandle_with_args_map of: unittest: Fix of_count_phandle_with_args() expected value message binder: fix async space check for 0-sized buffers binder: fix use-after-free in shinker's callback Input: atkbd - use ab83 as id when skipping the getid command Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" xen-netback: don't produce zero-size SKB frags binder: fix race between mmput() and do_exit() binder: fix unused alloc->free_async_space tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Revert "usb: dwc3: Soft reset phy on probe for host" Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" usb: chipidea: wait controller resume finished for wakeup irq Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" usb: typec: class: fix typec_altmode_put_partner to put plugs usb: mon: Fix atomicity violation in mon_bin_vma_fault ALSA: oxygen: Fix right channel of capture volume mixer fbdev: flush deferred work in fb_deferred_io_fsync() rootfs: Fix support for rootfstype= when root= is given wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors wifi: mwifiex: configure BSSID consistently when starting AP x86/kvm: Do not try to disable kvmclock if it was not enabled HID: wacom: Correct behavior when processing some confidence == false touches mips: Fix incorrect max_low_pfn adjustment MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed acpi: property: Let args be NULL in __acpi_node_get_property_reference software node: Let args be NULL in software_node_get_reference_args perf genelf: Set ELF program header addresses properly nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length nvmet-tcp: fix a crash in nvmet_req_complete() perf env: Add perf_env__numa_node() perf record: Move sb_evlist to 'struct record' perf top: Move sb_evlist to 'struct perf_top' perf bpf: Decouple creating the evlist from adding the SB event perf env: Avoid recursively taking env->bpf_progs.lock apparmor: avoid crash when parsed profile name is empty serial: imx: Correct clock error message in function probe() nvmet-tcp: Fix the H2C expected PDU len calculation PCI: keystone: Fix race condition when initializing PHYs s390/pci: fix max size calculation in zpci_memcpy_toio() net: qualcomm: rmnet: fix global oob in rmnet_policy net: phy: micrel: populate .soft_reset for KSZ9131 net: ravb: Fix dma_addr_t truncation in error case net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe netfilter: nf_tables: skip dead set elements in netlink dump ipvs: avoid stat macros calls from preemptible context kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ kdb: Fix a potential buffer overflow in kdb_local() mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure i2c: s3c24xx: fix read transfers in polling mode i2c: s3c24xx: fix transferring more than one message in polling mode perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set arm64: dts: armada-3720-turris-mox: set irq type for RTC Linux 5.4.268 Change-Id: I347fc44c3a9947e2b7cb476d622adca58677f78a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-26 02:15:05 +00:00
Carlos Llamas	5c3d4930c7	binder: fix unused alloc->free_async_space ... commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream. Each transaction is associated with a 'struct binder_buffer' that stores the metadata about its buffer area. Since commit 74310e06be ("android: binder: Move buffer out of area shared with user space") this struct is no longer embedded within the buffer itself but is instead allocated on the heap to prevent userspace access to this driver-exclusive info. Unfortunately, the space of this struct is still being accounted for in the total buffer size calculation, specifically for async transactions. This results in an additional 104 bytes added to every async buffer request, and this area is never used. This wasted space can be substantial. If we consider the maximum mmap buffer space of SZ_4M, the driver will reserve half of it for async transactions, or 0x200000. This area should, in theory, accommodate up to 262,144 buffers of the minimum 8-byte size. However, after adding the extra 'sizeof(struct binder_buffer)', the total number of buffers drops to only 18,724, which is a sad 7.14% of the actual capacity. This patch fixes the buffer size calculation to enable the utilization of the entire async buffer space. This is expected to reduce the number of -ENOSPC errors that are seen on the field. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@google.com [cmllamas: fix trivial conflict with missing 261e7818f06e.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	252a2a5569	binder: fix race between mmput() and do_exit() ... commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com [cmllamas: fix trivial conflict with missing d8ed45c5dcd4.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	a53e15e592	binder: fix use-after-free in shinker's callback ... commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream. The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway. Fixes: dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") Cc: stable@vger.kernel.org Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Minchan Kim <minchan@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com [cmllamas: use find_vma() instead of vma_lookup() as commit ce6d42f2e4a2 is missing in v5.4. This only works because we check the vma against our cached alloc->vma pointer. Also, unlock via up_read() instead of mmap_read_unlock() as commit d8ed45c5dcd4 is also missing in v5.4.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	fc1119a3c6	binder: fix async space check for 0-sized buffers ... commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream. Move the padding of 0-sized buffers to an earlier stage to account for this round up during the alloc->free_async_space check. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	da488e1aad	binder: fix comment on binder_alloc_new_buf() return value ... commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream. Update the comments of binder_alloc_new_buf() to reflect that the return value of the function is now ERR_PTR(-errno) on failure. No functional changes in this patch. Cc: stable@vger.kernel.org Fixes: 57ada2fb22 ("binder: add log information for binder transaction failures") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Carlos Llamas	a92b2797ca	binder: fix trivial typo of binder_free_buf_locked() ... commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream. Fix minor misspelling of the function in the comment section. No functional changes in this patch. Cc: stable@vger.kernel.org Fixes: 0f966cba95c7 ("binder: add flag to clear buffer on txn complete") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-7-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Carlos Llamas	9774dabad7	binder: use EPOLLERR from eventpoll.h ... commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream. Use EPOLLERR instead of POLLERR to make sure it is cast to the correct __poll_t type. This fixes the following sparse issue: drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types) drivers/android/binder.c:5030:24: expected restricted __poll_t drivers/android/binder.c:5030:24: got int Fixes: f88982679f ("binder: check for binder_thread allocation failure in binder_poll()") Cc: stable@vger.kernel.org Cc: Eric Biggers <ebiggers@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Greg Kroah-Hartman	38b412a16c	This is the 5.4.254 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmTc9xQACgkQONu9yGCS aT4VrQ//aeDhl35R4kgB8ZYcv2EHa9DgE+cDkFYIUruQ029jPET1NkMuXMiWys2K trzC5VCAawfac8jHR4kAetP2W6ydHgSQprtUxjgjIwKlPgiFQOla5/DXNqMGTv9Y fFKcIfgpef9OkvPr46LHf1S4i3H8vaVu3pN40gEnIAPu4Rgz3wvbmi6BoSTszThI MrbOu70iRxVxF8+3HR8G3Ja6bly4dTl2Y36P6G+JPAQc8+X9RT1Yv39kiAg7TSzP i/SIn2G5pNu2+BMcxUn0SO13YXPYIGQTZ6xLX13QIDEuoqQRjDB9vZPaKoSm7170 Nh1JjvUXy72/zvDJYJWzbrL/o4AfS2tHBNTUq5loXO4LPvbmg18g3Xysuk6vRBmG NjOpbG9PK3MCwWEQIdEAgtFF6hw74MF/UM7b1Tty3FAaWf4Ca75vY5acqSy4Fhbx KuBnNGZTaRJRCUFeEBtAz8sIeFCclfuSpBhrQzj8zCkDT59PuiWJ7wyW1yAizMtE VNvDJFxdQXtU06AHWJxp9msWiXYBZbFfk75MVTxnZLS3SDJuJ40fDjjGCM4WciMg gBLS+v4tO67KEuhj8t50WJW4Kk7P1Q0j3QkItHOMMRpsJQZF3z8rqEqthAacEaAH hVvB2OxpXicqpHwrFW3DZuxzgfJd6sofaKq85/2I7FullRyXVjg= =6G08 -----END PGP SIGNATURE----- Merge 5.4.254 into android11-5.4-lts Changes in 5.4.254 mmc: moxart: read scr register without changing byte order ipv6: adjust ndisc_is_useropt() to also return true for PIO dmaengine: pl330: Return DMA_PAUSED when transaction is paused drm/nouveau/gr: enable memory loads on helper invocation on all channels radix tree test suite: fix incorrect allocation size for pthreads x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate") nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput iio: cros_ec: Fix the allocation size for cros_ec_command binder: fix memory leak in binder_init() usb-storage: alauda: Fix uninit-value in alauda_check_media() usb: dwc3: Properly handle processing of pending events usb: common: usb-conn-gpio: Prevent bailing out if initial role is none x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines x86: Move gds_ucode_mitigated() declaration to header drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes selftests/rseq: Fix build with undefined __weak mISDN: Update parameter type of dsp_cmx_send() net/packet: annotate data-races around tp->status bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves dccp: fix data-race around dp->dccps_mss_cache drivers: net: prevent tun_build_skb() to exceed the packet size limit IB/hfi1: Fix possible panic during hotplug remove wifi: cfg80211: fix sband iftype data lookup for AP_VLAN dmaengine: mcf-edma: Fix a potential un-allocated memory access net/mlx5: Allow 0 for total host VFs ibmvnic: Handle DMA unmapping of login buffs in release functions btrfs: don't stop integrity writeback too early btrfs: set cache_block_group_error if we find an error nvme-tcp: fix potential unbalanced freeze & unfreeze nvme-rdma: fix potential unbalanced freeze & unfreeze netfilter: nf_tables: report use refcount overflow scsi: core: Fix legacy /proc parsing buffer overflow scsi: storvsc: Fix handling of virtual Fibre Channel timeouts scsi: 53c700: Check that command slot is not NULL scsi: snic: Fix possible memory leak if device_add() fails scsi: core: Fix possible memory leak if device_add() fails alpha: remove __init annotation from exported page_is_ram() sch_netem: fix issues in netem_change() vs get_dist_table() Linux 5.4.254 Change-Id: I187a81acd36ef0ec486a959c626f1f06373170cc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-23 15:06:40 +00:00
Qi Zheng	b97dad01c1	binder: fix memory leak in binder_init() ... commit adb9743d6a08778b78d62d16b4230346d3508986 upstream. In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that. Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com> Acked-by: Carlos Llamas <cmllamas@google.com> Fixes: f2517eb76f ("android: binder: Add global lru shrinker to binder") Cc: stable <stable@kernel.org> Link: https://lore.kernel.org/r/20230625154937.64316-1-qi.zheng@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-08-16 18:19:23 +02:00
Carlos Llamas	6c88024cab	binder: fix UAF caused by faulty buffer cleanup ... commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan@google.com> Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-05 08:17:33 +02:00
Carlos Llamas	6d5e0c7837	FROMLIST: binder: fix UAF caused by faulty buffer cleanup ... In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan@google.com> Link: https://b.corp.google.com/issues/275041864 Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 275041864 Link: https://lore.kernel.org/all/20230505203020.4101154-1-cmllamas@google.com Change-Id: I4bcc8bde77a8118872237d100cccb5caf95d99a1 [cmllamas: drop hunk for missing commit 9864bb480133] Signed-off-by: Carlos Llamas <cmllamas@google.com>	2023-05-08 14:22:01 +00:00
Greg Kroah-Hartman	39c4c9c65c	This is the 5.4.226 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORuw8ACgkQONu9yGCS aT4qeRAAjtp+p7ECcaXqZ4vHIka9IGcwRhjWbeB/xFCOgKKbOOLmZP9Cql1pJdEp grdcp/tjNAwi1ec80+G/3AaAWqGRFHYi/Tboe+ZSHIp4Oot78fSclMp6lCMh/bzC eR6niNNNlrEUC/lj0h5lWRJvQd6MK4orSCOCybeJ+HRmrLcm1pGSuJmssHoBn7Xk JHg3RR5OW4BU4UHQHmcJfeH+J5zfNH0ygu1L3MRqzoINWUJ7PtSrIdR5xCm/4ibr oyOH0nenC3hkOM4atui/92dX3HsNxazuA51Ch0AANFRiKYjJBIXMitapi1BvpqfB Ny1I95j37Tuys4OQhJhNlbvHgxdNmouEHH06SwY8+yaU6LPkrFtdD0AxIDofakBZ Npy9AkYmvj14ARAeyqzswxSQGWuuvlDjJR3dId/kIuP8wcRcNWsrFefHs0YZxhjn o0LKmpkw5QgjW7Gh8TKEdl4saAXZwLXV00gHN9DD6UOr4eYNHtBHUJg6zMN5aR19 Dco+UTJj1NlmlEBDP6pFp9LTAcTsjVh6FVpX+uMRs18+kXS3SxzPgB9qEwjerU5m HA0pzc+BgZqHpu3LhkbC4JfGNJ9fHnVZe6fT6/kTt3SiaEtLx8JKvH6VsCHVgEv6 whY3hlS4bWII8Jey0ZS8BtyKJiku3zfGDXAQ3rpwGbX1ddDn+d8= =qI32 -----END PGP SIGNATURE----- Merge 5.4.226 into android11-5.4-lts Changes in 5.4.226 wifi: mac80211: fix memory free error when registering wiphy fail wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support audit: fix undefined behavior in bit shift for AUDIT_BIT wifi: mac80211: Fix ack frame idr leak when mesh has no route spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) block, bfq: fix null pointer dereference in bfq_bio_bfqg() arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. RISC-V: vdso: Do not add missing symbols to version section in linker script MIPS: pic32: treat port as signed integer af_key: Fix send_acquire race with pfkey_register ARM: dts: am335x-pcm-953: Define fixed regulators in root node ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove regulator: core: fix kobject release warning and memory leak in regulator_register() regulator: core: fix UAF in destroy_regulator() bus: sunxi-rsb: Support atomic transfers tee: optee: fix possible memory leak in optee_register_device() ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl net: liquidio: simplify if expression nfc/nci: fix race with opening and closing net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() 9p/fd: fix issue of list_del corruption in p9_fd_cancel() ARM: mxs: fix memory leak in mxs_machine_init() net/mlx4: Check retval of mlx4_bitmap_init net/qla3xxx: fix potential memleak in ql3xxx_send() net: pch_gbe: fix pci device refcount leak while module exiting nfp: add port from netdev validation for EEPROM access Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() net/mlx5: Fix FW tracer timestamp calculation tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc tipc: check skb_linearize() return value in tipc_disc_rcv() xfrm: Fix ignored return value in xfrm6_init() NFC: nci: fix memory leak in nci_rx_data_packet() regulator: twl6030: re-add TWL6032_SUBCLASS bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). s390/dasd: fix no record found for raw_track_access nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION nfc: st-nci: fix memory leaks in EVT_TRANSACTION net: thunderx: Fix the ACPI memory leak s390/crashdump: fix TOD programmable field size lib/vdso: use "grep -E" instead of "egrep" usb: dwc3: exynos: Fix remove() function arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency iio: light: apds9960: fix wrong register for gesture gain iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash nios2: add FORCE for vmlinuz.gz iio: ms5611: Simplify IO callback parameters iio: pressure: ms5611: fixed value compensation bug ceph: do not update snapshot context when there is no new snapshot ceph: avoid putting the realm twice when decoding snaps fails firmware: google: Release devices before unregistering the bus firmware: coreboot: Register bus in module init nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty gcov: clang: fix the buffer overflow issue Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() xen/platform-pci: add missing free_irq() in error path platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) platform/x86: hp-wmi: Ignore Smart Experience App event tcp: configurable source port perturb table size net: usb: qmi_wwan: add Telit 0x103a composition dm integrity: flush the journal on suspend binder: avoid potential data leakage when copying txn binder: read pre-translated fds from sender buffer binder: defer copies of pre-patched txn data binder: fix pointer cast warning binder: Address corner cases in deferred copy and fixup binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 btrfs: free btrfs_path before copying root refs to userspace btrfs: free btrfs_path before copying fspath to userspace btrfs: free btrfs_path before copying subvol info to userspace btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN drm/amdgpu: always register an MMU notifier for userptr drm/i915: fix TLB invalidation for Gen12 video and compute engines fuse: lock inode unconditionally in fuse_fallocate() btrfs: free btrfs_path before copying inodes to userspace spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker drm/amdgpu: update drm_display_info correctly when the edid is read drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() iio: health: afe4403: Fix oob read in afe4403_read_raw iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: light: rpr0521: add missing Kconfig dependencies scripts/faddr2line: Fix regression in name resolution on ppc64le hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails of: property: decrement node refcount in of_fwnode_get_reference_args() net/mlx5: Fix uninitialized variable bug in outlen_write() net/mlx5e: Fix use-after-free when reverting termination table can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() can: cc770: cc770_isa_probe(): add missing free_cc770dev() qlcnic: fix sleep-in-atomic-context bugs caused by msleep wifi: cfg80211: fix buffer overflow in elem comparison net: phy: fix null-ptr-deref while probe() failed net: net_netdev: Fix error handling in ntb_netdev_init_module() net/9p: Fix a potential socket leak in p9_socket_open net: ethernet: nixge: fix NULL dereference dsa: lan9303: Correct stat name net: hsr: Fix potential use-after-free afs: Fix fileserver probe RTT handling net: tun: Fix use-after-free in tun_detach() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE sctp: fix memory leak in sctp_stream_outq_migrate() net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed hwmon: (coretemp) Check for null before removing sysfs attrs hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() net/mlx5: DR, Fix uninitialized var warning error-injection: Add prompt for function error injection tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 pinctrl: intel: Save and restore pins in "direct IRQ" mode mmc: mmc_test: Fix removal of debugfs file mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: sdhci-sprd: Fix no reset data and command after voltage switch tracing: Free buffers when a used dynamic event is removed arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 mm: Fix '.data.once' orphan section warning ASoC: ops: Fix bounds check for _sx controls pinctrl: single: Fix potential division by zero iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() parisc: Increase size of gcc stack frame check xtensa: increase size of gcc stack frame check parisc: Increase FRAME_WARN to 2048 bytes on parisc Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled selftests: net: add delete nexthop route warning test selftests: net: fix nexthop warning cleanup double ip typo ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference ipv4: Fix route deletion when nexthop info is not specified tracing/ring-buffer: Have polling block on watermark epoll: call final ep_events_available() check under the lock epoll: check for events when removing a timed out thread from the wait queue nvme: restrict management ioctls to admin nvme: ensure subsystem reset is single threaded x86/tsx: Add a feature bit for TSX control MSR support x86/pm: Add enumeration check before spec MSRs save/restore setup Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" char: tpm: Protect tpm_pm_suspend with locks mmc: sdhci: use FIELD_GET for preset value bit masks mmc: sdhci: Fix voltage switch delay proc: avoid integer type confusion in get_proc_long proc: proc_skip_spaces() shouldn't think it is working on C strings v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails ipc/sem: Fix dangling sem_array access in semtimedop race Linux 5.4.226 Change-Id: I20fe6cd332455ffff094b2be6afa8302b20db571 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-08 16:50:20 +00:00
Alessandro Astone	4741b00cac	binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 ... commit ef38de9217a04c9077629a24652689d8fdb4c6c6 upstream. Some android userspace is sending BINDER_TYPE_FDA objects with num_fds=0. Like the previous patch, this is reproducible when playing a video. Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0 were 'correctly handled', as in no fixup was performed. After commit 09184ae9b575 we aggregate fixup and skip regions in binder_ptr_fixup structs and distinguish between the two by using the skip_size field: if it's 0, then it's a fixup, otherwise skip. When processing BINDER_TYPE_FDA objects with num_fds=0 we add a skip region of skip_size=0, and this causes issues because now binder_do_deferred_txn_copies will think this was a fixup region. To address that, return early from binder_translate_fd_array to avoid adding an empty skip region. Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@kernel.org> Signed-off-by: Alessandro Astone <ales.astone@gmail.com> Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Alessandro Astone	4e682ce560	binder: Address corner cases in deferred copy and fixup ... commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream. When handling BINDER_TYPE_FDA object we are pushing a parent fixup with a certain skip_size but no scatter-gather copy object, since the copy is handled standalone. If BINDER_TYPE_FDA is the last children the scatter-gather copy loop will never stop to skip it, thus we are left with an item in the parent fixup list. This will trigger the BUG_ON(). This is reproducible in android when playing a video. We receive a transaction that looks like this: obj[0] BINDER_TYPE_PTR, parent obj[1] BINDER_TYPE_PTR, child obj[2] BINDER_TYPE_PTR, child obj[3] BINDER_TYPE_FDA, child Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@kernel.org> Signed-off-by: Alessandro Astone <ales.astone@gmail.com> Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Arnd Bergmann	15e098ab1d	binder: fix pointer cast warning ... commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009 upstream. binder_uintptr_t is not the same as uintptr_t, so converting it into a pointer requires a second cast: drivers/android/binder.c: In function 'binder_translate_fd_array': drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] 2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset; | ^ Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer") Acked-by: Todd Kjos <tkjos@google.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	74e7f1828a	binder: defer copies of pre-patched txn data ... commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d upstream. BINDER_TYPE_PTR objects point to memory areas in the source process to be copied into the target buffer as part of a transaction. This implements a scatter- gather model where non-contiguous memory in a source process is "gathered" into a contiguous region in the target buffer. The data can include pointers that must be fixed up to correctly point to the copied data. To avoid making source process pointers visible to the target process, this patch defers the copy until the fixups are known and then copies and fixeups are done together. There is a special case of BINDER_TYPE_FDA which applies the fixup later in the target process context. In this case the user data is skipped (so no untranslated fds become visible to the target). Reviewed-by: Martijn Coenen <maco@android.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [cmllamas: fix trivial merge conflict] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	7b31ab0d9e	binder: read pre-translated fds from sender buffer ... commit 656e01f3ab54afe71bed066996fc2640881e1220 upstream. This patch is to prepare for an up coming patch where we read pre-translated fds from the sender buffer and translate them before copying them to the target. It does not change run time. The patch adds two new parameters to binder_translate_fd_array() to hold the sender buffer and sender buffer parent. These parameters let us call copy_from_user() directly from the sender instead of using binder_alloc_copy_from_buffer() to copy from the target. Also the patch adds some new alignment checks. Previously the alignment checks would have been done in a different place, but this lets us print more useful error messages. Reviewed-by: Martijn Coenen <maco@android.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	c056a6ba35	binder: avoid potential data leakage when copying txn ... commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c upstream. Transactions are copied from the sender to the target first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA are then fixed up. This means there is a short period where the sender's version of these objects are visible to the target prior to the fixups. Instead of copying all of the data first, copy data only after any needed fixups have been applied. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reviewed-by: Martijn Coenen <maco@android.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [cmllamas: fix trivial merge conflict] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Greg Kroah-Hartman	0bd6dcc07a	This is the 5.4.224 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNtLZoACgkQONu9yGCS aT5VuQ/8CBRf5xVvPfDAGCXjoksCQWaVvSp4bs8UBRO7OM2bbzLOXgNR/aTXBYXS MmrHn/9vCy1EM/+MvsCF9BB7SBu5DN28/X18H/KvhNBXdSggYYSYiaHDsaU8YS89 PKCQouG9q5qNzMbiVx9ullBUQXNov3PMFs6La0AbRjiSuDnaQhwbhliZmbMWo+Wx YdxqT0PNrPdZsXA4aP6DZP1tHQ7rKt7BFZdDE2UhmMCkrycw3f4bm5nLyOIJgkCq JcnJu7mPbhGxwTVqBEBPH31cH+vC4TxMuRIgm7gmuTcIp883C2rhzYMfNK2aP8j6 5VdG+WZmlqkWJ7ipPGaMgT2el/+40Fy/TlAg+kdUQ7MDT9aLZM9ecv+q7o+qV8qn RxbkqBEUh3byJyx5hR6fmP+6QxF3x7X89QyAmQJ6+2thDhZtrZdM4cGk8AbK534u Pfv0Biu59u1rBHAcY2gFwtUMhPYQYK65liefeQoBFgc83ZQbPYOs3pk3gjPmOyy5 ce2JeyRIqWU9qN3/pxCDO8gVD7uUtMC/ut5fM2IPoatoGBmvpg0iFZLa+TF0PdVe U7+v6uakW86sWYzHdNLMXIaghzO3i04BVokOKoFHjP8WQeOaYBk5uUOP/qWS+Dke cSOhayYj7UALVAQww34mAWlPFN6l5sfW2GszN9a2GcfT1sLphDY= =bOv2 -----END PGP SIGNATURE----- Merge 5.4.224 into android11-5.4-lts Changes in 5.4.224 RDMA/cma: Use output interface for net_dev check IB/hfi1: Correctly move list in sc_disable() NFSv4.1: Handle RECLAIM_COMPLETE trunking errors NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot nfs4: Fix kmemleak when allocate slot failed net: dsa: Fix possible memory leaks in dsa_loop_init() RDMA/core: Fix null-ptr-deref in ib_core_cleanup() RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() net: fec: fix improper use of NETDEV_TX_BUSY ata: pata_legacy: fix pdc20230_set_piomode() net: sched: Fix use after free in red_enqueue() net: tun: fix bugs for oversize packet when napi frags enabled netfilter: nf_tables: release flow rule object from commit path ipvs: use explicitly signed chars ipvs: fix WARNING in __ip_vs_cleanup_batch() ipvs: fix WARNING in ip_vs_app_net_cleanup() rose: Fix NULL pointer dereference in rose_send_frame() mISDN: fix possible memory leak in mISDN_register_device() isdn: mISDN: netjet: fix wrong check of device registration btrfs: fix inode list leak during backref walking at resolve_indirect_refs() btrfs: fix inode list leak during backref walking at find_parent_nodes() btrfs: fix ulist leaks in error paths of qgroup self tests Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() net: mdio: fix undefined behavior in bit shift for __mdiobus_register net, neigh: Fix null-ptr-deref in neigh_table_clear() ipv6: fix WARNING in ip6_route_net_exit_late() media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE media: dvb-frontends/drxk: initialize err to 0 media: meson: vdec: fix possible refcount leak in vdec_probe() scsi: core: Restrict legal sdev_state transitions via sysfs HID: saitek: add madcatz variant of MMO7 mouse device ID i2c: xiic: Add platform module alias xfs: don't fail verifier on empty attr3 leaf block xfs: use ordered buffers to initialize dquot buffers during quotacheck xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() xfs: group quota should return EDQUOT when prj quota enabled xfs: don't fail unwritten extent conversion on writeback due to edquot xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster() Bluetooth: L2CAP: Fix attempting to access uninitialized memory block, bfq: protect 'bfqd->queued' by 'bfqd->lock' tcp/udp: Fix memory leak in ipv6_renew_options(). memcg: enable accounting of ipc resources binder: fix UAF of alloc->vma in race with munmap() btrfs: fix type of parameter generation in btrfs_get_dentry tcp/udp: Make early_demux back namespacified. kprobe: reverse kp->flags when arm_kprobe failed tools/nolibc/string: Fix memcmp() implementation tracing/histogram: Update document for KEYS_MAX size capabilities: fix potential memleak on error path from vfs_getxattr_alloc() fuse: add file_modified() to fallocate efi: random: reduce seed size to 32 bytes perf/x86/intel: Fix pebs event constraints for ICL perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices parisc: Make 8250_gsc driver dependend on CONFIG_PARISC parisc: Export iosapic_serial_irq() symbol for serial port driver parisc: Avoid printing the hardware path twice ext4: fix warning in 'ext4_da_release_space' ext4: fix BUG_ON() when directory entry has invalid rec_len KVM: x86: Mask off reserved bits in CPUID.8000001AH KVM: x86: Mask off reserved bits in CPUID.80000008H KVM: x86: emulator: em_sysexit should update ctxt->mode KVM: x86: emulator: introduce emulator_recalc_and_set_mode KVM: x86: emulator: update the emulation mode after CR0 write mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times drm/rockchip: dsi: Force synchronous probe drm/i915/sdvo: Filter out invalid outputs more sensibly drm/i915/sdvo: Setup DDC fully before output init wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() ipc: remove memcg accounting for sops objects in do_semtimedop() Linux 5.4.224 Change-Id: I4620eca3873c24ff6e810a762a0977bae99dcaeb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-16 16:18:17 +00:00
Carlos Llamas	27a594bc7a	binder: fix UAF of alloc->vma in race with munmap() ... In commit 720c241924 ("ANDROID: binder: change down_write to down_read") binder assumed the mmap read lock is sufficient to protect alloc->vma inside binder_update_page_range(). This used to be accurate until commit dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap"), which now downgrades the mmap_lock after detaching the vma from the rbtree in munmap(). Then it proceeds to teardown and free the vma with only the read lock held. This means that accesses to alloc->vma in binder_update_page_range() now will race with vm_area_free() in munmap() and can cause a UAF as shown in the following KASAN trace: ================================================================== BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0 Read of size 8 at addr ffff16204ad00600 by task server/558 CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2a0 show_stack+0x18/0x2c dump_stack+0xf8/0x164 print_address_description.constprop.0+0x9c/0x538 kasan_report+0x120/0x200 __asan_load8+0xa0/0xc4 vm_insert_page+0x7c/0x1f0 binder_update_page_range+0x278/0x50c binder_alloc_new_buf+0x3f0/0xba0 binder_transaction+0x64c/0x3040 binder_thread_write+0x924/0x2020 binder_ioctl+0x1610/0x2e5c __arm64_sys_ioctl+0xd4/0x120 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Allocated by task 559: kasan_save_stack+0x38/0x6c __kasan_kmalloc.constprop.0+0xe4/0xf0 kasan_slab_alloc+0x18/0x2c kmem_cache_alloc+0x1b0/0x2d0 vm_area_alloc+0x28/0x94 mmap_region+0x378/0x920 do_mmap+0x3f0/0x600 vm_mmap_pgoff+0x150/0x17c ksys_mmap_pgoff+0x284/0x2dc __arm64_sys_mmap+0x84/0xa4 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Freed by task 560: kasan_save_stack+0x38/0x6c kasan_set_track+0x28/0x40 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0x100/0x164 kasan_slab_free+0x14/0x20 kmem_cache_free+0xc4/0x34c vm_area_free+0x1c/0x2c remove_vma+0x7c/0x94 __do_munmap+0x358/0x710 __vm_munmap+0xbc/0x130 __arm64_sys_munmap+0x4c/0x64 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 [...] ================================================================== To prevent the race above, revert back to taking the mmap write lock inside binder_update_page_range(). One might expect an increase of mmap lock contention. However, binder already serializes these calls via top level alloc->mutex. Also, there was no performance impact shown when running the binder benchmark tests. Note this patch is specific to stable branches 5.4 and 5.10. Since in newer kernel releases binder no longer caches a pointer to the vma. Instead, it has been refactored to use vma_lookup() which avoids the issue described here. This switch was introduced in commit a43cfc87caaf ("android: binder: stop saving a pointer to the VMA"). Fixes: dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn <jannh@google.com> Cc: <stable@vger.kernel.org> # 5.4.x Cc: Minchan Kim <minchan@kernel.org> Cc: Yang Shi <yang.shi@linux.alibaba.com> Cc: Liam Howlett <liam.howlett@oracle.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-11-10 17:57:54 +01:00
Carlos Llamas	30d0901b30	binder: fix UAF of ref->proc caused by race condition ... commit a0e44c64b6061dda7e00b7c458e4523e2331b739 upstream. A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Cc: stable <stable@kernel.org> # 4.14+ Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-15 12:04:51 +02:00
Pavel Begunkov	fc78b2fc21	io_uring: disable polling pollfree files ... Older kernels lack io_uring POLLFREE handling. As only affected files are signalfd and android binder the safest option would be to disable polling those files via io_uring and hope there are no users. Fixes: 221c5eb233 ("io_uring: add support for IORING_OP_POLL") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-05 10:27:47 +02:00
Carlos Llamas	012ab662e2	ANDROID: binder: fix pending prio state for early exit ... When calling binder_do_set_priority() with the same policy and priority values as the current task, we exit early since there is nothing to do. However, the BINDER_PRIO_PENDING state might be set and in this case we fail to update it. A subsequent call to binder_transaction_priority() will then read an incorrect state and save the wrong priority. Fix this by setting thread->prio_state to BINDER_PRIO_SET on our way out. Bug: 199309216 Fixes: cac827f2619b ("ANDROID: binder: fix race in priority restore") Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I21e906cf4b2ebee908af41fe101ecd458ae1991c (cherry picked from commit 72193be6d4bd9ad29dacd998c14dff97f7a6c6c9)	2022-08-03 16:21:47 +00:00
Carlos Llamas	da97a10882	ANDROID: binder: fix race in priority restore ... During a reply, the target gets woken up and then the priority of the replier is restored. The order is such to allow the target to process the reply ASAP. Otherwise, we risk the sender getting scheduled out before the wakeup happens. This strategy reduces transaction latency. However, a subsequent transaction from the same target could be started before the priority of the replier gets restored. At this point we save the wrong priority and it gets reinstated at the end of the transaction. This patch allows the incoming transaction to detect the race condition and save the correct next priority. Additionally, the replier will abort its pending priority restore which allows the new transaction to always run at the desired priority. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I6fec41ae1a1342023f78212ab1f984e26f068221 (cherry picked from commit cac827f2619b280d418e546a09f25da600dafe5a) [cmllamas: fixed trivial merge conflict]	2022-08-03 16:21:47 +00:00
Carlos Llamas	308230b9d7	ANDROID: binder: switch task argument for binder_thread ... Refactor binder priority functions to take in 'struct binder_thread *' instead of just 'struct task_struct *'. This allows access to other thread fields used in subsequent patches. In any case, the same task reference is still available under thread->task. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I67b599884580d957d776500e467827e5035c99f6 (cherry picked from commit 759d98484b5b51932d3d11651fa83c6bb268ce03)	2022-08-03 16:21:47 +00:00
Carlos Llamas	807b6742c9	ANDROID: binder: pass desired priority by reference ... Avoid making unnecessary stack copies of struct binder_priority and pass the argument by reference instead. Rename 'desired_prio' to 'desired' to match the usage in other priority functions. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I66ff5305296e7b9dba56ed265236f2af518f66e0 (cherry picked from commit 52d85f8a16467ce0bca374f885de24918f017371) [cmllamas: fixed minor merge conflict]	2022-08-03 16:21:47 +00:00
Carlos Llamas	88c3fd6461	ANDROID: binder: fold common setup of node_prio ... The setup of node_prio is always the same, so just fold this logic into binder_transaction_priority() to avoid duplication. Let's pass the node reference instead, which also gives access to node->inherit_rt. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: Ib390204556e69c4bc8492cd9cd873773f9cdce42 (cherry picked from commit 498bf715b77c68e54d0289fa66e3f112278f87dc) [cmllamas: fixed minor merge conflicts]	2022-08-03 16:21:47 +00:00
Carlos Llamas	458b37a82d	FROMLIST: binder: fix UAF of ref->proc caused by race condition ... A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org> Bug: 239630375 Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/ Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868 (cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964)	2022-08-02 22:15:29 +00:00
Greg Kroah-Hartman	82b6e1787f	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: 617c7432b5 ANDROID: GKI: Enable CONFIG_SERIAL_8250_RUNTIME_UARTS=0 813b12454e ANDROID: GKI: db845c: Update symbols list and ABI 15dd5a8bc0 ANDROID: Increase x86 cmdline size to 4k 4ec7ffac46 UPSTREAM: cgroup-v1: Require capabilities to set release_agent fe0c18d0f0 ANDROID: incremental-fs: remove index and incomplete dir on umount 7aedba616c UPSTREAM: binder: fix async_free_space accounting for empty parcels f1a1171f3c UPSTREAM: tee: handle lookup of shm with reference count 0 693158f765 UPSTREAM: bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc b9d179c605 UPSTREAM: driver core: Fix possible memory leak in device_link_add() 3aeff14796 UPSTREAM: blk-mq: fix kernel panic during iterating over flush request 54e1868c8b UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg a4e84758f0 UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings 013b7ed754 ANDROID: incremental-fs: fix mount_fs issue ba4942c83d Merge tag 'android11-5.4.161_r00' into android11-5.4 202bc8432c UPSTREAM: vfs: fs_context: fix up param length parsing in legacy_parse_param New symbols tracked due to them being added in the android11-5.4 branch: Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function void kill_anon_super(super_block*)' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I89df6d21c7c36bb6b2a9047b1f7e2988f48a5637	2022-02-11 16:21:49 +01:00
Todd Kjos	7aedba616c	UPSTREAM: binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ie01082a056bff56f51035c0f6be34e136bd56faf	2022-01-31 14:15:02 -08:00
Greg Kroah-Hartman	b3174205cf	This is the 5.4.174 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHyVbEACgkQONu9yGCS aT6r6BAA13mGwb3g/n6W1539J2McTd3Wq7HhkvGnOQmJAHJKLzp51QYAXgLbRLCM gUOCPXh6o2gt3+lFrhFy0TE9F1VQY7Igyb2RziF9mdAcvEqcBXL11n6kZHGxx0TO rOpv/SoWMd/QrKC7Ytf5zgH+81dGYWr1L1Ge9g7KWmCev15zAvJQ4mQv6a8CQhCD pUZRBvFx8AGS6q/s9ZPZfvVBcHJDNF89/mkkWNzFgIOcXJh/01JdqNK635stUXu4 +hQYUpG2gj9X2i+e0bc2i95pql7M5OAdX3TBlMeiEjKkyXJuyWTCXSO332QLTeaP xF8Z6JQ0n4W4GI9AgQCWwOaDahtlh6rmpVj+iekeYOMMB6Y5zAoFOIu1DTBEwDK6 F+s5KGfV8t5zkWY6iFOUwHTsjeNc4qqX8B6Br3Yjo7HHBxiggNDD5k4IYe0wAvJL NzOTjdvVbG+qRmhGMQMOpLhDJaHVEJCaXCmv1G97AceaL/RcenUZkn3pQZbn5O7u iMFV620WB0tYyfsiWaQrC7HgVZRyoUYBcxuxdm/g8NqYAPM61HOBKQbyaG9jClyf dq+lnvipJzUmeTsrzkd0NON24HS53hYBZPQjxp7xuoFooBUQjd5iYJvPzeLUm2+g /PlDC4B48pZa3zm8z2amyxf7leaxZUqc2d/J8wSGM/lvaJ3BV7M= =eMMF -----END PGP SIGNATURE----- Merge 5.4.174 into android11-5.4-lts Changes in 5.4.174 HID: uhid: Fix worker destroying device without any protection HID: wacom: Reset expected and received contact counts at the same time HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Avoid using stale array indicies to read contact count f2fs: fix to do sanity check in is_alive() nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 x86/gpu: Reserve stolen memory for first integrated Intel GPU tools/nolibc: x86-64: Fix startup code bug tools/nolibc: i386: fix initial stack alignment tools/nolibc: fix incorrect truncation of exit code rtc: cmos: take rtc_lock while reading from CMOS media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE media: flexcop-usb: fix control-message timeouts media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: cpia2: fix control-message timeouts media: s2255: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: redrat3: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts can: softing_cs: softingcs_probe(): fix memleak on registration failure lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller mm_zone: add function to check if managed dma zone exists mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Reconfigure hardware on resume() drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm/panel: innolux-p079zca: Delete panel on attach() failure drm/rockchip: dsi: Fix unbalanced clock on probe error Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails clk: bcm-2835: Pick the closest clock rate clk: bcm-2835: Remove rounding up the dividers wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: Release DMA channel descriptor allocations media: videobuf2: Fix the size printk format media: aspeed: fix mode-detect always time out at 2nd run media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: Update signal status immediately to ensure sane hw state arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Bluetooth: stop proccessing malicious adv data tee: fix put order in teedev_close_context() media: dmxdev: fix UAF when dvb_register_device() fails crypto: qce - fix uaf on qce_ahash_register_one arm64: dts: ti: k3-j721e: correct cache-sets info tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() media: rcar-csi2: Correct the selection of hsfreqrange media: imx-pxp: Initialize the spinlock prior to using it media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases ACPI: EC: Rework flushing of EC work while suspended to idle drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() arm64: dts: ti: k3-j721e: Fix the L2 cache sets tty: serial: uartlite: allow 64 bit address serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected staging: rtl8192e: return error code from rtllib_softmac_init() staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() Bluetooth: btmtksdio: fix resume failure media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: si2157: Fix "warm" tuner state detection sched/rt: Try to restart rt period timer when rt runtime exceeded rcu/exp: Mark current CPU as exp-QS in IPI loop second pass mwifiex: Fix possible ABBA deadlock xfrm: fix a small bug in xfrm_sa_len() crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - fix lrw chaining mode ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors media: dw2102: Fix use after free media: msi001: fix possible null-ptr-deref in msi001_probe() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes drm/msm/dpu: fix safe status debugfs file drm/bridge: ti-sn65dsi86: Set max register for regmap media: hantro: Fix probe func error path xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding usb: ftdi-elan: fix memory leak on device disconnect ARM: dts: armada-38x: Add generic compatible to UART nodes mmc: meson-mx-sdio: add IRQ check selinux: fix potential memleak in selinux_add_opt() bpftool: Enable line buffering for stdout x86/mce/inject: Avoid out-of-bounds write when setting flags ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). ppp: ensure minimum packet size in ppp_write() rocker: fix a sleeping in atomic bug staging: greybus: audio: Check null pointer fsl/fman: Check for null pointer after calling devm_ioremap Bluetooth: hci_bcm: Check for error irq HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad debugfs: lockdown: Allow reading debugfs files that are not world readable net/mlx5e: Don't block routes with nexthop objects in SW Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5: Set command entry semaphore up once got index free spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe tpm: add request_locality before write TPM_INT_ENABLE can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls RDMA/hns: Validate the pkey index clk: imx8mn: Fix imx8mn_clko1_sels powerpc/prom_init: Fix improper check of prom_getprop() ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA ALSA: oss: fix compile error when OSS_DEBUG is enabled char/mwave: Adjust io port register size binder: fix handling of error during copy iommu/io-pgtable-arm: Fix table descriptor paddr formatting scsi: ufs: Fix race conditions related to driver data PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() powerpc/powermac: Add additional missing lockdep_register_key() RDMA/core: Let ib_find_gid() continue search even after empty entry RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry ASoC: rt5663: Handle device_property_read_u32_array error codes clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell dmaengine: pxa/mmp: stop referencing config->slave_id iommu/iova: Fix race between FQ timeout and teardown phy: uniphier-usb3ss: fix unintended writing zeros to PHY register ASoC: mediatek: Check for error clk pointer ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() RDMA/cxgb4: Set queue pair state when being queried of: base: Fix phandle argument length mismatch error message Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR ARM: shmobile: rcar-gen2: Add missing of_node_put() batman-adv: allow netlink usage in unprivileged containers usb: gadget: f_fs: Use stream_open() for endpoint files drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L HID: apple: Do not reset quirks when the Fn key is not found media: b2c2: Add missing check in flexcop_pci_isr: EDAC/synopsys: Use the quirk for version instead of ddr version mlxsw: pci: Add shutdown method in PCI driver drm/bridge: megachips: Ensure both bridges are probed before registration gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use HSI: core: Fix return freed object in hsi_new_client mwifiex: Fix skb_over_panic in mwifiex_usb_recv() rsi: Fix use-after-free in rsi_rx_done_handler() rsi: Fix out-of-bounds read in rsi_read_pkt() usb: uhci: add aspeed ast2600 uhci support floppy: Add max size check for user space request x86/mm: Flush global TLB when switching to trampoline page-table media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads iwlwifi: mvm: synchronize with FW after multicast commands ath10k: Fix tx hanging net-sysfs: update the queue counts in the unregistration path net: phy: prefer 1000baseT over 1000baseKX gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock x86/mce: Mark mce_panic() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_read_aux() noinstr net: bonding: debug: avoid printing debug logs when bond is not notifying peers bpf: Do not WARN in bpf_warn_invalid_xdp_action() HID: quirks: Allow inverting the absolute X/Y values media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO audit: ensure userspace is penalized the same as the kernel when under pressure arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus arm64: tegra: Adjust length of CCPLEX cluster MMIO region cpufreq: Fix initialization of min and max frequency QoS requests usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream iwlwifi: fix leaks/bad data after failed firmware load iwlwifi: remove module loading failure message iwlwifi: mvm: Fix calculation of frame length um: registers: Rename function names to avoid conflicts and build problems jffs2: GC deadlock reading a page that is used in jffs2_write_begin() ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Fix wrong interpretation of PCC address ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 drm/amdgpu: fixup bad vram size on gmc v8 ACPI: battery: Add the ThinkPad "Not Charging" quirk btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print mac80211: allow non-standard VHT MCS-10/11 dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() net: phy: marvell: configure RGMII delays for 88E1118 net: gemini: allow any RGMII interface mode regulator: qcom_smd: Align probe function with rpmh-regulator serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync random: do not throw away excess input to crng_fast_load parisc: Avoid calling faulthandler_disabled() twice powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put powerpc/watchdog: Fix missed watchdog reset due to memory ordering race i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB powerpc/powermac: Add missing lockdep_register_key() KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST w1: Misuse of get_user()/put_user() reported by sparse scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup ALSA: seq: Set upper limit of processed events powerpc: handle kdump appropriately with crash_kexec_post_notifiers option MIPS: OCTEON: add put_device() after of_find_device_by_node() i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA ASoC: mediatek: mt8173: fix device_node leak power: bq25890: Enable continuous conversion for ADC at charging rpmsg: core: Clean up resources on announce_create failure. crypto: omap-aes - Fix broken pm_runtime_and_get() usage crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: caam - replace this_cpu_ptr with raw_cpu_ptr ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers fuse: Pass correct lend value to filemap_write_and_wait_range() serial: Fix incorrect rs485 polarity on uart open cputime, cpuacct: Include guest time in user time in cpuacct.stat tracing/kprobes: 'nmissed' not showed correctly for kretprobe iwlwifi: mvm: Increase the scan timeout guard to 30 seconds s390/mm: fix 2KB pgtable release race drm/etnaviv: limit submit sizes drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/bridge: analogix_dp: Make PSR-exit block less PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device xfrm: fix policy lookup for ipv6 gre packets btrfs: fix deadlock between quota enable and other quota operations btrfs: check the root node for uptodate before returning it btrfs: respect the max size in the header when activating swap file ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: don't use the orphan list when migrating an inode drm/radeon: fix error handling in radeon_driver_open_kms of: base: Improve argument length mismatch error firmware: Update Kconfig help text for Google firmware media: rcar-csi2: Optimize the selection PHTW register Documentation: dmaengine: Correctly describe dmatest with channel unset Documentation: ACPI: Fix data node reference documentation Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: fix firewire.rst ABI file path error scsi: core: Show SCMD_LAST in text form RDMA/hns: Modify the mapping attribute of doorbell to device RDMA/rxe: Fix a typo in opcode name dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Revert "net/mlx5: Add retry mechanism to the command entry index allocation" powerpc/cell: Fix clang -Wimplicit-fallthrough warning powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses bpftool: Remove inclusion of utilities.mak from Makefiles ipv4: avoid quadratic behavior in netns dismantle net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries f2fs: fix to reserve space for IO align feature af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress clk: si5341: Fix clock HW provider cleanup net: axienet: limit minimum TX ring size net: axienet: fix number of TX ring slots for available check net: axienet: increase default TX ring size to 128 rtc: pxa: fix null pointer dereference inet: frags: annotate races around fqdir->dead and fqdir->high_thresh netns: add schedule point in ops_exit_list() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() perf script: Fix hex dump character output dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition arm64: dts: qcom: msm8996: drop not documented adreno properties net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property dt-bindings: display: meson-vpu: Add missing amlogic,canvas property scripts/dtc: dtx_diff: remove broken example from help text lib82596: Fix IRQ check in sni_82596_probe lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mtd: nand: bbt: Fix corner case in bad block table handling Revert "ia64: kprobes: Use generic kretprobe trampoline handler" Linux 5.4.174 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia656821e4377afa7ca279a6ed92195989be831b3	2022-01-31 15:14:13 +01:00
Todd Kjos	48fc8eebd1	binder: fix handling of error during copy ... [ Upstream commit fe6b1869243f23a485a106c214bcfdc7aa0ed593 ] If a memory copy function fails to copy the whole buffer, a positive integar with the remaining bytes is returned. In binder_translate_fd_array() this can result in an fd being skipped due to the failed copy, but the loop continues processing fds since the early return condition expects a negative integer on error. Fix by returning "ret > 0 ? -EINVAL : ret" to handle this case. Fixes: bb4a2e48d5 ("binder: return errors from buffer copy functions") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-2-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 09:19:38 +01:00
Hang Lu	a4e84758f0	UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings ... Add BR_FROZEN_REPLY in binder_return_strings to support stat function. Fixes: ae28c1be1e54 ("binder: BINDER_GET_FROZEN_INFO ioctl") Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Hang Lu <hangl@codeaurora.org> Link: https://lore.kernel.org/r/1617961246-4502-2-git-send-email-hangl@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 005169157448ca41eff8716d79dc1b8f158229d2) Bug: 187129171 Signed-off-by: Connor O'Brien <connoro@google.com> Change-Id: I3b0f67ee9f3a747d9052b7a900f2239b0e4097f5	2022-01-24 11:41:01 -08:00
Greg Kroah-Hartman	ba4942c83d	Merge tag 'android11-5.4.161_r00' into android11-5.4 ... This is the merge of the upstream LTS release of 5.4.1161 into the android11-5.4 branch. It contains the following commits: b52fb22557 ANDROID: GKI: disable CONFIG_FORTIFY_SOURCE 26b09f181d Merge 5.4.161 into android11-5.4-lts 5c088fba39 Linux 5.4.161 b786cb3236 erofs: fix unsafe pagevec reuse of hooked pclusters 83de35ae27 erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() b37f6da8c3 PCI: Add MSI masking quirk for Nvidia ION AHCI db1390b60e PCI/MSI: Deal with devices lying about their MSI mask capability 49b55a7792 PCI/MSI: Destroy sysfs before freeing entries 7186be970c parisc/entry: fix trace test in syscall exit path 258c42a8fb fortify: Explicitly disable Clang support 4f9a3cda16 scsi: ufs: Fix tm request when non-fatal error happens c468f9249d ext4: fix lazy initialization next schedule time computation in more granular unit 307c6f7287 MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL 7be773a028 scsi: ufs: Fix interrupt error message for shared interrupts e3c97ba4a6 soc/tegra: pmc: Fix imbalanced clock disabling in error code path ebd1ef6eae Revert "net: sched: update default qdisc visibility after Tx queue cnt changes" 9084a8ecc9 Revert "serial: core: Fix initializing and restoring termios speed" 91a7552bea Merge 5.4.160 into android11-5.4-lts 17efa1a44c Linux 5.4.160 66bd28d6be selftests/bpf: Fix also no-alu32 strobemeta selftest e7ea088cd0 ath10k: fix invalid dma_addr_t token assignment 20a951afb7 SUNRPC: Partial revert of commit 6f9f17287e78 5b7a0a4f7c PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros 256a1e009b powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload fe02d37870 s390/cio: make ccw_device_dma_* more robust 8a8d007bae s390/tape: fix timer initialization in tape_std_assign() 5ef14af166 s390/cio: check the subchannel validity for dev_busid b0989ae51d video: backlight: Drop maximum brightness override for brightness zero 66938ba128 mm, oom: do not trigger out_of_memory from the #PF d6648b55ed mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks c6f9a5c11a powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC 453b779d2b powerpc/security: Add a helper to query stf_barrier type 84b3fbfd8e powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 7edda4bd9e powerpc/bpf: Validate branch ranges 0347c001c9 powerpc/lib: Add helper to check if offset is within conditional branch range c4461ca7a8 ovl: fix deadlock in splice write 8d750efc8d 9p/net: fix missing error check in p9_check_errors aba12bb38b net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 223985fa1b f2fs: should use GFP_NOFS for directory inodes af73b240e0 irqchip/sifive-plic: Fixup EOI failed when masked 53014c1c41 parisc: Fix set_fixmap() on PA1.x CPUs 645d6dfdcb parisc: Fix backtrace to always include init funtion names 62c4e0a3d8 ARM: 9156/1: drop cc-option fallbacks for architecture selection 61a5e446bb ARM: 9155/1: fix early early_iounmap() dc33574246 selftests/net: udpgso_bench_rx: fix port argument dd3a418ba5 cxgb4: fix eeprom len when diagnostics not implemented 1800c9eecd net/smc: fix sk_refcnt underflow on linkdown and fallback b2d1b6624b vsock: prevent unnecessary refcnt inc for nonblocking connect 72aca95f95 net: hns3: allow configure ETS bandwidth of all TCs 07b218db54 net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any 18f2809441 bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 180a9b539c arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions 572599cbf1 nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails c1d5f943bb llc: fix out-of-bound array index in llc_sk_dev_hash() bdf94057aa perf bpf: Add missing free to bpf_event__print_bpf_prog_info() 23def86bbf zram: off by one in read_block_state() d26835de40 mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() 46d695e870 bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed dce69e0a06 ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses 700602b662 net: vlan: fix a UAF in vlan_dev_real_dev() 98e0ab88f4 net: davinci_emac: Fix interrupt pacing disable 70ecaadb49 xen-pciback: Fix return in pm_ctrl_init() 7f57b9bc8e i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' 53ad06ff3b NFSv4: Fix a regression in nfs_set_open_stateid_locked() c9dcb51ae4 scsi: qla2xxx: Turn off target reset during issue_lip 211f08d1ff scsi: qla2xxx: Fix gnl list corruption 9b180f3c2d ar7: fix kernel builds for compiler test 59e97c74d1 watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT 162a1cfcd5 m68k: set a default value for MEMORY_RESERVE 9770f8c29f signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) 9e6985190f dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` fd1de35901 netfilter: nfnetlink_queue: fix OOB when mac header was cleared 15351d5e8b soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read be832f781d auxdisplay: ht16k33: Fix frame buffer device blanking c441943075 auxdisplay: ht16k33: Connect backlight to fbdev 1fa9803de9 auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string e63507ea43 dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro 04317e7474 mtd: core: don't remove debugfs directory if device is in use 59929f9a57 mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() a83aaf1507 fs: orangefs: fix error return code of orangefs_revalidate_lookup() c79c37c775 NFS: Fix deadlocks in nfs_scan_commit_list() 5a893e0eab opp: Fix return in _opp_add_static_v2() 98ac698216 PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge 819925eff0 PCI: aardvark: Don't spam about PIO Response Status bab1cfec7a drm/plane-helper: fix uninitialized variable reference 4b48c6ede3 pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds 2b2fdb6f48 rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined bd48bdbfd9 apparmor: fix error check a7b2947649 power: supply: bq27xxx: Fix kernel crash on IRQ handler register error 3f698d97f7 mips: cm: Convert to bitfield API to fix out-of-bounds access fb7b73cd94 powerpc/44x/fsp2: add missing of_node_put d3dd1a057c HID: u2fzero: properly handle timeouts in usb_submit_urb b216a39b32 HID: u2fzero: clarify error check and length calculations fae0552d83 serial: xilinx_uartps: Fix race condition causing stuck TX 818e100c2b phy: qcom-qusb2: Fix a memory leak on probe de43e75917 ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER f00ff5357b ASoC: cs42l42: Correct some register default values baf5c1225e ARM: dts: stm32: fix SAI sub nodes register range bb74ce1feb staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC 73aaa6222a RDMA/mlx4: Return missed an error if device doesn't support steering 20dfad97db scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() 5ead6f4fea power: supply: rt5033_battery: Change voltage values to µV fdbe8e8a08 usb: gadget: hid: fix error code in do_config() 15355466cd serial: 8250_dw: Drop wrong use of ACPI_PTR() d8241e7a21 video: fbdev: chipsfb: use memset_io() instead of memset() e7df004eb1 clk: at91: check pmc node status before registering syscore ops 44a2dcd146 memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe 03fe35ce9a soc/tegra: Fix an error handling path in tegra_powergate_power_up() 543d85602f arm: dts: omap3-gta04a4: accelerometer irq fix 7cf7d9b83d ALSA: hda: Reduce udelay() at SKL+ position reporting d1cf71d79e JFS: fix memleak in jfs_mount 56911ee537 MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT ee49b6598c scsi: dc395: Fix error case unwinding dd49dee254 ARM: dts: at91: tse850: the emac<->phy interface is rmii 1df7102f26 arm64: dts: meson-g12a: Fix the pwm regulator supply properties 681c58f344 RDMA/bnxt_re: Fix query SRQ failure 50eca29537 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY 863e71a3af arm64: dts: rockchip: Fix GPU register width for RK3328 6694960195 ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() d27580c1b0 clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths 9212ebb1c6 RDMA/rxe: Fix wrong port_cap_flags cf234bc5fb ibmvnic: Process crqs after enabling interrupts bc40616481 ibmvnic: don't stop queue in xmit a91c8ee2ed udp6: allow SO_MARK ctrl msg to affect routing 9ff14503f4 selftests/bpf: Fix fclose/pclose mismatch in test_progs af51aa2b85 crypto: pcrypt - Delay write to padata->info 9be9cb2a2b net: phylink: avoid mvneta warning when setting pause parameters 077410c790 net: amd-xgbe: Toggle PLL settings during rate change 63a3b1af04 drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits 9ca0d10742 wcn36xx: add proper DMA memory barriers in rx path a3256ae45b libertas: Fix possible memory leak in probe and disconnect 427583b93d libertas_tf: Fix possible memory leak in probe and disconnect 2339ff4162 KVM: s390: Fix handle_sske page fault handling 3f3b4054e2 samples/kretprobes: Fix return value if register_kretprobe() failed 9435b2f9c0 tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() a8226599cb irq: mips: avoid nested irq_enter() ae5a244648 s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() 8fb436d146 libbpf: Fix BTF data layout checks and allow empty BTF 03a818c096 smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi 12ccb57379 drm/msm: Fix potential NULL dereference in DPU SSPP dc18f08062 clocksource/drivers/timer-ti-dm: Select TIMER_OF c523474f2a PM: hibernate: fix sparse warnings 0d22f55014 nvme-rdma: fix error code in nvme_rdma_setup_ctrl 67ba6c8e71 phy: micrel: ksz8041nl: do not use power down mode ae213c059a mwifiex: Send DELBA requests according to spec 3a781e2131 rsi: stop thread firstly in rsi_91x_init() error handling ad4cd01307 mt76: mt76x02: fix endianness warnings in mt76x02_mac.c bdbc9311f1 platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning 3446e5ecdf block: ataflop: fix breakage introduced at blk-mq refactoring 2918a29fc8 mmc: mxs-mmc: disable regulator on error and in the remove function b631c603b5 net: stream: don't purge sk_error_queue in sk_stream_kill_queues() f27fbff862 drm/msm: uninitialized variable in msm_gem_import() 32ac072c24 ath10k: fix max antenna gain unit 218fb43fff hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff 8384c4a7bc hwmon: Fix possible memleak in __hwmon_device_register() f7fd072039 net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE 9498f5272a memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() 5f462b38ce memstick: avoid out-of-range warning 3a7525d5d7 mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured dc73f7cae1 b43: fix a lower bounds test 1b6365fdae b43legacy: fix a lower bounds test c51ac7fd02 hwrng: mtk - Force runtime pm ops for sleep ops 52d2cdab52 crypto: qat - disregard spurious PFVF interrupts 4d7881430f crypto: qat - detect PFVF collision after ACK a3d3f9c5dc media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() 73dd601bec netfilter: nft_dynset: relax superfluous check on set updates 62f6260f70 EDAC/amd64: Handle three rank interleaving mode f399e650c0 ath9k: Fix potential interrupt storm on queue reset 843ff688eb media: em28xx: Don't use ops->suspend if it is NULL e577924b70 cpuidle: Fix kobject memory leaks in error paths 18fdbdbecf crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency a993159a2a kprobes: Do not use local variable when creating debugfs file 71411bd79e media: cx23885: Fix snd_card_free call on null card pointer 1c2c8030e7 media: tm6000: Avoid card name truncation 61266f852f media: si470x: Avoid card name truncation 4e65b9ec21 media: radio-wl1273: Avoid card name truncation 8eeec127d5 media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' 2b9ae7bac9 media: TDA1997x: handle short reads of hdmi info frame. 23b65152a0 media: dvb-usb: fix ununit-value in az6027_rc_query e2b2d221a4 media: cxd2880-spi: Fix a null pointer dereference on error handling path f46da0c6af media: em28xx: add missing em28xx_close_extension 14f3d77c77 drm/amdgpu: fix warning for overflow check 465dc8a1b1 ath10k: Fix missing frame timestamp for beacon/probe-resp 7c12c2fe45 net: dsa: rtl8366rb: Fix off-by-one bug 674637270e rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() d4cd7a167c crypto: caam - disable pkc for non-E SoCs 555fe5734d Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync 8c68d12f1a wilc1000: fix possible memory leak in cfg_scan_result() 1713b85634 cgroup: Make rebind_subsystems() disable v2 controllers all at once bd76ec43f1 net: net_namespace: Fix undefined member in key_remove_domain() 3a37742128 virtio-gpu: fix possible memory allocation failure 606c95078a drm/v3d: fix wait for TMU write combiner flush 6a93d8ebb8 rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() 6237a1685c Bluetooth: fix init and cleanup of sco_conn.timeout_work 28c1d96562 selftests/bpf: Fix strobemeta selftest regression f2c04d46c8 netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state 0c2acfede5 parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling cbe2872427 parisc/unwind: fix unwinder when CONFIG_64BIT is enabled a9a411adca task_stack: Fix end_of_stack() for architectures with upwards-growing stack c06cf3b1d0 parisc: fix warning in flush_tlb_all 7324419233 x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted ad67a7e2ab spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() a15fc58933 btrfs: do not take the uuid_mutex in btrfs_rm_device aba1db41dd net: annotate data-race in neigh_output() 2f78cb7ecc vrf: run conntrack only in context of lower/physdev for locally generated packets 5919f02e18 ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 d99f320a1b gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE 9929b3db46 ARM: clang: Do not rely on lr register for stacktrace 681a426e6b smackfs: use __GFP_NOFAIL for smk_cipso_doi() 4752a9c3a0 iwlwifi: mvm: disable RX-diversity in powersave 41e583edb1 selftests: kvm: fix mismatched fclose() after popen() 4411d0d8df PM: hibernate: Get block device exclusively in swsusp_check() a528d3aac3 nvme: drop scan_lock and always kick requeue list when removing namespaces 209c39b3f5 nvmet-tcp: fix use-after-free when a port is removed 81d11e40fd nvmet: fix use-after-free when a port is removed 1ec1ca2be9 block: remove inaccurate requeue check bfde056402 mwl8k: Fix use-after-free in mwl8k_fw_state_machine() e4af3e42ba tracing/cfi: Fix cmp_entries_* functions signature mismatch caeb6bae75 workqueue: make sysfs of unbound kworker cpumask more clever 58b4e0c075 lib/xz: Validate the value before assigning it to an enum variable 8cdab20660 lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression eb8f087201 memstick: r592: Fix a UAF bug when removing the driver 2226ad0314 leaking_addresses: Always print a trailing newline 63c3c7b699 ACPI: battery: Accept charges over the design capacity as full 2efb81b22d iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value d5fb057f23 ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() e2c27194fc tracefs: Have tracefs directories not set OTH permission bits by default ace6e7fe96 net-sysfs: try not to restart the syscall if it will fail eventually d8d1d35405 media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() 382e7b6458 media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info e5f9be4869 media: ipu3-imgu: imgu_fmt: Handle properly try cdf338e1db ACPICA: Avoid evaluating methods too early during system resume 9ff00d0b1d ipmi: Disable some operations during a panic 4bba26f89e media: rcar-csi2: Add checking to rcsi2_start_receiver() c08a655ed9 brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet f64551db52 ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK 31b7848647 media: mceusb: return without resubmitting URB in case of -EPROTO error. e419469adf media: imx: set a media_device bus_info string b2b2f91782 media: s5p-mfc: Add checking to s5p_mfc_probe(). 6b8ab552e2 media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() bc4af8c782 media: uvcvideo: Set unique vdev name based in type 7a646855d6 media: uvcvideo: Return -EIO for control errors ab7fca0eae media: uvcvideo: Set capability in s_param bff0833e2b media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() cede36511c media: netup_unidvb: handle interrupt properly according to the firmware 3fe3d04354 media: mt9p031: Fix corrupted frame after restarting stream 08743f9c48 ath10k: high latency fixes for beacon buffer fadb4cd750 mwifiex: Properly initialize private structure on interface type changes 7d3e6635c2 mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type 480c240ab6 x86: Increase exception stack sizes 91b9c23b6d smackfs: Fix use-after-free in netlbl_catmap_walk() 31df731c87 net: sched: update default qdisc visibility after Tx queue cnt changes a82f379378 locking/lockdep: Avoid RCU-induced noinstr fail f14eca60bf MIPS: lantiq: dma: reset correct number of channel ca07aff257 MIPS: lantiq: dma: add small delay after reset e5ea3dca94 platform/x86: wmi: do not fail if disabling fails b57df4d6fc drm/panel-orientation-quirks: add Valve Steam Deck 67bd269a84 Bluetooth: fix use-after-free error in lock_sock_nested() d416020f1a Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() a52bd11b24 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 e5ca76568a drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 c19cabfa55 drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) 46a25b7a25 dma-buf: WARN on dmabuf release with pending attachments 1bee9e59c6 USB: chipidea: fix interrupt deadlock 8a643c0f95 USB: iowarrior: fix control-message timeouts 3285811674 USB: serial: keyspan: fix memleak on probe errors 8ce0bc6962 iio: dac: ad5446: Fix ad5622_write() return value f01e16d324 pinctrl: core: fix possible memory leak in pinctrl_enable() 270541cbc0 quota: correct error number in free_dqentry() 10b808307d quota: check block number when reading the block in quota file a509a515f3 PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG 0ea58b9bb9 PCI: aardvark: Fix return value of MSI domain .alloc() method ee9cdca4d6 PCI: aardvark: Fix reporting Data Link Layer Link Active 6f99c7a51e PCI: aardvark: Do not unmask unused interrupts d964886327 PCI: aardvark: Fix checking for link up via LTSSM state e0269c0c81 PCI: aardvark: Do not clear status bits of masked interrupts 50b0ce94fb PCI: pci-bridge-emul: Fix emulation of W1C bits 3d995568c9 xen/balloon: add late_initcall_sync() for initial ballooning done 3f6255a91b ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume 6225a31b2e ALSA: mixer: oss: Fix racy access to slots e9adf72bdb serial: core: Fix initializing and restoring termios speed b535b63464 powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found bfefc5d6f9 can: j1939: j1939_can_recv(): ignore messages with invalid source address 94a3f521e3 can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport 8e61c799c8 KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use 654a824816 power: supply: max17042_battery: use VFSOC for capacity when no rsns 11129762e3 power: supply: max17042_battery: Prevent int underflow in set_soc_threshold 625c3ed247 signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT ec5ef8d4d7 signal: Remove the bogus sigkill_pending in ptrace_stop 28c70d5036 RDMA/qedr: Fix NULL deref for query_qp on the GSI QP 91a29609bd rsi: Fix module dev_oper_mode parameter description 9defe9b1ab rsi: fix rate mask set leading to P2P failure 2f1f06be3e rsi: fix key enabled check causing unwanted encryption for vap_id > 0 1fa1da8a60 rsi: fix occasional initialisation failure with BT coex 398e7e5add wcn36xx: handle connection loss indication 4a67355383 libata: fix checking of DMA state 6f2f91b9df mwifiex: Read a PCI register after writing the TX ring write pointer 3991cdc40f wcn36xx: Fix HT40 capability for 2Ghz band 301d33c954 evm: mark evm_fixmode as __ro_after_init e1f71a3289 rtl8187: fix control-message timeouts 76d2ce7ca9 PCI: Mark Atheros QCA6174 to avoid bus reset 3110371c7a ath10k: fix division by zero in send path 2b94d10056 ath10k: fix control-message timeout cfbe74d8b1 ath6kl: fix control-message timeout 1a2fe1c3d8 ath6kl: fix division by zero in send path 78ebff828a mwifiex: fix division by zero in fw download path 08501eb9ff EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell a147922924 regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property c9e5a00596 regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled 3baa5886d1 hwmon: (pmbus/lm25066) Add offset coefficients 98bea92379 ia64: kprobes: Fix to pass correct trampoline address to the handler ddb54bf3b7 btrfs: call btrfs_check_rw_degradable only if there is a missing device 5223324ed1 btrfs: fix lost error handling when replaying directory deletes c25984fa18 btrfs: clear MISSING device status bit in btrfs_close_one_device 87a87c82f7 net/smc: Correct spelling mistake to TCPF_SYN_RECV cc14499b9d nfp: bpf: relax prog rejection for mtu check through max_pkt_offset a62d430841 vmxnet3: do not stop tx queues after netif_device_detach() 17dcecf20c r8169: Add device 10ec:8162 to driver r8169 e84b38e578 nvmet-tcp: fix header digest verification 2804181e1b drm: panel-orientation-quirks: Add quirk for GPD Win3 7273488fd3 watchdog: Fix OMAP watchdog early handling 5ffdddcf28 net: multicast: calculate csum of looped-back and forwarded packets 9420e2496d spi: spl022: fix Microwire full duplex mode 1a667bc329 nvmet-tcp: fix a memory leak when releasing a queue 2f3860ba60 xen/netfront: stop tx queues during live migration de649ec7ad bpf: Prevent increasing bpf_jit_limit above max df8665c398 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT 8dd688ba67 drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 c4282bb805 mmc: winbond: don't build on M68K 05f0a97e2f reset: socfpga: add empty driver allowing consumers to probe dfa8fb782b ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode f09014e8be hyperv/vmbus: include linux/bitops.h 054fe50d26 sfc: Don't use netif_info before net_device setup 82005afbb3 cavium: Fix return values of the probe function 9f5fd5aab8 scsi: qla2xxx: Fix unmap of already freed sgl 96183337e9 scsi: qla2xxx: Return -ENOMEM if kzalloc() fails 8e3a0d28ed cavium: Return negative value when pci_alloc_irq_vectors() fails 58608e80d6 x86/irq: Ensure PI wakeup handler is unregistered before module unload 7252cb96e4 x86/cpu: Fix migration safety with X86_BUG_NULL_SEL e3d4ba338b x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c ccc4e5e60b fuse: fix page stealing 9505d48721 ALSA: timer: Unconditionally unlink slave instances, too 2c6446168f ALSA: timer: Fix use-after-free problem 246c6a1fe3 ALSA: synth: missing check for possible NULL after the call to kstrdup ce9f7535ec ALSA: usb-audio: Add registration quirk for JBL Quantum 400 7da6f4c5c2 ALSA: line6: fix control and interrupt message timeouts 4a12e624e5 ALSA: 6fire: fix control and bulk message timeouts ab3f823af2 ALSA: ua101: fix division by zero at probe a3bb6e0db7 ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED 40243342d2 ALSA: hda/realtek: Add quirk for ASUS UX550VE 8af6ade7ac ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N 809416fe0a ALSA: hda/realtek: Add quirk for Clevo PC70HS 638b53d67f media: v4l2-ioctl: Fix check_ext_ctrls 8c11269bd6 media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers bbd62d2fca media: ite-cir: IR receiver stop working after receive overflow eef6cb3d3c crypto: s5p-sss - Add error handling in s5p_aes_probe() d7a5d872b4 firmware/psci: fix application of sizeof to pointer 18f0fb57a9 tpm: Check for integer overflow in tpm2_map_response_body() f38f3da360 parisc: Fix ptrace check on syscall return acbc2a08ea mmc: dw_mmc: Dont wait for DRTO on Write RSP error 5ee76475f8 scsi: qla2xxx: Fix use after free in eh_abort path cc5b139488 scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file 617d2fd48d ocfs2: fix data corruption on truncate c20eb9551c libata: fix read log timeout value 69c2199f49 Input: i8042 - Add quirk for Fujitsu Lifebook T725 17ec1c6b45 Input: elantench - fix misreporting trackpoint coordinates ce4bec0a54 Input: iforce - fix control-message timeout db39f49ee7 binder: use cred instead of task for getsecid fc9c470cd5 binder: use cred instead of task for selinux checks 28a1e470b0 binder: use euid from cred instead of using task 3e87c4996d usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform 3fa7efd1fa xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay f911d1ad48 Merge 5.4.159 into android11-5.4-lts 5915b0ea67 Linux 5.4.159 abc49cc45d rsi: fix control-message timeout 64e6632ab4 media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init 6c382b6365 staging: rtl8192u: fix control-message timeouts f66258cb60 staging: r8712u: fix control-message timeout 88a252ff78 comedi: vmk80xx: fix bulk and interrupt message timeouts 1ae4715121 comedi: vmk80xx: fix bulk-buffer overflow 199acd8c11 comedi: vmk80xx: fix transfer-buffer overflows b0156b7c96 comedi: ni_usb6501: fix NULL-deref in command paths 3efb7af8ac comedi: dt9812: fix DMA buffers on stack 6e80e9314f isofs: Fix out of bound access for corrupted isofs image adc56dbfc4 printk/console: Allow to disable console output by using console="" or console=null 589ac131b3 binder: don't detect sender/target during buffer cleanup b60e89b63e usb-storage: Add compatibility quirk flags for iODD 2531/2541 5c3eba2904 usb: musb: Balance list entry in musb_gadget_queue 161571745d usb: gadget: Mark USB_FSL_QE broken on 64-bit d6013265a7 usb: ehci: handshake CMD_RUN instead of STS_HALT 6d000e1c16 Revert "x86/kvm: fix vcpu-id indexed array sizes" 3197361248 Merge branch 'android11-5.4' into 'android11-5.4-lts' 7cd388bad4 Merge 5.4.158 into android11-5.4-lts c65356f0f7 Linux 5.4.158 e31d51f8a4 ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" 960b1fdfc3 Revert "drm/ttm: fix memleak in ttm_transfered_destroy" a73ebe514a sfc: Fix reading non-legacy supported link modes 6789e4b759 Revert "usb: core: hcd: Add support for deferring roothub registration" 049849492b Revert "xhci: Set HCD flag to defer primary roothub registration" 2461f38384 media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() 21fc2bb836 net: ethernet: microchip: lan743x: Fix skb allocation failure e02fdd7db4 vrf: Revert "Reset skb conntrack connection..." 1ce287eff9 scsi: core: Put LLD module refcnt after SCSI device is released 553d3c4173 Merge 5.4.157 into android11-5.4-lts e6de9a8b5b Linux 5.4.157 39fb393e21 perf script: Check session->header.env.arch before using it 472d9354a9 KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu 07e9a4e1ab KVM: s390: clear kicked_mask before sleeping again 5919a07d71 cfg80211: correct bridge/4addr mode check dba9e632ed net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT 0f5b4c57dc sctp: add vtag check in sctp_sf_ootb df52776407 sctp: add vtag check in sctp_sf_do_8_5_1_E_sa 0aa322b5fe sctp: add vtag check in sctp_sf_violation d6470c2200 sctp: fix the processing for COOKIE_ECHO chunk 5fe74d5e4d sctp: fix the processing for INIT_ACK chunk 5953ee99ba sctp: use init_tag from inithdr for ABORT chunk 5395650d15 phy: phy_start_aneg: Add an unlocked version c85b696270 phy: phy_ethtool_ksettings_get: Lock the phy for consistency 0dea6379e2 net/tls: Fix flipped sign in async_wait.err assignment e12b8f3c2b net: nxp: lpc_eth.c: avoid hang when bringing interface down b232898c1d net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent 92507dc1ef net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails 3708aa267d nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST b1c76f97ad RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string 18a012869f net: Prevent infinite while loop in skb_tx_hash() 6422e84718 net: batman-adv: fix error handling 1cead23c1c regmap: Fix possible double-free in regcache_rbtree_exit() 207e6e93e7 arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node c29c3295e0 RDMA/mlx5: Set user priority for DCT 13ad93a42c nvme-tcp: fix data digest pointer calculation b597b0e2e8 nvmet-tcp: fix data digest pointer calculation d997d4e436 IB/hfi1: Fix abba locking issue with sc_disable() 0f8cdfff06 IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields 5f0bfe21c8 tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function bd99782f3c drm/ttm: fix memleak in ttm_transfered_destroy d2c64ebcc7 net: lan78xx: fix division by zero in send path a37c5e70ac cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() 590abe5bec mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit 07da44b086 mmc: sdhci: Map more voltage level to SDHCI_POWER_330 0821c5608d mmc: dw_mmc: exynos: fix the finding clock sample value 08328d65cb mmc: cqhci: clear HALT state after CQE enable 55a3870f4a mmc: vub300: fix control-message timeouts e0cfd5159f net/tls: Fix flipped sign in tls_err_abort() calls 6a18d155d5 Revert "net: mdiobus: Fix memory leak in __mdiobus_register" 9fdcf66ee4 nfc: port100: fix using -ERRNO as command type mask 853f22623d ata: sata_mv: Fix the error handling of mv_chip_id() 6d0b30784f Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" b7dfc536db usbnet: fix error return code in usbnet_probe() 492140e45d usbnet: sanity check for maxpacket 4ba6c163fe ipv4: use siphash instead of Jenkins in fnhe_hashfun() 3f439c231a ipv6: use siphash in rt6_exception_hash() 1cad781ecf powerpc/bpf: Fix BPF_MOD when imm == 1 ca10ddbbab ARM: 9141/1: only warn about XIP address when not compile testing 40cd329455 ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype 2f7647cc13 ARM: 9134/1: remove duplicate memcpy() definition 9f44f66396 ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned 5f1f361447 Merge 5.4.156 into android11-5.4-lts 3a7a77d783 Merge branch 'android11-5.4' into 'android11-5.4-lts' 89b6869b94 Linux 5.4.156 7cdcaa7c76 pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() a9c4e246f7 ARM: 9122/1: select HAVE_FUTEX_CMPXCHG a98c81ab17 tracing: Have all levels of checks prevent recursion b0feaa8376 net: mdiobus: Fix memory leak in __mdiobus_register 0ab35e7074 scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() 9068beaa04 Input: snvs_pwrkey - add clk handling 8de335e819 ALSA: hda: avoid write to STATESTS if controller is in reset 570bc60dcd platform/x86: intel_scu_ipc: Update timeout value in comment 4054b869dc isdn: mISDN: Fix sleeping function called from invalid context 5001160d3e ARM: dts: spear3xx: Fix gmac node e9d9ffa193 net: stmmac: add support for dwmac 3.40a 044fa2afd6 btrfs: deal with errors when checking if a dir entry exists during log replay d49a293b94 gcc-plugins/structleak: add makefile var for disabling structleak e8ef998441 selftests: netfilter: remove stray bash debug line b7fdebde2c netfilter: Kconfig: use 'default y' instead of 'm' for bool config option 285e9210b1 isdn: cpai: check ctr->cnr to avoid array index out of bound 1f75f8883b nfc: nci: fix the UAF of rf_conn_info object 4f5d1c29cf mm, slub: fix potential memoryleak in kmem_cache_open() a1ec195a19 mm, slub: fix mismatch between reconstructed freelist depth and cnt 8e25a62e8d powerpc/idle: Don't corrupt back chain when going idle d0148cfaf8 KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest 80bbb0bc3a KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() 722e6f6ac8 powerpc64/idle: Fix SP offsets when saving GPRs d6f451f1f6 audit: fix possible null-pointer dereference in audit_filter_rules c974f2f92c ASoC: DAPM: Fix missing kctl change notifications 5307a77b71 ALSA: hda/realtek: Add quirk for Clevo PC50HS 50fc52e5ca ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset 0f218ba4c8 vfs: check fd has read access in kernel_read_file_from_fd() f439d2bcb6 elfcore: correct reference to CONFIG_UML d3a8357637 ocfs2: mount fails with buffer overflow in strlen b05caf023b ocfs2: fix data corruption after conversion from inline format bce53fbee9 ceph: fix handling of "meta" errors 151c72bba1 can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes 0ddf781882 can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length a0e47d2833 can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv 7e66cfed66 can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer 1248582e47 can: peak_pci: peak_pci_remove(): fix UAF ea82c2463e can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification c26dcd1cb8 can: rcar_can: fix suspend/resume 8c5585eae3 net: enetc: fix ethtool counter name for PM0_TERR c0b0baade9 net: stmmac: Fix E2E delay mechanism c4b64011e4 net: hns3: disable sriov before unload hclge layer 472acf1582 net: hns3: add limit ets dwrr bandwidth cannot be 0 b1f9380ee2 net: hns3: reset DWRR of unused tc to zero 12bdcbc043 NIOS2: irqflags: rename a redefined register name 599766696f net: dsa: lantiq_gswip: fix register definition f49ce82f9b lan78xx: select CRC32 83094f8c44 netfilter: ipvs: make global sysctl readonly in non-init netns ce70ee94dd ASoC: wm8960: Fix clock configuration on slave mode 0f5b08ca22 dma-debug: fix sg checks in debug_dma_map_sg() 50aefa9acc NFSD: Keep existing listeners on portlist error 4a5bf3e729 xtensa: xtfpga: Try software restart before simulating CPU reset 31137288b9 xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF d946a39bad ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default e7c4819c0b tee: optee: Fix missing devices unregister during optee_remove b1e9b4e0f6 net: switchdev: do not propagate bridge updates across bridges 2d22cd0482 parisc: math-emu: Fix fall-through warnings ff9005a69e Merge branch 'android11-5.4' into 'android11-5.4-lts' fa6db42758 Merge 5.4.155 into android11-5.4-lts 4f508aa9dd Linux 5.4.155 32d2ce0b94 ionic: don't remove netdev->dev_addr when syncing uc list abaf8e8b90 r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 a4f7d2246e qed: Fix missing error code in qed_slowpath_start() 62d96bb68b mqprio: Correct stats in mqprio_dump_class_stats(). fa272e8353 acpi/arm64: fix next_platform_timer() section mismatch error 32ac4ed32b drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling 4620098958 drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() f302be08e3 drm/msm: Fix null pointer dereference on pointer edp 0d5ef1e875 drm/panel: olimex-lcd-olinuxino: select CRC32 9225d57f51 platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call ae0993739e mlxsw: thermal: Fix out-of-bounds memory accesses 97e6dcb416 ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() b9352ed9b9 pata_legacy: fix a couple uninitialized variable bugs 2bde4aca56 NFC: digital: fix possible memory leak in digital_in_send_sdd_req() 7ab488d722 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() 69b3a13f0d nfc: fix error handling of nfc_proto_register() 2731eaac19 ethernet: s2io: fix setting mac address during resume 4c2eb80fc9 net: encx24j600: check error in devm_regmap_init_encx24j600 0904e1be2a net: stmmac: fix get_hw_feature() on old hardware 06251ea8d1 net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp 19a01522c5 net: korina: select CRC32 32b57d897e net: arc: select CRC32 2880dc1302 gpio: pca953x: Improve bias setting d887745395 sctp: account stream padding length for reconf chunk 232c485c6b iio: dac: ti-dac5571: fix an error code in probe() 69696951de iio: ssp_sensors: fix error code in ssp_print_mcu_debug() 10ecff1522 iio: ssp_sensors: add more range checking in ssp_parse_dataframe() ac0688bcd1 iio: light: opt3001: Fixed timeout error when 0 lux 3c00d93297 iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED cf4b39907a iio: adc128s052: Fix the error handling path of 'adc128_probe()' 580c09a9ef iio: adc: aspeed: set driver data when adc probe. 1904050cac powerpc/xive: Discard disabled interrupts in get_irqchip_state() 5683ed468f x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically 0594f1d048 nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells d07571672c EDAC/armada-xp: Fix output of uncorrectable error counter dba8834bae virtio: write back F_VERSION_1 before validate 1b39a67856 USB: serial: option: add prod. id for Quectel EG91 41e178c138 USB: serial: option: add Telit LE910Cx composition 0x1204 848eac2cb7 USB: serial: option: add Quectel EC200S-CN module support 958e98ca52 USB: serial: qcserial: add EM9191 QDL support 733dcc08e9 Input: xpad - add support for another USB ID of Nacon GC-100 9ab5d539bc usb: musb: dsps: Fix the probe error path 278e483dc7 efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() 27a847dbc9 efi/cper: use stack buffer for error record decoding 6e35a5e926 cb710: avoid NULL pointer subtraction e71ce4a81e xhci: Enable trust tx length quirk for Fresco FL11 USB controller 01c2dcb67e xhci: Fix command ring pointer corruption while aborting a command 7ce7d4a46d xhci: guard accesses to ep_state in xhci_endpoint_reset() 783579057c mei: me: add Ice Lake-N device id. 9264bd22d7 x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails 10b77e16b3 watchdog: orion: use 0 for unset heartbeat 9acf1c10f1 btrfs: check for error when looking up inode during dir entry replay 625565fd80 btrfs: deal with errors when adding inode reference during log replay 6e2ac49b21 btrfs: deal with errors when replaying dir entry during log replay 005a07c9ac btrfs: unlock newly allocated extent buffer after error e9f457f056 csky: Fixup regs.sr broken in ptrace a6f4ea748a csky: don't let sigreturn play with priveleged bits of status register 98544ca6cb s390: fix strrchr() implementation 5959e22e07 nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^' 2e41b9c846 ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW 90cf96afa3 ALSA: hda/realtek - ALC236 headset MIC recording issue 33627fa4db ALSA: hda/realtek: Add quirk for Clevo X170KM-G e96079ab1c ALSA: hda/realtek: Complete partial device name to avoid ambiguity dd3f048315 ALSA: seq: Fix a potential UAF by wrong private_free call order 825786f723 ALSA: usb-audio: Add quirk for VF0770 43d9332526 ovl: simplify file splice 615b28244c Merge 5.4.154 into android11-5.4-lts ce061ef43f Linux 5.4.154 291a48871e sched: Always inline is_percpu_thread() 3e105ecc4a scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 1ff5ee9d39 scsi: ses: Fix unsigned comparison with less than zero 83d857d6b0 drm/amdgpu: fix gart.bo pin_count leak 1843ae8c4b net: sun: SUNVNET_COMMON should depend on INET 6d1d7acb10 mac80211: check return value of rhashtable_init 2aaf3fd5e1 net: prevent user from passing illegal stab size 1e66a472b5 m68k: Handle arrivals of multiple signals correctly be191c8e68 mac80211: Drop frames from invalid MAC address in ad-hoc mode fffad5988f netfilter: nf_nat_masquerade: defer conntrack walk to work queue b3cb063034 netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic a9d8aa2d3c HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs 8c6680025b netfilter: ip6_tables: zero-initialize fragment offset 744b908a7f HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS b6bccc978e ext4: correct the error path of ext4_write_inline_data_end() de4a28b718 net: phy: bcm7xxx: Fixed indirect MMD operations 57f5a5a9ae UPSTREAM: ovl: simplify file splice 65d414cb38 Merge branch 'android11-5.4' into 'android11-5.4-lts' ffab1c7d7c Merge 5.4.153 into android11-5.4-lts 940a14a7d8 Linux 5.4.153 6a89b1e0c2 x86/Kconfig: Correct reference to MWINCHIP3D 5b3b400741 x86/hpet: Use another crystalball to evaluate HPET usability 367f643191 x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI 9e2a9da532 RISC-V: Include clone3() on rv32 a326f9c01c bpf, s390: Fix potential memory leak about jit_data 60bacf259e i2c: acpi: fix resource leak in reconfiguration device addition b723b34a98 net: prefer socket bound to interface when not in VRF 17063cac40 i40e: Fix freeing of uninitialized misc IRQ vector 0a1fcc981d i40e: fix endless loop under rtnl d6c0668119 gve: fix gve_get_stats() d83787c26d rtnetlink: fix if_nlmsg_stats_size() under estimation 0311d97753 gve: Correct available tx qpl check 11cd944bb8 drm/nouveau/debugfs: fix file release memory leak cb7e651879 video: fbdev: gbefb: Only instantiate device when built for IP32 04f981251e bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 809aa82ac6 netlink: annotate data races around nlk->bound fd73c2e64b net: sfp: Fix typo in state machine debug string c951c08a59 net/sched: sch_taprio: properly cancel timer from taprio_destroy() c2c45102ae net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() 8af0c7d3fb ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence ebe58e1c1a arm64: dts: ls1028a: add missing CAN nodes 1b9f0d242a arm64: dts: freescale: Fix SP805 clock-names 27e53e23a3 ptp_pch: Load module automatically if ID matches a7b441a2e2 powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 c951a3be5e net_sched: fix NULL deref in fifo_set_limit() 414bb4ead1 phy: mdio: fix memory leak b14f28126c bpf: Fix integer overflow in prealloc_elems_and_freelist() a3d68a4245 bpf, arm: Fix register clobbering in div/mod implementation e0c6e864d2 xtensa: call irqchip_init only when CONFIG_USE_OF is selected d10a2a8f88 xtensa: use CONFIG_USE_OF instead of CONFIG_OF 73711563f5 xtensa: move XCHAL_KIO_* definitions to kmem_layout.h c82cffe171 arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding 14c9c75d48 ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo 720a4dceee ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo 6b2855ac7e soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment 1179cd690a ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference bdc189d6b6 soc: qcom: socinfo: Fixed argument passed to platform_set_data() 1a0fe45501 bpf, mips: Validate conditional branch offsets 7ed0402445 MIPS: BPF: Restore MIPS32 cBPF JIT 4239cd380a ARM: dts: qcom: apq8064: use compatible which contains chipid 30d68bf74d ARM: dts: omap3430-sdp: Fix NAND device node 2abb4077fa xen/balloon: fix cancelled balloon action 42fbcbaa8a nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero f88420197a nfsd: fix error handling of register_pernet_subsys() in init_nfsd() fab338f33c ovl: fix missing negative dentry check in ovl_rename() 4920aae61b mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk 47f7bb3dc2 xen/privcmd: fix error handling in mmap-resource processing 9d93cfdaf8 usb: typec: tcpm: handle SRC_STARTUP state if cc changes b53aa224ad USB: cdc-acm: fix break reporting 3135935b7f USB: cdc-acm: fix racy tty buffer accesses 7c2392f03f Partially revert "usb: Kconfig: using select for USB_COMMON dependency" cc109ff104 ANDROID: Different fix for KABI breakage in 5.4.151 in struct sock 17eb597c8b Merge 5.4.152 into android11-5.4-lts faaca480fd Linux 5.4.152 caff281e20 libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. fecbe957ef silence nfscache allocation warnings with kvzalloc 5546e3987d perf/x86: Reset destroy callback on event init failure 2787cde6cb kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[] ba58770c14 KVM: do not shrink halt_poll_ns below grow_start d67e01e5e0 tools/vm/page-types: remove dependency on opt_file for idle page tracking 65c7e3c973 scsi: ses: Retry failed Send/Receive Diagnostic commands e4e756054d selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn 1f830ab345 selftests: be sure to make khdr before other targets 8b9c1c33e5 usb: dwc2: check return value after calling platform_get_resource() 5d124ee0d2 usb: testusb: Fix for showing the connection speed 350d048cc5 scsi: sd: Free scsi_disk device via put_device() 4f194b5769 ext2: fix sleeping in atomic bugs on error 2d8eb45674 sparc64: fix pci_iounmap() when CONFIG_PCI is not set 61504f62bb xen-netback: correct success/error reporting for the SKB-with-fraglist case 2ecca3b282 net: mdio: introduce a shutdown method to mdio device drivers 4659036941 ANDROID: Fix up KABI breakage in 5.4.151 in struct sock 0454b0c925 Merge 5.4.151 into android11-5.4-lts 31cdcb6d43 Linux 5.4.151 965147067f HID: usbhid: free raw_report buffers in usbhid_stop 6f2f68640b netfilter: ipset: Fix oversized kvmalloc() calls fe9bb925e7 HID: betop: fix slab-out-of-bounds Write in betop_probe 24f3d26091 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() 62c5cacb09 usb: hso: remove the bailout parameter fe57d53dd9 usb: hso: fix error handling code of hso_create_net_device d29c7a1a32 hso: fix bailout in error case of probe 1f2b324e82 libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind dd336267d8 PCI: Fix pci_host_bridge struct device release/free handling e81f3b7e71 net: stmmac: don't attach interface until resume finishes f8ffde0bb9 net: udp: annotate data race around udp_sk(sk)->corkflag 9dbf7e343b HID: u2fzero: ignore incomplete packets without data d518ea0314 ext4: fix potential infinite loop in ext4_dx_readdir() 59c19fdcde ext4: fix reserved space counter leakage c4b8db2b47 ext4: fix loff_t overflow in ext4_max_bitmap_size() 3253c87e1e ipack: ipoctal: fix module reference leak 9c802a0574 ipack: ipoctal: fix missing allocation-failure check 3fd682d461 ipack: ipoctal: fix tty-registration error handling e6a71c173e ipack: ipoctal: fix tty registration race 8657158a3b ipack: ipoctal: fix stack information leak 91d5de0b71 debugfs: debugfs_create_file_size(): use IS_ERR to check for error 98574c91e3 elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 9356e4dceb perf/x86/intel: Update event constraints for ICX 0fcfaa8ed9 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses 694b0cee7f net: sched: flower: protect fl_walk() with rcu 5a31d4e73a net: hns3: do not allow call hns3_nic_net_open repeatedly 87de237b0b scsi: csiostor: Add module softdep on cxgb4 1b6ccfcec6 Revert "block, bfq: honor already-setup queue merges" 753096c38a selftests, bpf: test_lwt_ip_encap: Really disable rp_filter 897d1401d1 e100: fix buffer overrun in e100_get_regs 93372e02f9 e100: fix length calculation in e100_get_regs_len a2624e0934 net: ipv4: Fix rtnexthop len when RTA_FLOW is present c37d3287e7 hwmon: (tmp421) fix rounding for negative values 8a07d5aba3 hwmon: (tmp421) report /PVLD condition as fault ec018021cf sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb 9bee85de2c mac80211-hwsim: fix late beacon hrtimer handling 21c3a84493 mac80211: mesh: fix potentially unaligned access ab85997465 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap 87e06c4428 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug a6c42ae153 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs 2c30592255 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 9a571d83ac drm/amd/display: Pass PCI deviceid into DC 3443eb443f x86/kvmclock: Move this_cpu_pvti into kvmclock.h 50149e0866 mac80211: fix use-after-free in CCMP/GCMP RX 956bc3ee31 scsi: ufs: Fix illegal offset in UPIU event trace 44d3c480e4 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field 200ced5ba7 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field 6cb01fe630 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field 504cf969d5 fs-verity: fix signed integer overflow with i_size near S64_MAX b2fb6ce06c usb: cdns3: fix race condition before setting doorbell e2370e1935 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 67c98e0231 cpufreq: schedutil: Use kobject release() method to free sugov_tunables 883f7897a2 tty: Fix out-of-bound vmalloc access in imageblit ec298edf02 Merge 5.4.150 into android11-5.4-lts 2abce4ec2a Merge 5.4.149 into android11-5.4-lts 5785e5360a Revert "crypto: public_key: fix overflow during implicit conversion" 3a7dc5b4cf Linux 5.4.150 27f8c4402c qnx4: work around gcc false positive warning bug 3a0f951e37 xen/balloon: fix balloon kthread freezing f80b679381 arm64: dts: marvell: armada-37xx: Extend PCIe MEM space 04783de9c0 thermal/drivers/int340x: Do not set a wrong tcc offset on resume de1c350680 EDAC/synopsys: Fix wrong value type assignment for edac_mode 8ede848bc9 spi: Fix tegra20 build with CONFIG_PM=n d193f7dbf4 net: 6pack: Fix tx timeout and slot time fa56f2c987 alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile af4a142ab7 arm64: Mark __stack_chk_guard as __ro_after_init aeb19da46c parisc: Use absolute_pointer() to define PAGE0 8cd34eb616 qnx4: avoid stringop-overread errors 1214ace614 sparc: avoid stringop-overread errors 113a8edfb9 net: i825xx: Use absolute_pointer for memcpy from fixed memory location 2397ea2db2 compiler.h: Introduce absolute_pointer macro d12ddd843f blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd 9d77988232 sparc32: page align size in arch_dma_alloc ec49f3f7f6 nvme-multipath: fix ANA state updates when a namespace is not present 29917bbb07 xen/balloon: use a kernel thread instead a workqueue 93937596e0 bpf: Add oversize check before call kvcalloc() 7273cb182f ipv6: delay fib6_sernum increase in fib6_add 7432ecc55f m68k: Double cast io functions to unsigned long 29c70b0d33 net: stmmac: allow CSR clock of 300MHz 1da750d1e2 net: macb: fix use after free on rmmod ebb8d26d93 blktrace: Fix uaf in blk_trace access after removing by sysfs 2b5befcd40 md: fix a lock order reversal in md_alloc 42d3711c23 irqchip/gic-v3-its: Fix potential VPE leak on error 71f323f605 irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build 1b59625da6 scsi: lpfc: Use correct scnprintf() limit 30d373dc35 scsi: qla2xxx: Restore initiator in dual mode d140ccb140 cifs: fix a sign extension bug 1c1062c5cf thermal/core: Potential buffer overflow in thermal_build_list_of_policies() b869901cab fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 0ebc3e688f fpga: machxo2-spi: Return an error on failure 5bcead7cde tty: synclink_gt: rename a conflicting function name c5f27aedf6 tty: synclink_gt, drop unneeded forward declarations 1deb94d37a scsi: iscsi: Adjust iface sysfs attr detection d0f4a2eeeb net/mlx4_en: Don't allow aRFS for encapsulated packets ae7b957ef0 qed: rdma - don't wait for resources under hw error recovery flow 23716d7153 gpio: uniphier: Fix void functions to remove return value f7fb7dbdfb net/smc: add missing error check in smc_clc_prfx_set() 363438ed5d bnxt_en: Fix TX timeout when TX ring size is set to the smallest 4c4c305291 enetc: Fix illegal access when reading affinity_hint cf9138c966 platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() a8e8b14819 afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation acce91ba0d net: hso: fix muxed tty registration 494260e20a serial: mvebu-uart: fix driver's tx_empty callback 2d7c20db72 xhci: Set HCD flag to defer primary roothub registration 381c8ce0ab btrfs: prevent __btrfs_dump_space_info() to underflow its free space d4ec140e71 erofs: fix up erofs_lookup tracepoint 7751f609ea mcb: fix error handling in mcb_alloc_bus() 406ff5bf72 USB: serial: option: add device id for Foxconn T99W265 4b2cf0faff USB: serial: option: remove duplicate USB device ID 59564b0183 USB: serial: option: add Telit LN920 compositions 5cc674a3f1 USB: serial: mos7840: remove duplicated 0xac24 device ID 20c9fdde30 usb: core: hcd: Add support for deferring roothub registration a6c7d3c2d1 Re-enable UAS for LaCie Rugged USB3-FW with fk quirk 4dc56951a8 staging: greybus: uart: fix tty use after free aa2c274c27 binder: make sure fd closes complete 93fa08e9a3 USB: cdc-acm: fix minor-number release 0dc1cfa7b9 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter 85d3493085 usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c d4e7647695 xen/x86: fix PV trap handling on secondary processors 8b06b0f17f cifs: fix incorrect check for null pointer in header_assemble b1f6efa27b usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() b8c8060651 usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA ff275c870e usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave f013a5001b usb: gadget: r8a66597: fix a loop in set_feature() aa40438c71 ocfs2: drop acl cache for directories too e74e2950a0 Linux 5.4.149 3825263486 drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV 409cb0b3d4 rtc: rx8010: select REGMAP_I2C 43832bf763 blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() c37a34d797 pwm: stm32-lp: Don't modify HW state in .remove() callback 8a29e68ea8 pwm: rockchip: Don't modify HW state in .remove() callback ed60d2db31 pwm: img: Don't modify HW state in .remove() callback b16f4acf6b nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group 594addd436 nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group 237ca37ca5 nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group 288c8b5ba5 nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group dc70f0c8c3 nilfs2: fix NULL pointer in nilfs_##name##_attr_release 9c3ba40488 nilfs2: fix memory leak in nilfs_sysfs_create_device_group fb4c7d2923 btrfs: fix lockdep warning while mounting sprout fs 3f2d5c11be ceph: lockdep annotations for try_nonblocking_invalidate 3bbb11261a ceph: request Fw caps before updating the mtime in ceph_write_iter 2c89a856fa dmaengine: xilinx_dma: Set DMA mask for coherent APIs 2f3206199d dmaengine: ioat: depends on !UML 644f1e87fe dmaengine: sprd: Add missing MODULE_DEVICE_TABLE 445a3379f6 parisc: Move pci_dev_is_behind_card_dino to where it is used 2f7bfc07e3 drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() a12743d072 thermal/core: Fix thermal_cooling_device_register() prototype c7b9a866ee Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH 3c1d9b650c net: stmmac: reset Tx desc base address before restarting Tx 729f9d5ee3 phy: avoid unnecessary link-up delay in polling mode 81e6b51709 pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered b94def8a47 profiling: fix shift-out-of-bounds bugs 7e98111cb2 nilfs2: use refcount_dec_and_lock() to fix potential UAF 5607b1bae1 prctl: allow to setup brk for et_dyn executables b40301607c 9p/trans_virtio: Remove sysfs file on probe failure c3b45ea0a3 thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() e106080303 dmaengine: acpi: Avoid comparison GSI with Linux vIRQ 93f8a98ad8 um: virtio_uml: fix memory leak on init failures 4cd05e390a staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() 2f4b67bceb sctp: add param size validation for SCTP_PARAM_SET_PRIMARY cbd10b1189 sctp: validate chunk size in __rcv_asconf_lookup 6a12918e90 ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE 2f7974cd7b ARM: 9079/1: ftrace: Add MODULE_PLTS support 1b27a03d12 ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link() 490be340c8 ARM: 9077/1: PLT: Move struct plt_entries definition to header 278df06460 apparmor: remove duplicate macro list_entry_is_head() f23763ab46 ARM: Qualify enabling of swiotlb_init() 6bfdc3056c s390/pci_mmio: fully validate the VMA before calling follow_pte() bd292c6873 console: consume APC, DM, DCS b0c813fbbf KVM: remember position in kvm->vcpus array 5163578e9d PCI/ACPI: Add Ampere Altra SOC MCFG quirk ec29e33e5c PCI: aardvark: Fix reporting CRS value 3f0e275e43 PCI: pci-bridge-emul: Add PCIe Root Capabilities Register 296895c4f0 PCI: aardvark: Indicate error in 'val' when config read fails 2fcb7b7a1d PCI: pci-bridge-emul: Fix big-endian support c4f92aff87 Merge 5.4.148 into android11-5.4-lts 07e5f23d3f Linux 5.4.148 54ac8339ae s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant a5fc48000b s390/bpf: Fix optimizing out zero-extensions f7f1bac898 net: renesas: sh_eth: Fix freeing wrong tx descriptor 3d32ce5472 ip_gre: validate csum_start only on pull f9b308f730 qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom 93f54354cc fq_codel: reject silly quantum parameters d448b240b1 netfilter: socket: icmp6: fix use-after-scope b79204169d net: dsa: b53: Fix calculating number of switch ports d5c0f016ae perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} 114bf5776f ARC: export clear_user_page() for modules 9b63c27d6b mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' 14e0fdc43d PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n 810f9b6f0a KVM: arm64: Handle PSCI resets before userspace touches vCPU state 5f289dcf0b mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set e1746c27c3 PCI: Fix pci_dev_str_match_path() alloc while atomic bug beaf65f0fe mfd: axp20x: Update AXP288 volatile ranges 4a6c7c818b NTB: perf: Fix an error code in perf_setup_inbuf() 5a16141949 NTB: Fix an error code in ntb_msit_probe() 0980697969 ethtool: Fix an error code in cxgb2.c f336aa92b4 PCI: ibmphp: Fix double unmap of io_mem 0f9550c4f4 block, bfq: honor already-setup queue merges b61a99dda3 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 79b584d859 Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 cf4168c4e0 PCI: Add ACS quirks for Cavium multi-function devices b3435cd968 tracing/probes: Reject events which have the same name of existing one 32280649f0 mfd: Don't use irq_create_mapping() to resolve a mapping e904621ae0 fuse: fix use after free in fuse_read_interrupt() a1eaaa6b7d PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms 47c4490617 mfd: db8500-prcmu: Adjust map to reality 88834a6253 dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation 8656566821 mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() d291cca2c4 net: hns3: fix the timing issue of VF clearing interrupt sources 65bcb8f73a net: hns3: disable mac in flr process d8fe64c351 net: hns3: change affinity_mask to numa node range dede0381da net: hns3: pad the short tunnel frame before sending to hardware 4bf2c9605d KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers 235f782d5e ibmvnic: check failover_pending in login response d3939844eb dt-bindings: arm: Fix Toradex compatible typo c642afd17a qed: Handle management FW error 9ebbb8b964 tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() baf4504771 net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup 498e765b85 net/af_unix: fix a data-race in unix_dgram_poll e7332a1ac1 vhost_net: fix OoB on sendmsg() failure. 172749c879 events: Reuse value read using READ_ONCE instead of re-reading it cd78d9c996 net/mlx5: Fix potential sleeping in atomic context 48e79555c2 net/mlx5: FWTrace, cancel work on alloc pd error flow 4655f8a5af perf machine: Initialize srcline string member in add_location struct 6808e70a77 tipc: increase timeout in tipc_sk_enqueue() 678787dcfe r6040: Restore MDIO clock frequency after MAC reset efe35db948 net/l2tp: Fix reference count leak in l2tp_udp_recv_core 5ab04a4ffe dccp: don't duplicate ccid when cloning dccp sock 6c4b7a87ba ptp: dp83640: don't define PAGE0 faf9d46542 net-caif: avoid user-triggerable WARN_ON(1) 79ab38864d tipc: fix an use-after-free issue in tipc_recvmsg 08f33350ed x86/mm: Fix kern_addr_valid() to cope with existing but not present entries fde4caf6fe s390/sclp: fix Secure-IPL facility detection 15b674b1e5 drm/etnaviv: add missing MMU context put when reaping MMU mapping b2ec1e6f1d drm/etnaviv: reference MMU context when setting up hardware state 5827dbac41 drm/etnaviv: fix MMU context leak on GPU reset 5e67b38435 drm/etnaviv: exec and MMU state is lost when resetting the GPU 7068030d5e drm/etnaviv: keep MMU context across runtime suspend/resume a7970d4f00 drm/etnaviv: stop abusing mmu_context as FE running marker ee52ccecfe drm/etnaviv: put submit prev MMU context when it exists a9bacefda0 drm/etnaviv: return context from etnaviv_iommu_context_get b56b6c51a9 drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 c221eb008a PCI: Add AMD GPU multi-function power dependencies d180a373a0 PM: base: power: don't try to use non-existing RTC for storing data 484fbe9cc0 arm64/sve: Use correct size when reinitialising SVE state 2f72542033 bnx2x: Fix enabling network interfaces without VFs 66c88a4793 xen: reset legacy rtc flag for PV domU c7fab1f536 btrfs: fix upper limit for max_inline for page size 64K b9cc70e3dc drm/panfrost: Clamp lock region to Bifrost minimum 9a6c885489 drm/panfrost: Use u64 for size in lock_region 6c635129bf drm/panfrost: Simplify lock_region calculation 825ba38dfd drm/amdgpu: Fix BUG_ON assert d7a936da63 drm/msi/mdp4: populate priv->kms in mdp4_kms_init 90358cb02a net: dsa: lantiq_gswip: fix maximum frame length c1f12f440c lib/test_stackinit: Fix static initializer test 3c232895b8 platform/chrome: cros_ec_proto: Send command again when timeout occurs 0569920e43 memcg: enable accounting for pids in nested pid namespaces d0ddb80bbf mm,vmscan: fix divide by zero in get_scan_count 22b11dbbf9 mm/hugetlb: initialize hugetlb_usage in mm_init 1dc6df795c s390/pv: fix the forcing of the swiotlb f3b57cf090 cpufreq: powernv: Fix init_chip_info initialization in numa=off b5eb54c4a9 scsi: qla2xxx: Sync queue idx with queue_pair_map idx f499a9e9ed scsi: qla2xxx: Changes to support kdump kernel cfa4591328 scsi: BusLogic: Fix missing pr_cont() use a701ae9a0d ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() 1a2f728b03 parisc: fix crash with signals and alloca 76bebc93e1 net: w5100: check return value after calling platform_get_resource() 3179dd79db fix array-index-out-of-bounds in taprio_change ef9a7867b2 net: fix NULL pointer reference in cipso_v4_doi_free 88a4ed85e8 ath9k: fix sleeping in atomic context 99b950d55e ath9k: fix OOB read ar9300_eeprom_restore_internal 5f70ea4a5c parport: remove non-zero check on count c30ea33b03 net/mlx5: DR, Enable QP retransmission c9095f788d iwlwifi: mvm: fix access to BSS elements f950996d64 iwlwifi: mvm: avoid static queue number aliasing 2db5ae5b28 iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed 3da13a1e2a drm/amdkfd: Account for SH/SE count when setting up cu masks. 2af60889c8 ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B 98381f840f ASoC: rockchip: i2s: Fix regmap_ops hang a1c7bc02e1 usbip:vhci_hcd USB port can get stuck in the disabled state 4f6095b0c9 usbip: give back URBs for unsent unlink requests during cleanup 9a4a680529 usb: musb: musb_dsps: request_irq() after initializing musb d24381e5a7 Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" aa40cf19bf cifs: fix wrong release in sess_alloc_buffer() failed path 39111cbb7b mmc: core: Return correct emmc response in case of ioctl error 26f55b60f2 selftests/bpf: Enlarge select() timeout for test_maps 48f5a5f027 mmc: rtsx_pci: Fix long reads when clock is prescaled 4e773c5553 mmc: sdhci-of-arasan: Check return value of non-void funtions a73bbfabfe of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS 2fdf7d38ee ASoC: Intel: Skylake: Fix passing loadable flag for module f6ff4d5609 ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER 736f60bd48 btrfs: tree-log: check btrfs_lookup_data_extent return value 53a72858bc m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch 3710cff57d drm/exynos: Always initialize mapping in exynos_drm_register_dma() 727c973ffe lockd: lockd server-side shouldn't set fl_ops a18cfd715e usb: chipidea: host: fix port index underflow and UBSAN complains 8deedce385 gfs2: Don't call dlm after protocol is unmounted 50cf8f1b6c staging: rts5208: Fix get_ms_information() heap buffer size 8dfd785ae1 rpc: fix gss_svc_init cleanup on failure 0bc818e023 tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD 2918eca497 serial: sh-sci: fix break handling for sysrq d02a1c5fd7 opp: Don't print an error if required-opps is missing d772d993b0 Bluetooth: Fix handling of LE Enhanced Connection Complete fb8593e8ed nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data 072660f6c6 arm64: dts: ls1046a: fix eeprom entries 08825a784e arm64: tegra: Fix compatible string for Tegra132 CPUs a6b69a76c3 ARM: tegra: tamonten: Fix UART pad setting a66049c5ff mac80211: Fix monitor MTU limit so that A-MSDUs get through 1e2842fb7e drm/display: fix possible null-pointer dereference in dcn10_set_clock() cf82fe45be gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() bbaa21da55 net/mlx5: Fix variable type to match 64bit 0d563020b8 Bluetooth: avoid circular locks in sco_sock_connect 37d7ae2b05 Bluetooth: schedule SCO timeouts with delayed_work c408efcb8a selftests/bpf: Fix xdp_tx.c prog section name 350e7501ee drm/msm: mdp4: drop vblank get/put from prepare/complete_commit e545080477 net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() ed3400f22b arm64: dts: qcom: sdm660: use reg value for memory node 52f8a30730 ARM: dts: imx53-ppd: Fix ACHC entry e15afa6747 media: tegra-cec: Handle errors of clk_prepare_enable() 53d02b0409 media: TDA1997x: fix tda1997x_query_dv_timings() return value 71de2779e5 media: v4l2-dv-timings.c: fix wrong condition in two for-loops d785cef384 media: imx258: Limit the max analogue gain to 480 33bd83fe3f media: imx258: Rectify mismatch of VTS value 8d179746b3 ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output 37414bd6ec arm64: tegra: Fix Tegra194 PCIe EP compatible string 5a24034ad8 bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() b6cee35839 workqueue: Fix possible memory leaks in wq_numa_init() 9b4f0170e0 Bluetooth: skip invalid hci_sync_conn_complete_evt 7b1718666f ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() 76cbc142a5 samples: bpf: Fix tracex7 error raised on the missing argument 917eb0bbb8 staging: ks7010: Fix the initialization of the 'sleep_status' structure 44fd61a8bd serial: 8250_pci: make setup_port() parameters explicitly unsigned 4beadefea8 hvsi: don't panic on tty_register_driver failure af0bd97b9d xtensa: ISS: don't panic in rs_init 5418023f81 serial: 8250: Define RX trigger levels for OxSemi 950 devices b050848bba s390: make PCI mio support a machine flag 0dd8da8ad0 s390/jump_label: print real address in a case of a jump label bug 91b4d44c7c flow_dissector: Fix out-of-bounds warnings 8076709052 ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() faf0749c90 video: fbdev: riva: Error out if 'pixclock' equals zero ae0d210aa7 video: fbdev: kyro: Error out if 'pixclock' equals zero 98551f0a7b video: fbdev: asiliantfb: Error out if 'pixclock' equals zero 9dff06c505 bpf/tests: Do not PASS tests without actually testing the result 58831317c9 bpf/tests: Fix copy-and-paste error in double word test a23430e79e drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex 9baa552b2f drm/amd/display: Fix timer_per_pixel unit error 6c78ee1aec tty: serial: jsm: hold port lock when reporting modem line changes 7993ee1733 staging: board: Fix uninitialized spinlock when attaching genpd 995567ded0 usb: gadget: composite: Allow bMaxPower=0 if self-powered 44bbd4e636 USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() 7b96de5c30 usb: gadget: u_ether: fix a potential null pointer dereference e1480bcb40 usb: host: fotg210: fix the actual_length of an iso packet 33109bdf2c usb: host: fotg210: fix the endpoint's transactional opportunities calculation b190fdb93a igc: Check if num of q_vectors is smaller than max before array access f4bf2fdfe3 drm: avoid blocking in drm_clients_info's rcu section a1d12196c3 Smack: Fix wrong semantics in smk_access_entry() c454b1a215 netlink: Deal with ESRCH error in nlmsg_notify() 5adbbb27bb video: fbdev: kyro: fix a DoS bug by restricting user input 4ee6cc0f52 ARM: dts: qcom: apq8064: correct clock names b9707a9504 iavf: fix locking of critical sections 35429d3aa3 iavf: do not override the adapter state in the watchdog task ab03f15c1d iio: dac: ad5624r: Fix incorrect handling of an optional regulator. 0de0c16739 tipc: keep the skb in rcv queue until the whole data is read fe14f10c07 PCI: Use pci_update_current_state() in pci_enable_device_flags() 7d35690974 crypto: mxs-dcp - Use sg_mapping_iter to copy data 80bec14b4e media: dib8000: rewrite the init prbs logic 4cab14bcff ASoC: atmel: ATMEL drivers don't need HAS_DMA 4a7c6e9159 drm/amdgpu: Fix amdgpu_ras_eeprom_init() d766826eee userfaultfd: prevent concurrent API initialization 7bf2913a5b kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y 0ac2ecb915 MIPS: Malta: fix alignment of the devicetree buffer debdff9600 f2fs: fix to unmap pages from userspace process in punch_hole() 1c28c23dc8 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() 1ca5b00782 f2fs: fix to account missing .skipped_gc_rwsem ec5cab3798 KVM: PPC: Fix clearing never mapped TCEs in realmode e46ce5a8ab clk: at91: clk-generated: Limit the requested rate to our range 557f6445e3 clk: at91: clk-generated: pass the id of changeable parent at registration d93a37889e clk: at91: sam9x60: Don't use audio PLL 57188e2cac fscache: Fix cookie key hashing e2e3758a2c platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call ba5d4dc003 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live a02309beb2 HID: i2c-hid: Fix Elan touchpad regression f934961bf4 scsi: target: avoid per-loop XCOPY buffer allocations 389946024f powerpc/config: Renable MTD_PHYSMAP_OF db16408d52 scsi: qedf: Fix error codes in qedf_alloc_global_queues() 5e56c8d843 scsi: qedi: Fix error codes in qedi_alloc_global_queues() a90ef02f01 scsi: smartpqi: Fix an error code in pqi_get_raid_map() 3365d41c04 pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() ef476b8d5a scsi: fdomain: Fix error return code in fdomain_probe() 9ee7b45edd SUNRPC: Fix potential memory corruption be09cbd6a3 dma-debug: fix debugfs initialization order 9315497b17 openrisc: don't printk() unconditionally f56ee9af23 f2fs: reduce the scope of setting fsck tag when de->name_len is zero 2a2afb6d26 f2fs: show f2fs instance in printk_ratelimited 25ed049891 RDMA/efa: Remove double QP type assignment b8bb4b2839 powerpc/stacktrace: Include linux/delay.h 02889ac588 vfio: Use config not menuconfig for VFIO_NOIOMMU b900cc4816 pinctrl: samsung: Fix pinctrl bank pin count e69c283621 docs: Fix infiniband uverbs minor number fb42b9801e RDMA/iwcm: Release resources if iw_cm module initialization fails 7930b1f98d IB/hfi1: Adjust pkey entry in index 0 2b1addd585 scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND a02982545e f2fs: quota: fix potential deadlock bd74d6de0b HID: input: do not report stylus battery state as "full" 0656eb5e7e PCI: aardvark: Fix masking and unmasking legacy INTx interrupts 2b58db229e PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response 0f39f8429c PCI: aardvark: Fix checking for PIO status d810fa6f5f PCI: xilinx-nwl: Enable the clock through CCF d43ad02ad3 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure 3aa6d023c6 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported 4d2bc69df9 PCI/portdrv: Enable Bandwidth Notification only if port supports it 0445da50b7 ARM: 9105/1: atags_to_fdt: don't warn about stack size 8ec08f1431 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs 7cfbf391e8 dmaengine: imx-sdma: remove duplicated sdma_load_context 788122c99d Revert "dmaengine: imx-sdma: refine to load context only once" 86e1abcd14 media: rc-loopback: return number of emitters rather than error 9d91046f6b media: uvc: don't do DMA on stack 1ccb1fa41f VMCI: fix NULL pointer dereference when unmapping queue pair 80d1675903 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() a6d4ac3f86 power: supply: max17042: handle fails of reading status register 668370dd4c block: bfq: fix bfq_set_next_ioprio_data() cfdd25cd42 crypto: public_key: fix overflow during implicit conversion 3411b481ed arm64: head: avoid over-mapping in map_memory 991b64b89b soc: aspeed: p2a-ctrl: Fix boundary check for mmap 2712f29c44 soc: aspeed: lpc-ctrl: Fix boundary check for mmap 24c245de17 soc: qcom: aoss: Fix the out of bound usage of cooling_devs 603dbb1fa2 pinctrl: ingenic: Fix incorrect pull up/down info eda59ca42f pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast d4acec5e94 tools/thermal/tmon: Add cross compiling support 8a964aa6ed 9p/xen: Fix end of loop tests for list_for_each_entry 7d81fcc203 include/linux/list.h: add a macro to test if entry is pointing to the head 4bc0d1b535 xen: fix setting of max_pfn in shared_info 27f3b7f5c6 powerpc/perf/hv-gpci: Fix counter value parsing 7e9e6d0e07 PCI/MSI: Skip masking MSI-X on Xen PV 2edc06fa38 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN 8da22cc41a blk-zoned: allow zone management send operations without CAP_SYS_ADMIN cd7b39e7c4 btrfs: reset replace target device to allocation state on close 8554095328 btrfs: wake up async_delalloc_pages waiters after submit d609c63a71 rtc: tps65910: Correct driver module alias 4076dc42c4 Merge branch 'android11-5.4' into 'android11-5.4-lts' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idd628e993b6566952e119bfe31f4c8fe87d818a8	2022-01-21 08:26:49 +01:00
Greg Kroah-Hartman	7ada083540	This is the 5.4.170 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHVgw8ACgkQONu9yGCS aT71vhAAgVauEQ0nyXBUsH7vqKS6tYdcjoOor8FdNYSfoZ7iY6MptIdtHMVA0MxZ 793CRZDc7cyNtNVhGIomSzLPI4Nb/U5g57xfGrIQZ9Yzv1vcDsC8iEU1GLELWVAO 1gX6oyVJMXQb4JrbGGdP3QPqLPa6ekZ07c3/Dt2p32e+yqm3JvrcaDqklR7qSzBi Nx6VWp2ZxbvDqmzhzzVX+wWoB1darxp1I08ZgPMqsAbn78MelxrOxp8asNVuJQip KusrhdA4xSrXHfzYj1oxSAWctA0mlHJVie+/x+DPDKDP7/zIop+58fEbSEPLcDHA d+19gkNuNR0CtmEPACm/DAPU/iKiuK1YhmfGvPWQHdQCGQxxMKAdS0sH7BqQ2NU6 c7QiRA0Q3JNc+D2TGO5e2u1D5jqsVnBRaEAOnrHwnX6Dx27I8vwIsSKF1Si6TCdU S7whO8n1r7are5Ahaak25qR83wIpn/2fL4Q0AzP7Ox9kue7ceDQ42RfPzNoYh3LS ITJxRbxZYsnOHjlDS4dc5Hih+WioclSALmYhzSbWsjepzyv0EVEup6vzBffY5A4k ENlXQOCV7jZdfZ+ZdMI+kR9cTGO1F7Le5UKp4H+a0qpY/MWIlUI1C7qWDp5YZTsi 2iYwzrOpKCgqrMBhAR2jHeqmqItkal1dsTvrh2Lwc+3FPYRjNoo= =Lkh+ -----END PGP SIGNATURE----- Merge 5.4.170 into android11-5.4-lts Changes in 5.4.170 HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option tee: handle lookup of shm with reference count 0 Input: i8042 - add deferred probe support Input: i8042 - enable deferred probe quirk for ASUS UM325UA tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). platform/x86: apple-gmux: use resource_size() with res memblock: fix memblock_phys_alloc() section mismatch error recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment sctp: use call_rcu to free endpoint net: usb: pegasus: Do not drop long Ethernet frames net: lantiq_xrx200: fix statistics of received bytes NFC: st21nfca: Fix memory leak in device probe and remove ionic: Initialize the 'lif->dbid_inuse' bitmap net/mlx5e: Fix wrong features assignment in case of error selftests/net: udpgso_bench_tx: fix dst ip argument net/ncsi: check for error return from call to nla_put_u32 fsl/fman: Fix missing put_device() call in fman_port_probe i2c: validate user data in compat ioctl nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler perf script: Fix CPU filtering of a script's switch events Linux 5.4.170 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic66d754505081f001b420af0ee4c8da1edf5c27f	2022-01-05 13:23:05 +01:00
Todd Kjos	103b16a8c5	binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:37:46 +01:00
Greg Kroah-Hartman	a91f4fe26c	This is the 5.4.165 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG4oNgACgkQONu9yGCS aT7/Rw//UdbaPGmrtR7mUi9mXH/BVcD/M5eIFqeKvMWrCSriSN+C5otRWomNNySh NGTivPXmzVBKTub1TUPCNRrTFHWOn76VqLG1ecm4W6q9bxsKBsLrp2WuUdzLYi76 o+3+MurzbqVC10M26NQGXWY7pF+WOTtxn3SwJVQ4UR7YDzxdP2gRvRvTzam5DjzR D2q6escg33v+IGCwVTUluTKzya7YJhtsSrlzZZhhxvP60sOwV4GT7rCHXr9mM33w mvqoqftKMti6HUSaR1VvL+bclctCoYqedwcS/RsN9qv+e/wOMNFy/GsPmTzYh7E1 wWzjDS9/V4Oo47vFm237deKFSi6vXT7kQusb3uUTizca6N5xpwZNSzLGuJTdQkKP 7qZUMbx1e1f904P7mruWe+47Ktu1JCP6B4xo3yBNUTsmzngYqa2WA6pII+iEePtF KF1P4eb5Roza3NhVO1eKj8dBU6ZqveObX4jIxupl6skJJyK4cT0oqAJRJCSj29Cw TjJQOxLzp3Q/iOd+kdZQZU8Q9qxJIqEBRhoPOabTmQfV9tnNBFuPRlOj0SDyQguY 30WMLnFlPN/giMMXc7UKrJ3aX6sQSk4qYX4y75a6U+FKF4C52NiunUiIHk2BJljp hytIooKlAAheR9bMJJJO9qelWWFuo9mhQuDb/p37oAqRAtv3MIg= =5lsH -----END PGP SIGNATURE----- Merge 5.4.165 into android11-5.4-lts Changes in 5.4.165 serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type HID: quirks: Add quirk for the Microsoft Surface 3 type-cover HID: google: add eel USB id HID: add hid_is_usb() function to make it simpler for USB detection HID: add USB_HID dependancy to hid-prodikeys HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy on some USB HID drivers HID: bigbenff: prevent null pointer dereference HID: wacom: fix problems when device is not a valid USB device HID: check for valid USB device for many HID drivers can: kvaser_usb: get CAN clock frequency from device can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: sja1000: fix use after free in ems_pcmcia_add_card() nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done selftests: netfilter: add a vrf+conntrack testcase vrf: don't run conntrack on vrf with !dflt qdisc bpf: Fix the off-by-two error in range markings ice: ignore dropped packets during init bonding: make tx_rebalance_counter an atomic nfp: Fix memory leak in nfp_cpp_area_cache_add() seg6: fix the iif in the IPv6 socket control block udp: using datalen to cap max gso segments iavf: restore MSI state on reset iavf: Fix reporting when setting descriptor count IB/hfi1: Correct guard on eager buffer deallocation mm: bdi: initialize bdi_min_ratio when bdi is unregistered ALSA: ctl: Fix copy of updated id with element read/write ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() btrfs: clear extent buffer uptodate when we fail to write it btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling nfsd: Fix nsfd startup race (again) tracefs: Have new files inherit the ownership of their parent clk: qcom: regmap-mux: fix parent clock lookup drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. can: pch_can: pch_can_rx_normal: fix use after free can: m_can: Disable and ignore ELO interrupt x86/sme: Explicitly map new EFI memmap table as encrypted libata: add horkage for ASMedia 1092 wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling tracefs: Set all files to the same group ownership as the mount option block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) qede: validate non LSO skb length ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer i40e: Fix failed opcode appearing if handling messages from VF i40e: Fix pre-set max number of queues for VF mtd: rawnand: fsmc: Take instruction delay into account mtd: rawnand: fsmc: Fix timing computation dt-bindings: net: Reintroduce PHY no lane swap binding tools build: Remove needless libpython-version feature check that breaks test-all fast path net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero net: altera: set a couple error code in probe() net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net, neigh: clear whole pneigh_entry at alloc time net/qla3xxx: fix an error code in ql_adapter_up() selftests/fib_tests: Rework fib_rp_filter_test() USB: gadget: detect too-big endpoint 0 requests USB: gadget: zero allocate endpoint 0 buffers usb: core: config: fix validation of wMaxPacketValue entries xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: using bit mask instead of individual bits xhci: avoid race between disable slot command and host runtime suspend iio: trigger: Fix reference counting iio: trigger: stm32-timer: fix MODULE_ALIAS iio: stk3310: Don't return error code in interrupt handler iio: mma8452: Fix trigger reference couting iio: ltr501: Don't return error code in trigger handler iio: kxsd9: Don't return error code in trigger handler iio: itg3200: Call iio_trigger_notify_done() on error iio: dln2-adc: Fix lockdep complaint iio: dln2: Check return value of devm_iio_trigger_register() iio: at91-sama5d2: Fix incorrect sign extension iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: ad7768-1: Call iio_trigger_notify_done() on error iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip: nvic: Fix offset for Interrupt Priority Offsets misc: fastrpc: fix improper packet size calculation bpf: Add selftests to cover packet access corner cases Linux 5.4.165 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I756efb854dc947509cf712a292eab0bf72f32694	2021-12-14 15:19:08 +01:00
Eric Biggers	1a478a0522	binder: use wake_up_pollfree() ... commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert binder to use wake_up_pollfree(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 14:49:02 +01:00
Eric Biggers	da5ecad710	UPSTREAM: binder: use wake_up_pollfree() ... commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert binder to use wake_up_pollfree(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 185125206 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0f08d9f9a40348d7d2381607fabe3648416ab2a2	2021-12-12 16:44:26 +01:00
Greg Kroah-Hartman	b2d37d0916	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: b0f930a58e BACKPORT: f2fs: relocate inline conversion from mmap() to mkwrite() 4f4602b711 BACKPORT: f2fs: support RO feature e6fd4c5c6a BACKPORT: f2fs: fix wrong total_sections check and fsmeta check ce664fbdcc BACKPORT: FROMGIT: binder: fix freeze race b1232b020f FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl a02d0f685d FROMGIT: binder: use EINTR for interrupted wait for work e658e9e4bc BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl 63ef444773 ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request 50c9c8cb33 FROMGIT: binder: fix test regression due to sender_euid change 1c1f571840 BACKPORT: binder: use cred instead of task for getsecid ea1a2391d5 BACKPORT: binder: use cred instead of task for selinux checks 1fe8a2bb64 BACKPORT: binder: use euid from cred instead of using task a080050156 ANDROID: setlocalversion: make KMI_GENERATION optional e785a25f52 Revert "ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC" Change-Id: Ica7d80e62dcd4b12f7294bcc4b5c9291491ad37b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-12-09 11:01:27 +01:00
Todd Kjos	aaa83768ba	binder: fix test regression due to sender_euid change ... commit c21a80ca0684ec2910344d72556c816cb8940c01 upstream. This is a partial revert of commit 29bc22ac5e5b ("binder: use euid from cred instead of using task"). Setting sender_euid using proc->cred caused some Android system test regressions that need further investigation. It is a partial reversion because subsequent patches rely on proc->cred. Fixes: 29bc22ac5e5b ("binder: use euid from cred instead of using task") Cc: stable@vger.kernel.org # 4.4+ Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Change-Id: I9b1769a3510fed250bb21859ef8beebabe034c66 Link: https://lore.kernel.org/r/20211112180720.2858135-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-01 09:23:28 +01:00
Li Li	ce664fbdcc	BACKPORT: FROMGIT: binder: fix freeze race ... Currently cgroup freezer is used to freeze the application threads, and BINDER_FREEZE is used to freeze the corresponding binder interface. There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any existing transactions to drain out before actually freezing the binder interface. But freezing an app requires 2 steps, freezing the binder interface with ioctl(BINDER_FREEZE) and then freezing the application main threads with cgroupfs. This is not an atomic operation. The following race issue might happen. 1) Binder interface is frozen by ioctl(BINDER_FREEZE); 2) Main thread A initiates a new sync binder transaction to process B; 3) Main thread A is frozen by "echo 1 > cgroup.freeze"; 4) The response from process B reaches the frozen thread, which will unexpectedly fail. This patch provides a mechanism to check if there's any new pending transaction happening between ioctl(BINDER_FREEZE) and freezing the main thread. If there's any, the main thread freezing operation can be rolled back to finish the pending transaction. Furthermore, the response might reach the binder driver before the rollback actually happens. That will still cause failed transaction. As the other process doesn't wait for another response of the response, the response transaction failure can be fixed by treating the response transaction like an oneway/async one, allowing it to reach the frozen thread. And it will be consumed when the thread gets unfrozen later. NOTE: This patch reuses the existing definition of struct binder_frozen_status_info but expands the bit assignments of __u32 member sync_recv. To ensure backward compatibility, bit 0 of sync_recv still indicates there's an outstanding sync binder transaction. This patch adds new information to bit 1 of sync_recv, indicating the binder transaction happens exactly when there's a race. If an existing userspace app runs on a new kernel, a sync binder call will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still return the expected value (true). The app just doesn't check bit 1 intentionally so it doesn't have the ability to tell if there's a race. This behavior is aligned with what happens on an old kernel which doesn't set bit 1 at all. A new userspace app can 1) check bit 0 to know if there's a sync binder transaction happened when being frozen - same as before; and 2) check bit 1 to know if that sync binder transaction happened exactly when there's a race - a new information for rollback decision. Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Li Li <dualli@google.com> Test: stress test with apps being frozen and initiating binder calls at the same time, confirmed the pending transactions succeeded. Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 198493121 (cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus) Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9	2021-11-30 15:38:33 -08:00
Marco Ballesio	b1232b020f	FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl ... User space needs to know if binder transactions occurred to frozen processes. Introduce a new BINDER_GET_FROZEN ioctl and keep track of transactions occurring to frozen proceses. Bug: 180989544 (cherry picked from commit c55019c24b22d6770bd8e2f12fbddf3f83d37547 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing) Signed-off-by: Marco Ballesio <balejs@google.com> Signed-off-by: Li Li <dualli@google.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20210316011630.1121213-4-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ie631f331ba4ca94a3bcdd43dec25fe9ba1306af2	2021-11-30 15:38:18 -08:00
Marco Ballesio	a02d0f685d	FROMGIT: binder: use EINTR for interrupted wait for work ... when interrupted by a signal, binder_wait_for_work currently returns -ERESTARTSYS. This error code isn't propagated to user space, but a way to handle interruption due to signals must be provided to code using this API. Replace this instance of -ERESTARTSYS with -EINTR, which is propagated to user space. Bug: 180989544 (cherry picked from commit 48f10b7ed0c23e2df7b2c752ad1d3559dad007f9 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing) Signed-off-by: Marco Ballesio <balejs@google.com> Signed-off-by: Li Li <dualli@google.com> Test: built, booted, interrupted a worker thread within Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20210316011630.1121213-3-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ie6c7993cab699bc2c1a25a2f9d94b200a1156e5d	2021-11-30 15:38:09 -08:00
Marco Ballesio	e658e9e4bc	BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl ... Frozen tasks can't process binder transactions, so a way is required to inform transmitting ends of communication failures due to the frozen state of their receiving counterparts. Additionally, races are possible between transitions to frozen state and binder transactions enqueued to a specific process. Implement BINDER_FREEZE ioctl for user space to inform the binder driver about the intention to freeze or unfreeze a process. When the ioctl is called, block the caller until any pending binder transactions toward the target process are flushed. Return an error to transactions to processes marked as frozen. Bug: 180989544 (cherry picked from commit 15949c3cdd97bccdcd45c0c0f6c31058520b6494 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing) Co-developed-by: Todd Kjos <tkjos@google.com> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Marco Ballesio <balejs@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Li Li <dualli@google.com> Link: https://lore.kernel.org/r/20210316011630.1121213-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ia1b5951cd99eeb98b59e06c3e27d59062dc725f6	2021-11-30 15:37:59 -08:00